libssh2 1.11.2_DEV

Deprecation notices:

- This release disables these options by default:

- DSA: `ssh-dss` hostkeys.

You can enable it with `-DLIBSSH2_DSA_ENABLE`.

- MD5-based MACs and hashes: `hmac-md5`, `hmac-md5-96`,

`LIBSSH2_HOSTKEY_HASH_MD5`

You can enable it with `-DLIBSSH2_MD5_ENABLE`.

- old-style, MD5-based encrypted private keys:

You can enable it with `-DLIBSSH2_MD5_PEM_ENABLE`.

- 3DES cipher: `3des-cbc`

You can enable it with `-DLIBSSH2_3DES_ENABLE`.

- RIPEMD-160 MACs: `hmac-ripemd160`, `hmac-ripemd160@openssh.com`

You can enable it with `-DLIBSSH2_HMAC_RIPEMD_ENABLE`.

- Blowfish cipher: `blowfish-cbc`

You can enable it with `-DLIBSSH2_BLOWFISH_ENABLE`.

- RC4 ciphers: `arcfour`, `arcfour128`

You can enable it with `-DLIBSSH2_RC4_ENABLE`.

- CAST cipher: `cast128-cbc`

You can enable it with `-DLIBSSH2_CAST_ENABLE`.

- The next release drops support for the above options.

- This release dropped support for OpenSSL <1.1.1 and LibreSSL <2.7.

- The next release drops mbedTLS 2.x support, following its

deprecation upstream.

- This release drops support for Visual Studio 2008 and older.

Requiring 2010 or newer (`_MSC_VER` >= 1600).

- This release always enables large file support on Windows.

This release includes the following enhancements and bugfixes:

- agent: pageant backend, bound reply copy, handle missing reply (8ddf3b31 #1711)

- agent: fix error code on agent recv error (42669040 #1710)

- agent: fix byte amount copied for method in libssh2_agent_sign (9136cc76 #1603)

- agent: merge `agent_win.c` into the main source (ddc4cf34 #941 follow: 4f0f4bff)

- appveyor: enable WinCrypt ECDSA in tests, move to Windows 2016 (0f584387 #1721 #1720 #1461)

- appveyor: fix PowerShell warning (df2b206c #1514)

- appveyor: use `-A` option with all MSVC versions (25d3a092 #1513)

- build: quote a cmake variable, drop redundant step in Cygwin CI jobs (bb7b68de #1730)

- build: fix/extend Apple clang and mainline llvm version translations (664d7654 #1658)

- build: tidy up comments on `Makefile.inc` variables (723b7017 #1615)

- build: sync up picky warnings with curl, fix fallouts (72982d15 #1588 #1525 #1524)

- build: drop `crypto.c` umbrella source (e0681cdb #941 follow: 4f0f4bff)

- build: add support for clang-cl, add CI job (784446b6 #1484)

- build: enable `-Wcast-qual`, fix fallouts (606c102e #1527)

- build: prepare builds for clang-cl, add cmake ossfuzz support (854cfa82 #1524)

- build: disable warning `-Wunreachable-code-break` (4844e368 #1481 #12331 #1224 follow: 7ecc309c)

- checksrc: update, update local config, fix toctou in examples (557611f9 #1719)

- checksrc: sync with curl (7e1c6be1 #1474)

- clang-tidy: fix and/or silence issues found, and more (a1a28ac9 #1561)

- cmake: verify minimum CMake version in `libssh2-config.cmake` (96e21c2e #1754)

- cmake: namespace all local variables in `libssh2-config.cmake` (78cd32aa #1752)

- cmake: save and restore `CMAKE_MODULE_PATH` in `libssh2-config.cmake` (7fd89a58 #1750 #1322 follow: 82b09f9b)

- cmake: small tidy-ups (3969991b #1732)

- cmake: link wolfSSL macOS/Unix system lib dependencies (f2838c76 #1722)

- cmake: tidy up passing compiler and linker options (61d51cb4 #1690 #939 #1686 #1524 follow: 80175921)

- cmake: enable picky warnings for `MSC_VERSION=1944` (549d90b8 #1687)

