[dependabot]

Bumps the cargo group with 3 updates: toml, russh and flate2.

Updates toml from 1.1.8+spec-1.1.0 to 1.2.0+spec-1.1.0

Commits

• 8ffe3c5 chore: Release
• fa51878 docs: Update changelog
• f8ad91e perf(serde): Reuse key allocations (#1261)
• fe51467 perf(serde): Reuse key allocations
• 7024319 perf(writer): Expand coverage of the fast path (#1259)
• be196a8 perf(writer): Expand coverage of the fast path
• 932704c perf(serde): Pre-allocate serialization buffers (#1258)
• 52b563d perf(serde): Pre-allocate serialization buffers
• e346a79 perff(writer): Add key and string fast paths (#1257)
• ab695e6 perf(writer): Add a fast path for writing string types
• Additional commits viewable in compare view

Updates russh from 0.65.0 to 0.65.1

Release notes

Sourced from russh's releases.

v0.65.1

Security fixes

GHSA-736f-c93q-9fwx - agent lock status not checked after confirmation wait

Agent lock status is now rechecked after the confirmation await again.

GHSA-9264-jvgf-6w2f - kex_done called before host-key verification

client::Handler::kex_done is now only called after server host key verification succeeds

Fixes

• 20c5a93: fix(keys): keep the comment when loading a public key file (#801) (@​JakeHuneau) #801
  • load_public_key now keeps the comment from an OpenSSH public key file, so key.comment() returns it and to_openssh() round-trips. Fixes #713.
• 3a21566: fix(client): accept non-canonical ECDSA P-521 signature mpints after strict decode fails (#803) (@​gugahartmann) #803
  • Fixes key exchange against servers such as the Huawei S6720, which pad P-521 signature scalars with extra leading zero bytes.
• a6be9ba: fix(cipher): count the MAC tag in the minimum packet length check (#802) (@​JakeHuneau) #802
  • Fixes valid packets being rejected when an EtM MAC is in use. Fixes #787.
• 43a46d6: fix(AgentClient): propagate method errors (#808) (@​mdevolde) #808
  • add_smartcard_key, lock, unlock, remove_identity, remove_smartcard_key and extension now return the agent's failure response as an error. Before, they always returned Ok(()).
• 7c59594: fix(server): let Dropbear through strict kex by accounting for the ignored first_kex_packet_follows guess (#805) (@​NatLee) #805
  • Fixes Dropbear clients failing to connect when strict key exchange is on. Fixes #804.

Dependencies

• d10345d: deps: trim aws-lc-rs features to avoid transitive deps (#809) (@​sepointon) #809
  • Removes the unused ring-compatible API of aws-lc-rs and the old untrusted crate it pulled in.
• 0a8cc28: deps: remove dep on generic-array 0.14 compat (#810) (@​sepointon) #810

New Contributors

• @​sepointon made their first contribution in Eugeny/russh#810
• @​NatLee made their first contribution in Eugeny/russh#805
• @​JakeHuneau made their first contribution in Eugeny/russh#802
• @​gugahartmann made their first contribution in Eugeny/russh#803

Full Changelog: Eugeny/russh@v0.65.0...v0.65.1

Commits

• b33092a v0.65.1
• 20c5a93 fix(keys): keep the comment when loading a public key file (#801)
• 3a21566 fix(client): accept non-canonical ECDSA P-521 signature mpints after strict d...
• a6be9ba fix(cipher): count the MAC tag in the minimum packet length check (#802)
• 43a46d6 fix(AgentClient): propagate method errors (#808)
• 56384e6 add Eric-D as a contributor for code (#799)
• 7c59594 fix(server): let Dropbear through strict kex by accounting for the ignored fi...
• d10345d deps: trim aws-lc-rs features to avoid transitive deps (#809)
• 0a8cc28 deps: remove dep on generic-array 0.14 compat (#810)
• 92562d3 tests: adapt to VerifiedPublicKey after #785 (#807)
• See full diff in compare view

Updates flate2 from 1.1.10 to 1.1.11

Release notes

Sourced from flate2's releases.

v1.1.11

Fixed

• fixup! Complete sync flushes across output buffer boundaries (#581)
• Separate gzip header reads from compressed data
• Defer gzip input errors without losing read progress
• Preserve gzip header progress on input read errors (#571)

