[dependabot]

Bumps russh from 0.65.0 to 0.65.1.

Release notes

Sourced from russh's releases.

v0.65.1

Security fixes

GHSA-736f-c93q-9fwx - agent lock status not checked after confirmation wait

Agent lock status is now rechecked after the confirmation await again.

GHSA-9264-jvgf-6w2f - kex_done called before host-key verification

client::Handler::kex_done is now only called after server host key verification succeeds

Fixes

• 20c5a93: fix(keys): keep the comment when loading a public key file (#801) (@​JakeHuneau) #801
  • load_public_key now keeps the comment from an OpenSSH public key file, so key.comment() returns it and to_openssh() round-trips. Fixes #713.
• 3a21566: fix(client): accept non-canonical ECDSA P-521 signature mpints after strict decode fails (#803) (@​gugahartmann) #803
  • Fixes key exchange against servers such as the Huawei S6720, which pad P-521 signature scalars with extra leading zero bytes.
• a6be9ba: fix(cipher): count the MAC tag in the minimum packet length check (#802) (@​JakeHuneau) #802
  • Fixes valid packets being rejected when an EtM MAC is in use. Fixes #787.
• 43a46d6: fix(AgentClient): propagate method errors (#808) (@​mdevolde) #808
  • add_smartcard_key, lock, unlock, remove_identity, remove_smartcard_key and extension now return the agent's failure response as an error. Before, they always returned Ok(()).
• 7c59594: fix(server): let Dropbear through strict kex by accounting for the ignored first_kex_packet_follows guess (#805) (@​NatLee) #805
  • Fixes Dropbear clients failing to connect when strict key exchange is on. Fixes #804.

Dependencies

• d10345d: deps: trim aws-lc-rs features to avoid transitive deps (#809) (@​sepointon) #809
  • Removes the unused ring-compatible API of aws-lc-rs and the old untrusted crate it pulled in.
• 0a8cc28: deps: remove dep on generic-array 0.14 compat (#810) (@​sepointon) #810

New Contributors

• @​sepointon made their first contribution in Eugeny/russh#810
• @​NatLee made their first contribution in Eugeny/russh#805
• @​JakeHuneau made their first contribution in Eugeny/russh#802
• @​gugahartmann made their first contribution in Eugeny/russh#803

Full Changelog: Eugeny/russh@v0.65.0...v0.65.1

Commits

• b33092a v0.65.1
• 20c5a93 fix(keys): keep the comment when loading a public key file (#801)
• 3a21566 fix(client): accept non-canonical ECDSA P-521 signature mpints after strict d...
• a6be9ba fix(cipher): count the MAC tag in the minimum packet length check (#802)
• 43a46d6 fix(AgentClient): propagate method errors (#808)
• 56384e6 add Eric-D as a contributor for code (#799)
• 7c59594 fix(server): let Dropbear through strict kex by accounting for the ignored fi...
• d10345d deps: trim aws-lc-rs features to avoid transitive deps (#809)
• 0a8cc28 deps: remove dep on generic-array 0.14 compat (#810)
• 92562d3 tests: adapt to VerifiedPublicKey after #785 (#807)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)