From 293efdba100a3b85f5305e006aaaef1b91bb6084 Mon Sep 17 00:00:00 2001
From: GeiserX <9169332+GeiserX@users.noreply.github.com>
Date: Wed, 21 Oct 2026 13:03:41 +0200
Subject: [PATCH] fix(deps): close two russh advisories by moving to 0.64.1

GHSA-4wc5-f2rc-q74m (medium): the agent protocol server allocated without bound on crafted
constraint records; fixed in 0.64.1. GHSA-j7h2-66j4-ghjf (low): the server accepted a publickey
signature made with a different algorithm than the request named; fixed in 0.64.0. russh stays on
ring with the same features, so aws-lc stays out of the graph, and its cargo vet exemption moves to
the new version.
---
 Cargo.lock               | 4 ++--
 Cargo.toml               | 2 +-
 supply-chain/config.toml | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a111384..f311cac 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4951,9 +4951,9 @@ dependencies = [
 
 [[package]]
 name = "russh"
-version = "0.63.3"
+version = "0.64.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "036204edbd199552a5b3832f63c60dcdf395dc44c7f06b4af1c0e8139cc11bce"
+checksum = "ba61e87b9ec9a39a59a6bbed4c0b8ff7fb07073405b24a767a1f2c8560ac8f58"
 dependencies = [
  "aes 0.9.1",
  "bitflags 2.13.0",
diff --git a/Cargo.toml b/Cargo.toml
index 419b86a..a66ed68 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -305,7 +305,7 @@ rand.workspace = true
 ratatui = { version = "0.30", optional = true }
 # exclude rsa to avoid https://rustsec.org/advisories/RUSTSEC-2023-0071. ring, not aws-lc-rs, is the
 # crypto backend, so aws-lc stays out of the dependency graph even with `ssh` on (deny.toml bans it).
-russh = { version = "0.63.2", optional = true, default-features = false, features = ["flate2", "ring"] }
+russh = { version = "0.64.1", optional = true, default-features = false, features = ["flate2", "ring"] }
 secrecy.workspace = true
 serde.workspace = true
 serde_json.workspace = true
diff --git a/supply-chain/config.toml b/supply-chain/config.toml
index ae4792d..35a9cfd 100644
--- a/supply-chain/config.toml
+++ b/supply-chain/config.toml
@@ -1610,7 +1610,7 @@ version = "0.2.11"
 criteria = "safe-to-deploy"
 
 [[exemptions.russh]]
-version = "0.63.3"
+version = "0.64.1"
 criteria = "safe-to-deploy"
 
 [[exemptions.russh-cryptovec]]