Skip to content

build(deps): Bump sshd-core.version from 2.18.0 to 2.19.0#6232

Merged
delchev merged 1 commit into
masterfrom
dependabot/maven/sshd-core.version-2.19.0
Jul 10, 2026
Merged

build(deps): Bump sshd-core.version from 2.18.0 to 2.19.0#6232
delchev merged 1 commit into
masterfrom
dependabot/maven/sshd-core.version-2.19.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 10, 2026

Copy link
Copy Markdown
Contributor

Bumps sshd-core.version from 2.18.0 to 2.19.0.
Updates org.apache.sshd:sshd-core from 2.18.0 to 2.19.0

Release notes

Sourced from org.apache.sshd:sshd-core's releases.

Apache MINA SSHD 2.19.0

Bug Fixes

  • GH-899 Fix ProcessShellFactory on Linux
  • GH-902 Fix client-side handling of sk-* public key signatures (also in the agent interfaces)
  • Limit size of decompressed SSH packets
  • Improve checking SSH user certificates in public-key authentication
  • Improve handling of repository paths in sshd-git on Windows
  • Validate file names in SCP
  • Escape newlines in filenames in the SCP protocol
  • Restrict JGit commands accessible via GitPgmCommandFactory in sshd-git

Potential Compatibility Issues

Restrict JGit commands accessible via GitPgmCommandFactory in sshd-git

Bundle sshd-git contains a GitPgmCommandFactory that can be configured for an Apache MINA SSHD server. It enables remote execution of git commands via JGit.

However, running arbitrary git commands remotely is an exotic use case, and some commands (like git archive --format zip --output somefile.zip or also git clone or git checkout) could even create files on the server. This should be only allowed in an OS-level chrooted environment, which Apache MINA SSHD does not and cannot provide.

We have therefore limited the available commands to a small set of whitelisted git commands that might be useful as maintenance commands for authorized power users on a git server implemented based on sshd-git. The command are: archive, blame, branch, describe, diff, gc, log, reflog, show, and status. All these commands can be executed from an client via git --git-dir <repo> <command> <args>, where <repo> is the server-side name of the git repository (its local path on the server relative to the configured root), <command> is the command name (e.g., archive) and <args> are the command arguments. Results are sent back via the command output streams (output or error streams) and are thus sent back to the client. For the archivecommand, the --output (or -o) argument is ignored; the archive is always returned via the command's output stream and this is also sent to the client.

Applications that might have relied on the ability to run other JGit command remotely may no longer work. Either implement your own dedicated command factory to enable accesss to certain commands, or set the property GitModuleProperties.RESTRICT_COMMANDS to false on the server-side SshServer (for all sessions) or on particular ServerSessions (for particular individual sessions) to re-enable access to all commands supported by JGit.

Changelog

Sourced from org.apache.sshd:sshd-core's changelog.

Previous Versions

Latest Version

Planned for Next Version

Bug Fixes

New Features

Potential Compatibility Issues

Major Code Re-factoring

Commits
  • e2926a2 [maven-release-plugin] prepare release sshd-2.19.0
  • 49e4408 Prepare release documentation
  • 8caed36 Bump dependency to org.apache.mina:mina-core
  • e940752 Fix copy-paste error in a test
  • 3a93226 UTF8 fix in NOTICE-bin.txt
  • 3f036c5 Restrict remote execution of git commands
  • a792e08 SCP: escape newlines in file names on sending
  • 400626e Update CHANGES.md
  • ab3672f SCP: validate filenames
  • 384de9e Update CHANGES.md
  • Additional commits viewable in compare view

Updates org.apache.sshd:sshd-sftp from 2.18.0 to 2.19.0

Release notes

Sourced from org.apache.sshd:sshd-sftp's releases.

