Skip to content

chore(deps): bump dartssh2 from 2.22.2 to 3.3.1 - #14

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pub/dartssh2-3.3.1
Open

chore(deps): bump dartssh2 from 2.22.2 to 3.3.1#14
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pub/dartssh2-3.3.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 27, 2026

Copy link
Copy Markdown

Bumps dartssh2 from 2.22.2 to 3.3.1.

Release notes

Sourced from dartssh2's releases.

3.3.1

What's Changed

Full Changelog: vicajilau/dartssh2@v3.3.0...v3.3.1

3.3.0

What's Changed

Full Changelog: vicajilau/dartssh2@v3.2.0...v3.3.0

3.2.0

What's Changed

Full Changelog: vicajilau/dartssh2@v3.1.0...v3.2.0

3.1.0

What's Changed

Full Changelog: vicajilau/dartssh2@v3.0.2...v3.1.0

3.0.2

What's Changed

... (truncated)

Changelog

Sourced from dartssh2's changelog.

[3.3.1] - 2026-08-19

  • Removed the background isolate offload from X25519 and NIST curve key exchange, which cost more than the work it was hiding. Generating an ephemeral key or computing the shared secret on these curves is one fixed-size scalar multiply, well under a millisecond, while Isolate.run takes several times that to spawn and tear down, and a client pays it twice per handshake. On a memory constrained Android device the spawn delay was long enough for the server to time out the key exchange and close the connection before SSH_MSG_NEWKEYS went out, surfacing as SSHAuthAbortError with a null reason #226. Thanks [@​cesarcamps].
  • Kept the offload for finite field Diffie-Hellman, which is the one exchange whose cost the peer controls: group exchange lets the server name a modulus of up to 8192 bits, and modular exponentiation grows steeply with it.
  • Added debug logging around host key signature verification and the onVerifyHostKey callback. Everything between receiving the key exchange reply and sending SSH_MSG_NEWKEYS used to run without a single printDebug call, so a slow user callback and a slow shared secret were indistinguishable in a trace, and both looked like a hung handshake #226.

[3.3.0] - 2026-08-18

  • Added SSHDisconnectError, so the reason the peer gave for terminating the connection reaches the caller. SSH_MSG_DISCONNECT carries a reason code and a description, which is where OpenSSH puts lines such as "no matching key exchange method found"; the transport used to log it and close cleanly, leaving an unexplained disconnection #224.
  • Fixed SSHMessageReader.readBytes() indexing the underlying buffer instead of the message, so it returned the wrong bytes whenever the message was a view into a larger buffer, which is what every SSH and SFTP payload is. Only OpenSSH private key decoding called it, on a freshly decoded blob where the two coincide, so nothing was broken in practice #223.
  • Changed malformed packets to raise SSHPacketError instead of RangeError or IndexError. Every decoder that parses peer-supplied bytes went through the latter, which are how Dart reports a bug in the caller: a handler catching SSHError missed them, and inside a stream callback they escaped as uncaught errors #223.
  • Deprecated SSHTransport.onPacket in favour of onMessage, which reports whether it recognized a message so the transport can answer unknown ones as RFC 4253 requires. onPacket keeps working #221.
  • Added interop tests that run a real dartssh2 client against a real OpenSSH server, forcing one algorithm per connection across the ciphers, key exchanges and MACs, plus a command and an SFTP round trip. Unit tests can only show the library agrees with itself, which is how the X11 screen number stayed a string until #194 #224 #225.
  • Removed the last test helper pointing at infrastructure belonging to the previous maintainer's organisation. It was unused #224.
  • Added regression tests pinning how many requests an SFTP download costs, so a repeat of the 3.0.2 read size collapse fails a test rather than needing to be found by hand #222.
  • Documented hostbased authentication in the README, which 3.2.0 added without mentioning it anywhere outside the changelog #220.

[3.2.0] - 2026-08-18

  • Added the chacha20-poly1305@openssh.com packet cipher, implemented as OpenSSH's own construction rather than the RFC 8439 AEAD: two independent ChaCha20 keys, a separately encrypted packet length, and Poly1305 over the raw encrypted length and body. It joins the default cipher list in third place, after the two AES-GCM variants, so it is negotiated with servers that do not offer AES-GCM #217. Thanks [@​GT-610].
  • Added RFC 4252 hostbased authentication through the asynchronous SSHIdentity API, with the new SSHClient.hostbasedIdentities, SSHClient.hostName and SSHClient.userNameOnClientHost options. The host key blob type is kept separate from the signature algorithm, so RSA SHA-2 signatures work #218. Thanks [@​GT-610].
  • Changed the authentication state machine to treat the server's methodsLeft as an allow-list while keeping the client's own preference order, to keep publickey and hostbased available only while identities remain, and to reset publickey state after a partial success, as OpenSSH does #218. Thanks [@​GT-610].
  • Added RFC 4253 SSH_MSG_UNIMPLEMENTED handling. Genuinely unrecognized messages are now reported with the rejected packet's own sequence number, while SSH_MSG_IGNORE, SSH_MSG_DEBUG and incoming SSH_MSG_UNIMPLEMENTED are consumed without creating reply loops. Unexpected messages during the initial strict key exchange disconnect, matching OpenSSH, while rekeys reply instead #216. Thanks [@​GT-610].
  • Added SSHTransport.onMessage, a handler that reports whether it recognized a message so the transport knows when to reply SSH_MSG_UNIMPLEMENTED. The existing onPacket keeps working unchanged and assumes every packet it receives is handled #216. Thanks [@​GT-610].
  • Added a 256 KiB limit on SFTP packets in both directions, matching SFTP_MAX_MSG_LENGTH in OpenSSH, with the four-byte length prefix excluded. Without it a peer could declare an arbitrarily large packet and make the client buffer indefinitely while waiting for a body that never arrives #215. Thanks [@​GT-610].

[3.1.0] - 2026-08-17

  • Fixed operations hanging forever when the component they were waiting on terminated. A channel request, a global request or a channel open whose reply could no longer arrive now fails with the error that ended the connection or the channel, instead of leaving the caller awaiting a reply that will never come #212. Thanks [@​GT-610].
  • Changed SSH_MSG_CHANNEL_CLOSE, channel destruction and transport termination to be terminal for pending replies, while SSH_MSG_CHANNEL_EOF remains non-terminal, since RFC 4254 allows request replies to arrive after EOF #212. Thanks [@​GT-610].
  • Fixed a channel stalling forever once a slow reader paused the stream: the receive window was never replenished after it reached zero, so the channel could not accept another byte for the rest of its life. This affected any slow consumer, such as an SFTP download or shell output #210. Thanks [@​GT-610].
  • Added the channel limits required by RFC 4254 §5.2: data beyond the advertised maximum packet size or beyond the remaining receive window is rejected, and a window adjustment that would overflow the 32-bit window is refused #210. Thanks [@​GT-610].
  • Changed a peer that breaks those limits to fail only the affected channel, raising the error on its stream so the caller finds out, while the connection and its other channels stay alive #213. Thanks [@​vicajilau].
  • Added rejection of unsolicited and duplicate channel open confirmations and failures, which used to be ignored #210. Thanks [@​GT-610].
  • Fixed channel identifiers leaking on a failed channel open, on an open still pending when the connection closed, and when sending the open request threw #210. Thanks [@​GT-610].
  • Added strict key exchange (kex-strict-c-v00@openssh.com), the countermeasure against the Terrapin attack (CVE-2023-48795). It is negotiated automatically and, when the server supports it, packet sequence numbers are reset after every SSH_MSG_NEWKEYS, SSH_MSG_IGNORE / SSH_MSG_UNIMPLEMENTED / SSH_MSG_DEBUG are rejected during a key exchange, and the first SSH_MSG_KEXINIT is required to be the first packet of the connection. Exposed as SSHClient.strictKex #207. Thanks [@​vicajilau].
  • Added SSH_MSG_EXT_INFO support (RFC 8308). The client advertises ext-info-c and exposes the signature algorithms the server accepts as SSHClient.serverSigAlgs #207. Thanks [@​vicajilau].
  • Changed the default algorithm preferences. AES-GCM is now the preferred cipher instead of being opt-in, encrypt-then-MAC is preferred over encrypt-and-MAC, and ssh-rsa (SHA-1) is now last among the host key algorithms. CBC ciphers and hmac-sha1 remain available but are only reached when a server offers nothing better #207. Thanks [@​vicajilau].
  • Removed three broken algorithms from the defaults: diffie-hellman-group1-sha1 (1024-bit group), hmac-md5, and the truncated hmac-sha2-[256|512]-96 variants. They are still implemented and can be re-enabled by passing them to SSHAlgorithms explicitly #207. Thanks [@​vicajilau].
  • Fixed SSH_Message_Userauth_Request.decode() swapping the old and new password when decoding a password change request, contrary to RFC 4252 §8 #207. Thanks [@​vicajilau].
  • Fixed SSH_Message_Userauth_Request.decode() not reading the boolean that precedes the algorithm name in a publickey request (RFC 4252 §7), which misparsed every signed request and could not represent an unsigned probe #207. Thanks [@​vicajilau].
  • Added a SECURITY.md with a private vulnerability reporting process #207. Thanks [@​vicajilau].
  • Documented onVerifyHostKey in the README. Host key signatures were and are always verified, but deciding whether the key is the expected one is the caller's job, and omitting the handler accepts any host key #207. Thanks [@​vicajilau].

[3.0.2] - 2026-08-17

  • Fixed silent data loss in SFTP reads when a server returned fewer bytes than requested, which the protocol allows: the missing suffix is now retried instead of skipped, so SftpFile.read() and SftpClient.download() no longer return truncated, misaligned data #200 #203. Thanks [@​GT-610].
  • Fixed NIST ECDH private scalar generation, which sampled only 65 bytes for P-521 and could therefore never set the 521st bit, and replaced the modulo reduction with rejection sampling for a uniform scalar in 1 <= x < n #201. Thanks [@​GT-610].
  • Changed SftpFile.read() to process pipelined read replies as they arrive while still emitting chunks ordered by file offset #200. Thanks [@​GT-610].
  • Changed SftpFile.read() to throw SftpError when a server returns more bytes than requested, instead of silently truncating the surplus #200. Thanks [@​GT-610].
  • Registered SFTP reply waiters before sending each request, so a reply can no longer be discarded by a channel that delivers it synchronously #199. Thanks [@​GT-610].
  • Limited SFTP read resizing to short replies of at least 512 bytes, so a single tiny reply no longer pins every later request to that floor for the rest of a transfer #203.

[3.0.1] - 2026-08-16

  • Fixed X11 forwarding by encoding and decoding the x11-req screen number as a uint32 instead of a string, as required by RFC 4254 §6.3 #194. Thanks [@​GT-610].

... (truncated)

Commits
  • c61f6a4 Merge pull request #227 from vicajilau/fix/kex-isolate-offload
  • 6b82887 fix: stop offloading elliptic curve key exchange to isolates
  • 8585dc4 Merge pull request #225 from vicajilau/test/known-algorithm-sshd
  • f970d7c test: build the interop server so its algorithms are known
  • ad4b1ae Merge pull request #224 from vicajilau/ci/hermetic-integration-tests
  • de6012b chore: cover the disconnect path and collect the 3.3.0 notes
  • 3d80f98 Merge branch 'main' into ci/hermetic-integration-tests
  • 45df590 test: leave the finite-field DH exchanges out of the interop matrix
  • 38602ae Merge pull request #223 from vicajilau/test/decoder-fuzzing
  • a9940cc fix: surface the peer's SSH_MSG_DISCONNECT reason
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
chore(deps): bump dartssh2 from 2.22.2 to 3.3.1
1ef185a 
Bumps [dartssh2](https://github.com/vicajilau/dartssh2) from 2.22.2 to 3.3.1.
- [Release notes](https://github.com/vicajilau/dartssh2/releases)
- [Changelog](https://github.com/vicajilau/dartssh2/blob/main/CHANGELOG.md)
- [Commits](vicajilau/dartssh2@v2.22.2...v3.3.1)

---
updated-dependencies:
- dependency-name: dartssh2
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Aug 27, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: dependencies, pub. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@changeset-bot

changeset-bot Bot commented Aug 27, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 1ef185a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants