[dependabot]

Updates the requirements on net-ssh to permit the latest version.

Changelog

Sourced from net-ssh's changelog.

=== 8.0.4

• Security: validate every ProxyJump hop, not only the first, as [user@]host[:port] (refusing a path, query, fragment or password) and shell-escape the hops passed to ssh -J; a hop such as evil/x&$(cmd) ran cmd through the shell [GHSA-g2r2-x3p2-5677]

=== 8.0.3

• Add preopen_channels option: keep a spare session channel open so each command saves a round trip #1071

=== 8.0.2

• Fixed Session#close raising EOFError: cannot send data if channel has declared eof when a forwarded connection still had unread data from its local client; data net-ssh had already read is still sent before the EOF and, as in OpenSSH, the rest is dropped; a regression in 8.0.0 [#1066, #1067]

=== 8.0.1

• Fixed unexpected packet type 94 during initial key exchange (or 93) when channel data arrives during a client-initiated re-key, which broke bulk transfers at the first re-key (e.g. with rekey_limit, or after about 1 GB); a regression in 7.3.5 and 8.0.0 #1063
• control_master: :auto now ignores forward_agent (logged at info level) instead of raising ArgumentError, and logs the ignored connection options at info instead of warn level, so it works with sshkit (Kamal, Capistrano), which always passes forward_agent: true, keys, known_hosts and keepalive #1062

=== 8.0.0

• No changes since 8.0.0 rc5.

=== 8.0.0 rc5

• BREAKING: Security: a custom verify_host_key verifier must now implement verify_signature (deprecated since 5.1.0) or ArgumentError is raised; such verifiers were previously wrapped so the server's host key signature was never checked #1050
• BREAKING: Unsupported key types now raise Net::SSH::UnsupportedKeyType (a Net::SSH::Exception) instead of NotImplementedError; code that rescued NotImplementedError around key loading or connecting should rescue the new class [#945, #1060]
• BREAKING: Net::SSH.start raises ArgumentError for option values that are nil or arrays containing nil (deprecated since 4.0.0); omit the option to use the default or ssh_config value, the error names a value that turns it off where one exists (e.g. proxy: false, keys: [], config: false). password: nil and passphrase: nil are still accepted [#458, #1053]
• BREAKING: removed the :paranoid option (deprecated since 4.2.0); use :verify_host_key with the same values. Passing :paranoid raises ArgumentError #1050
• BREAKING: removed the verify_host_key values false, true, :very and :secure (deprecated since 5.0.0); use :never, :accept_new_or_local_tunnel, :accept_new and :always respectively. The old values raise ArgumentError naming the replacement #1050
• BREAKING: Net::SSH::HostKeyEntries::PubKey (the known_hosts entries returned by KnownHosts.search_for) no longer forwards methods to the wrapped key (deprecated since 7.0.0); use ssh_type, to_blob or matches_key?, or the new key reader for the wrapped public key #1050
• Security: append_all_supported_algorithms: true no longer enables the none cipher and MAC; name them explicitly (encryption: '+none', hmac: '+none') to use them #1051
• Security: diffie-hellman-group-exchange-sha1/sha256 now requires groups of at least 2048 bits and requests sizes from the negotiated ciphers, as OpenSSH since 7.2, and rejects invalid server groups and DH public values; like OpenSSH, the requested group size is capped at 4096 bits for Cisco servers. Pass minimum_dh_bits: 1024 to connect to legacy servers that only offer 1024-bit groups. minimum_dh_bits values other than 1024 no longer fail key exchange with "could not verify server signature" #1049
• Security: diffie-hellman-group14-sha1 is no longer offered by default for key exchange, as in OpenSSH since 8.2; add KexAlgorithms +diffie-hellman-group14-sha1 in ssh_config (or kex: '+diffie-hellman-group14-sha1') or pass append_all_supported_algorithms: true to re-enable [#705, #1042]
• Changelog entries are now added as changelog.d/<PR number>.<type>.txt fragment files instead of editing CHANGES.txt, and CI requires one per PR; see CONTRIBUTING.md #1058
• Net::SSH.start(host, user, control_master: :auto) reuses an already running OpenSSH ControlMaster found via :control_path or ssh_config ControlPath, falling back to a normal connection when there is none [#443, #1057]
• Default max_win_size is now 2 MB as in OpenSSH (was 128 KB), which avoids truncated output from some devices (e.g. Mikrotik); pass max_win_size: 0x20000 for the old behaviour [#726, #1055]
• Added hmac-sha1-etm@openssh.com, offered by default after the SHA2 etm MACs as in OpenSSH [#985, #1056]
• Net::SSH::Proxy::Jump options: values may be an Array for ssh_config options that can be given more than once (IdentityFile, CertificateFile, SendEnv); each element is passed as its own -o Key=value, an empty Array passes nothing, and a nil value (alone or in an Array) raises ArgumentError as in Net::SSH.start #1052
• ssh-rsa-cert-v00@openssh.com host keys are deprecated and warn when named in host_key/HostKeyAlgorithms or negotiated; net-ssh cannot parse v00 certificates, use ssh-rsa-cert-v01@openssh.com or a modern key type #1051
• README: weak algorithms (CBC/3DES/Blowfish ciphers, ssh-dss, diffie-hellman-group1-sha1, old MACs, ...) stay available as opt-ins for legacy servers rather than being removed in 8.0 #1051
• An ssh-agent that fails while listing keys (e.g. closes the connection) is now skipped and key files are still tried, as in OpenSSH, instead of aborting authentication [#867, #1048]
• %r in a ProxyCommand now defaults to the connection's user, as in OpenSSH, instead of raising unless :remote_user is set [#881, #787, #1047]
• Net::SSH.start no longer modifies the options hash passed to it [#989, #1046]
• Session#exec! with a block now returns an empty string with exitstatus (like the non-block form) instead of nil [#848, #1045]
• ssh_config KexAlgorithms is now honoured and maps to :kex, including +, - and ^; it was previously ignored #1042
• Net::SSH::Proxy::Jump.new accepts options:, a Hash of ssh_config options passed to the jump host's ssh command as escaped -o Key=value arguments, e.g. options: { 'StrictHostKeyChecking' => 'no' } [#915, #1041]
• Net::SSH::Proxy::Jump no longer fails with "unknown key" or substitutes the target host when the config: path contains % #1041

=== 8.0.0 rc4

• Security: RSA signatures using SHA-1 (ssh-rsa, ssh-rsa-cert-v01@openssh.com) are no longer offered by default for host keys or public key authentication, as in OpenSSH since 8.8; RSA keys keep working via rsa-sha2-256/512. For servers that only support SHA-1 add HostKeyAlgorithms +ssh-rsa / PubkeyAcceptedAlgorithms +ssh-rsa in ssh_config (or host_key: '+ssh-rsa' / pubkey_algorithms: %w[+ssh-rsa]), or pass append_all_supported_algorithms: true #1039

... (truncated)

Commits

• 11d004d bump version
• 16254fe Merge GHSA-g2r2-x3p2-5677 fix: validate and escape every ProxyJump hop
• 107d7ba Add changelog fragment for GHSA-g2r2-x3p2-5677
• 74ffdfa Validate and escape every ProxyJump hop
• 4c46adb bump version
• 5df0d7f Merge pull request #1071 from net-ssh/preopen-channels
• 4ebcc0e Merge pull request #1070 from net-ssh/changelogd
• cb56b69 Add changelog fragment for #1071
• 7e4da23 Add :preopen_channels option to keep a spare session channel open
• 1e0c7a6 Add changelog fragment
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)