Apache MINA SSHD 2.19.0

Bug Fixes

  • GH-899 Fix ProcessShellFactory on Linux
  • GH-902 Fix client-side handling of sk-* public key signatures (also in the agent interfaces)
  • Limit size of decompressed SSH packets
  • Improve checking SSH user certificates in public-key authentication
  • Improve handling of repository paths in sshd-git on Windows
  • Validate file names in SCP
  • Escape newlines in filenames in the SCP protocol
  • Restrict JGit commands accessible via GitPgmCommandFactory in sshd-git

Potential Compatibility Issues

Restrict JGit commands accessible via GitPgmCommandFactory in sshd-git

Bundle sshd-git contains a GitPgmCommandFactory that can be configured for an Apache MINA SSHD server. It enables remote execution of git commands via JGit.

However, running arbitrary git commands remotely is an exotic use case, and some commands (like git archive --format zip --output somefile.zip or also git clone or git checkout) could even create files on the server. This should be only allowed in an OS-level chrooted environment, which Apache MINA SSHD does not and cannot provide.

We have therefore limited the available commands to a small set of whitelisted git commands that might be useful as maintenance commands for authorized power users on a git server implemented based on sshd-git. The command are: archive, blame, branch, describe, diff, gc, log, reflog, show, and status. All these commands can be executed from an client via git --git-dir <repo> <command> <args>, where <repo> is the server-side name of the git repository (its local path on the server relative to the configured root), <command> is the command name (e.g., archive) and <args> are the command arguments. Results are sent back via the command output streams (output or error streams) and are thus sent back to the client. For the archivecommand, the --output (or -o) argument is ignored; the archive is always returned via the command's output stream and this is also sent to the client.

Applications that might have relied on the ability to run other JGit command remotely may no longer work. Either implement your own dedicated command factory to enable accesss to certain commands, or set the property GitModuleProperties.RESTRICT_COMMANDS to false on the server-side SshServer (for all sessions) or on particular ServerSessions (for particular individual sessions) to re-enable access to all commands supported by JGit.

Changelog

Sourced from org.apache.sshd:sshd-sftp's changelog.

Previous Versions

Latest Version

Planned for Next Version

Bug Fixes

New Features

Potential Compatibility Issues

Major Code Re-factoring

Commits
  • e2926a2 [maven-release-plugin] prepare release sshd-2.19.0
  • 49e4408 Prepare release documentation
  • 8caed36 Bump dependency to org.apache.mina:mina-core
  • e940752 Fix copy-paste error in a test
  • 3a93226 UTF8 fix in NOTICE-bin.txt
  • 3f036c5 Restrict remote execution of git commands
  • a792e08 SCP: escape newlines in file names on sending
  • 400626e Update CHANGES.md
  • ab3672f SCP: validate filenames
  • 384de9e Update CHANGES.md
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): Bump sshd-core.version from 2.18.0 to 2.19.0
dea9f8f 
Bumps `sshd-core.version` from 2.18.0 to 2.19.0.

Updates `org.apache.sshd:sshd-core` from 2.18.0 to 2.19.0
- [Release notes](https://github.com/apache/mina-sshd/releases)
- [Changelog](https://github.com/apache/mina-sshd/blob/master/CHANGES.md)
- [Commits](apache/mina-sshd@sshd-2.18.0...sshd-2.19.0)

Updates `org.apache.sshd:sshd-sftp` from 2.18.0 to 2.19.0
- [Release notes](https://github.com/apache/mina-sshd/releases)
- [Changelog](https://github.com/apache/mina-sshd/blob/master/CHANGES.md)
- [Commits](apache/mina-sshd@sshd-2.18.0...sshd-2.19.0)

---
updated-dependencies:
- dependency-name: org.apache.sshd:sshd-core
  dependency-version: 2.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: org.apache.sshd:sshd-sftp
  dependency-version: 2.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@delchev delchev merged commit d27a630 into master Jul 10, 2026
10 checks passed
@delchev delchev deleted the dependabot/maven/sshd-core.version-2.19.0 branch July 10, 2026 14:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@delchev