chore(deps): bump russh from 0.62.5 to 0.62.6 in the rust-dependencies group

[dependabot]

Bumps the rust-dependencies group with 1 update: russh.

Updates russh from 0.62.5 to 0.62.6

Release notes

Sourced from russh's releases.

v0.62.6

Security fixes

GHSA-g6xm-f9xp-qq35 - server-side max_auth_attempts was not enforced - f8fd0b1

Config::max_auth_attempts was not being properly enforced by russh server implementation.

Fixes

• c66837e: Fix deadlock when handling open channel on contended handler (#734) (Eric Rodrigues Pires) #734

Changes

• c465e3f: accept a single trailing comma in SSH name-lists (#743) (PokAhonTAS911) #743
• add Motor OS support (#742) #742 (lasiotus)

Commits

• 27554ed v0.62.6
• 5fb05fc clippy
• 6f9419d Merge branch 'main' of github.com:warp-tech/russh
• 8f4548e Update rust-toolchain.toml
• c66837e Fix deadlock when handling open channel on contended handler (#734)
• c465e3f accept a single trailing comma in SSH name-lists (#743)
• ffe78fe add PokAhonTAS911 as a contributor for code (#744)
• f9733c2 cryptovec: add Motor OS support (#742)
• f8fd0b1 fix auth cap handling
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	4c1c5ab	Commit Preview URL Branch Preview URL	Aug 15 2026, 09:38 AM

[chaliy]

Superseded by #2305.

Two reasons this needed a replacement rather than a re-run:

1. cargo vet gate. The only real failure here is russh:0.62.6 missing ["safe-to-deploy"] (the Check failure is just the aggregate gate). That needs a reviewed delta audit in supply-chain/audits.toml, which Dependabot can't author. chore(deps): bump russh to 0.62.6 #2305 records the 0.62.5 -> 0.62.6 delta as safe-to-deploy with review notes.

2. Unrelated lockfile churn. This PR's Cargo.lock also re-unifies tempfile, rustix, socket2 and friends onto windows-sys 0.52.0 and getrandom 0.3.4 — a silent downgrade of the Windows bindings that has nothing to do with the russh bump. russh 0.62.6 declares the same requirements as 0.62.5, so chore(deps): bump russh to 0.62.6 #2305 keeps the lockfile edit to the 2 lines that actually change and verifies it with cargo metadata --locked.

Closing once #2305 merges.

---

Generated by Claude Code

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml