Skip to content

Update asyncssh requirement from >=2.24.0 to >=2.24.1 - #58

Merged
gensyn merged 1 commit into
mainfrom
dependabot/pip/asyncssh-gte-2.24.1
Oct 13, 2026
Merged

gensyn merged 1 commit into
mainfrom
dependabot/pip/asyncssh-gte-2.24.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 12, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on asyncssh to permit the latest version.

Changelog

Sourced from asyncssh's changelog.

Release 2.24.1 (3 Oct 2026)

  • Fixed a potential "short read/write" issue in SFTP, potentially requiring multiple calls to successfully read or write all the data an application requests. Thanks go to Landon Peng for reporting this issue.

  • Added protection against unreasonable packet lengths when parsing SSH and SFTP packets, avoiding a potential denial of service attack. Thanks go to zhangph (GitHub user afldl) for suggesting this change.

  • Added restrictions on which SSH channel requests are allowed to be sent more than once on a channel. Thanks go to zhangph (GitHub user afldl) for reporting this issue for shell/exec/subsystem requests.

  • Improved error reporting of a client trying to set multiple attributes on a file, when some of the operations aren't supported. Thanks go to Kevin O'Neil for reporting this issue and helping to test this fix.

  • Improved path sanitizaation for SCP, to protect against additional "path traversal" attacks. Thanks go to GitHub user jankesec for reporting the issue and providing a proposed fix.

  • Fixed a race condition in server authentication that could result in the wrong username being set as the authenticated user. Thanks go to OpenAI security team for reporting this issue and providing a suggested fix.

  • Fixed a possible leak of options across authentication attempts when multiple authentication requests are attempted on a connection. Thanks go to GitHub user 0xW41th for reporting this issue and providing a suggested fix.

  • Fixed multiple SFTP "path traversal" issues, where a malicious SFTP server could trick an SFTP client into writing outside of the requested target directory. Thanks go to Youjoon Yoon, Khizar Ali Shah, and GitHub user L1nq0 for reporting these issues and suggesting possible fixes.

  • Fixed multiple SFTP chroot escape issues, where a client could read and write files outside of a chroot'd AsyncSSH SFTP server. Thanks go to GitHub user LorenzMap, Arpit Jain, and Mario Madersbacher for reporting these issues and suggesting possible fixes.

  • Fixed revocation checking to handle the case where a host certificate is sent with a trusted CA but where the host key within the certificate is marked as revoked. Thanks go to Mohammad Thabet Hassan for reporting this issue.

... (truncated)

Commits
  • 5dbdf18 Bump version number up to 2.24.1 and update change log
  • 1c3212d Disallow empty username substitutions in config file token expansion
  • 307f093 Fix flow control issue on SSH channels
  • 6cd3357 Fix revocation check on certs signed by a trusted CA
  • ec34b9d Update pylint module size limit
  • 382ee2c Improve SCP path sanitization
  • 47cd8f4 Fix typing issue
  • 9331e97 Enhance fix for download directory escape in SFTP client
  • aee6203 Enhance protection against zero packet size in dropbear case
  • 742f091 More GSSAPI unit test improvements
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Updates the requirements on [asyncssh](https://github.com/ronf/asyncssh) to permit the latest version.
- [Changelog](https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst)
- [Commits](ronf/asyncssh@v2.24.0...v2.24.1)

---
updated-dependencies:
- dependency-name: asyncssh
  dependency-version: 2.24.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 12, 2026
@gensyn
gensyn merged commit cb0e2eb into main Oct 13, 2026
5 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/asyncssh-gte-2.24.1 branch October 13, 2026 07:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant