Skip to content

chore(agent)(deps): bump russh from 0.62.6 to 0.63.1 in /catalyst-agent - #241

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/catalyst-agent/russh-0.63.1
Open

chore(agent)(deps): bump russh from 0.62.6 to 0.63.1 in /catalyst-agent#241
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/cargo/catalyst-agent/russh-0.63.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps russh from 0.62.6 to 0.63.1.

Release notes

Sourced from russh's releases.

v0.63.1

Security fixes

GHSA-47hw-gvq5-r2gm - client-side Handler callbacks reachable with invalid channel IDs

A mirror of GHSA-m65r-rprj-r5rg for the client side - Handler per-channel callbacks are called even when the server supplies an invalid (never opened) channel ID. Depending on what the handler does this can lead to a vulnerability.

GHSA-p8qx-h547-fjw9 - MAC-requiring block cipher can be negotiated without MAC and panic

Two peers disagreeing on supported MACs can end up negotiating none MAC for a cipher that requires one, which leads to the session task panicking.

v0.63.0

Features

  • 09f6582: Support host certificates on the client side (#752) (@​biao29) #752

    • This changes the signature of Handler::check_server_key to take a new PublicKeyOrCertificate enum instead of &PublicKey

  • d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

    • Adds a Config::certificates that functions similarly to Config::keys

Fixes

  • f2354c7: improve strict kex checks (Eugene)
  • 0363fde: fixed PKCS#8 parsing panicking on incorrect contents (Eugene)
  • 46c927a: use constant-time comparison for agent unlock (Eugene)
  • 8da8967: sanitize Curve25519 params (Eugene)

Full Changelog: Eugeny/russh@v0.62.7...v0.63.0

v0.63.0-beta.1

Features

  • 09f6582: Support host certificates on the client side (#752) (@​biao29) #752
  • d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

Full Changelog: Eugeny/russh@v0.62.7...v0.63.0-beta.1

v0.62.7

Features

Fixes

  • don't truncate decompressed packets that expand more than 2x (#750) #750 (Luiz Ribeiro)
  • c9da80c: Pageant WM_COPYDATA protocol fix & token tightening (#624) (vzex) #624
  • fall back to GetUserNameA when GetUserNameExA fails (#726) #726 (cwatanab)
Commits

@dependabot @github

dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: agent, rust. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 31, 2026
@dependabot dependabot Bot mentioned this pull request Aug 31, 2026
Closed
@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

🔒 Supply Chain Security Review

Check Status
Socket.dev malware scan ✅ success
Vulnerability audit ✅ success
Lockfile diff review ✅ success
OSSF Scorecard ✅ success

This review was automatically generated by the Supply Chain Review workflow.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/catalyst-agent/russh-0.63.1 branch from f5fd04d to 42dd4f0 Compare August 31, 2026 15:56
@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown
Contributor

🔒 Supply Chain Security Review

Check Status
Socket.dev malware scan ✅ success
Vulnerability audit ✅ success
Lockfile diff review ✅ success
OSSF Scorecard ✅ success

This review was automatically generated by the Supply Chain Review workflow.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/catalyst-agent/russh-0.63.1 branch from 42dd4f0 to 5b18f12 Compare September 1, 2026 18:25
@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

🔒 Supply Chain Security Review

Check Status
Socket.dev malware scan ✅ success
Vulnerability audit ✅ success
Lockfile diff review ✅ success
OSSF Scorecard ✅ success

This review was automatically generated by the Supply Chain Review workflow.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/catalyst-agent/russh-0.63.1 branch from 5b18f12 to bbdd2f4 Compare September 1, 2026 19:39
@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

🔒 Supply Chain Security Review

Check Status
Socket.dev malware scan ✅ success
Vulnerability audit ✅ success
Lockfile diff review ✅ success
OSSF Scorecard ✅ success

This review was automatically generated by the Supply Chain Review workflow.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/catalyst-agent/russh-0.63.1 branch from bbdd2f4 to 03ba3ee Compare September 2, 2026 18:20
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

🔒 Supply Chain Security Review

Check Status
Socket.dev malware scan ✅ success
Vulnerability audit ✅ success
Lockfile diff review ✅ success
OSSF Scorecard ✅ success

This review was automatically generated by the Supply Chain Review workflow.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/catalyst-agent/russh-0.63.1 branch from 03ba3ee to d55ab85 Compare September 2, 2026 18:56
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

🔒 Supply Chain Security Review

Check Status
Socket.dev malware scan ✅ success
Vulnerability audit ✅ success
Lockfile diff review ✅ success
OSSF Scorecard ✅ success

This review was automatically generated by the Supply Chain Review workflow.

@dependabot
dependabot Bot force-pushed the dependabot/cargo/catalyst-agent/russh-0.63.1 branch from d55ab85 to 26eaec2 Compare September 3, 2026 03:09
@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

🔒 Supply Chain Security Review

Check Status
Socket.dev malware scan ✅ success
Vulnerability audit ✅ success
Lockfile diff review ✅ success
OSSF Scorecard ✅ success

This review was automatically generated by the Supply Chain Review workflow.

@dependabot
chore(agent)(deps): bump russh from 0.62.6 to 0.63.1 in /catalyst-agent
e4a10e5 
Bumps [russh](https://github.com/warp-tech/russh) from 0.62.6 to 0.63.1.
- [Release notes](https://github.com/warp-tech/russh/releases)
- [Commits](Eugeny/russh@v0.62.6...v0.63.1)

---
updated-dependencies:
- dependency-name: russh
  dependency-version: 0.63.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/cargo/catalyst-agent/russh-0.63.1 branch from 26eaec2 to e4a10e5 Compare September 3, 2026 12:58
@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown
Contributor

🔒 Supply Chain Security Review

Check Status
Socket.dev malware scan ✅ success
Vulnerability audit ✅ success
Lockfile diff review ✅ success
OSSF Scorecard ✅ success

This review was automatically generated by the Supply Chain Review workflow.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants