Version 0.004 - Official CPAN release

0.004 2026-09-20T18:38:02Z
 [SECURITY: connect() now verifies the server host key against known_hosts (CWE-322, reported privately via CPANSec). Previously strict_hostkeycheck was passed to libssh but ssh_session_is_known_server() was never consulted, so any server -- including a man-in-the-middle -- was accepted silently. With the default strict_hostkeycheck => 1, connect() now returns 0 with error() naming the problem when the host key is unknown, changed, of a different type, or known_hosts cannot be read; the session is disconnected and stays spent. strict_hostkeycheck => 0 disables the check entirely, as documented. Users who relied on the default and never populated known_hosts must add the host key (e.g. via ssh-keyscan) or set strict_hostkeycheck => 0 explicitly]
SHA256 hash of CPAN release

fedb4261bc0bbda574ba66f4cc86f45e56e7370d01e4a2739fb766eeaf799c8d *Net-LibSSH-0.004.tar.gz

Version 0.003 - Official CPAN release

0.003 2026-09-01T00:06:26Z
 [SFTP integration test now stats /etc/passwd instead of /etc/hostname, so it passes on FreeBSD smokers where /etc/hostname does not exist (GH #1)]
 [connect() on a session that has already been disconnected now returns 0 immediately, with error() saying the session was disconnected and cannot be reconnected — instead of waiting out the connection timeout for libssh's misleading "Timeout connecting to ..."; disconnect() on a session that was never connected still leaves it connectable]
 [Channel methods (exec, read, write, send_eof, eof, exit_status) now croak instead of operating on a closed channel; close() stays idempotent]
 [Fix segfault when a channel or SFTP session is used after the session variable it was opened on has been undef-ed or reassigned; the session now stays alive until the last object opened on it is gone]
 [Fix segfault when a channel or SFTP session is used, or merely dropped, after disconnect(); ssh_disconnect() frees those objects inside libssh, so they are now invalidated instead of left dangling. Their methods croak with "session was disconnected", close() on such a channel stays a harmless no-op, and nothing is leaked on the way]
SHA256 hash of CPAN release

ad7f5e4db65c0bf30f0232c720fb7129a626c1f24e76c95b2f9abef15846d410 *Net-LibSSH-0.003.tar.gz