v2.2.3

bssh v2.2.3

A dependency-modernization and security release: both internal russh forks are synced to their latest upstream releases (bringing the current RustCrypto generation), ssh-key is unified onto a single version, and a transitive time advisory is patched.

Minimum supported Rust is now 1.88 (raised from 1.85), required by the time 0.3.47 security fix below. This affects building from source only; prebuilt binaries, Homebrew, and Debian packages are unaffected.

Security

• RUSTSEC-2026-0009 (medium, 6.8): a stack-exhaustion denial of service in time 0.3.45, pulled transitively via ratatui 0.30. Fixed by bumping time to 0.3.47 (plus num-conv and time-core); cargo audit now reports 0 vulnerabilities. Because time 0.3.47 requires Rust 1.88, the workspace MSRV is raised to 1.88, which also keeps the MSRV-aware resolver from reverting time to the vulnerable 0.3.45 (#208).

New Features

None

Improvements

• SFTP server error replies now carry a human-readable message (via russh-sftp 2.3.0's StatusReply), not just a numeric status code (#207).

Bug Fixes

None

CI/CD Improvements

• Bump action-gh-release to v3 for the Node 24 runtime.
• Adjust the download shield badge.

Technical Details

• bssh-russh synced to upstream russh 0.61.1 (from a 0.60.3 base), adopting the new RustCrypto generation: sha2/sha1 0.11, hmac 0.13, aes 0.9, cbc 0.2, ctr 0.10, digest 0.11, pbkdf2 0.13, ssh-key 0.7.0-rc.10, ssh-encoding 0.3.0-rc.9. The high-frequency PTY Handle::data() drain fix is re-ported onto the new server session loop (still absent upstream in 0.61.1, so the fork stays necessary), three now-upstreamed patches are removed, and a PTY regression test is added (#207).
• bssh-russh-sftp synced to upstream russh-sftp 2.3.0 (from 2.1.2), with the pipelined File I/O helpers re-applied and the SFTP server adapted to the new Into<StatusReply> handler API (#207).
• Fork maintenance tooling is now self-contained (create-patch.sh clones upstream; sync-upstream.sh applies all patches/*.patch), and both fork READMEs were rewritten (#207).
• Minimum supported Rust raised from 1.85 to 1.88 (declared via rust-version on the root crate and bssh-russh), required by time 0.3.47.

Dependencies

• Internal forks: bssh-russh 0.60.3 to 0.61.1 and bssh-russh-sftp 2.1.2 to 2.3.0, both published to crates.io.
• ssh-key unified to a single =0.7.0-rc.10; argon2 gains its std feature.
• time 0.3.45 to 0.3.47 (security, see above).

Breaking Changes

• Minimum supported Rust is now 1.88 (was 1.85). This affects building bssh from source only; prebuilt release binaries, Homebrew, and Debian packages are unaffected.

Known Issues

None

What's Changed

• update: sync russh/russh-sftp forks to upstream and unify ssh-key by @inureyes in #207
• fix: bump time to 0.3.47 for RUSTSEC-2026-0009 by @inureyes in #208

Full Changelog: v2.2.2...v2.2.3