Update Rust crate russh to 0.64 #13

Merged

oss merged 1 commit from renovate/russh-monorepo into main

2026-10-08 21:44:30 +02:00

renovate-bot commented

2026-09-10 05:03:44 +02:00

Collaborator

This PR contains the following updates:

Package	Type	Update	Change
russh	dependencies	minor	`0.63` → `0.64`

Release Notes

warp-tech/russh (russh)

Security fixes

GHSA-4wc5-f2rc-q74m - Unbounded memory allocation in agent protocol server via crafted constraint records

A local actor or a connected remote server (that the user forwards an agent connection to) can trigger an unlimited memory allocation in a russh-based SSH agent via a crafted message.

Breaking changes

5d9d2b8: drop the legacy ed25519 key parser
- Dropped the legacy-ed25519-pkcs8-parser feature. Legacy keys were written in non-compliant format by russh pre-v0.43. From now on, parsing those keys will return a hard error.

Security fixes

GHSA-j7h2-66j4-ghjf - russh server accepts pubkey authentication with a mismatched signature algorithm

Russh server side did not verify that the client signatures were made using the negotiated algorithm. While no bypass is possible through this bug, this allowed a client to e.g. silently downgrade its own signature from rsa-sha2-512 to rsa-sha1

Features

efa9a03: Add support hostkeys-prove-00@openssh.com support (#767) (@inureyes) #767
- Adds client::Handle::hostkeys_prove to ask the server to prove ownership of the host keys it announced via hostkeys-00@openssh.com.
a0ded76: Support sending custom global requests from the client (#759) (@ChrisJr404) #759
- Adds client::Handle::send_global_request(name, data, want_reply)

Fixes

e8b2fd3: Fix enforce rekey read and time limits (#766) (@inureyes) #766
bf05d50: honor want_reply = false on server-side global requests
dddf72c: bug: Fix partial_success clobber (#773) (@markovejnovic) #773
26487fb: fix: auth-agent-req@openssh.com replies on channel (#774) (#775) (@markovejnovic) #775
36fa1bc: fix(pageant): trim username padding and handle empty principals (#779) (@t8y2) #779

New Contributors

@markovejnovic made their first contribution in Eugeny#773
@t8y2 made their first contribution in Eugeny#779
@ChrisJr404 made their first contribution in Eugeny#759

Full Changelog: https://github.com/Eugeny/russh/compare/v0.63.3...v0.64.0

`v0.63.3`

Compare Source

Fixes

c13b259: enforce inactivity timeout even during stalled writes (Eugene)

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [russh](https://github.com/warp-tech/russh) | dependencies | minor | `0.63` → `0.64` | --- ### Release Notes <details> <summary>warp-tech/russh (russh)</summary> ### [`v0.64.1`](https://github.com/Eugeny/russh/releases/tag/v0.64.1) [Compare Source](https://github.com/warp-tech/russh/compare/v0.64.0...v0.64.1) ### Security fixes #### [GHSA-4wc5-f2rc-q74m](https://github.com/Eugeny/russh/security/advisories/GHSA-4wc5-f2rc-q74m) - Unbounded memory allocation in agent protocol server via crafted constraint records A local actor or a connected remote server (that the user forwards an agent connection to) can trigger an unlimited memory allocation in a russh-based SSH agent via a crafted message. ### [`v0.64.0`](https://github.com/Eugeny/russh/releases/tag/v0.64.0) [Compare Source](https://github.com/warp-tech/russh/compare/v0.63.3...v0.64.0) ### Breaking changes - [`5d9d2b8`](https://github.com/warp-tech/russh/commit/5d9d2b8): drop the legacy [`ed25519`](https://github.com/warp-tech/russh/commit/ed25519) key parser - Dropped the `legacy-ed25519-pkcs8-parser` feature. Legacy keys were written in non-compliant format by russh pre-v0.43. From now on, parsing those keys will return a hard error. ### Security fixes #### GHSA-j7h2-66j4-ghjf - russh server accepts pubkey authentication with a mismatched signature algorithm Russh server side did not verify that the client signatures were made using the negotiated algorithm. While no bypass is possible through this bug, this allowed a client to e.g. silently downgrade its own signature from rsa-sha2-512 to rsa-sha1 ### Features - [`efa9a03`](https://github.com/warp-tech/russh/commit/efa9a03): Add support `hostkeys-prove-00@openssh.com` support ([#767](https://github.com/warp-tech/russh/issues/767)) ([@inureyes](https://github.com/inureyes)) [#767](https://github.com/Eugeny/russh/pull/767) - Adds `client::Handle::hostkeys_prove` to ask the server to prove ownership of the host keys it announced via `hostkeys-00@openssh.com`. - [`a0ded76`](https://github.com/warp-tech/russh/commit/a0ded76): Support sending custom global requests from the client ([#759](https://github.com/warp-tech/russh/issues/759)) ([@ChrisJr404](https://github.com/ChrisJr404)) [#759](https://github.com/Eugeny/russh/pull/759) - Adds `client::Handle::send_global_request(name, data, want_reply)` ### Fixes - [`e8b2fd3`](https://github.com/warp-tech/russh/commit/e8b2fd3): Fix enforce rekey read and time limits ([#766](https://github.com/warp-tech/russh/issues/766)) ([@inureyes](https://github.com/inureyes)) [#766](https://github.com/Eugeny/russh/pull/766) - [`bf05d50`](https://github.com/warp-tech/russh/commit/bf05d50): honor `want_reply = false` on server-side global requests - [`dddf72c`](https://github.com/warp-tech/russh/commit/dddf72c): bug: Fix partial_success clobber ([#773](https://github.com/warp-tech/russh/issues/773)) ([@markovejnovic](https://github.com/markovejnovic)) [#773](https://github.com/Eugeny/russh/pull/773) - [`26487fb`](https://github.com/warp-tech/russh/commit/26487fb): fix: <auth-agent-req@openssh.com> replies on channel ([#774](https://github.com/warp-tech/russh/issues/774)) ([#775](https://github.com/warp-tech/russh/issues/775)) ([@markovejnovic](https://github.com/markovejnovic)) [#775](https://github.com/Eugeny/russh/pull/775) - [`36fa1bc`](https://github.com/warp-tech/russh/commit/36fa1bc): fix(pageant): trim username padding and handle empty principals ([#779](https://github.com/warp-tech/russh/issues/779)) ([@t8y2](https://github.com/t8y2)) [#779](https://github.com/Eugeny/russh/pull/779) #### New Contributors - [@markovejnovic](https://github.com/markovejnovic) made their first contribution in [Eugeny#773](https://github.com/Eugeny/russh/pull/773) - [@t8y2](https://github.com/t8y2) made their first contribution in [Eugeny#779](https://github.com/Eugeny/russh/pull/779) - [@ChrisJr404](https://github.com/ChrisJr404) made their first contribution in [Eugeny#759](https://github.com/Eugeny/russh/pull/759) **Full Changelog**: <https://github.com/Eugeny/russh/compare/v0.63.3...v0.64.0> ### [`v0.63.3`](https://github.com/Eugeny/russh/releases/tag/v0.63.3) [Compare Source](https://github.com/warp-tech/russh/compare/v0.63.2...v0.63.3) ### Fixes - [`c13b259`](https://github.com/warp-tech/russh/commit/c13b259): enforce inactivity timeout even during stalled writes (Eugene) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added 1 commit

2026-09-10 05:03:44 +02:00

Update Rust crate russh to v0.63.3 8eae695c34

renovate-bot force-pushed renovate/russh-monorepo from 8eae695c34 to 1436b0d0d2

2026-10-05 05:07:48 +02:00

Compare

renovate-bot changed title from ~~Update Rust crate russh to v0.63.3~~ to Update Rust crate russh to 0.64

2026-10-05 05:07:48 +02:00