Other

• Merge pull request #582 from rust-lang/fix-lacking-buffer-drain
• Merge pull request #574 from Sharadhi-v98/decompress-reset-window-bits
• Merge pull request #577 from rust-lang/fix-loop
• Setup trusted publishing for the flate2 crate
• Complete sync flushes across output buffer boundaries (#581)
• Fix "can by extended" typos in deflate and zlib write docs
• Merge pull request #579 from NUAAwqy/docs/fix-double-space
• Fix double space in read module doc comment
• Add missing preposition in README description
• Cover decoder retries across the output buffer boundary
• Drain output before refilling the buffer
• Clarify partial-write buffering behavior
• Avoid shifting buffered output on partial writes
• Merge pull request #567 from ndossche/more-asserts
• Merge pull request #566 from HDauven/reject-incomplete-write-decoder-streams
• Fix encoder writes hanging after try_finish (#576)
• Avoid panicking when dropping unfinished compressors
• Merge pull request #565 from HDauven/zlib-rs-uninit-output
• still allow resetting incomplete write decoders
• Assert return result of reset calls
• Reject incomplete streams in write decoders
• Merge pull request #573 from NUAAwqy/taiyi/fix-gzip-read-error-header
• review
• Reject incomplete streams when finishing write-side decoders
• Preserve window size and gzip mode across Decompress::reset
• preserve runtime detection in backend examples (#570)
• Make miniz_oxide dictionary clearing explicit on reset
• Harden miniz_oxide decompressor reset
• Deduplicate zlib-rs flush conversions
• Use native zlib-rs uninitialized output

Changelog

Sourced from flate2's changelog.

1.1.11 - 2026-11-06

Fixed

• fixup! Complete sync flushes across output buffer boundaries (#581)
• Separate gzip header reads from compressed data
• Defer gzip input errors without losing read progress
• Preserve gzip header progress on input read errors (#571)

Other

• Merge pull request #582 from rust-lang/fix-lacking-buffer-drain
• Merge pull request #574 from Sharadhi-v98/decompress-reset-window-bits
• Merge pull request #577 from rust-lang/fix-loop
• Setup trusted publishing for the flate2 crate
• Complete sync flushes across output buffer boundaries (#581)
• Fix "can by extended" typos in deflate and zlib write docs
• Merge pull request #579 from NUAAwqy/docs/fix-double-space
• Fix double space in read module doc comment
• Add missing preposition in README description
• Cover decoder retries across the output buffer boundary
• Drain output before refilling the buffer
• Clarify partial-write buffering behavior
• Avoid shifting buffered output on partial writes
• Merge pull request #567 from ndossche/more-asserts
• Merge pull request #566 from HDauven/reject-incomplete-write-decoder-streams
• Fix encoder writes hanging after try_finish (#576)
• Avoid panicking when dropping unfinished compressors
• Merge pull request #565 from HDauven/zlib-rs-uninit-output
• still allow resetting incomplete write decoders
• Assert return result of reset calls
• Reject incomplete streams in write decoders
• Merge pull request #573 from NUAAwqy/taiyi/fix-gzip-read-error-header
• review
• Reject incomplete streams when finishing write-side decoders
• Preserve window size and gzip mode across Decompress::reset
• preserve runtime detection in backend examples (#570)
• Make miniz_oxide dictionary clearing explicit on reset
• Harden miniz_oxide decompressor reset
• Deduplicate zlib-rs flush conversions
• Use native zlib-rs uninitialized output

Commits

• cd06529 chore: release v1.1.11
• 6ff4098 Merge pull request #582 from rust-lang/fix-lacking-buffer-drain
• 5f68913 Merge pull request #574 from Sharadhi-v98/decompress-reset-window-bits
• 5582d95 fixup! Complete sync flushes across output buffer boundaries (#581)
• d05c7c4 Merge pull request #577 from rust-lang/fix-loop
• 5c7ee7a Merge pull request #583 from Kobzol/trusted-publishing
• cc527c6 Setup trusted publishing for the flate2 crate
• 54f49cd Merge pull request #580 from NUAAwqy/fix/can-by-extended-typo
• 491df15 Complete sync flushes across output buffer boundaries (#581)
• a7a1161 Fix "can by extended" typos in deflate and zlib write docs
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0c499da5-588a-4af3-a81a-1cadf467cbf6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn