Skip to content

chore(deps): bump the cargo group across 1 directory with 3 updates - #6

Merged
vheins merged 1 commit into
masterfrom
dependabot/cargo/cargo-78615f28b4
Nov 4, 2026
Merged

vheins merged 1 commit into
masterfrom
dependabot/cargo/cargo-78615f28b4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 4, 2026

Copy link
Copy Markdown
Contributor

Bumps the cargo group with 3 updates in the / directory: rustls, russh and zip.

Updates rustls from 0.23.45 to 0.23.46

Commits
  • f04804f Delay saving KX hint until handshake confirmation
  • 049d39b Bump version to 0.23.46
  • 6d0ba08 Eliminate secret from impl Debug for ServerSessionValue
  • 2b82b81 unbuffered: update TLS 1.3 traffic keys before exhausting them
  • 74343e7 conn: update TLS 1.3 traffic keys within fragmented writes
  • 795eea7 Advance the HPKE sequence only after seal succeeds
  • d67cb71 stream: provide backpressure while buffering received plaintext
  • 7a69ade util: fuse flushes from connections with errors
  • 493d089 conn: fuse writes for connections with errors
  • db00e01 util: keep flushing after short writes
  • Additional commits viewable in compare view

Updates russh from 0.64.1 to 0.65.0

Release notes

Sourced from russh's releases.

v0.65.0

Breaking changes

  • d507707: feat(server): expose the publickey algorithms to Handler (#785) (@​Eric-D) #785
    • Handler::auth_publickey_offered now takes a server::PublicKeyOffer and Handler::auth_publickey takes a server::VerifiedPublicKey instead of &PublicKey. Read the key from the public_key field. The new algorithm field makes accessible the signature algorithm used by the client, allowing the server to react to it
  • 62efa5a: Remove the no-op async-trait dependency and crate feature (#786) (@​FalkWoldmann) #786

Security fixes

GHSA-9wfm-jcj8-jfv9 - russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

  • 23aa5d2 - A malicious SSH agent client can trigger unbounded allocations in russh based agents

GHSA-4p9f-7p9m-5vfg - russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

  • b33e93b - russh did not limit the number of EXT_INFO messages that a malicious server can send, leading to unbounded memory growth over time

GHSA-fw5c-8223-6h42 - russh: peer-declared zero maximum packet size permanently stalls channel writes

  • 39cb9db - malicious peers can hang up the channel by setting max packet size to zero

GHSA-662x-8wvj-2276 - pageant: unbounded frame buffering on peer-controlled 4-byte length prefix

  • 69e4b55 - a malicious SSH agent client can trigger unbounded allocations in russh based agents

GHSA-vp5q-ff62-jwqv - Agent server never calls Agent::confirm

  • 62db6e7 - Agent::confirm was defunct and never got called by the agent server

GHSA-3hm4-p7h4-rvwp - russh: pre-authentication stack exhaustion via nested OpenSSH certificates

  • 730d663 - a malicious client could trigger a stack overflow via a crafted OpenSSH certificate

Features

  • d65823f: feat(client): support OpenSSH agent session binding (#794) (@​inureyes) #794
    • Exposes the verified initial key-exchange data through a typed AgentSessionBinding. You need it to send session-bind@openssh.com for OpenSSH destination-constrained agent keys.

Fixes

  • 13c94f0: Fix channel window accounting on window adjust (#790) (@​notsapinho) #790
  • e2bdf85: client: keep the session usable when a Signer fails after PK_OK (#788) (@​meanaverage) #788
  • b10506e: Re-arm the client keepalive timer before authentication (#791) (@​Bokjan) #791
    • Fixes the client session task spinning on a CPU core when the keepalive timer fired before authentication.
  • c1fada1: fix(agent): honor SSH_AGENT_RSA_SHA2_* flags when signing with RSA keys (#796) (@​mdevolde) #796
  • 3beb126: client: don't arm the rekey timer on wasm32 (#797) (@​biao29) #797

New Contributors

... (truncated)

Commits

Updates zip from 2.4.2 to 2.6.1

Release notes

Sourced from zip's releases.

v2.6.1

🐛 Bug Fixes

  • avoid scanning through all local file headers while opening an archive (#281)

v2.6.0

🚀 Features

  • Add support for time::PrimitiveDateTime (#322)
  • Add jiff integration (#323)

🐛 Bug Fixes

  • improve error message for duplicated file (#277)

v2.5.0

🚀 Features

  • Add support for time::PrimitiveDateTime (#322)
  • Add jiff integration (#323)

🐛 Bug Fixes

  • improve error message for duplicated file (#277)
Changelog

Sourced from zip's changelog.

2.6.1 - 2025-04-03

🐛 Bug Fixes

  • avoid scanning through all local file headers while opening an archive (#281)

2.6.0 - 2025-03-30

  • No documented changes.

2.5.0 - 2025-03-23

🚀 Features

  • Add support for time::PrimitiveDateTime (#322)
  • Add jiff integration (#323)

🐛 Bug Fixes

  • improve error message for duplicated file (#277)
Commits
  • 1d42731 chore: release v2.6.1 (#334)
  • f4d71a4 fix: avoid scanning through all local file headers while opening an archive (...
  • 84e19f2 doc: Comment about where to update MSRV and where to find the policy
  • 081443d chore: Update crate version to trigger relelase-plz
  • e4e7010 doc: Update 6-month MSRV policy, since Rust now releases minor versions more ...
  • f24ffa9 fix handling decryption with msdos date of 0 (#327)
  • 81ac002 First pass (#331)
  • 77cde6a chore: release v2.5.0 (#325)
  • 7613e6b feat: Add support for time::PrimitiveDateTime (#322)
  • a7b80cf deps: remove thiserror and displaydoc dependencies (#324)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the cargo group with 3 updates in the / directory: [rustls](https://github.com/rustls/rustls), [russh](https://github.com/warp-tech/russh) and [zip](https://github.com/zip-rs/zip2).


Updates `rustls` from 0.23.45 to 0.23.46
- [Release notes](https://github.com/rustls/rustls/releases)
- [Changelog](https://github.com/rustls/rustls/blob/main/CHANGELOG.md)
- [Commits](rustls/rustls@v/0.23.45...v/0.23.46)

Updates `russh` from 0.64.1 to 0.65.0
- [Release notes](https://github.com/warp-tech/russh/releases)
- [Commits](Eugeny/russh@v0.64.1...v0.65.0)

Updates `zip` from 2.4.2 to 2.6.1
- [Release notes](https://github.com/zip-rs/zip2/releases)
- [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md)
- [Commits](zip-rs/zip2@v2.4.2...v2.6.1)

---
updated-dependencies:
- dependency-name: rustls
  dependency-version: 0.23.46
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: russh
  dependency-version: 0.65.0
  dependency-type: direct:production
  dependency-group: cargo
- dependency-name: zip
  dependency-version: 2.6.1
  dependency-type: indirect
  dependency-group: cargo
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Nov 4, 2026
@github-actions
github-actions Bot requested a review from vheins November 4, 2026 14:13
@vheins
vheins merged commit eb52d94 into master Nov 4, 2026
2 of 6 checks passed
@vheins
vheins deleted the dependabot/cargo/cargo-78615f28b4 branch November 4, 2026 14:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant