40 Releases 41 Tags

RSS Feed

• v0.6.3 7f25bb681c

  Compare

  v0.6.3 — russh security bump + axum 0.8 Pre-Release

  mward4 released this 2026-06-09 19:47:13 -04:00 | 9 commits to main since this release

  Security-driven dependency release. Recommended upgrade for anyone using SFTP remote libraries.

  Security

  • russh 0.55 → 0.61.2 — closes a batch of advisories reachable from our SFTP client path: unbounded / allocation-first packet parsing (CVE-2026-48110, CVE-2026-46702, CVE-2026-46673 — HIGH) plus CVE-2026-48107 in client auth. Previously a malicious or compromised SFTP server an operator pointed OpenPXE at could OOM the server. Bonus: ~21% SSH throughput improvement upstream (mlock removed on non-secret buffers) — directly in the remote-share ISO streaming path.
  • bergshamra 0.4 → 0.5.1 (SAML) — the long-standing russh version pin existed only because bergshamra-crypto used release-candidate RustCrypto crates; 0.5 moved to the stable generation, so the pin is gone. 0.5 is also secure-by-default for XML-DSig (settings we already enforced explicitly) and fixes an XML-Enc DerivedKey fallthrough.

  Framework

  • axum 0.7 → 0.8.9 — route captures migrated to {param} syntax (router + /api/docs). Gains the HEAD response content-length fix (iPXE/sanboot clients probe with HEAD before issuing Range requests) and returns us to the maintained release line.

  Validation

  clippy clean · fmt clean · all 272 workspace tests green · static musl image build (the authoritative gate for the russh bump) passed.

  Image

  docker pull gitea.milesward.dev/mward4/openpxe:0.6.3
  

  :0.6.3 / :latest — digest sha256:f35e6b76aa6ae31bcc24505a91eef55f4dc4df86567a820dd3d40d2e49902eee (linux/amd64).

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)