[dependabot]

Bumps the rust-dependencies group with 3 updates in the / directory: russh, napi and napi-derive.

Updates russh from 0.64.1 to 0.65.0

Release notes

Sourced from russh's releases.

v0.65.0

Breaking changes

• d507707: feat(server): expose the publickey algorithms to Handler (#785) (@​Eric-D) #785
  • Handler::auth_publickey_offered now takes a server::PublicKeyOffer and Handler::auth_publickey takes a server::VerifiedPublicKey instead of &PublicKey. Read the key from the public_key field. The new algorithm field makes accessible the signature algorithm used by the client, allowing the server to react to it
• 62efa5a: Remove the no-op async-trait dependency and crate feature (#786) (@​FalkWoldmann) #786

Security fixes

GHSA-9wfm-jcj8-jfv9 - russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages

• 23aa5d2 - A malicious SSH agent client can trigger unbounded allocations in russh based agents

GHSA-4p9f-7p9m-5vfg - russh's SSH client is susceptible to unbounded allocations via EXT_INFO packets

• b33e93b - russh did not limit the number of EXT_INFO messages that a malicious server can send, leading to unbounded memory growth over time

GHSA-fw5c-8223-6h42 - russh: peer-declared zero maximum packet size permanently stalls channel writes

• 39cb9db - malicious peers can hang up the channel by setting max packet size to zero

GHSA-662x-8wvj-2276 - pageant: unbounded frame buffering on peer-controlled 4-byte length prefix

• 69e4b55 - a malicious SSH agent client can trigger unbounded allocations in russh based agents

GHSA-vp5q-ff62-jwqv - Agent server never calls Agent::confirm

• 62db6e7 - Agent::confirm was defunct and never got called by the agent server

GHSA-3hm4-p7h4-rvwp - russh: pre-authentication stack exhaustion via nested OpenSSH certificates

• 730d663 - a malicious client could trigger a stack overflow via a crafted OpenSSH certificate

Features

• d65823f: feat(client): support OpenSSH agent session binding (#794) (@​inureyes) #794
  • Exposes the verified initial key-exchange data through a typed AgentSessionBinding. You need it to send session-bind@openssh.com for OpenSSH destination-constrained agent keys.

Fixes

• 13c94f0: Fix channel window accounting on window adjust (#790) (@​notsapinho) #790
• e2bdf85: client: keep the session usable when a Signer fails after PK_OK (#788) (@​meanaverage) #788
• b10506e: Re-arm the client keepalive timer before authentication (#791) (@​Bokjan) #791
  • Fixes the client session task spinning on a CPU core when the keepalive timer fired before authentication.
• c1fada1: fix(agent): honor SSH_AGENT_RSA_SHA2_* flags when signing with RSA keys (#796) (@​mdevolde) #796
• 3beb126: client: don't arm the rekey timer on wasm32 (#797) (@​biao29) #797

New Contributors

• @​Eric-D made their first contribution in Eugeny/russh#785

... (truncated)

Commits

• 183a22e v0.65.0
• 39cb9db reject zero max packet size
• 69e4b55 limit pageant message sizes
• 62db6e7 call Agent::confirm
• b33e93b limit ext_info messages
• 730d663 check certificate nesting
• 23aa5d2 dedupe agent constraints
• d65823f feat(client): support OpenSSH agent session binding (#794)
• d507707 feat(server): expose the publickey algorithms to Handler (#785)
• 13c94f0 Fix channel window accounting on window adjust (#790)
• Additional commits viewable in compare view

Updates napi from 3.15.0 to 3.16.0

Release notes

Sourced from napi's releases.

napi-v3.16.0

Added

• (napi) support well-known symbol keys for class members (#3665)
• (napi) support symbol_for keys for class members (#3661)

Fixed

• (napi) compact class identity metadata (#3667)
• (napi) keep the registered classes when a later load fails (#3666)
• (napi) free define_class closures, honour static flags, avoid TS1016 in constructors (#3662)
• (napi) free threadsafe function call data when the call fails (#3656)

Commits

• f89400d chore: release (#3637)
• 192cbaa chore(deps): update dependency @​types/inquirer to v10 (#3668)
• 9188219 chore(deps): update dependency electron to v45 (#3634)
• 1d93a4e fix(napi): compact class identity metadata (#3667)
• e9de902 fix(napi): keep the registered classes when a later load fails (#3666)
• cad7ff7 feat(napi): support well-known symbol keys for class members (#3665)
• c01ce60 fix(napi): free define_class closures, honour static flags, avoid TS1016 in c...
• 5a49dad feat(napi): support symbol_for keys for class members (#3661)
• 0c58903 fix(napi): free threadsafe function call data when the call fails (#3656)
• ada66a3 chore(deps): update release-plz/action action to v0.5.147 (#3659)
• Additional commits viewable in compare view

Updates napi-derive from 3.6.13 to 3.7.0

Release notes

Sourced from napi-derive's releases.

napi-derive-v3.7.0

Added

• (napi) support well-known symbol keys for class members (#3665)
• (napi) support symbol_for keys for class members (#3661)

Fixed

• (napi) free define_class closures, honour static flags, avoid TS1016 in constructors (#3662)

Commits

• f89400d chore: release (#3637)
• 192cbaa chore(deps): update dependency @​types/inquirer to v10 (#3668)
• 9188219 chore(deps): update dependency electron to v45 (#3634)
• 1d93a4e fix(napi): compact class identity metadata (#3667)
• e9de902 fix(napi): keep the registered classes when a later load fails (#3666)
• cad7ff7 feat(napi): support well-known symbol keys for class members (#3665)
• c01ce60 fix(napi): free define_class closures, honour static flags, avoid TS1016 in c...
• 5a49dad feat(napi): support symbol_for keys for class members (#3661)
• 0c58903 fix(napi): free threadsafe function call data when the call fails (#3656)
• ada66a3 chore(deps): update release-plz/action action to v0.5.147 (#3659)
• Additional commits viewable in compare view

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	b5c756e	Commit Preview URL Branch Preview URL	Nov 02 2026, 09:31 PM