QRun-IO/qbit-file-gateway
3
0 Fork 0
Code Issues 1 Pull Requests 3 Actions Packages Projects Releases 6 Wiki Activity

build(deps): Bump the maven-minor-and-patch group across 1 directory with 7 updates #23

Open
dependabot[bot] wants to merge 1 commits from dependabot/maven/develop/maven-minor-and-patch-15df832370 into develop
pull from: dependabot/maven/develop/maven-minor-and-patch-15df832370
merge into: QRun-IO:develop
Conversation 1 Commits 1 Files Changed 3
+195 -195
dependabot[bot] commented 2026-10-21 03:54:40 +00:00 (Migrated from github.com)
Copy link
Copy source

Bumps the maven-minor-and-patch group with 7 updates in the / directory:

Package From To
com.kingsrook:qbit-build-parent 2.0.0 2.1.2
org.bouncycastle:bcpg-jdk18on 1.84 1.86
org.apache.sshd:sshd-core 2.16.0 2.20.0
org.apache.sshd:sshd-sftp 2.16.0 2.20.0
org.apache.sshd:sshd-sftp 2.16.0 2.20.0
com.h2database:h2 2.2.224 2.5.252
org.apache.maven.plugins:maven-checkstyle-plugin 3.3.1 3.6.0
org.apache.maven:apache-maven 3.9.11 3.10.0

Updates com.kingsrook:qbit-build-parent from 2.0.0 to 2.1.2

Release notes

Sourced from com.kingsrook:qbit-build-parent's releases.

Build Parent and Guardrails 2.1.2

com.kingsrook:qbit-build-parent:2.1.2 and com.kingsrook:qbit-guardrails:2.1.2 are published to Maven Central from the signed tag v2.1.2 on main 1630c83.

  • G1 default allow-lists now include qbit-assistant's provider SPI package (com.kingsrook.qbits.assistant.spi), so qbits can depend on the provider API without per-repo allow-list entries (#13).

This is a patch release with no other changes since 2.1.1.

Build Parent and Guardrails 2.1.1

com.kingsrook:qbit-build-parent:2.1.1 and com.kingsrook:qbit-guardrails:2.1.1 are published to Maven Central from the signed tag v2.1.1 on main 699c457.

  • G1 default allow-lists now include qbit-email and its public api package, so qbits can depend on qbit-email without per-repo allow-list entries (#12).

Patch release; no other changes from 2.1.0.

Build Parent and Guardrails 2.1.0

com.kingsrook:qbit-build-parent:2.1.0 and the new com.kingsrook:qbit-guardrails:2.1.0 are published to Maven Central from the signed tag v2.1.0 on main 67fa618 (#10, closes #9).

  • Architecture guardrails G1, G2, G3, G4 and G7 (from QRun-IO/qqq#1150, section 5) ship as qbit-guardrails, an ArchUnit-based test jar with no QQQ dependency. G5 (no HTML widgets) waits for core typed widgets (qqq#1151).
  • The parent turns them on: a qbit-guardrails profile, active unless -Dqbit.guardrails.skip=true, runs the *GuardrailTest classes inside each qbit's surefire run and the enforcer at validate.
  • Report-first: every rule only reports by default, so adopting 2.1.0 doesn't break existing qbits.

Use com.kingsrook:qbit-build-parent:2.1.0 as the Maven parent to adopt them. See the README.

Commits
  • 1630c83 Merge pull request #13 from QRun-IO/feature/assistant-spi-allowlist
  • 00c6f1b feat(guardrails): allow qbit-assistant's provider SPI by default
  • b42f4f3 Bump version to 2.1.1 [skip ci]
  • 699c457 Merge pull request #12 from QRun-IO/feature/email-api-allowlist
  • 574a169 ci: re-run after a ChromeDriver install flake
  • 0f54482 feat(guardrails): allow qbit-email's published API by default
  • 736b796 Merge pull request #11 from QRun-IO/feature/ga-only-tag-filter-main
  • a4035aa ci: fix regex escaping in the GA tag filter
  • 52706aa ci: publish_release only on GA tags (port of #7 to main)
  • 67fa618 Merge pull request #10 from QRun-IO/feature/architecture-guardrails
  • Additional commits viewable in compare view

Updates org.bouncycastle:bcpg-jdk18on from 1.84 to 1.86

Changelog

Sourced from org.bouncycastle:bcpg-jdk18on's changelog.

Bouncy Castle Crypto Package - Release Notes

1.0 Introduction

The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the J2ME) with the additional infrastructure to conform the algorithms to the JCE framework.

