[dependabot]

Bumps net-ssh from 7.3.3 to 7.3.6.

Changelog

Sourced from net-ssh's changelog.

=== 8.0.0 rc2

• Security: refuse agent channels opened by the server unless agent forwarding was requested (forward_agent, ForwardAgent, or Forward#agent); any use of port forwarding let a malicious server use the local ssh-agent [GHSA-qpg5-fx6p-8cq3]
• Security: reject host and user names containing shell metacharacters, and non-numeric ports, before substituting them into ProxyCommand/ProxyJump commands, as OpenSSH does since 9.6 [GHSA-3x7f-q7wf-fp73]
• Security: reject OpenSSH private keys claiming more than 2**20 bcrypt rounds, and only run the KDF once a passphrase is given [GHSA-rpq3-v334-f5pm]
• Security: bound the server's identification banner like OpenSSH (8192-byte lines, 1024 lines), and apply :timeout to the whole version exchange instead of only its first byte [GHSA-r75w-7fhp-84w8]
• Security: reject packet lengths below 5 or above 256 KB, as OpenSSH does [GHSA-pfqh-p9vh-wx4p]
• Security: treat unexpected packets during the initial key exchange as a protocol error, and bound packets queued during a re-key [GHSA-ggxh-cfwq-5xqc]

=== 8.0.0 rc1

• BREAKING: TCP_NODELAY is now set on the connection socket by default, as OpenSSH does; pass no_delay: false to keep Nagle's algorithm on #1017
• Ruby 4.0 support: add logger as a runtime dependency; Windows Pageant users on Ruby 4.0 need fiddle in their Gemfile [#984, #1012]
• Close the socket when connection setup fails, e.g. on a server version timeout #1013
• Ignore SSH_MSG_EXT_INFO from servers that send it unrequested #1020
• Fix undefined method 'to_pem' for ECDSA key_data when an agent is running #982
• Agent forwarding connects to the agent set by identity_agent/IdentityAgent #974
• Keyboard-interactive prompts show input when the server asks for it to be echoed #1014
• Raise Net::SSH::Exception on a truncated KEXINIT #1016
• Remote forwarding no longer prints diagnostics to stdout #953

=== 8.0.0 beta3

• Verify @​cert-authority host certificate constraints — principals (shell-glob, matching OpenSSH), validity window, host type, and critical options — instead of trusting any CA-signed certificate for any host #1009

=== 8.0.0 beta1

• BREAKING: require Ruby 2.7 and the openssl gem >= 3.2 #1001
• Use OpenSSL for Ed25519, X25519 and ChaCha20-Poly1305; the ed25519, x25519 and rbnacl gems are no longer needed #1001
• Support AEAD-encrypted OpenSSH private keys #1001

Commits

• d82cbd5 bump version
• 75033c7 Merge pull request #1029 from mfazekas/changes/7.3.6
• 7a00340 Add CHANGES for 7.3.6
• 1bab2bc Merge pull request #1028 from mfazekas/fix/known-hosts-deprecation-warning-7-3
• f493b76 Don't print PubKey deprecation warnings when verifying plain known_hosts keys
• 8b0ce73 Merge pull request #1025 from mfazekas/fix/ci-stale-images-7-3
• cb0d73b Fix CI: archived bullseye repos, Fedora rpm spec, Ruby 3.3.0 parser bug
• a64cb4d bump version
• 80c7c83 Merge pull request #1024 from mfazekas/changes/7.3.5
• eb8c89a Add CHANGES for 7.3.5
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)