jpillora/chisel v1.12.0

on GitHub

Chisel 1.12.0 is a reliability and security release focused on recovering
cleanly from network and configuration changes, making failures visible, and
hardening unauthenticated surfaces.

This stable release follows three public release candidates. No 1.12-specific
runtime regressions were reported after rc3. The archive corruption reported
for rc1 was fixed in rc2; release CI now integrity-tests every .gz and
.zip before any asset or image is published.

Highlights

• Fixes the high-CPU failure after disconnected SSH sessions by updating
  x/crypto/ssh, bounding keepalive requests, and closing dead connections
  promptly (#608).
• Makes authfile reloads reliable across editor renames and Kubernetes
  ConfigMap swaps. ACL changes apply to new tunnels without interrupting
  established tunnels.
• Propagates TCP half-close through tunnels, rejects unreachable targets
  instead of presenting dead connections, and recovers UDP exit nodes after
  reaching their flow limit.
• Adds graceful SIGTERM shutdown with HTTP request draining, safer retry
  behavior, configurable retry intervals, and socks5:// client proxy URLs.
• Caps pre-authentication WebSocket messages while preserving every valid SSH
  packet, validates auth strings, safely quotes untrusted usernames in logs,
  and requires full fingerprints instead of accepting truncated legacy MD5
  prefixes.
• Updates x/crypto/ssh to v0.55.0 to address
  GO-2026-6303, with release binaries
  built using Go 1.27.0.
• Reports real versions for go install builds and adds useful info-level
  session, authentication, and ACL-denial logs.
• Migrates CLI parsing and help output to opts, including terminal-aware
  formatting and reliable wrapping at narrow widths.
• Ships verified archives and packages plus ko-built, scratch-based images
  with CA roots for six architectures on Docker Hub and GHCR. Publishing the
  draft release promotes latest, 1, and 1.12 without rebuilding them.

Upgrading from 1.11.x

Four changes may require action:

1. With --socks5 and --authfile, users who should retain SOCKS5 access need
   an authfile entry matching socks. The wildcard "" continues to match
   everything.
2. --fingerprint must use the full SHA256 fingerprint, or the full deprecated
   16-octet MD5 colon form. Truncated MD5 prefixes are rejected.
3. --auth values must use <user>:<pass>; values without a colon now fail at
   startup instead of silently disabling authentication.
4. A client that exhausts --max-retry-count exits non-zero. Cancellation and
   normal signal-driven shutdown still exit successfully.

The wire protocol remains chisel-v3. Mixed 1.11.x/1.12 deployments continue
to work, with new behavior degrading to the older peer's capabilities.

See Upgrading to 1.12 for
configuration details and the
full 1.12 review
for the complete compatibility analysis.