Security-driven dependency release.
- russh =0.55.0 (pinned) -> 0.61.2: closes the advisory batch reachable
from our SFTP *client* path — unbounded/allocation-first packet
parsing (CVE-2026-48110, CVE-2026-46702, CVE-2026-46673, HIGH) plus
CVE-2026-48107 in client auth. A malicious or compromised SFTP server
an operator pointed us at could previously OOM the PXE server. Also
drops mlock on non-secret buffers (~21% SSH throughput upstream) —
directly in the remote-share ISO streaming path. ring backend kept;
zero code changes needed in sftp_share.rs.
- bergshamra 0.4 -> 0.5.1: the pin's blocking condition (stable
RustCrypto generation, pkcs8 0.11) is now met upstream, so the
=0.55.0 pin is deleted and its comment rewritten as history. 0.5 is
secure-by-default for DSig (flags we already set explicitly) and
fixes an XML-Enc DerivedKey fallthrough.
- axum 0.7 -> 0.8.9: route captures /:id -> {id} across the router and
the /api/docs listing; ConnectInfo optional extraction moves to the
Result form. Gains the HEAD content-length fix (iPXE/sanboot clients
probe with HEAD before Range requests) and puts us back on the
maintained line.
Validation: clippy clean, fmt clean, all 272 workspace tests green.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
