From 0bbc690342e5545b69c0bdb0648b28f714c6611f Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Sun, 16 Aug 2026 09:18:03 +0000 Subject: [PATCH 1/2] chore(deps): bump russh to 0.62.6 Picks up the upstream channel-open reply priority queue, server-side max_auth_attempts enforcement, and the OpenSSH name-list trailing-comma interop fix. Records the 0.62.5 -> 0.62.6 cargo-vet delta audit as safe-to-deploy so `cargo vet` passes without a blanket exemption bump. Keeps the lockfile edit scoped to russh: a plain `cargo update -p russh` also re-unifies unrelated crates onto windows-sys 0.52.0 / getrandom 0.3.4, which is churn unrelated to this bump. russh 0.62.6 declares the same requirements as 0.62.5, so the two-line edit stays consistent under --locked. --- Cargo.lock | 4 ++-- supply-chain/audits.toml | 6 ++++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 796450026..dd6c2c133 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -4393,9 +4393,9 @@ dependencies = [ [[package]] name = "russh" -version = "0.62.5" +version = "0.62.6" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "da7c230e0ed9cbeb92fbad6c8848985d6df2a1464c0dc247a021abd666e9005e" +checksum = "b41043523e0edcbd4e31d00903e26f12994f63b21bae9904f7405c1ed92752a5" dependencies = [ "aes 0.9.1", "aws-lc-rs", diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index fbd0818c4..b2b773107 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -128,6 +128,12 @@ criteria = "safe-to-deploy" delta = "0.62.4 -> 0.62.5" notes = "Reviewed delta: rejects channel-scoped messages unless the SSH channel is confirmed, and bounds queued application output when channel windows are exhausted; no unsafe code or new ambient capabilities, with regression and backpressure coverage." +[[audits.russh]] +who = "Mykhailo Chalyi " +criteria = "safe-to-deploy" +delta = "0.62.5 -> 0.62.6" +notes = 'Reviewed delta: routes channel-open replies through a dedicated priority queue drained ahead of the bounded receivers, so a confirmation can no longer be silently dropped by a full queue or be overtaken by data for a channel that is not registered yet; enforces the server-side max_auth_attempts cap with a DISCONNECT while keeping publickey probes uncounted; and tolerates exactly one trailing comma in name-lists for OpenSSH interop, still rejecting "," and "a,,". No new unsafe code (unchanged single occurrence), no new dependencies, and no ambient capability changes; each behaviour change lands with test coverage.' + [[audits.rustls-webpki]] who = "Mykhailo Chalyi " criteria = "safe-to-deploy" From 63d586cd3e1085b7b86d25225ae5e0d3e2f85270 Mon Sep 17 00:00:00 2001 From: Mykhailo Chalyi Date: Sun, 16 Aug 2026 09:21:38 +0000 Subject: [PATCH 2/2] chore(deps): keep the russh vet note free of embedded quotes CI installs cargo-vet@latest via taiki-e/install-action, which currently resolves to 0.10.0, while cargo-binstall ships 0.10.2. The two disagree on how to format a TOML string containing double quotes (0.10.0 escapes them in a basic string, 0.10.2 emits a literal string), so a note quoting name-list examples fails `cargo vet` on whichever version did not write it. Phrasing the note without embedded quotes formats identically under both. --- supply-chain/audits.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml index b2b773107..66201f205 100644 --- a/supply-chain/audits.toml +++ b/supply-chain/audits.toml @@ -132,7 +132,7 @@ notes = "Reviewed delta: rejects channel-scoped messages unless the SSH channel who = "Mykhailo Chalyi " criteria = "safe-to-deploy" delta = "0.62.5 -> 0.62.6" -notes = 'Reviewed delta: routes channel-open replies through a dedicated priority queue drained ahead of the bounded receivers, so a confirmation can no longer be silently dropped by a full queue or be overtaken by data for a channel that is not registered yet; enforces the server-side max_auth_attempts cap with a DISCONNECT while keeping publickey probes uncounted; and tolerates exactly one trailing comma in name-lists for OpenSSH interop, still rejecting "," and "a,,". No new unsafe code (unchanged single occurrence), no new dependencies, and no ambient capability changes; each behaviour change lands with test coverage.' +notes = "Reviewed delta: routes channel-open replies through a dedicated priority queue drained ahead of the bounded receivers, so a confirmation can no longer be silently dropped by a full queue or be overtaken by data for a channel that is not registered yet; enforces the server-side max_auth_attempts cap with a DISCONNECT while keeping publickey probes uncounted; and tolerates exactly one trailing comma in name-lists for OpenSSH interop, still rejecting a bare comma and a doubled separator. No new unsafe code (unchanged single occurrence), no new dependencies, and no ambient capability changes; each behaviour change lands with test coverage." [[audits.rustls-webpki]] who = "Mykhailo Chalyi "