- cmake: pass picky C options to C targets only (and not to C++ ossfuzz) (14a709a7 #1686)

- cmake: use modern alternative for `get_filename_component()` (af679ecc #1673)

- cmake: initialize `__runtime_dependencies` variable (fdd6aa2c #1661 #1610)

- cmake: use C compiler version (not C++), fix a fallout (09eb59e3 #1648 follow: 09f0ffd9)

- cmake: make `clean-coverage` target portable (25ed4d74 #1647)

- cmake: add `LIBSSH2_DISABLE_INSTALL` option (dd50a411 #1638)

- cmake: make the ExternalProject test work (714fa876 #1637 #1589)

- cmake: fixup `Libs.private` lib order (ad8e9245 #1623 #1535 #1466 follow: c87f1296)

- cmake: de-duplicate `LIBSSH2_PC_LIBS_PRIVATE` more carefully (e1da7b2c #1621 #1131 follow: 64643018)

- cmake: tidy up `add_feature_info()` formatting (4e08dac7 #1622)

- cmake: pre-fill more, simplify control flow (300da4e2 #1620)

- cmake: drop redundant `-lws2_32` meant for `libssh2.pc` (22784a56 #1619 #827 #811 #1535 #1128)

- cmake: add linter, fix issues (694b9d96 #1610)

- cmake: test integration with old cmake (v3.11.4 2018-03-28) (f522f10c #1591)

- cmake: honor individual picky option overrides found in `CMAKE_C_FLAGS` (62ad6a84 #1590)

- cmake: fix copy-paste typo in integration tests for old cmake (4e78006c #1592 #1589)

- cmake: extend integration tests (77df7677 #1589)

- cmake: `IMPORTED` target improvements and fixes (ac800418 #1581 #1571 #1535)

- cmake: avoid 'target is imported but not globally visible' when consuming libcurl with old cmake (a8dd5090 #1587 #1581)

- cmake: fix `libssh2-config.cmake` for cmake <3.15 (117b02b4 #1586 #1322 follow: 82b09f9b)

- cmake: whitespace in Find modules (3ae5ae32)

- cmake: use `CMAKE_COMPILE_WARNING_AS_ERROR` if available (6af8a7ca #1583)

- cmake: fix declspec for MSVC consuming static libssh2 (7b4f821e #1579 #1578)

- cmake: tidy-up `ENABLE_WERROR` logic (8a871d0b #1576)

- cmake: avoid passing options via `CMAKE_*_FLAGS` (a8e4456b #1575)

- cmake: fix target interfaces for old CMake versions (a0d8529b #1571 #1535)

- cmake: use `VERSION_GREATER_EQUAL` (71179930 #1573)

- cmake: add clang-tidy support via `LIBSSH2_CLANG_TIDY=ON` (66358804)

- cmake: replace deprecated `CMAKE_COMPILER_IS_GNUCC` (902fc957 #1564)

- cmake: make Find modules use `INTERFACE` (df0563a8 #1535 #1534)

- cmake: add comment to inegration test (8ea6ae72 #1529)

- cmake: use `GREATER_EQUAL` (837ccb2d #1559)

- cmake: replace `add_definitions()` with directory props (94a099bc #1558)

- cmake: prefer `CMAKE_INSTALL_PREFIX` over `--prefix` (in tests) (669b51a0 #1542)

- cmake: add missing quotes (9642a96e #1540)

- cmake: exclude `CMAKE_C_IMPLICIT_LINK_DIRECTORIES` from `libssh2.pc` (3de8731e)

- cmake: initialize variables where missing (d92de595 #1539)

- cmake: normalize before matching paths with syspaths (9da0ca3c #1538)

- cmake: ZLIB linkage tidy-ups (eea97dbf #1534)

- cmake: extend, not overwrite, `CMAKE_REQUIRED_*` values (d07d12ae)

- cmake: avoid dupe `target_link_libraries()` commands in tests (1a9f7b4c)

- cmake: make `libssh2-config` work with all TLS-backends (96d7f404 #1534 #1525 #1460 #1322 follow: 82b09f9b follow: d9c2e550)

- cmake: tidy up string append and list prepend syntax (d033c1ea #1533 #1524)

- cmake: split integration tests into steps (7d5a4c76 #1529)

- cmake: misc improvements, add `LIBSSH2_USE_PKGCONFIG` option (a3aa6b4c #1525)

- cmake: make integration tests generator-agnostic, use `GIT_SHALLOW` (1612807b #1523)

- cmake: bump policy_max, add `FATAL_ERROR` for old cmake versions (717c0836 #1510)

- cmake: fix cmake warnings (47258265 #1511)

- cmake: tidy up `-j` make option in integration tests (389d70bf #1509)

- cmake: build but don't install static lib in certain conditions (5d03b4f9 #1469 #1450)

- cmake: add clang-cl support to PickyWarnings.cmake (bf9bb045 #1480)

- cmake: tidy up variables names in PickyWarnings.cmake (ac00f6c4 #1478)

- cmake: decorate comments in Find modules (efad5f90 #1477)

- cmake/Find*: clear package version after `pkg-config` detection (d4e43c7b #1479)

- cmakelint: also lint CMake `.in` files (fixup), fix a long line (69bed46a #1751)

- cmakelint: also lint CMake `.in` files (9e4d307e #1751)

- comp: use `z_const` when zlib supports it (c03eb8d3 #1555)

- configure: fix `--without-lib*-prefix` when `lib*` is detected anyway (ffd0c982 #1506 #1505 #1384 follow: d19b6190)

- configure: drop duplicate `-lmbedcrypto` from `LIBS` (bd8caa19 #1507)

- disable deprecated algos by default (b89858b8 #1531)

- Dockerfile: pin Debian trixie image, enable Dependabot (d2230944 #1724)

- Dockerfile: switch to Debian stable (f89406b5 #1595 #1594 #1591)

- docs: convert man page sources to "curldown" format (b889b399 #1660)

- docs: improve man page for `libssh2_channel_request_auth_agent` (30203f16 #1503)

- fix two NULL checks (openssl, userauth) (51b35d1b #1656 #698 #1314 follow: 3a6ab70d follow: ed439a29)

- GHA: bump pip reuse and 2 GitHub Actions (dd2b04f2 #1756 #1755)

- GHA: minor command sync with the curl repo (2b7f8298)

- GHA: move config log dumps to their separate steps (78ffc2d4 #1749)

- GHA: fix using mbedtls@3 in macOS jobs (c124c6a9 #1748 #1744)

- GHA: switch macOS jobs to versioned mbedtls@3 brew package (b098a3c4 #1744)

- GHA: add actionlint job, fix reported issues (f61703cc #1740)

- GHA: run fuzzer on master commits, bump upload-artifacts (455f0622 #1736)

- GHA: replace deprecated `set-output` command with `$GITHUB_OUTPUT` (d4ebb524 #1735)

- GHA: set concurrency, zizmor Dependabot, set cooldown (da6dec93 #1734)

- GHA: drop `HOMEBREW_NO_AUTO_UPDATE=1` (8dd9da32 #1678)

- GHA: bump crypto lib dependencies (7c92792f #1728)

- GHA: bump components (45d52d16 #1726 #1725)

- GHA: stop running tests with Libgcrypt (51f6259d #1720 #1723 #1721 #1718 #1644)

- GHA: bump reuse from 5.1.1 to 6.1.2 (9abb4e78 #1716)

- GHA: bump github/codeql-action from 3.30.5 to 4.30.7 (aa334c77 #1715)

- GHA: show full versions next to pinned actions (f29de587 #1695)

- GHA: pass zizmor a GH token, fix warnings found (ab7dd899 #1694)

- GHA: bump actions (af2de52f #1693 #1692)

- GHA: use `--enable-option-checking=fatal`, fix fallout (a7b3fdb4 #1689 #1685)

- GHA: sync MSVC job names with others (31f23ac0)

- GHA: fix Linux autotools jobs to honor their zlib settings (1f79b005 #1685)

- GHA: merge cmake/autotools steps, other misc updates (9ce9909d #1684)

- GHA: bump github/codeql-action and actions/cache (08f5df3c #1682 #1681)

- GHA: enable Dependabot pip updates (cd37b704 #1680)

- GHA: drop spaces from `requirements.txt` (e9905622)

- GHA: use `reuse` linter tool directly, merge linters into a single workflow (ec5ba062 #1678)

- GHA: pin codespell, use venv (d4142923 #1676)

- GHA: merge Linux CodeQL jobs into one (a30ea29b #1666 #1657)

- GHA: disable `trap-caching` in CodeQL (b200b656)

- GHA: fixup comments after actions bump (3389a125)

- GHA: bump actions/checkout from 4.2.2 to 5.0.0 (765c102f #1665)

- GHA: rename GHA CodeQL configuration (629904e4 #1655)

- GHA: test WinCNG with CodeQL (746de2ad #1659)

- GHA: extend CodeQL to libgcrypt, mbedTLS, wolfSSL, zlib builds (63ae236f #1657)

- GHA: add CodeQL jobs for GHA and C (1ec4e27f #1655)

- GHA: document permissions as required by zizmor 1.13.0 (4cb8398f #1653)

- GHA: bump actions (a0dafb31 #1651 #1650 #1649)

- GHA: enable Dependabot to bump GitHub Actions (60c528be)

- GHA: stay on windows-2022 runners (2fcba30a #1645)

- GHA: bumps, delete two jobs with fallouts (0ec6b3e8 #1642)

- GHA: allow more time for 'CM integration' job (dfe7aca9)

- GHA: move CI checks to Linux, other CI tweaks (e62a72b2 #1618)

- GHA: fix new zizmor warnings (339ea0f6 #1614)

- GHA: fix zizmor and shellcheck warnings, verify in CI (d7cf63bb #1609)

- GHA: avoid touching `GITHUB_ENV` (201c368a #1598)

- GHA: use more Ninja (09c948c9 #1585)

- GHA: skip updating man-db for faster installs (Ubuntu) (01b8d356 #1584)

- GHA: move Cygwin to drive `D:` for install speed (1323e17b #1567)

- GHA: add clang-tidy jobs for Linux and Windows (fb7ea5d7 #1566)

- GHA: sync linux-mingw workflow with curl (15752e5f)

- GHA: add CI test for AWS-LC (d32ab162 #1557)

- GHA: limit `ENABLE_ECDSA_WINCNG` option to WinCNG (5f51c7a2 #1368 follow: 3f98bfb0)

- GHA: bump BoringSSL (6443b2f9 #1530)

- GHA: general maintenance, security, add LibreSSL and old OpenSSL jobs with tests (008e82c0 #1528)

- GHA: fix Cygwin breakage in `mansyntax.sh` (d65c4b39 #1521)

- GHA: bump to cygwin v5 (bc781383 #1512)

- GHA: make `apg-get install` faster, drop a workaround (d01680ca #1476)

- GHA: adjust job for Ubuntu 24.04 image (9d6836e0 #1470)

- GHA/codeql: limit cron job to the origin repository (1045cfd0 #1741)

- GHA/dependabot: group updates, other tidy-ups (26a78929)

- GHA/dependabot: minor fixes to prev (6c6ea30d #1724)

- GHA/dependabot: fix Dockerfile path (d1ba043d #1724)

- GHA/dependabot: fix pip directory (5dd317fa)

- gitignore: compress rules (90a686ef)

- INSTALL_CMAKE: fixes build result directories (98cd10d1 #1617)

- kex: remove unused kex state variable `exchange_hash` (c3d8976c #1713)

- kex: fix DH-GEX-sha256 bignum initialization (30befffe #1599 follow: 09c5e599)

- kex: fix possible null pointer dereference in diffie_hellman_sha_algo() (1ac1ff44 #1508)

- kex: return error if user KEX methods are invalid #1553 (4beed724 #1554 #1553)

- knownhost: improve known_hosts parsing and harden _libssh2_base64_encode() (d1c0e14d #1641)

- knownhost: handle malformed comments in known_hosts parsing #1628 (aa4c7b5b #1629 #1628)

- libgcrypt: add support for RSA SHA-256/SHA-512 (f4642222 #1600)

- libssh2_base64_decode: add deprecation warning (cf3aac1a)

- libssh2_scp_send, libssh2_scp_send_ex: add deprecation warning (70276045)

