chore(deps): bump the rust-dependencies group with 6 updates

[chaliy]

What changed

Takes the rust-dependencies group bump from #2706 and adds the supply-chain
delta audits it needs. Ten crates move; the notable one is russh
0.63.3 → 0.64.1, which both fixes a server-side authentication bug and
removes a dependency.

Supersedes #2706, which cannot merge as-is.

Why

#2706 was green on Test, Lint, Examples and every WASM/Windows job.
Only Audit failed:

Vetting Failed!

10 unvetted dependencies:
  napi:3.14.2            russh:0.64.1          serde_spanned:1.1.2
  signal-hook:0.4.5      syn:3.0.7             toml:1.1.8+spec-1.1.0
  toml_datetime:1.1.2+spec-1.1.0               toml_parser:1.1.5+spec-1.1.0
  toml_writer:1.1.3+spec-1.1.0                 zeroize:1.9.1

Refreshing the imported audits (mozilla, bytecodealliance) covers
serde_spanned and the four toml crates, so imports.lock moves and five
crates needed review by hand.

Before / After

$ cargo vet --locked        # before
Vetting Failed!  10 unvetted dependencies

$ cargo vet --locked        # after
Vetting Succeeded (91 fully audited, 82 partially audited, 496 exempted)

What the review found

None of the five adds a dependency, a build script, or any host filesystem,
network or process access. Every one is a narrowing — this upgrade set
reduces risk rather than adding it.

russh 0.63.3 → 0.64.1 — the one worth reading closely, since it is the SSH
client behind the ssh/scp/sftp builtins.

• Security fix. A publickey request's signature must now use the algorithm
  the request announced (RFC 4252 §7, RFC 8332 §3). Previously a client could
  announce rsa-sha2-512 and sign with ssh-rsa (SHA-1) and the server
  accepted it. Upstream added the comparison plus a regression test asserting
  both the rejection and that a matching signature still passes.
• A dependency removed, not added. The legacy-ed25519-pkcs8-parser feature
  and its yasna ASN.1 crate are gone, so the PKCS8 path no longer falls back
  to a second parser on error.
• Our exposure: we use russh as a client with default features, so that
  feature was never enabled and the server-side bug was never reachable from
  this tree. Both changes only shrink the surface here.
• The remainder is mechanical: let-chain rewrites in keys/known_hosts.rs and
  kex/dh/mod.rs with identical semantics, saturating arithmetic for the
  cipher byte counter, and new integration tests. No new unsafe anywhere
  in src.

napi 3.14.0 → 3.14.2 — bounds serde_json::Value conversion at 128 levels
of nesting, which matters most here because the binding converts untrusted
input; fixes an aliasing violation in NativeBorrowScope by owning its storage
through NonNull; registers the wasm cleanup via the env cleanup hook.

zeroize 1.9.0 → 1.9.1 — replaces Zeroizing's derived Debug with an
opaque impl, so a wrapped secret no longer renders through {:?} (the same
concern as TM-INF-022); stops double-zeroizing Vec elements; fixes a
potential uninitialized read in the optimization_barrier fallback.

toml_parser 1.1.3 → 1.1.5 — removes its optional unsafe feature's
get_unchecked paths outright.

syn 3.0.6 → 3.0.7 — one-line parser fix: a label is no longer matched when
the next token is ::. signal-hook 0.4.4 → 0.4.5 — hoists the raw fd out
of a borrow before the unsafe libc::send wake.

Recorded as five delta audits, matching the shape of the existing entries for
these crates.

Risk

• Medium, driven entirely by russh. 0.63 → 0.64 is semver-breaking for a
  0.x crate, and it is the SSH client in the ssh feature.
• Mitigating: chore(deps): bump the rust-dependencies group across 1 directory with 6 updates #2706 proved these exact versions compile and pass the suite —
  Test, Lint and Examples were all green there, with Audit the only
  failure. CI here runs the ssh suite again
  (cargo test --features ssh -p bashkit --test ssh_builtin_tests).
• The audit notes are source safety reviews, not a cryptographic audit of
  russh. The signature-algorithm change is the part a regression would most
  likely come from, though it tightens rather than loosens acceptance.
• imports.lock moves because the imported audits were refreshed; that is how
  the five toml-family crates become vetted without hand-written entries.

Checklist

• Tests added or updated — none needed: dependency bumps plus
  supply-chain metadata, with the existing ssh, toml and binding suites
  covering behavior. The gate that was failing is shown passing above.
• Backward compatibility considered — no bashkit API change. russh's
  breaking changes are in its server surface and the removed legacy PKCS8
  feature, neither of which this tree uses.

---

Generated by Claude Code

[chaliy]

russh is the semver-breaking part of this group, so I ran its suite locally against 0.64.1 before pushing, with the ssh feature on:

$ cargo test --features ssh -p bashkit --test ssh_builtin_tests
test result: ok. 24 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out
[exited with code 0]

Also confirmed the breaking changes miss this tree. Cargo.toml takes russh with default features, so legacy-ed25519-pkcs8-parser was never enabled — its removal is a no-op here — and the signature-algorithm fix is server-side, while the builtins are a client. A scan of the 0.63.3 → 0.64.1 source delta found no new unsafe block anywhere in src.

CI runs the same ssh suite, so this is corroboration rather than a substitute.

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	744650a	Commit Preview URL Branch Preview URL	Oct 13 2026, 11:11 AM