chore(deps): bump the rust-dependencies group with 3 updates

[dependabot]

Bumps the rust-dependencies group with 3 updates: russh, serial_test and tabled.

Updates russh from 0.60.3 to 0.61.1

Release notes

Sourced from russh's releases.

v0.61.1

Security fixes

GHSA-wwx6-x28x-8259

When compression is negotiated, an attacker can craft a "ZIP bomb" style packet that would bypass the maximum packet size checks. This could allow the attacker to hit the OOM limit and either get the server process killed by the OS, or, prior to russh@0.58.0, aborted. A similar issue existed in the AgentClient as well, which could be triggered by a malformed SSH agent response.

Fixes

• keys/agent: forward full agent signature blob for sk-ecdsa/sk-ed25519 keys (#701) #701 (ztbh)
• accept empty name-list in KEXINIT (RFC 4251 §5) (#710) #710 (Bernardo Meurer)

v0.61.0

Changes

• 32fd46f: Reduce russh write-path copies with direct Bytes sends (#695) (Mika Cohen) #695

  • New APIs allow zero-copy writes into channels:
    • Channel::data_bytes
    • Channel::extended_data_bytes
    • ChannelWriteHalf::data_bytes
    • ChannelWriteHalf::extended_data_bytes

• deps: migrate to stable versions pkcs5 / pkcs8 / ed25519 and loosen prerelease pins (extends #697) (#702) #702 (escapecode)

• 72b250a: migrate to upstream ssh-key crate and update RustCrypto crates (#709) (Eugene) #709

Security fixes

Part of the hardening efforts by @​mjc

GHSA-hpv4-5h6f-wqr3

• When a client changed their username between authentication requests, russh server implementation would not correctly reset its internal state (allowed methods and "partial success" state), which could lead to incorrect responses to the client.
  • Note that you still need to handle the case where the client sends a subsequent authentication request with a different username and reset any accumulated authentication state your application might have

GHSA-g9g7-5cgw-6v28

• When a client sent a keyboard-interactive authentication request, the prompt counter was used to directly allocate memory without verifying it, which can lead to denial of service.

GHSA-76r6-x97p-67vr

• russh server did not enfore the SSH protocol header validation strictly enough, allowing a client to hold the connection open indefinitely, wasting resources.

GHSA-4r3c-5hpg-58qr

• "Name list" fields such as algorithm lists were only bounded by the packet size. While the SSH protocol does not impose a limit, in practice it could allow a client to waste resources by spamming huge KEXINIT messages via multiple connections.

Fixes

• 4186cf2: Refactor block-cipher packet-length probing to avoid unsafe state duplication (#706) (Mika Cohen) #706
• reject trailing KEX and channel-open payloads (Mika Cohen)
• reject trailing encrypted message payloads (Mika Cohen)

Commits

• a2ffd0f v0.61.1
• 2692a6f Merge commit from fork
• 93bc2c9 add ztbh as a contributor for code (#712)
• 7f585b5 fix: accept empty name-list in KEXINIT (RFC 4251 §5) (#710)
• 0e1b6fb fix(keys/agent): forward full agent signature blob for sk-ecdsa/sk-ed25519 ke...
• 264a885 Add GitArena to adopters (#698)
• 04c0acf Add Calagopus to adopters (#711)
• 1947d6b v0.61.0
• 22295fa Merge commit from fork
• 311f6cf Merge commit from fork
• Additional commits viewable in compare view

Updates serial_test from 3.4.0 to 3.5.0

Release notes

Sourced from serial_test's releases.

v3.5.0

What's Changed

• Replace scc/sdd with std::sync::Mutex for Miri strict provenance compatibility by @​justanotheranonymoususer in palfrey/serial_test#157

New Contributors

• @​justanotheranonymoususer made their first contribution in palfrey/serial_test#157

Full Changelog: palfrey/serial_test@v3.4.0...v3.5.0

Commits

• 6181f64 3.5.0
• 480bead Merge pull request #157 from justanotheranonymoususer/remove-scc-dep
• e03019e Update ci.yml
• 820c0f3 Update ci.yml
• 62a89b0 Only skip file_lock with filesystem access
• 5ff5501 Update ci.yml
• 0bd996d Let's try --all-features
• 338e4ed Fix formatting
• a55cde5 Cleanup code_lock.rs
• 9ad7a8f Remove unnecessary test leftover changes
• Additional commits viewable in compare view

Updates tabled from 0.20.0 to 0.21.0

Changelog

Sourced from tabled's changelog.

[0.21.0] - 2026-06-01

Added

• Added Color::is_empty function (by @​mvanhorn).
• Added Settings::modify function (by @​mvanhorn).
• Added qc test for wrap (by @​mvanhorn).
• Added LineText::limit function (by @​mvanhorn).
• Added ColumnNames::padding.

Changed

• Reworked Charset (by @​mvanhorn).
• Removed TabSize in favor of Charset::tab_size().
• Changed ColumnNames interface - splited it into ColumnNames and RowNames.

Fixed

• Fixed Wrap strings with 0 width (by @​ymcx).
• Improved examples (by @​alexanderkjall).
• Remove broken LICENSE symlink (by @​mvanhorn).
• Fixed CHANGELOG.md (by @​mvanhorn).
• Fixed clippy issue (by @​akiomik).
• Fixed documentation (by @​akiomik).
• Fixed documentation (by @​darko-mesaros).
• Fixed documentation (by @​brownjohnf).
• Fixed documentation (by @​spiritualhost).
• Fixed wrong render of vertical char in case of Span (corner case).
• Fixed BorderCorrection::span when Span::column and Span::row is used for same cell (corner case).

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	bashkit	fa768a5	Commit Preview URL Branch Preview URL	Jun 02 2026, 09:36 AM