chore(deps): Bump russh from 0.62.1 to 0.62.5 - #385
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
Bumps [russh](https://github.com/warp-tech/russh) from 0.62.1 to 0.62.5. - [Release notes](https://github.com/warp-tech/russh/releases) - [Commits](Eugeny/russh@v0.62.1...v0.62.5) --- updated-dependencies: - dependency-name: russh dependency-version: 0.62.5 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
gnanirahulnutakki
requested changes
Aug 11, 2026
gnanirahulnutakki
left a comment
gnanirahulnutakki
left a comment
Member
There was a problem hiding this comment.
This should not merge directly to main at exact head 3cd4034694.
The security update is necessary: Russh <=0.62.4 is affected by GHSA-m65r-rprj-r5rg, and 0.62.5 is patched. However, all five checks here failed before checkout because the main workflows use unpinned action tags, so CI did not test this lockfile.
PR #386 at exact head 3094e63e8b already carries the complete Russh 0.62.5 resolution on dev: the same Russh checksum, every stable crypto transition from this PR, and none of the obsolete release-candidate packages. Its cargo-deny, dependency review, CodeQL, Ubuntu/macOS, Docker, Trivy, and DCO checks are green. I also verified this head locally with locked metadata and 9/9 terminal tests.
This PR additionally contains incidental resolver rebindings to older windows-sys and socket2 selections that #386 correctly avoids. Please merge #386 into dev, promote the tested dev state to main, and then close this PR as superseded. Because #386 is not merged yet and main still resolves Russh 0.62.1, the security remediation is not complete until that promotion lands.
gnanirahulnutakki
added a commit
that referenced
this pull request
Aug 11, 2026
…uinn-proto, resync Cargo.lock (#387) Three coupled fixes that together restore a mergeable `dev`. 1. cargo-deny (required check) is failing on every open PR and on `dev` itself with a single finding: error[unmaintained]: bitmaps is unmaintained ID: RUSTSEC-2026-0247 Solution: No safe upgrade is available! `bitmaps` is transitive only, via matrix-sdk -> imbl -> imbl-sized-chunks. It is an unmaintained notice, not a vulnerability, and cargo-deny itself reports that no safe upgrade exists. That is exactly the class `[advisories].ignore` already documents (bincode via syntect, paste via fastembed, proc-macro-error2 via Matrix/Teloxide, rustls-pemfile via qdrant-client), so it is ignored on the same terms. Vulnerability advisories are still upgraded rather than ignored — see (2). 2. Patch the two crates behind all five open Dependabot alerts. Both are reachable from the workspace and both have released fixes: - russh 0.62.2 -> 0.62.5 (direct dep of crates/terminal), closing GHSA-m65r-rprj-r5rg (CVE-2026-68930, channel-scoped server callbacks reachable without an open channel), GHSA-g9hv-x236-4qp3 (pre-auth X25519 wrong-length panic), GHSA-cqjc-rmpq-xprq (post-auth pty-req panic) and GHSA-5xvq-cp9x-6p6r (pre-auth all-zero Curve25519 encode_mpint OOB). - quinn-proto 0.11.14 -> 0.11.16 (transitive), closing the one HIGH alert, GHSA-4w2j-m93h-cj5j (remote memory exhaustion from unbounded out-of-order stream reassembly). Dependabot did raise these as #385 and #382, but against `main`, where they fail DCO; `dev` never received them. 3. Resync Cargo.lock, which had drifted from the manifests: it was missing `ardur-delegate-tool` (#332) and `ardur-durability` (#327) along with tar/filetime/xattr, and still carried stale entries. `.github/workflows/release.yml` builds `--locked`, so a release cut from `dev` would have failed to resolve. `cargo metadata --locked` now succeeds. Verified locally: `cargo deny check` reports advisories/bans/licenses/ sources all ok; `cargo fmt --check`, `cargo build --workspace` and `cargo clippy --workspace --all-targets -D warnings` are clean. --- **Why this lands first:** `cargo-deny` is a required check and is currently red on *every* open PR (#368, #369, #370, #372, #373, #374, #375 all show exactly one failing required check, and it is this one). Nothing can merge into `dev` until the advisory is resolved. Signed-off-by: GR <gnanirn@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps russh from 0.62.1 to 0.62.5.
Release notes
Sourced from russh's releases.
Commits
4882af7v0.62.57c5659fguard channel messages against non-yet-established channel IDsde96ad1fixed #725 - add backpressure to Channel::data()0089c89v0.62.48912512fixed pty modes validationa7fc1ebfix mpint encoding and validate curve25519 keys2311de1chore(russh): bump russh-sftp dev-dependency 2.1.0 → 2.3.0 (#728)2ae5d72v0.62.32e3f1ccUpdate more RustCrypto dependencies to stabilized versions (#735)c4be19fv0.62.2Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.