chore(deps): bump russh to 0.62.6

[chaliy]

Supersedes #2301.

What changed

Bumps russh 0.62.5 -> 0.62.6 and records the corresponding cargo-vet delta audit.

Upstream changes picked up:

• Channel-open replies now go through a dedicated priority queue drained ahead of the bounded receivers. Previously the reply used the bounded sender via try_send, so a confirmation could be silently dropped when the queue was full, and channel data could overtake the confirmation for a channel that was not registered yet (dropping that data). This is a direct follow-up to the backpressure work audited in 0.62.4 -> 0.62.5.
• Server-side max_auth_attempts is actually enforced, disconnecting with NoMoreAuthMethodsAvailable once the cap is exceeded; publickey probes answered with PK_OK explicitly do not count toward it.
• Name-lists tolerate exactly one trailing comma for OpenSSH interop, while still rejecting "," and "a,,".

Why

cargo vet gates the bump: russh:0.62.6 missing ["safe-to-deploy"] is the only real failure on #2301. Rather than widening the blanket exemption, this records a reviewed delta audit, keeping the existing 0.62.4 exemption + delta-audit chain intact.

The lockfile edit is deliberately scoped to russh alone. Running cargo update -p russh --precise 0.62.6 also re-unifies unrelated crates (tempfile, rustix, socket2, ...) onto windows-sys 0.52.0 and getrandom 0.3.4 — churn that has nothing to do with this bump and that silently downgrades Windows bindings. That churn is what #2301 carries. russh 0.62.6 declares exactly the same dependency requirements as 0.62.5 (only the version line differs in its manifest), so the two-line lockfile edit is sufficient and stays consistent.

Before / After

Vet gate:

# before (as on #2301)
Vetting Failed!
1 unvetted dependencies:
  russh:0.62.6 missing ["safe-to-deploy"]

# after
Vetting Succeeded (27 fully audited, 6 partially audited, 590 exempted)

Lockfile blast radius:

# `cargo update -p russh --precise 0.62.6` (what #2301 carries)
 Cargo.lock | 18 +++++++++---------

# this PR
 Cargo.lock | 4 ++--

Lock consistency and SSH behavior:

$ cargo metadata --locked   # LOCK OK
$ cargo test --features ssh -p bashkit --test ssh_builtin_tests
test result: ok. 24 passed; 0 failed; 0 ignored

No behavior change in bashkit itself — this is a dependency patch bump plus a supply-chain record.

Risk

• Low
• The upstream delta touches SSH channel-open sequencing. bashkit drives russh as a client (ssh/scp/sftp builtins), and the priority-queue change strictly reduces the chance of a dropped channel-open confirmation. The server-side auth cap does not apply to bashkit's client usage. All 24 SSH builtin tests pass.
• Review notes: no new unsafe (unchanged single occurrence), no new dependencies, no ambient capability changes.

Checklist

• Tests added or updated — existing SSH builtin suite covers the client paths; the upstream delta lands with its own regression tests. No new bashkit-side behavior to test.
• Backward compatibility considered — patch-level dependency bump, no public API change.

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	63d586c	Commit Preview URL Branch Preview URL	Aug 16 2026, 09:22 AM