2.0 Release History

2.1.1 Version

Release: 1.87
Date: 2026, TBD

2.1.2 Defects Fixed

  • X500Name.equals compared two names that are equal but not byte-identical - the same RDNs in another order, or in another string type - by searching the second name for each RDN of the first and canonicalising both values on every candidate comparison, so the comparison was quadratic in the number of RDNs, and CMSSignedData.getSignerInfos(), the CMSEnvelopedData, CMSAuthEnvelopedData and CMSEnvelopedDataParser constructors, TimeStampToken, the S/MIME classes built on them and X509CertificateHolderSelector.match() all compare names taken from the message before anything in it is verified: a 1.1 MB signed or enveloped message carrying two 40,000 RDN issuer names took about 90 seconds of CPU to parse. The signer and recipient stores also indexed their entries in a HashMap keyed on the signer or recipient id, whose hash code is easy to make collide, so a message with 16,000 signers or recipients chosen to collide took several seconds to index. AbstractX500NameStyle.areEqual now compares the RDNs positionally and otherwise sorts the canonical form of each RDN once and compares the two multisets, so a comparison is n log n in the number of RDNs, the two stores now scan their entries on lookup instead of indexing them, and the selector checks the serial number before the issuer name.
  • The hash code of an ASN.1 object is a short fold over its content octets that a sender can make collide at will, and several tables built while a message is parsed were keyed on one: the extension table behind Extensions, so every certificate, CRL, OCSP and timestamp request parse, the deprecated X509Extensions, ExtendedKeyUsage, the CMS AttributeTable built from a SignerInfo's signed and unsigned attributes (the unsigned ones lying outside the signature), the EST CSRAttributesResponse index, and the Set of digest AlgorithmIdentifiers that the CMSSignedDataParser constructor and CMSSignedData.getDigestAlgorithmIDs() build from the SignedData digestAlgorithms field. With every key sharing one hash code each insert scanned all those before it, so a 6 MB certificate or message holding 65,000 such entries took about 35 seconds of CPU to parse and the parser's digest algorithm set about 140 seconds. Those tables are now ordered maps keyed on the OID's string form and the digest algorithm sets are ordered on the identifier's DER encoding, so each is n log n in the number of entries whatever their hash codes. AttributeTable.add() and remove() also no longer share a multi-valued entry's Vector with the table they were derived from.
  • CMSSignedData digested the encapsulated or detached content once for every signer it verified, so a message carrying many SignerInfos over a large content cost their product in digesting before any signature was checked, where CMSSignedDataParser digests once per algorithm named in the digestAlgorithms field. The signers of a CMSSignedData now share the content digests computed under each digest algorithm identifier, so signers using the same algorithm digest the content once. The new org.bouncycastle.cms.max_digest_algorithms property bounds the number of distinct digest algorithms either class will compute over one message's content, each algorithm past the limit raising a CMSException; it is unlimited unless set.
  • The verify side of the ML-DSA-CALCULATE-MU signature service, and MLDSASigner.verifyMu beneath it, compared the supplied mu with a value derived from the key's tr and the context alone, never absorbing the message passed to update(), so a correct mu was accepted only for an empty message and rejected for every other, while the sign side of the same service computed mu correctly. The comparison also finalised the engine's shared digest, so an ordinary verifySignature on the same MLDSASigner afterwards failed for a valid signature, and a mu of the wrong length escaped Signature.verify() as an unchecked DataLengthException. verifyMu now derives the expected mu from the message digest exactly as generateMu does and compares in constant time, the signer stays usable afterwards, the service answers a wrong-length mu with a SignatureException, and the contract - the verify side accepts exactly the mu the sign side returns for the same key, context and data - is now in the javadoc of both.
  • The SM2 key pair generator of the BC provider, KeyPairGenerator.getInstance("SM2", "BC"), was built on the generic EC key pair generator rather than the lightweight SM2KeyPairGenerator the 1.73 release notes described, so it could draw a private key of n - 1, which Section 6.1 of GB/T 32918.1 excludes and which the SM2 signer rejects. It now uses SM2KeyPairGenerator and draws from [1, n - 2].
  • ESTResponse added each header line of an EST server's response to its header table by copying that header's value array, so a response repeating one header many times was quadratic to parse - about 7 seconds of CPU per megabyte of header lines - and a read limit set through JsseESTServiceBuilder.withReadLimit() only applied once the header block had been read. The values of each header are now collected once, and the header block counts against the read limit of the source.
  • The C509 encoding of an RFC 6955 proof-of-possession value (the sa-ecdhPop signature algorithms, values 14 to 16 of the C509 Signature Algorithms Registry) copied the DER DhSigStatic into the signature value byte string, where Section 4.2 of draft-ietf-cose-cbor-encoded-cert-21 defines the value as the bare hashValue when the DhSigStatic names no issuer and serial number and as the [issuer, certificateSerialNumber, hashValue] array when it does. The converter now produces both forms from the DER and reconstructs the DER from either; previously the array form was rejected outright and the byte-string form reconstructed a signature value four bytes short of the DER it came from, so a type 3 request carrying one could not verify. The privateKeyPossessionStatement certification request attribute (RFC 9883, Section 4.3.3 of the draft) was carried in the generic ~oid form on conversion and refused on reconstruction; it is now converted to and from its int-coded [issuer, certificateSerialNumber, cert] form, with an embedded signature certificate re-encoded as a type 3 C509 certificate. The certificate, certification request and template vectors of draft-ietf-cose-c509-test-vectors-02 now drive the util and pkix test suites.
  • The DANE SMIMEA support in org.bouncycastle.cert.dane had three defects. JndiDANEFetcherFactory, when asked for every entry under a bare domain name, removed the first and last characters of the owner name the JNDI DNS provider reports for each listed record, assuming a quoted name; the provider returns the name unquoted with a trailing root dot, so the first hex digit of the hash label was lost and the lookup that followed could never find the record. It now removes only the root dot. DANEEntryStore kept one entry per owner name, so an address with more than one SMIMEA record (a signing and an encryption certificate, say) only ever showed its last; every entry is now kept. DANEEntrySelectorFactory split an address at its first '@', mis-handling a quoted local-part containing one, and threw StringIndexOutOfBoundsException rather than DANEException for an address with none; it now splits at the last '@', removes enclosing quotes and backslash quoting from the local-part before hashing as RFC 8162 sec. 3 describes, and rejects an address with no '@'. The DANEEntry(String, byte[]) constructor also now rejects, with an IOException, a record whose flags do not describe a full certificate entry rather than parsing whatever follows the flags as a certificate.
  • TimeStampToken accepted a token whose signing-time signed attribute disagreed with the genTime in its TSTInfo. Both are the TSA's statement of when the token was produced, and the disagreement is what distinguishes an RFC 3161 token from a signature a TSA has put over a supplied TSTInfo through another service using the same key, such as a legacy countersignature endpoint, which some TSAs still offer. The constructor now rejects a token whose signing-time, when present, is further from genTime than the token's accuracy plus one minute; the check can be switched off with the org.bouncycastle.tsp.allow_inconsistent_signing_time property. TimeStampTokenGenerator now sets a signing-time attribute from the genTime it is given rather than the clock, so its tokens are consistent whatever genTime is passed.
  • TimeStampToken.validate() accepted a token whose message imprint was calculated with MD5, for which collisions can be computed, and TSPAlgorithms.ALLOWED, the set the request side is typically checked against, included MD5. MD5 has been removed from TSPAlgorithms.ALLOWED, and validate() now rejects a token whose imprint algorithm is not in it (failure code badAlg). The new TSPAlgorithms.LEGACY is ALLOWED plus MD5; validate(SignerInformationVerifier, Set) takes the set of acceptable imprint algorithms, and the org.bouncycastle.tsp.allowed_imprint_algorithms property, a comma separated list of digest names or OIDs, replaces ALLOWED as the default for validate(SignerInformationVerifier). TSPAlgorithms.ALLOWED and LEGACY are now unmodifiable.
  • CRL-based revocation checking (the PKIX CertPathValidator and the pkix X509RevocationChecker) tracked a CRL entry's reasonCode in the same field as its own status markers and did not range-check it, so a CRL entry whose reasonCode was outside the RFC 5280 sec. 5.3.1 set was mishandled: 11 left the certificate unrevoked, other out-of-range values threw an unchecked exception out of validation. The revocation date and the reason code are now kept separately; an undefined reasonCode is processed as unspecified and reported as "(unknown code: N)".
  • OERDefinition.enumItem(label, value) discarded the explicit enumerand value: Builder.enumValue() set it on the builder it had just copied and returned the copy without it, so every item was numbered by its position in the definition instead. The value is now kept, and the items without one are numbered as X.680 sec. 20.3 and 20.6 specify: a root item takes the successive integers from 0, skipping any explicit root number, and an extension item takes the smallest value not defined in the root and greater than every preceding extension item (the old loop restarted its count after an explicit number, so an explicit 0 followed by an unnumbered item was a duplicate). The three ETSI TS 102 941 response-code definitions that use explicit values give "ok" the value 0 at position 0, so their encodings are unchanged.
  • OERInputStream read the two length-prefixed INTEGER forms and BIT STRING with Streams.readFully and did not check its best-effort return, so a stream that ended inside the value decoded the zero-padded buffer as a value rather than failing. Every length-driven read in the decoder now goes through Streams.readLenBytesFully, which fails with EOFException at the real end of input and, for a long length, does not allocate the full array until the stream has delivered a fair part of it - so a hostile length that is within the decoder's allocation cap, or a cap a caller has raised, cannot drive a large allocation from a short input.
  • The OER codec gave a signed INTEGER whose upper bound is exactly the maximum of a fixed-size word the next word up: X.696 sec. 10.4 a)-d) make both bounds inclusive, but the upper-bound comparison was strict, so INTEGER (-128..127) was a two-octet word rather than one, and likewise at the 16-, 32- and 64-bit boundaries. The two signed ranges shipped with the library, NinetyDegreeInt and OneEightyDegreeInt, lie inside the four-octet word and are unaffected.
  • The ETSI TS 102 941 response code wrappers AuthorizationResponseCode, AuthorizationValidationResponseCode and EnrolmentResponseCode checked their range on BigInteger.intValue(), which truncates, so a value past the int range whose low 32 bits were in range was accepted - 2^32 as "ok". The check now rejects a negative value or one over 31 bits before consulting intValue().
  • OERInputStream accepted an empty group of octets as the value zero in four places where X.696 requires at least one: a variable-size INTEGER with a length determinant of 0 (sec. 3.7.11 and 3.7.12 define the number forms as one or more octets), an ENUMERATED long form with 0 subsequent octets (sec. 11.4 says 1 to 127), a length determinant long form with 0 subsequent octets (sec. 8.6.5, likewise) and a sequence-of quantity of 0 octets (sec. 17.2). Each now fails with an IOException; the one-octet encodings of zero decode as before.
  • OEROutputStream could not encode a CHOICE whose chosen alternative has a tag number of 63 or more. X.696 sec. 8.7.2.2 keeps a tag number below 63 in the first octet and sec. 8.7.2.3 continues one of 63 or more in 7-bit groups, most significant first, with bit 8 as the continuation flag; the encoder used the single octet up to and including 63, so 63 went out as the continuation escape with nothing after it, and BitBuilder.write7BitBytes took its groups from bit 31 downward rather than from the low end, so 63 encoded as 83 78, which decodes as 504. Both forms of write7BitBytes now write the fewest 7-bit groups of the value, and the boundary is at 63. No CHOICE in the shipped ITS definitions has that many alternatives.
  • OEROutputStream rejected a required SEQUENCE component as absent whenever it arrived wrapped in an OEROptional, the form the ITS classes' toASN1Primitive methods produce for present values, rather than only when the wrapper is the undefined ABSENT. A defined wrapper at a required position is now unwrapped and written like the bare value.
  • OERInputStream, for an absent optional SEQUENCE component selected through a switch, tested the selected alternative for a default value but then took the default from the switch itself, which has none, so the alternative's default was added as null and the decode failed with NullPointerException. The default now comes from the selected alternative. No definition shipped with the library has a switched component with a default.
  • OERInputStream read a SEQUENCE OF count through BigInteger.intValue(), which keeps only the low 32 bits, so a count of 2^32 + 3 decoded as 3 elements and the rest of the input was left in place for the next field. A count that does not fit in 31 bits is now rejected as out of range, and the fixed sizes taken from a definition go through BigIntegers.intValueExact() rather than silently truncating.
  • OERInputStream rejected a valid SEQUENCE OF as "out of range" on any stream whose available() reported fewer bytes than the element count: available() is an estimate of what can be read without blocking, 0 from the base InputStream and from wrappers such as CipherInputStream, and the decoder had been using it as a bound on the count. The count is now bounded by the decoder's allocation ceiling (maxByteAllocation, 1 MiB by default) instead, and a count within it over a short input fails at the first element that is not there.
  • OERInputStream could not decode a variable-size BIT STRING. X.696 sec. 13.3 encodes one as a length determinant covering an initial octet, which gives the number of unused bits in the final octet, and the octets of the value, which is what OEROutputStream writes; the decoder read the determinant as a bit count, divided it by 8 and never read the initial octet, so it took no data at all for a two-octet value, and a stray third branch keyed on a negative size bound threw NullPointerException for an unbounded schema. The decoder now has the two forms of clause 13: a fixed size reads the whole octets the size occupies and derives the unused bits from it (a 12-bit string is two octets with four unused bits, where it was one octet), and any other size reads the determinant, the initial octet (rejected over 7, or non-zero for an empty value, 13.3.4) and the data, carrying the unused-bit count into the DERBitString. OERDefinition gains bitString() and bitString(lower, upper) alongside bitString(size). The single BIT STRING in the shipped ITS definitions is a fixed 8 bits and decodes as before.
  • OEROutputStream wrote a negative INTEGER value under a type whose lower bound is zero or more through the unsigned encodings, so it went out as a different, positive value: -1 under INTEGER (0..255) as FF, the encoding of 255, and under INTEGER (0..MAX) as 01 FF. A negative value is now rejected with IllegalArgumentException on both unsigned paths.
  • OERInputStream.uint64() read its eight octets as a signed number, so a value with the top bit set came back negative; the other uintN readers were unsigned. It now reads unsigned.
  • The OER codec treated an INTEGER with a positive lower bound as signed. X.696 sec. 10.2 a) gives the unsigned encodings to an integer whose lower bound is zero or positive; OERInputStream and OEROutputStream tested for a lower bound of exactly zero, so INTEGER (1..255) went out as a two-octet signed word rather than one unsigned octet and INTEGER (1..MAX) as a variable-size signed number, where 128 is 00 80 rather than 80. No OER definition shipped with the library puts a positive lower bound on an INTEGER.
  • The OER codec encoded and decoded a negative ENUMERATED value wrongly. X.696 sec. 11.4 reserves the one-octet short form for the values 0 to 127 and puts every other value, negative ones included, in the long form as a two's-complement signed integer; OEROutputStream chose the long form only for values above 127, so a negative value went out in the short form masked to seven bits (-1 as 7F, the encoding of 127), and OERInputStream read a long-form value as unsigned (81 FF, the encoding of -1, as 255). Both now follow sec. 11.4. No OER definition shipped with the library declares a negative enumerand.
  • ASN1Enumerated rejected negative values, although an ENUMERATED is an integer (X.680 sec. 20) and may be negative: the int and BigInteger constructors threw "enumerated must be non-negative", the byte array constructor rejected a leading sign bit, and a parsed ENUMERATED with a negative value failed to decode. The checks are removed, ASN1Enumerated gains isNegative() and longValueExact() alongside the existing intValueExact(), and a zero-length ENUMERATED is now reported as "malformed enumerated", as a zero-length INTEGER is reported as "malformed integer", rather than "ENUMERATED has zero length". ASN1Enumerated.valueOf(int) and valueOf(long) return shared instances for the values 0 to 15, as ASN1Integer.valueOf() does, and a parsed single-byte ENUMERATED in that range is returned as the shared instance.
  • A PBEKey stored in a BCFKS KeyStore was not reported as a key entry: isKeyEntry() returned false for it, so KeyStore.getEntry() returned null rather than a SecretKeyEntry, although getKey() recovered it. The PBE key entry type added for github #2164 was missing from engineIsKeyEntry, and is now included.
  • The CMS content-type decoders SignedData, EnvelopedData, AuthenticatedData, AuthEnvelopedData and EncryptedData read their mandatory fields by index or enumeration with no lower-bound size check, so a ContentInfo whose inner content was an empty or too-short SEQUENCE - malformed but DER-parseable - left the decode as an unchecked NoSuchElementException or ArrayIndexOutOfBoundsException rather than the CMSException the CMSSignedData, CMSEnvelopedData, CMSAuthenticatedData and CMSAuthEnvelopedData constructors declare (the IllegalArgumentException CMSEncryptedData documents). Each now rejects a short sequence with IllegalArgumentException before reading, as the sibling content types CompressedData and DigestedData already did, so the wrappers surface it as their declared exception; the case that claims an OPTIONAL field and then truncates the mandatory ones after it is covered too. The streaming parsers CMSSignedDataParser, CMSEnvelopedDataParser, CMSAuthenticatedDataParser, CMSAuthEnvelopedDataParser and CMSCompressedDataParser had the same gap and more: an absent or truncated inner SEQUENCE, a mandatory field of the wrong type, or absent encapsulated or encrypted content escaped as NullPointerException, ClassCastException, IllegalArgumentException or IllegalStateException. The asn1.cms stream parsers now report a missing mandatory field as an IOException, and the CMS parsers report malformed content as CMSException ("Malformed content." / "Missing content.") or the IOException they declare.
  • A KeyAgreement asked for its shared secret before doPhase returned data rather than refusing. javax.crypto.KeyAgreement specifies IllegalStateException for that state, but nothing in the provider tracked it, so each SPI handed back whatever its result field held: for Diffie-Hellman that was the private value itself - engineInit seeded result with x, so generateSecret() returned the private exponent padded to the prime's length and generateSecret("AES") an all-zero key taken from that padding - while ECDH returned null and its named-algorithm overload raised NullPointerException. BaseAgreementSpi now records whether a doPhase has completed the agreement since the last init and refuses the request with an IllegalStateException naming the algorithm, so every family in the provider - DH, ECDH and ECMQV, the SM2 exchange, both ECGOST families, XDH, SM9 and NewHope - answers the same way, and the DH SPI no longer holds the private value in that field at all.
  • Mac.getInstance and KeyGenerator.getInstance by the HMAC SHA-512/224 and SHA-512/256 object identifiers (1.2.840.113549.2.12 and .13) failed, although the same algorithms resolved by name and the matching SecretKeyFactory aliases were registered: the SHA512 mappings called addHMACAlgorithm for the two truncated variants without the addHMACAlias that registers their OIDs against Mac and KeyGenerator. Both are now aliased, as every other HMAC in that class already was.
  • A KTSParameterSpec naming an HKDF key-derivation function with a parameters field - a form the provider does not service - was accepted at Cipher init and then failed out of wrap or unwrap with an unchecked IllegalStateException neither method declares. The KTS key-wrapping Ciphers (ML-KEM, Classic McEliece, FrodoKEM, the composite KEM and RSA-KEM) now validate the spec's KDF when they take it, reporting an unserviceable one as the InvalidAlgorithmParameterException engineInit declares, which is what the javax.crypto.KEM services already did through KdfUtil.resolveKemSpec.
  • A DTLS handshake deadlocked when a handshake message ahead of the peer's ChangeCipherSpec (a client's CertificateVerify, say) was lost while the ChangeCipherSpec and Finished behind it arrived: the record layer moved its read epoch on at the ChangeCipherSpec and then discarded every retransmission of the lost message as belonging to the old epoch, whose records are only accepted once the handshake has completed. Each side then waited on the other until a handshake timeout, if one was configured, ended it. Every client-authenticated handshake, and every handshake in which the server issues a NewSessionTicket, was exposed. Until the handshake completes, handshake records from the current epoch are now still accepted after the read epoch has moved on, and each message is checked against the epoch of the record that carried it. The DTLS loopback tests now run their handshakes at 10% datagram loss in each direction, with a client-authenticated handshake at 25%.

... (truncated)

Commits

Updates org.apache.sshd:sshd-core from 2.16.0 to 2.20.0

Release notes

Sourced from org.apache.sshd:sshd-core's releases.

Apache MINA SSHD 2.20.0

Bug Fixes

  • GH-656 ChannelPipedInputStream: shrink buffer when emptied
  • GH-906 Fix finding a signature factory for BC ed25519 keys
  • GH-911 Fix server-side SOCKS5 proxy for fragmented and pipelined CONNECT requests
  • More checks in authentication (server-side)

Security fixes

New Features

  • GH-905 Implement the "from" and "expiry-time" options in authorized_keys handling in public key authentication (server side)

Potential Compatibility Issues

None.

Major Code Re-factoring

None.

Apache MINA SSHD 2.19.0

Bug Fixes

  • GH-899 Fix ProcessShellFactory on Linux
  • GH-902 Fix client-side handling of sk-* public key signatures (also in the agent interfaces)
  • Limit size of decompressed SSH packets
  • Escape newlines in filenames in the SCP protocol

Security Fixes

Potential Compatibility Issues

Restrict JGit commands accessible via GitPgmCommandFactory in sshd-git

... (truncated)

Changelog

Sourced from org.apache.sshd:sshd-core's changelog.

Previous Versions

Latest Version

Planned for Next Version

Bug Fixes

  • Fixed a race condition in key exchanges
  • GH-925 Re-allow "none" authentication (regression in 2.20.0)

New Features

  • GH-904 Log local port in ClientSessionImpl.toString() to be able to distinguish multiple sessions to the same host in logs

Potential Compatibility Issues

Major Code Re-factoring

Commits
  • 2221feb [maven-release-plugin] prepare release sshd-2.20.0
  • daa4002 Prepare release documentation
  • 0b41c6f Format PublickeyAuthenticator
  • cea7e24 Bump BC-FIPS test dependencies
  • 1c97396 Update CHANGES.md
  • 602896f PublicKeyAuthenticator.authenticate(): remove AsyncAuthException
  • 53b57ce Bump Bouncy Castle 1.85 -> 1.86
  • acc0f1e Fix LDAP authentication
  • f4f562c Fix check-file-name/check-file-handle SFTP v6 extension
  • 53bce94 DefaultSftpClient: simplify SFTP message handling
  • Additional commits viewable in compare view

Updates org.apache.sshd:sshd-sftp from 2.16.0 to 2.20.0

Release notes

Sourced from org.apache.sshd:sshd-sftp's releases.

Apache MINA SSHD 2.20.0

Bug Fixes

  • GH-656 ChannelPipedInputStream: shrink buffer when emptied
  • GH-906 Fix finding a signature factory for BC ed25519 keys
  • GH-911 Fix server-side SOCKS5 proxy for fragmented and pipelined CONNECT requests
  • More checks in authentication (server-side)

Security fixes

New Features

  • GH-905 Implement the "from" and "expiry-time" options in authorized_keys handling in public key authentication (server side)

Potential Compatibility Issues

None.

Major Code Re-factoring

None.

Apache MINA SSHD 2.19.0

Bug Fixes

  • GH-899 Fix ProcessShellFactory on Linux
  • GH-902 Fix client-side handling of sk-* public key signatures (also in the agent interfaces)
  • Limit size of decompressed SSH packets
  • Escape newlines in filenames in the SCP protocol

Security Fixes

Potential Compatibility Issues

Restrict JGit commands accessible via GitPgmCommandFactory in sshd-git

... (truncated)

Changelog

Sourced from org.apache.sshd:sshd-sftp's changelog.

Previous Versions

Latest Version

Planned for Next Version

Bug Fixes

  • Fixed a race condition in key exchanges
  • GH-925 Re-allow "none" authentication (regression in 2.20.0)

New Features

  • GH-904 Log local port in ClientSessionImpl.toString() to be able to distinguish multiple sessions to the same host in logs

Potential Compatibility Issues

Major Code Re-factoring

Commits
  • 2221feb [maven-release-plugin] prepare release sshd-2.20.0
  • daa4002 Prepare release documentation
  • 0b41c6f Format PublickeyAuthenticator
  • cea7e24 Bump BC-FIPS test dependencies
  • 1c97396 Update CHANGES.md
  • 602896f PublicKeyAuthenticator.authenticate(): remove AsyncAuthException
  • 53b57ce Bump Bouncy Castle 1.85 -> 1.86
  • acc0f1e Fix LDAP authentication
  • f4f562c Fix check-file-name/check-file-handle SFTP v6 extension
  • 53bce94 DefaultSftpClient: simplify SFTP message handling
  • Additional commits viewable in compare view

Updates org.apache.sshd:sshd-sftp from 2.16.0 to 2.20.0

Release notes

Sourced from org.apache.sshd:sshd-sftp's releases.

Apache MINA SSHD 2.20.0

Bug Fixes

  • GH-656 ChannelPipedInputStream: shrink buffer when emptied
  • GH-906 Fix finding a signature factory for BC ed25519 keys
  • GH-911 Fix server-side SOCKS5 proxy for fragmented and pipelined CONNECT requests
  • More checks in authentication (server-side)

Security fixes

New Features

  • GH-905 Implement the "from" and "expiry-time" options in authorized_keys handling in public key authentication (server side)

Potential Compatibility Issues

None.

Major Code Re-factoring

None.

Apache MINA SSHD 2.19.0

Bug Fixes

  • GH-899 Fix ProcessShellFactory on Linux
  • GH-902 Fix client-side handling of sk-* public key signatures (also in the agent interfaces)
  • Limit size of decompressed SSH packets
  • Escape newlines in filenames in the SCP protocol

Security Fixes

Potential Compatibility Issues

Restrict JGit commands accessible via GitPgmCommandFactory in sshd-git

... (truncated)

Changelog

Sourced from org.apache.sshd:sshd-sftp's changelog.

Previous Versions

Latest Version

Planned for Next Version

Bug Fixes

  • Fixed a race condition in key exchanges
  • GH-925 Re-allow "none" authentication (regression in 2.20.0)

New Features

  • GH-904 Log local port in ClientSessionImpl.toString() to be able to distinguish multiple sessions to the same host in logs

Potential Compatibility Issues

Major Code Re-factoring

Commits
  • 2221feb [maven-release-plugin] prepare release sshd-2.20.0
  • daa4002 Prepare release documentation
  • 0b41c6f Format PublickeyAuthenticator
  • cea7e24 Bump BC-FIPS test dependencies
  • 1c97396 Update CHANGES.md
  • 602896f PublicKeyAuthenticator.authenticate(): remove AsyncAuthException
  • 53b57ce Bump Bouncy Castle 1.85 -> 1.86
  • acc0f1e Fix LDAP authentication
  • f4f562c Fix check-file-name/check-file-handle SFTP v6 extension
  • 53bce94 DefaultSftpClient: simplify SFTP message handling
  • Additional commits viewable in compare view

Updates com.h2database:h2 from 2.2.224 to 2.5.252

Release notes

Sourced from com.h2database:h2's releases.

Version 2.5.252

version-2.5.250

... (truncated)

Commits
Bumps the maven-minor-and-patch group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [com.kingsrook:qbit-build-parent](https://github.com/Kingsrook/qbit-bom) | `2.0.0` | `2.1.2` | | [org.bouncycastle:bcpg-jdk18on](https://github.com/bcgit/bc-java) | `1.84` | `1.86` | | [org.apache.sshd:sshd-core](https://github.com/apache/mina-sshd) | `2.16.0` | `2.20.0` | | [org.apache.sshd:sshd-sftp](https://github.com/apache/mina-sshd) | `2.16.0` | `2.20.0` | | [org.apache.sshd:sshd-sftp](https://github.com/apache/mina-sshd) | `2.16.0` | `2.20.0` | | [com.h2database:h2](https://github.com/h2database/h2database) | `2.2.224` | `2.5.252` | | [org.apache.maven.plugins:maven-checkstyle-plugin](https://github.com/apache/maven-checkstyle-plugin) | `3.3.1` | `3.6.0` | | org.apache.maven:apache-maven | `3.9.11` | `3.10.0` | Updates `com.kingsrook:qbit-build-parent` from 2.0.0 to 2.1.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Kingsrook/qbit-bom/releases">com.kingsrook:qbit-build-parent's releases</a>.</em></p> <blockquote> <h2>Build Parent and Guardrails 2.1.2</h2> <p><code>com.kingsrook:qbit-build-parent:2.1.2</code> and <code>com.kingsrook:qbit-guardrails:2.1.2</code> are published to Maven Central from the signed tag <code>v2.1.2</code> on main <code>1630c83</code>.</p> <ul> <li><strong>G1 default allow-lists</strong> now include qbit-assistant's provider SPI package (<code>com.kingsrook.qbits.assistant.spi</code>), so qbits can depend on the provider API without per-repo allow-list entries (<a href="https://redirect.github.com/QRun-IO/qbit-bom/pull/13">#13</a>).</li> </ul> <p>This is a patch release with no other changes since 2.1.1.</p> <h2>Build Parent and Guardrails 2.1.1</h2> <p><code>com.kingsrook:qbit-build-parent:2.1.1</code> and <code>com.kingsrook:qbit-guardrails:2.1.1</code> are published to Maven Central from the signed tag <code>v2.1.1</code> on main <code>699c457</code>.</p> <ul> <li><strong>G1 default allow-lists</strong> now include qbit-email and its public api package, so qbits can depend on <code>qbit-email</code> without per-repo allow-list entries (<a href="https://redirect.github.com/QRun-IO/qbit-bom/pull/12">#12</a>).</li> </ul> <p>Patch release; no other changes from 2.1.0.</p> <h2>Build Parent and Guardrails 2.1.0</h2> <p><code>com.kingsrook:qbit-build-parent:2.1.0</code> and the new <code>com.kingsrook:qbit-guardrails:2.1.0</code> are published to Maven Central from the signed tag <code>v2.1.0</code> on main <code>67fa618</code> (<a href="https://redirect.github.com/QRun-IO/qbit-bom/pull/10">#10</a>, closes <a href="https://redirect.github.com/Kingsrook/qbit-bom/issues/9">#9</a>).</p> <ul> <li><strong>Architecture guardrails G1, G2, G3, G4 and G7</strong> (from <a href="https://redirect.github.com/QRun-IO/qqq/issues/1150">QRun-IO/qqq#1150</a>, section 5) ship as <code>qbit-guardrails</code>, an ArchUnit-based test jar with no QQQ dependency. G5 (no HTML widgets) waits for core typed widgets (qqq#1151).</li> <li><strong>The parent turns them on:</strong> a <code>qbit-guardrails</code> profile, active unless <code>-Dqbit.guardrails.skip=true</code>, runs the <code>*GuardrailTest</code> classes inside each qbit's surefire run and the enforcer at <code>validate</code>.</li> <li><strong>Report-first:</strong> every rule only reports by default, so adopting 2.1.0 doesn't break existing qbits.</li> </ul> <p>Use <code>com.kingsrook:qbit-build-parent:2.1.0</code> as the Maven parent to adopt them. See the <a href="https://github.com/QRun-IO/qbit-bom/blob/v2.1.0/README.md">README</a>.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/1630c830fe943a0857e0c149c8e640622a1960e8"><code>1630c83</code></a> Merge pull request <a href="https://redirect.github.com/Kingsrook/qbit-bom/issues/13">#13</a> from QRun-IO/feature/assistant-spi-allowlist</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/00c6f1bb5557184f803f16a65e06b67970204158"><code>00c6f1b</code></a> feat(guardrails): allow qbit-assistant's provider SPI by default</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/b42f4f30a2003c57341ff44313061c494f0ee936"><code>b42f4f3</code></a> Bump version to 2.1.1 [skip ci]</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/699c457f374e85120e7a5c3e665afcb4e6bcca24"><code>699c457</code></a> Merge pull request <a href="https://redirect.github.com/Kingsrook/qbit-bom/issues/12">#12</a> from QRun-IO/feature/email-api-allowlist</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/574a1696b6e5c3eb3cf8af7490df96c39f7bba72"><code>574a169</code></a> ci: re-run after a ChromeDriver install flake</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/0f5448256c77647fa6c18ae1fbca108142f97e36"><code>0f54482</code></a> feat(guardrails): allow qbit-email's published API by default</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/736b796d48f7cea65bfde28fce19f4ed3a307936"><code>736b796</code></a> Merge pull request <a href="https://redirect.github.com/Kingsrook/qbit-bom/issues/11">#11</a> from QRun-IO/feature/ga-only-tag-filter-main</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/a4035aa8d714f659ec49b1664a639927bae4f217"><code>a4035aa</code></a> ci: fix regex escaping in the GA tag filter</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/52706aa987f881ebc39a25a941ff0b6b300760bb"><code>52706aa</code></a> ci: publish_release only on GA tags (port of <a href="https://redirect.github.com/Kingsrook/qbit-bom/issues/7">#7</a> to main)</li> <li><a href="https://github.com/QRun-IO/qbit-bom/commit/67fa618d37d037f5689c8bf132240ed9266db89f"><code>67fa618</code></a> Merge pull request <a href="https://redirect.github.com/Kingsrook/qbit-bom/issues/10">#10</a> from QRun-IO/feature/architecture-guardrails</li> <li>Additional commits viewable in <a href="https://github.com/Kingsrook/qbit-bom/compare/v2.0.0...v2.1.2">compare view</a></li> </ul> </details> <br /> Updates `org.bouncycastle:bcpg-jdk18on` from 1.84 to 1.86 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.md">org.bouncycastle:bcpg-jdk18on's changelog</a>.</em></p> <blockquote> <h1>Bouncy Castle Crypto Package - Release Notes</h1> <h2>1.0 Introduction</h2> <p>The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. The package is organised so that it contains a light-weight API suitable for use in any environment (including the J2ME) with the additional infrastructure to conform the algorithms to the JCE framework.</p> <h2>2.0 Release History</h2> <p><!-- raw HTML omitted --><!-- raw HTML omitted --></p> <h3>2.1.1 Version</h3> <p>Release: 1.87<br /> Date: 2026, TBD</p> <h3>2.1.2 Defects Fixed</h3> <ul> <li>X500Name.equals compared two names that are equal but not byte-identical - the same RDNs in another order, or in another string type - by searching the second name for each RDN of the first and canonicalising both values on every candidate comparison, so the comparison was quadratic in the number of RDNs, and CMSSignedData.getSignerInfos(), the CMSEnvelopedData, CMSAuthEnvelopedData and CMSEnvelopedDataParser constructors, TimeStampToken, the S/MIME classes built on them and X509CertificateHolderSelector.match() all compare names taken from the message before anything in it is verified: a 1.1 MB signed or enveloped message carrying two 40,000 RDN issuer names took about 90 seconds of CPU to parse. The signer and recipient stores also indexed their entries in a HashMap keyed on the signer or recipient id, whose hash code is easy to make collide, so a message with 16,000 signers or recipients chosen to collide took several seconds to index. AbstractX500NameStyle.areEqual now compares the RDNs positionally and otherwise sorts the canonical form of each RDN once and compares the two multisets, so a comparison is n log n in the number of RDNs, the two stores now scan their entries on lookup instead of indexing them, and the selector checks the serial number before the issuer name.</li> <li>The hash code of an ASN.1 object is a short fold over its content octets that a sender can make collide at will, and several tables built while a message is parsed were keyed on one: the extension table behind Extensions, so every certificate, CRL, OCSP and timestamp request parse, the deprecated X509Extensions, ExtendedKeyUsage, the CMS AttributeTable built from a SignerInfo's signed and unsigned attributes (the unsigned ones lying outside the signature), the EST CSRAttributesResponse index, and the Set of digest AlgorithmIdentifiers that the CMSSignedDataParser constructor and CMSSignedData.getDigestAlgorithmIDs() build from the SignedData digestAlgorithms field. With every key sharing one hash code each insert scanned all those before it, so a 6 MB certificate or message holding 65,000 such entries took about 35 seconds of CPU to parse and the parser's digest algorithm set about 140 seconds. Those tables are now ordered maps keyed on the OID's string form and the digest algorithm sets are ordered on the identifier's DER encoding, so each is n log n in the number of entries whatever their hash codes. AttributeTable.add() and remove() also no longer share a multi-valued entry's Vector with the table they were derived from.</li> <li>CMSSignedData digested the encapsulated or detached content once for every signer it verified, so a message carrying many SignerInfos over a large content cost their product in digesting before any signature was checked, where CMSSignedDataParser digests once per algorithm named in the digestAlgorithms field. The signers of a CMSSignedData now share the content digests computed under each digest algorithm identifier, so signers using the same algorithm digest the content once. The new org.bouncycastle.cms.max_digest_algorithms property bounds the number of distinct digest algorithms either class will compute over one message's content, each algorithm past the limit raising a CMSException; it is unlimited unless set.</li> <li>The verify side of the ML-DSA-CALCULATE-MU signature service, and MLDSASigner.verifyMu beneath it, compared the supplied mu with a value derived from the key's tr and the context alone, never absorbing the message passed to update(), so a correct mu was accepted only for an empty message and rejected for every other, while the sign side of the same service computed mu correctly. The comparison also finalised the engine's shared digest, so an ordinary verifySignature on the same MLDSASigner afterwards failed for a valid signature, and a mu of the wrong length escaped Signature.verify() as an unchecked DataLengthException. verifyMu now derives the expected mu from the message digest exactly as generateMu does and compares in constant time, the signer stays usable afterwards, the service answers a wrong-length mu with a SignatureException, and the contract - the verify side accepts exactly the mu the sign side returns for the same key, context and data - is now in the javadoc of both.</li> <li>The SM2 key pair generator of the BC provider, KeyPairGenerator.getInstance(&quot;SM2&quot;, &quot;BC&quot;), was built on the generic EC key pair generator rather than the lightweight SM2KeyPairGenerator the 1.73 release notes described, so it could draw a private key of n - 1, which Section 6.1 of GB/T 32918.1 excludes and which the SM2 signer rejects. It now uses SM2KeyPairGenerator and draws from [1, n - 2].</li> <li>ESTResponse added each header line of an EST server's response to its header table by copying that header's value array, so a response repeating one header many times was quadratic to parse - about 7 seconds of CPU per megabyte of header lines - and a read limit set through JsseESTServiceBuilder.withReadLimit() only applied once the header block had been read. The values of each header are now collected once, and the header block counts against the read limit of the source.</li> <li>The C509 encoding of an RFC 6955 proof-of-possession value (the sa-ecdhPop signature algorithms, values 14 to 16 of the C509 Signature Algorithms Registry) copied the DER DhSigStatic into the signature value byte string, where Section 4.2 of draft-ietf-cose-cbor-encoded-cert-21 defines the value as the bare hashValue when the DhSigStatic names no issuer and serial number and as the [issuer, certificateSerialNumber, hashValue] array when it does. The converter now produces both forms from the DER and reconstructs the DER from either; previously the array form was rejected outright and the byte-string form reconstructed a signature value four bytes short of the DER it came from, so a type 3 request carrying one could not verify. The privateKeyPossessionStatement certification request attribute (RFC 9883, Section 4.3.3 of the draft) was carried in the generic ~oid form on conversion and refused on reconstruction; it is now converted to and from its int-coded [issuer, certificateSerialNumber, cert] form, with an embedded signature certificate re-encoded as a type 3 C509 certificate. The certificate, certification request and template vectors of draft-ietf-cose-c509-test-vectors-02 now drive the util and pkix test suites.</li> <li>The DANE SMIMEA support in org.bouncycastle.cert.dane had three defects. JndiDANEFetcherFactory, when asked for every entry under a bare domain name, removed the first and last characters of the owner name the JNDI DNS provider reports for each listed record, assuming a quoted name; the provider returns the name unquoted with a trailing root dot, so the first hex digit of the hash label was lost and the lookup that followed could never find the record. It now removes only the root dot. DANEEntryStore kept one entry per owner name, so an address with more than one SMIMEA record (a signing and an encryption certificate, say) only ever showed its last; every entry is now kept. DANEEntrySelectorFactory split an address at its first '@', mis-handling a quoted local-part containing one, and threw StringIndexOutOfBoundsException rather than DANEException for an address with none; it now splits at the last '@', removes enclosing quotes and backslash quoting from the local-part before hashing as RFC 8162 sec. 3 describes, and rejects an address with no '@'. The DANEEntry(String, byte[]) constructor also now rejects, with an IOException, a record whose flags do not describe a full certificate entry rather than parsing whatever follows the flags as a certificate.</li> <li>TimeStampToken accepted a token whose signing-time signed attribute disagreed with the genTime in its TSTInfo. Both are the TSA's statement of when the token was produced, and the disagreement is what distinguishes an RFC 3161 token from a signature a TSA has put over a supplied TSTInfo through another service using the same key, such as a legacy countersignature endpoint, which some TSAs still offer. The constructor now rejects a token whose signing-time, when present, is further from genTime than the token's accuracy plus one minute; the check can be switched off with the org.bouncycastle.tsp.allow_inconsistent_signing_time property. TimeStampTokenGenerator now sets a signing-time attribute from the genTime it is given rather than the clock, so its tokens are consistent whatever genTime is passed.</li> <li>TimeStampToken.validate() accepted a token whose message imprint was calculated with MD5, for which collisions can be computed, and TSPAlgorithms.ALLOWED, the set the request side is typically checked against, included MD5. MD5 has been removed from TSPAlgorithms.ALLOWED, and validate() now rejects a token whose imprint algorithm is not in it (failure code badAlg). The new TSPAlgorithms.LEGACY is ALLOWED plus MD5; validate(SignerInformationVerifier, Set) takes the set of acceptable imprint algorithms, and the org.bouncycastle.tsp.allowed_imprint_algorithms property, a comma separated list of digest names or OIDs, replaces ALLOWED as the default for validate(SignerInformationVerifier). TSPAlgorithms.ALLOWED and LEGACY are now unmodifiable.</li> <li>CRL-based revocation checking (the PKIX CertPathValidator and the pkix X509RevocationChecker) tracked a CRL entry's reasonCode in the same field as its own status markers and did not range-check it, so a CRL entry whose reasonCode was outside the RFC 5280 sec. 5.3.1 set was mishandled: 11 left the certificate unrevoked, other out-of-range values threw an unchecked exception out of validation. The revocation date and the reason code are now kept separately; an undefined reasonCode is processed as unspecified and reported as &quot;(unknown code: N)&quot;.</li> <li>OERDefinition.enumItem(label, value) discarded the explicit enumerand value: Builder.enumValue() set it on the builder it had just copied and returned the copy without it, so every item was numbered by its position in the definition instead. The value is now kept, and the items without one are numbered as X.680 sec. 20.3 and 20.6 specify: a root item takes the successive integers from 0, skipping any explicit root number, and an extension item takes the smallest value not defined in the root and greater than every preceding extension item (the old loop restarted its count after an explicit number, so an explicit 0 followed by an unnumbered item was a duplicate). The three ETSI TS 102 941 response-code definitions that use explicit values give &quot;ok&quot; the value 0 at position 0, so their encodings are unchanged.</li> <li>OERInputStream read the two length-prefixed INTEGER forms and BIT STRING with Streams.readFully and did not check its best-effort return, so a stream that ended inside the value decoded the zero-padded buffer as a value rather than failing. Every length-driven read in the decoder now goes through Streams.readLenBytesFully, which fails with EOFException at the real end of input and, for a long length, does not allocate the full array until the stream has delivered a fair part of it - so a hostile length that is within the decoder's allocation cap, or a cap a caller has raised, cannot drive a large allocation from a short input.</li> <li>The OER codec gave a signed INTEGER whose upper bound is exactly the maximum of a fixed-size word the next word up: X.696 sec. 10.4 a)-d) make both bounds inclusive, but the upper-bound comparison was strict, so INTEGER (-128..127) was a two-octet word rather than one, and likewise at the 16-, 32- and 64-bit boundaries. The two signed ranges shipped with the library, NinetyDegreeInt and OneEightyDegreeInt, lie inside the four-octet word and are unaffected.</li> <li>The ETSI TS 102 941 response code wrappers AuthorizationResponseCode, AuthorizationValidationResponseCode and EnrolmentResponseCode checked their range on BigInteger.intValue(), which truncates, so a value past the int range whose low 32 bits were in range was accepted - 2^32 as &quot;ok&quot;. The check now rejects a negative value or one over 31 bits before consulting intValue().</li> <li>OERInputStream accepted an empty group of octets as the value zero in four places where X.696 requires at least one: a variable-size INTEGER with a length determinant of 0 (sec. 3.7.11 and 3.7.12 define the number forms as one or more octets), an ENUMERATED long form with 0 subsequent octets (sec. 11.4 says 1 to 127), a length determinant long form with 0 subsequent octets (sec. 8.6.5, likewise) and a sequence-of quantity of 0 octets (sec. 17.2). Each now fails with an IOException; the one-octet encodings of zero decode as before.</li> <li>OEROutputStream could not encode a CHOICE whose chosen alternative has a tag number of 63 or more. X.696 sec. 8.7.2.2 keeps a tag number below 63 in the first octet and sec. 8.7.2.3 continues one of 63 or more in 7-bit groups, most significant first, with bit 8 as the continuation flag; the encoder used the single octet up to and including 63, so 63 went out as the continuation escape with nothing after it, and BitBuilder.write7BitBytes took its groups from bit 31 downward rather than from the low end, so 63 encoded as 83 78, which decodes as 504. Both forms of write7BitBytes now write the fewest 7-bit groups of the value, and the boundary is at 63. No CHOICE in the shipped ITS definitions has that many alternatives.</li> <li>OEROutputStream rejected a required SEQUENCE component as absent whenever it arrived wrapped in an OEROptional, the form the ITS classes' toASN1Primitive methods produce for present values, rather than only when the wrapper is the undefined ABSENT. A defined wrapper at a required position is now unwrapped and written like the bare value.</li> <li>OERInputStream, for an absent optional SEQUENCE component selected through a switch, tested the selected alternative for a default value but then took the default from the switch itself, which has none, so the alternative's default was added as null and the decode failed with NullPointerException. The default now comes from the selected alternative. No definition shipped with the library has a switched component with a default.</li> <li>OERInputStream read a SEQUENCE OF count through BigInteger.intValue(), which keeps only the low 32 bits, so a count of 2^32 + 3 decoded as 3 elements and the rest of the input was left in place for the next field. A count that does not fit in 31 bits is now rejected as out of range, and the fixed sizes taken from a definition go through BigIntegers.intValueExact() rather than silently truncating.</li> <li>OERInputStream rejected a valid SEQUENCE OF as &quot;out of range&quot; on any stream whose available() reported fewer bytes than the element count: available() is an estimate of what can be read without blocking, 0 from the base InputStream and from wrappers such as CipherInputStream, and the decoder had been using it as a bound on the count. The count is now bounded by the decoder's allocation ceiling (maxByteAllocation, 1 MiB by default) instead, and a count within it over a short input fails at the first element that is not there.</li> <li>OERInputStream could not decode a variable-size BIT STRING. X.696 sec. 13.3 encodes one as a length determinant covering an initial octet, which gives the number of unused bits in the final octet, and the octets of the value, which is what OEROutputStream writes; the decoder read the determinant as a bit count, divided it by 8 and never read the initial octet, so it took no data at all for a two-octet value, and a stray third branch keyed on a negative size bound threw NullPointerException for an unbounded schema. The decoder now has the two forms of clause 13: a fixed size reads the whole octets the size occupies and derives the unused bits from it (a 12-bit string is two octets with four unused bits, where it was one octet), and any other size reads the determinant, the initial octet (rejected over 7, or non-zero for an empty value, 13.3.4) and the data, carrying the unused-bit count into the DERBitString. OERDefinition gains bitString() and bitString(lower, upper) alongside bitString(size). The single BIT STRING in the shipped ITS definitions is a fixed 8 bits and decodes as before.</li> <li>OEROutputStream wrote a negative INTEGER value under a type whose lower bound is zero or more through the unsigned encodings, so it went out as a different, positive value: -1 under INTEGER (0..255) as FF, the encoding of 255, and under INTEGER (0..MAX) as 01 FF. A negative value is now rejected with IllegalArgumentException on both unsigned paths.</li> <li>OERInputStream.uint64() read its eight octets as a signed number, so a value with the top bit set came back negative; the other uintN readers were unsigned. It now reads unsigned.</li> <li>The OER codec treated an INTEGER with a positive lower bound as signed. X.696 sec. 10.2 a) gives the unsigned encodings to an integer whose lower bound is zero or positive; OERInputStream and OEROutputStream tested for a lower bound of exactly zero, so INTEGER (1..255) went out as a two-octet signed word rather than one unsigned octet and INTEGER (1..MAX) as a variable-size signed number, where 128 is 00 80 rather than 80. No OER definition shipped with the library puts a positive lower bound on an INTEGER.</li> <li>The OER codec encoded and decoded a negative ENUMERATED value wrongly. X.696 sec. 11.4 reserves the one-octet short form for the values 0 to 127 and puts every other value, negative ones included, in the long form as a two's-complement signed integer; OEROutputStream chose the long form only for values above 127, so a negative value went out in the short form masked to seven bits (-1 as 7F, the encoding of 127), and OERInputStream read a long-form value as unsigned (81 FF, the encoding of -1, as 255). Both now follow sec. 11.4. No OER definition shipped with the library declares a negative enumerand.</li> <li>ASN1Enumerated rejected negative values, although an ENUMERATED is an integer (X.680 sec. 20) and may be negative: the int and BigInteger constructors threw &quot;enumerated must be non-negative&quot;, the byte array constructor rejected a leading sign bit, and a parsed ENUMERATED with a negative value failed to decode. The checks are removed, ASN1Enumerated gains isNegative() and longValueExact() alongside the existing intValueExact(), and a zero-length ENUMERATED is now reported as &quot;malformed enumerated&quot;, as a zero-length INTEGER is reported as &quot;malformed integer&quot;, rather than &quot;ENUMERATED has zero length&quot;. ASN1Enumerated.valueOf(int) and valueOf(long) return shared instances for the values 0 to 15, as ASN1Integer.valueOf() does, and a parsed single-byte ENUMERATED in that range is returned as the shared instance.</li> <li>A PBEKey stored in a BCFKS KeyStore was not reported as a key entry: isKeyEntry() returned false for it, so KeyStore.getEntry() returned null rather than a SecretKeyEntry, although getKey() recovered it. The PBE key entry type added for github <a href="https://redirect.github.com/bcgit/bc-java/issues/2164">#2164</a> was missing from engineIsKeyEntry, and is now included.</li> <li>The CMS content-type decoders SignedData, EnvelopedData, AuthenticatedData, AuthEnvelopedData and EncryptedData read their mandatory fields by index or enumeration with no lower-bound size check, so a ContentInfo whose inner content was an empty or too-short SEQUENCE - malformed but DER-parseable - left the decode as an unchecked NoSuchElementException or ArrayIndexOutOfBoundsException rather than the CMSException the CMSSignedData, CMSEnvelopedData, CMSAuthenticatedData and CMSAuthEnvelopedData constructors declare (the IllegalArgumentException CMSEncryptedData documents). Each now rejects a short sequence with IllegalArgumentException before reading, as the sibling content types CompressedData and DigestedData already did, so the wrappers surface it as their declared exception; the case that claims an OPTIONAL field and then truncates the mandatory ones after it is covered too. The streaming parsers CMSSignedDataParser, CMSEnvelopedDataParser, CMSAuthenticatedDataParser, CMSAuthEnvelopedDataParser and CMSCompressedDataParser had the same gap and more: an absent or truncated inner SEQUENCE, a mandatory field of the wrong type, or absent encapsulated or encrypted content escaped as NullPointerException, ClassCastException, IllegalArgumentException or IllegalStateException. The asn1.cms stream parsers now report a missing mandatory field as an IOException, and the CMS parsers report malformed content as CMSException (&quot;Malformed content.&quot; / &quot;Missing content.&quot;) or the IOException they declare.</li> <li>A KeyAgreement asked for its shared secret before doPhase returned data rather than refusing. javax.crypto.KeyAgreement specifies IllegalStateException for that state, but nothing in the provider tracked it, so each SPI handed back whatever its result field held: for Diffie-Hellman that was the private value itself - engineInit seeded result with x, so generateSecret() returned the private exponent padded to the prime's length and generateSecret(&quot;AES&quot;) an all-zero key taken from that padding - while ECDH returned null and its named-algorithm overload raised NullPointerException. BaseAgreementSpi now records whether a doPhase has completed the agreement since the last init and refuses the request with an IllegalStateException naming the algorithm, so every family in the provider - DH, ECDH and ECMQV, the SM2 exchange, both ECGOST families, XDH, SM9 and NewHope - answers the same way, and the DH SPI no longer holds the private value in that field at all.</li> <li>Mac.getInstance and KeyGenerator.getInstance by the HMAC SHA-512/224 and SHA-512/256 object identifiers (1.2.840.113549.2.12 and .13) failed, although the same algorithms resolved by name and the matching SecretKeyFactory aliases were registered: the SHA512 mappings called addHMACAlgorithm for the two truncated variants without the addHMACAlias that registers their OIDs against Mac and KeyGenerator. Both are now aliased, as every other HMAC in that class already was.</li> <li>A KTSParameterSpec naming an HKDF key-derivation function with a parameters field - a form the provider does not service - was accepted at Cipher init and then failed out of wrap or unwrap with an unchecked IllegalStateException neither method declares. The KTS key-wrapping Ciphers (ML-KEM, Classic McEliece, FrodoKEM, the composite KEM and RSA-KEM) now validate the spec's KDF when they take it, reporting an unserviceable one as the InvalidAlgorithmParameterException engineInit declares, which is what the javax.crypto.KEM services already did through KdfUtil.resolveKemSpec.</li> <li>A DTLS handshake deadlocked when a handshake message ahead of the peer's ChangeCipherSpec (a client's CertificateVerify, say) was lost while the ChangeCipherSpec and Finished behind it arrived: the record layer moved its read epoch on at the ChangeCipherSpec and then discarded every retransmission of the lost message as belonging to the old epoch, whose records are only accepted once the handshake has completed. Each side then waited on the other until a handshake timeout, if one was configured, ended it. Every client-authenticated handshake, and every handshake in which the server issues a NewSessionTicket, was exposed. Until the handshake completes, handshake records from the current epoch are now still accepted after the read epoch has moved on, and each message is checked against the epoch of the record that carried it. The DTLS loopback tests now run their handshakes at 10% datagram loss in each direction, with a client-authenticated handshake at 25%.</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/bcgit/bc-java/commits">compare view</a></li> </ul> </details> <br /> Updates `org.apache.sshd:sshd-core` from 2.16.0 to 2.20.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/mina-sshd/releases">org.apache.sshd:sshd-core's releases</a>.</em></p> <blockquote> <h2>Apache MINA SSHD 2.20.0</h2> <h2>Bug Fixes</h2> <ul> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/656">GH-656</a> <code>ChannelPipedInputStream</code>: shrink buffer when emptied</li> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/906">GH-906</a> Fix finding a signature factory for BC ed25519 keys</li> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/911">GH-911</a> Fix server-side SOCKS5 proxy for fragmented and pipelined CONNECT requests</li> <li>More checks in authentication (server-side)</li> </ul> <p><strong>Security fixes</strong></p> <ul> <li>Allow asynchronous authentication only for password and keyboard-interactive authentication schemes. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-77185">CVE-2026-77185</a>, <a href="https://lists.apache.org/thread.html/t8pn812yq8ndokxyfxztg8tovov1284n">announced</a> 2026-09-29.</li> <li>Fix authentication requiring multiple public keys (server-side). Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-93994">CVE-2026-93994</a>, <a href="https://lists.apache.org/thread.html/9t3vsm8rnvwdv9779mlg1lq2fbwojdwp">announced</a> 2026-09-29.</li> <li>Better argument handling in sshd-git. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-93995">CVE-2026-93995</a>, <a href="https://lists.apache.org/thread.html/k13ox2xlry38h9gh6rhmh1d9zs345clk">announced</a> 2026-09-29.</li> <li>Better SCP command handling. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-93996">CVE-2026-93996</a>, <a href="https://lists.apache.org/thread.html/xwk8vogkpphcpm01hrt9tb6mgnpjzp35">announced</a> 2026-09-29.</li> <li>SFTP client: simplify response message handling. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-94002">CVE-2026-94002</a>, <a href="https://lists.apache.org/thread.html/x2cb00kh4qvsq145tj2w4g3toy8cybld">announced</a> 2026-09-29.</li> <li>Fix check-file-name/check-file-handle SFTP v6 extension (server-side). Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-94029">CVE-2026-94029</a>, <a href="https://lists.apache.org/thread.html/ytbl4rwby62xl7llm3wp7k975wwdx99t">announced</a> 2026-09-29.</li> <li>Improve LDAP authentication (sshd-ldap). <ul> <li>Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-94052">CVE-2026-94052</a>, <a href="https://lists.apache.org/thread.html/qch5kdwwms13y6bylb7c6qqzq718wn24">announced</a> 2026-09-29.</li> <li>Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-94053">CVE-2026-94053</a>, <a href="https://lists.apache.org/thread.html/cyrxkdzl3c70rrqs3klqphqz1hwm7p41">announced</a> 2026-09-29.</li> </ul> </li> </ul> <h2>New Features</h2> <ul> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/905">GH-905</a> Implement the &quot;from&quot; and &quot;expiry-time&quot; options in <code>authorized_keys</code> handling in public key authentication (server side)</li> </ul> <h2>Potential Compatibility Issues</h2> <p>None.</p> <h2>Major Code Re-factoring</h2> <p>None.</p> <h2>Apache MINA SSHD 2.19.0</h2> <h2>Bug Fixes</h2> <ul> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/899">GH-899</a> Fix <code>ProcessShellFactory</code> on Linux</li> <li><a href="https://redirect.github.com/apache/mina-sshd/pull/902">GH-902</a> Fix client-side handling of sk-* public key signatures (also in the agent interfaces)</li> <li>Limit size of decompressed SSH packets</li> <li>Escape newlines in filenames in the SCP protocol</li> </ul> <p><strong>Security Fixes</strong></p> <ul> <li>Validate file names in SCP. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-56452">CVE-2026-56452</a>, <a href="https://lists.apache.org/thread/xgoqvmksmd94fsqnzqjdtfjxf35os9no">announced</a> 2026-07-20.</li> <li>Improve handling of repository paths in <code>sshd-git</code> on Windows. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-56623">CVE-2026-56623</a>, <a href="https://lists.apache.org/thread/bhw26snzgvk0mtqqp5dcyjvczp4kcqky">announced</a> 2026-07-20.</li> <li>Improve checking SSH user certificates in public-key authentication. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-56624">CVE-2026-56624</a>, <a href="https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6">announced</a> 2026-07-20.</li> <li>Restrict JGit commands accessible via <code>GitPgmCommandFactory</code> in <code>sshd-git</code>. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-58624">CVE-2026-58624</a>, <a href="https://lists.apache.org/thread/7c3cry6pdy6hj1q0f28rc72x4o4tlyjo">announced</a> 2026-07-20.</li> </ul> <h2>Potential Compatibility Issues</h2> <h3>Restrict JGit commands accessible via <code>GitPgmCommandFactory</code> in <code>sshd-git</code></h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/apache/mina-sshd/blob/master/CHANGES.md">org.apache.sshd:sshd-core's changelog</a>.</em></p> <blockquote> <h1>Previous Versions</h1> <ul> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.2.0.md">Version 2.1.0 to 2.2.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.3.0.md">Version 2.2.0 to 2.3.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.4.0.md">Version 2.3.0 to 2.4.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.5.0.md">Version 2.4.0 to 2.5.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.5.1.md">Version 2.5.0 to 2.5.1</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.6.0.md">Version 2.5.1 to 2.6.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.7.0.md">Version 2.6.0 to 2.7.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.8.0.md">Version 2.7.0 to 2.8.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.9.0.md">Version 2.8.0 to 2.9.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.9.1.md">Version 2.9.0 to 2.9.1</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.9.2.md">Version 2.9.1 to 2.9.2</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.10.0.md">Version 2.9.2 to 2.10.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.11.0.md">Version 2.10.0 to 2.11.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.12.0.md">Version 2.11.0 to 2.12.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.12.1.md">Version 2.12.0 to 2.12.1</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.13.0.md">Version 2.12.1 to 2.13.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.13.1.md">Version 2.13.0 to 2.13.1</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.13.2.md">Version 2.13.1 to 2.13.2</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.14.0.md">Version 2.13.2 to 2.14.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.15.0.md">Version 2.14.0 to 2.15.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.16.0.md">Version 2.15.0 to 2.16.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.17.0.md">Version 2.16.0 to 2.17.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.17.1.md">Version 2.17.0 to 2.17.1</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.18.0.md">Version 2.17.1 to 2.18.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.19.0.md">Version 2.18.0 to 2.19.0</a></li> </ul> <h1>Latest Version</h1> <ul> <li><strong><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.20.0.md">Version 2.19.0 to 2.20.0</a></strong></li> </ul> <h1>Planned for Next Version</h1> <h2>Bug Fixes</h2> <ul> <li>Fixed a race condition in key exchanges</li> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/925">GH-925</a> Re-allow &quot;none&quot; authentication (regression in 2.20.0)</li> </ul> <h2>New Features</h2> <ul> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/904">GH-904</a> Log local port in <code>ClientSessionImpl.toString()</code> to be able to distinguish multiple sessions to the same host in logs</li> </ul> <h2>Potential Compatibility Issues</h2> <h2>Major Code Re-factoring</h2> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/mina-sshd/commit/2221febd396cd3daafdfbf2ff982c6d0eb69a203"><code>2221feb</code></a> [maven-release-plugin] prepare release sshd-2.20.0</li> <li><a href="https://github.com/apache/mina-sshd/commit/daa4002349bffb4b6045c29dd72d1c5df96a0efd"><code>daa4002</code></a> Prepare release documentation</li> <li><a href="https://github.com/apache/mina-sshd/commit/0b41c6f95caf8e29125d3202c37d2b1974ef14a8"><code>0b41c6f</code></a> Format PublickeyAuthenticator</li> <li><a href="https://github.com/apache/mina-sshd/commit/cea7e243239467da206ad1deb0e3a4370c9e22e3"><code>cea7e24</code></a> Bump BC-FIPS test dependencies</li> <li><a href="https://github.com/apache/mina-sshd/commit/1c97396ff1d52e39b044e4fdbcb040898d15cae6"><code>1c97396</code></a> Update CHANGES.md</li> <li><a href="https://github.com/apache/mina-sshd/commit/602896f3e418ed1ec025feabadb1eecb2cb5f397"><code>602896f</code></a> PublicKeyAuthenticator.authenticate(): remove AsyncAuthException</li> <li><a href="https://github.com/apache/mina-sshd/commit/53b57cecaac5486cbfd4f5723da0e71bf21116cc"><code>53b57ce</code></a> Bump Bouncy Castle 1.85 -&gt; 1.86</li> <li><a href="https://github.com/apache/mina-sshd/commit/acc0f1ed436529c24f6677da83e7ec4e3537c4c9"><code>acc0f1e</code></a> Fix LDAP authentication</li> <li><a href="https://github.com/apache/mina-sshd/commit/f4f562c29e22ed98479405e8bec58611f2faceba"><code>f4f562c</code></a> Fix check-file-name/check-file-handle SFTP v6 extension</li> <li><a href="https://github.com/apache/mina-sshd/commit/53bce94f4b27d1dd7b4d8d730af8b96b9616446f"><code>53bce94</code></a> DefaultSftpClient: simplify SFTP message handling</li> <li>Additional commits viewable in <a href="https://github.com/apache/mina-sshd/compare/sshd-2.16.0...sshd-2.20.0">compare view</a></li> </ul> </details> <br /> Updates `org.apache.sshd:sshd-sftp` from 2.16.0 to 2.20.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/mina-sshd/releases">org.apache.sshd:sshd-sftp's releases</a>.</em></p> <blockquote> <h2>Apache MINA SSHD 2.20.0</h2> <h2>Bug Fixes</h2> <ul> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/656">GH-656</a> <code>ChannelPipedInputStream</code>: shrink buffer when emptied</li> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/906">GH-906</a> Fix finding a signature factory for BC ed25519 keys</li> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/911">GH-911</a> Fix server-side SOCKS5 proxy for fragmented and pipelined CONNECT requests</li> <li>More checks in authentication (server-side)</li> </ul> <p><strong>Security fixes</strong></p> <ul> <li>Allow asynchronous authentication only for password and keyboard-interactive authentication schemes. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-77185">CVE-2026-77185</a>, <a href="https://lists.apache.org/thread.html/t8pn812yq8ndokxyfxztg8tovov1284n">announced</a> 2026-09-29.</li> <li>Fix authentication requiring multiple public keys (server-side). Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-93994">CVE-2026-93994</a>, <a href="https://lists.apache.org/thread.html/9t3vsm8rnvwdv9779mlg1lq2fbwojdwp">announced</a> 2026-09-29.</li> <li>Better argument handling in sshd-git. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-93995">CVE-2026-93995</a>, <a href="https://lists.apache.org/thread.html/k13ox2xlry38h9gh6rhmh1d9zs345clk">announced</a> 2026-09-29.</li> <li>Better SCP command handling. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-93996">CVE-2026-93996</a>, <a href="https://lists.apache.org/thread.html/xwk8vogkpphcpm01hrt9tb6mgnpjzp35">announced</a> 2026-09-29.</li> <li>SFTP client: simplify response message handling. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-94002">CVE-2026-94002</a>, <a href="https://lists.apache.org/thread.html/x2cb00kh4qvsq145tj2w4g3toy8cybld">announced</a> 2026-09-29.</li> <li>Fix check-file-name/check-file-handle SFTP v6 extension (server-side). Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-94029">CVE-2026-94029</a>, <a href="https://lists.apache.org/thread.html/ytbl4rwby62xl7llm3wp7k975wwdx99t">announced</a> 2026-09-29.</li> <li>Improve LDAP authentication (sshd-ldap). <ul> <li>Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-94052">CVE-2026-94052</a>, <a href="https://lists.apache.org/thread.html/qch5kdwwms13y6bylb7c6qqzq718wn24">announced</a> 2026-09-29.</li> <li>Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-94053">CVE-2026-94053</a>, <a href="https://lists.apache.org/thread.html/cyrxkdzl3c70rrqs3klqphqz1hwm7p41">announced</a> 2026-09-29.</li> </ul> </li> </ul> <h2>New Features</h2> <ul> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/905">GH-905</a> Implement the &quot;from&quot; and &quot;expiry-time&quot; options in <code>authorized_keys</code> handling in public key authentication (server side)</li> </ul> <h2>Potential Compatibility Issues</h2> <p>None.</p> <h2>Major Code Re-factoring</h2> <p>None.</p> <h2>Apache MINA SSHD 2.19.0</h2> <h2>Bug Fixes</h2> <ul> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/899">GH-899</a> Fix <code>ProcessShellFactory</code> on Linux</li> <li><a href="https://redirect.github.com/apache/mina-sshd/pull/902">GH-902</a> Fix client-side handling of sk-* public key signatures (also in the agent interfaces)</li> <li>Limit size of decompressed SSH packets</li> <li>Escape newlines in filenames in the SCP protocol</li> </ul> <p><strong>Security Fixes</strong></p> <ul> <li>Validate file names in SCP. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-56452">CVE-2026-56452</a>, <a href="https://lists.apache.org/thread/xgoqvmksmd94fsqnzqjdtfjxf35os9no">announced</a> 2026-07-20.</li> <li>Improve handling of repository paths in <code>sshd-git</code> on Windows. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-56623">CVE-2026-56623</a>, <a href="https://lists.apache.org/thread/bhw26snzgvk0mtqqp5dcyjvczp4kcqky">announced</a> 2026-07-20.</li> <li>Improve checking SSH user certificates in public-key authentication. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-56624">CVE-2026-56624</a>, <a href="https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6">announced</a> 2026-07-20.</li> <li>Restrict JGit commands accessible via <code>GitPgmCommandFactory</code> in <code>sshd-git</code>. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-58624">CVE-2026-58624</a>, <a href="https://lists.apache.org/thread/7c3cry6pdy6hj1q0f28rc72x4o4tlyjo">announced</a> 2026-07-20.</li> </ul> <h2>Potential Compatibility Issues</h2> <h3>Restrict JGit commands accessible via <code>GitPgmCommandFactory</code> in <code>sshd-git</code></h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/apache/mina-sshd/blob/master/CHANGES.md">org.apache.sshd:sshd-sftp's changelog</a>.</em></p> <blockquote> <h1>Previous Versions</h1> <ul> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.2.0.md">Version 2.1.0 to 2.2.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.3.0.md">Version 2.2.0 to 2.3.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.4.0.md">Version 2.3.0 to 2.4.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.5.0.md">Version 2.4.0 to 2.5.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.5.1.md">Version 2.5.0 to 2.5.1</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.6.0.md">Version 2.5.1 to 2.6.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.7.0.md">Version 2.6.0 to 2.7.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.8.0.md">Version 2.7.0 to 2.8.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.9.0.md">Version 2.8.0 to 2.9.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.9.1.md">Version 2.9.0 to 2.9.1</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.9.2.md">Version 2.9.1 to 2.9.2</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.10.0.md">Version 2.9.2 to 2.10.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.11.0.md">Version 2.10.0 to 2.11.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.12.0.md">Version 2.11.0 to 2.12.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.12.1.md">Version 2.12.0 to 2.12.1</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.13.0.md">Version 2.12.1 to 2.13.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.13.1.md">Version 2.13.0 to 2.13.1</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.13.2.md">Version 2.13.1 to 2.13.2</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.14.0.md">Version 2.13.2 to 2.14.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.15.0.md">Version 2.14.0 to 2.15.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.16.0.md">Version 2.15.0 to 2.16.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.17.0.md">Version 2.16.0 to 2.17.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.17.1.md">Version 2.17.0 to 2.17.1</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.18.0.md">Version 2.17.1 to 2.18.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.19.0.md">Version 2.18.0 to 2.19.0</a></li> </ul> <h1>Latest Version</h1> <ul> <li><strong><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.20.0.md">Version 2.19.0 to 2.20.0</a></strong></li> </ul> <h1>Planned for Next Version</h1> <h2>Bug Fixes</h2> <ul> <li>Fixed a race condition in key exchanges</li> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/925">GH-925</a> Re-allow &quot;none&quot; authentication (regression in 2.20.0)</li> </ul> <h2>New Features</h2> <ul> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/904">GH-904</a> Log local port in <code>ClientSessionImpl.toString()</code> to be able to distinguish multiple sessions to the same host in logs</li> </ul> <h2>Potential Compatibility Issues</h2> <h2>Major Code Re-factoring</h2> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/mina-sshd/commit/2221febd396cd3daafdfbf2ff982c6d0eb69a203"><code>2221feb</code></a> [maven-release-plugin] prepare release sshd-2.20.0</li> <li><a href="https://github.com/apache/mina-sshd/commit/daa4002349bffb4b6045c29dd72d1c5df96a0efd"><code>daa4002</code></a> Prepare release documentation</li> <li><a href="https://github.com/apache/mina-sshd/commit/0b41c6f95caf8e29125d3202c37d2b1974ef14a8"><code>0b41c6f</code></a> Format PublickeyAuthenticator</li> <li><a href="https://github.com/apache/mina-sshd/commit/cea7e243239467da206ad1deb0e3a4370c9e22e3"><code>cea7e24</code></a> Bump BC-FIPS test dependencies</li> <li><a href="https://github.com/apache/mina-sshd/commit/1c97396ff1d52e39b044e4fdbcb040898d15cae6"><code>1c97396</code></a> Update CHANGES.md</li> <li><a href="https://github.com/apache/mina-sshd/commit/602896f3e418ed1ec025feabadb1eecb2cb5f397"><code>602896f</code></a> PublicKeyAuthenticator.authenticate(): remove AsyncAuthException</li> <li><a href="https://github.com/apache/mina-sshd/commit/53b57cecaac5486cbfd4f5723da0e71bf21116cc"><code>53b57ce</code></a> Bump Bouncy Castle 1.85 -&gt; 1.86</li> <li><a href="https://github.com/apache/mina-sshd/commit/acc0f1ed436529c24f6677da83e7ec4e3537c4c9"><code>acc0f1e</code></a> Fix LDAP authentication</li> <li><a href="https://github.com/apache/mina-sshd/commit/f4f562c29e22ed98479405e8bec58611f2faceba"><code>f4f562c</code></a> Fix check-file-name/check-file-handle SFTP v6 extension</li> <li><a href="https://github.com/apache/mina-sshd/commit/53bce94f4b27d1dd7b4d8d730af8b96b9616446f"><code>53bce94</code></a> DefaultSftpClient: simplify SFTP message handling</li> <li>Additional commits viewable in <a href="https://github.com/apache/mina-sshd/compare/sshd-2.16.0...sshd-2.20.0">compare view</a></li> </ul> </details> <br /> Updates `org.apache.sshd:sshd-sftp` from 2.16.0 to 2.20.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/apache/mina-sshd/releases">org.apache.sshd:sshd-sftp's releases</a>.</em></p> <blockquote> <h2>Apache MINA SSHD 2.20.0</h2> <h2>Bug Fixes</h2> <ul> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/656">GH-656</a> <code>ChannelPipedInputStream</code>: shrink buffer when emptied</li> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/906">GH-906</a> Fix finding a signature factory for BC ed25519 keys</li> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/911">GH-911</a> Fix server-side SOCKS5 proxy for fragmented and pipelined CONNECT requests</li> <li>More checks in authentication (server-side)</li> </ul> <p><strong>Security fixes</strong></p> <ul> <li>Allow asynchronous authentication only for password and keyboard-interactive authentication schemes. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-77185">CVE-2026-77185</a>, <a href="https://lists.apache.org/thread.html/t8pn812yq8ndokxyfxztg8tovov1284n">announced</a> 2026-09-29.</li> <li>Fix authentication requiring multiple public keys (server-side). Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-93994">CVE-2026-93994</a>, <a href="https://lists.apache.org/thread.html/9t3vsm8rnvwdv9779mlg1lq2fbwojdwp">announced</a> 2026-09-29.</li> <li>Better argument handling in sshd-git. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-93995">CVE-2026-93995</a>, <a href="https://lists.apache.org/thread.html/k13ox2xlry38h9gh6rhmh1d9zs345clk">announced</a> 2026-09-29.</li> <li>Better SCP command handling. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-93996">CVE-2026-93996</a>, <a href="https://lists.apache.org/thread.html/xwk8vogkpphcpm01hrt9tb6mgnpjzp35">announced</a> 2026-09-29.</li> <li>SFTP client: simplify response message handling. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-94002">CVE-2026-94002</a>, <a href="https://lists.apache.org/thread.html/x2cb00kh4qvsq145tj2w4g3toy8cybld">announced</a> 2026-09-29.</li> <li>Fix check-file-name/check-file-handle SFTP v6 extension (server-side). Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-94029">CVE-2026-94029</a>, <a href="https://lists.apache.org/thread.html/ytbl4rwby62xl7llm3wp7k975wwdx99t">announced</a> 2026-09-29.</li> <li>Improve LDAP authentication (sshd-ldap). <ul> <li>Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-94052">CVE-2026-94052</a>, <a href="https://lists.apache.org/thread.html/qch5kdwwms13y6bylb7c6qqzq718wn24">announced</a> 2026-09-29.</li> <li>Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-94053">CVE-2026-94053</a>, <a href="https://lists.apache.org/thread.html/cyrxkdzl3c70rrqs3klqphqz1hwm7p41">announced</a> 2026-09-29.</li> </ul> </li> </ul> <h2>New Features</h2> <ul> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/905">GH-905</a> Implement the &quot;from&quot; and &quot;expiry-time&quot; options in <code>authorized_keys</code> handling in public key authentication (server side)</li> </ul> <h2>Potential Compatibility Issues</h2> <p>None.</p> <h2>Major Code Re-factoring</h2> <p>None.</p> <h2>Apache MINA SSHD 2.19.0</h2> <h2>Bug Fixes</h2> <ul> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/899">GH-899</a> Fix <code>ProcessShellFactory</code> on Linux</li> <li><a href="https://redirect.github.com/apache/mina-sshd/pull/902">GH-902</a> Fix client-side handling of sk-* public key signatures (also in the agent interfaces)</li> <li>Limit size of decompressed SSH packets</li> <li>Escape newlines in filenames in the SCP protocol</li> </ul> <p><strong>Security Fixes</strong></p> <ul> <li>Validate file names in SCP. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-56452">CVE-2026-56452</a>, <a href="https://lists.apache.org/thread/xgoqvmksmd94fsqnzqjdtfjxf35os9no">announced</a> 2026-07-20.</li> <li>Improve handling of repository paths in <code>sshd-git</code> on Windows. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-56623">CVE-2026-56623</a>, <a href="https://lists.apache.org/thread/bhw26snzgvk0mtqqp5dcyjvczp4kcqky">announced</a> 2026-07-20.</li> <li>Improve checking SSH user certificates in public-key authentication. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-56624">CVE-2026-56624</a>, <a href="https://lists.apache.org/thread/o4c2jml522j3z80gbryqzc2f1253ltp6">announced</a> 2026-07-20.</li> <li>Restrict JGit commands accessible via <code>GitPgmCommandFactory</code> in <code>sshd-git</code>. Resolves <a href="https://www.cve.org/CVERecord?id=CVE-2026-58624">CVE-2026-58624</a>, <a href="https://lists.apache.org/thread/7c3cry6pdy6hj1q0f28rc72x4o4tlyjo">announced</a> 2026-07-20.</li> </ul> <h2>Potential Compatibility Issues</h2> <h3>Restrict JGit commands accessible via <code>GitPgmCommandFactory</code> in <code>sshd-git</code></h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/apache/mina-sshd/blob/master/CHANGES.md">org.apache.sshd:sshd-sftp's changelog</a>.</em></p> <blockquote> <h1>Previous Versions</h1> <ul> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.2.0.md">Version 2.1.0 to 2.2.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.3.0.md">Version 2.2.0 to 2.3.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.4.0.md">Version 2.3.0 to 2.4.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.5.0.md">Version 2.4.0 to 2.5.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.5.1.md">Version 2.5.0 to 2.5.1</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.6.0.md">Version 2.5.1 to 2.6.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.7.0.md">Version 2.6.0 to 2.7.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.8.0.md">Version 2.7.0 to 2.8.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.9.0.md">Version 2.8.0 to 2.9.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.9.1.md">Version 2.9.0 to 2.9.1</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.9.2.md">Version 2.9.1 to 2.9.2</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.10.0.md">Version 2.9.2 to 2.10.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.11.0.md">Version 2.10.0 to 2.11.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.12.0.md">Version 2.11.0 to 2.12.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.12.1.md">Version 2.12.0 to 2.12.1</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.13.0.md">Version 2.12.1 to 2.13.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.13.1.md">Version 2.13.0 to 2.13.1</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.13.2.md">Version 2.13.1 to 2.13.2</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.14.0.md">Version 2.13.2 to 2.14.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.15.0.md">Version 2.14.0 to 2.15.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.16.0.md">Version 2.15.0 to 2.16.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.17.0.md">Version 2.16.0 to 2.17.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.17.1.md">Version 2.17.0 to 2.17.1</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.18.0.md">Version 2.17.1 to 2.18.0</a></li> <li><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.19.0.md">Version 2.18.0 to 2.19.0</a></li> </ul> <h1>Latest Version</h1> <ul> <li><strong><a href="https://github.com/apache/mina-sshd/blob/master/docs/changes/2.20.0.md">Version 2.19.0 to 2.20.0</a></strong></li> </ul> <h1>Planned for Next Version</h1> <h2>Bug Fixes</h2> <ul> <li>Fixed a race condition in key exchanges</li> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/925">GH-925</a> Re-allow &quot;none&quot; authentication (regression in 2.20.0)</li> </ul> <h2>New Features</h2> <ul> <li><a href="https://redirect.github.com/apache/mina-sshd/issues/904">GH-904</a> Log local port in <code>ClientSessionImpl.toString()</code> to be able to distinguish multiple sessions to the same host in logs</li> </ul> <h2>Potential Compatibility Issues</h2> <h2>Major Code Re-factoring</h2> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/apache/mina-sshd/commit/2221febd396cd3daafdfbf2ff982c6d0eb69a203"><code>2221feb</code></a> [maven-release-plugin] prepare release sshd-2.20.0</li> <li><a href="https://github.com/apache/mina-sshd/commit/daa4002349bffb4b6045c29dd72d1c5df96a0efd"><code>daa4002</code></a> Prepare release documentation</li> <li><a href="https://github.com/apache/mina-sshd/commit/0b41c6f95caf8e29125d3202c37d2b1974ef14a8"><code>0b41c6f</code></a> Format PublickeyAuthenticator</li> <li><a href="https://github.com/apache/mina-sshd/commit/cea7e243239467da206ad1deb0e3a4370c9e22e3"><code>cea7e24</code></a> Bump BC-FIPS test dependencies</li> <li><a href="https://github.com/apache/mina-sshd/commit/1c97396ff1d52e39b044e4fdbcb040898d15cae6"><code>1c97396</code></a> Update CHANGES.md</li> <li><a href="https://github.com/apache/mina-sshd/commit/602896f3e418ed1ec025feabadb1eecb2cb5f397"><code>602896f</code></a> PublicKeyAuthenticator.authenticate(): remove AsyncAuthException</li> <li><a href="https://github.com/apache/mina-sshd/commit/53b57cecaac5486cbfd4f5723da0e71bf21116cc"><code>53b57ce</code></a> Bump Bouncy Castle 1.85 -&gt; 1.86</li> <li><a href="https://github.com/apache/mina-sshd/commit/acc0f1ed436529c24f6677da83e7ec4e3537c4c9"><code>acc0f1e</code></a> Fix LDAP authentication</li> <li><a href="https://github.com/apache/mina-sshd/commit/f4f562c29e22ed98479405e8bec58611f2faceba"><code>f4f562c</code></a> Fix check-file-name/check-file-handle SFTP v6 extension</li> <li><a href="https://github.com/apache/mina-sshd/commit/53bce94f4b27d1dd7b4d8d730af8b96b9616446f"><code>53bce94</code></a> DefaultSftpClient: simplify SFTP message handling</li> <li>Additional commits viewable in <a href="https://github.com/apache/mina-sshd/compare/sshd-2.16.0...sshd-2.20.0">compare view</a></li> </ul> </details> <br /> Updates `com.h2database:h2` from 2.2.224 to 2.5.252 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/h2database/h2database/releases">com.h2database:h2's releases</a>.</em></p> <blockquote> <h2>Version 2.5.252</h2> <!-- raw HTML omitted --> <h2>version-2.5.250</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/h2database/h2database/commit/f986838bbbf4941d2edcd5298b18c9936d1b7359"><code>f986838</code></a> in preparation for a release</li> <li><a href="https://github.com/h2database/h2database/commit/06c34a7fa288208ecabb5d670555fd807270bb2a"><code>06c34a7</code></a> Merge pull request <a href="https://redirect.github.com/h2database/h2database/issues/4418">#4418</a> from andreitokar/issues-4380-4376</li> <li><a href="https://github.com/h2database/h2database/commit/1aef3e0692b7379402b2a1a14e5223a8911e31ec"><code>1aef3e0</code></a> <a href="https://redirect.github.com/h2database/h2database/issues/4376">#4376</a>: Reading INFORMATION_SCHEMA.COLUMNS fails with a NPE while any material...</li> <li><a href="https://github.com/h2database/h2database/commit/4bb8aee6bf4305a83e79b6a93e9e3781f904fed9"><code>4bb8aee</code></a> <a href="https://redirect.github.com/h2database/h2database/issues/4380">#4380</a>: creating a MATERIALIZED VIEW makes a persistent database permanently u...</li> <li><a href="https://github.com/h2database/h2database/commit/95b6af03b8768d770e5dac1ae829b7c15301b38e"><code>95b6af0</code></a> Merge pull request <a href="https://redirect.github.com/h2database/h2database/issues/4417">#4417</a> from andreitokar/issue-4395</li> <li><a href="https://github.com/h2database/h2database/commit/6ec30b66b68a298d6cfc424aa77fec90ebf05199"><code>6ec30b6</code></a> <a h... _Description has been truncated_
KofTwentyTwo (Migrated from github.com) reviewed 2026-10-21 03:54:40 +00:00
Checking for merge conflicts…
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin dependabot/maven/develop/maven-minor-and-patch-15df832370:dependabot/maven/develop/maven-minor-and-patch-15df832370
git checkout dependabot/maven/develop/maven-minor-and-patch-15df832370
Sign in to join this conversation.
Reviewers
No Reviewers
KofTwentyTwo
Labels
Clear labels
bug
Something isn't working
 dependencies
documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 java
Pull requests that update java code
 question
Further information is requested
 secuurity
wontfix
This will not be worked on
No labels dependencies java
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: QRun-IO/qbit-file-gateway#23