- libssh2_trace.3: Update prototype (7495084b #1518 #1517)

- libssh2.h: typo fixes (780bf13a #1496)

- libssh2.h: add note about release versions to `LIBSSH2_VERSION` (83590ac7 #1475 #771 #1473)

- mansyntax.sh: revert a change to unhide `man` error output (c343f06b #982)

- mbedtls: fix using garbage value (reported by clang-tidy) (16ce0ec8 #1729 #132 follow: 186f1a2d)

- mbedtls: Bug fix for gen_publickey_from_rsa (6746b789 #1560)

- misc: fix small leak in base64_encode() with empty data #1627 (cea8783e #1630 #1627)

- misc: _libssh2_base64_decode() handle malformed data (8cad398b #1551)

- openssl: drop support for OpenSSL <1.1.1, LibreSSL <2.7 (2018-03-21) (cea796fc #1668)

- openssl: fix to build with wolfSSL without AES-CTR (4fbd5923)

- openssl: make it compatible with wolfSSL built without `OPENSSL_ALL` (2da28146)

- ossfuzz: fix picky compiler warnings, make it pass `checksrc` (96cbe618 #1526 #901 follow: 50124428)

- packet: authagent_open: fix failure packet length (31ec5a8b #1701)

- packet: fix type mismatch in "reason code" (13a71451 #1706)

- pem: fix possible double free if key in error cases (2fb5803c #1550 #1549)

- REUSE: add copyright headers to more files, `.gitignore` updates (4f9e6e0b #1718)

- scp: fix NULL dereference in path arg of send/recv (992dafbc #1625)

- scripts: fix shellcheck SC2046 warnings (f97fb271 #1739)

- SECURITY.md: mention GitHub PVR as an option (5bd1baed #1664)

- session: null checks to quiet fuzzer (c090b696 #1556)

- sftp: fix sftp_symlink when getting SSH_FXP_STATUS response (4ed26f57 #1731)

- sftp: update sftp_symlink to avoid out of bounds read on malformed packet #1705 (2dae3024 #1717 #1705)

- sftp: downcast packet length checks #1707 (c097c681 #1714 #1707)

- sftp: add input bounds checking to SFTP API (ff50682c #1679)

- tests: improve `SSHD` default value (fixup) (ea56904a #1568 #1563)

- tests: use `setfacl` if available (cf15fdd2 #1565)

- tests: improve `SSHD` default value (fb12d87e #1563)

- tests: add support for wine/qemu (5930dc3c #1562)

- tests: delete CMake ExternalProject integration test (8011f901 #1522 #1510 #1116)

- tidy-up: `Makefile.am` comments and copyright header (199526f9 #1662)

- tidy-up: fix typos found by typos-cli 1.36.2 (c3e6dbd4 #1654)

- tidy-up: replace `exit()` with `return` (a751d578 #1541)

- tidy-up: prefer `#ifdef` / `#ifndef` (formatting) (5cca650b #1532)

- tidy-up: `unsigned const char` -> `const unsigned char` (114923f1 #1487)

- tidy-up: spelling (91b0e099)

- transport: fix when server/client uses encryption method with integrated MAC and the other does not (d8ae40ba #1582)

- transport: fix formatting (64fafc78)

- transport: fix indentation of comments (21228cff)

- transport: stop passing newline to the trace handler via `debugdump()` (c78d54c2 #1492 #1485 follow: 0f0652a3)

- userauth: fix error message for EAGAIN in public-key response (81f0203c #1747)

- userauth: fix typo from #1516 (73ac65f7 #1516)

- userauth: fix possible memory leaks #1504 (49837fd7 #1516 #1504)

- wincng: move `_libssh2_aes_ctr_increment()` from misc, make static (131480d2)

- wolfssl: fix detecting ECDSA support (b807dac9 #1723 #666 #1720 follow: b95e7582)

This release would not have looked like this without help, code, reports and

advice from friends like these:

Viktor Szakats, Will Cosgrove, "dependabot[bot]", Joshua Rogers, Liu Xing Yu,

Josh Brobst, Kai Pastor, Michael Buckley, pyscripter on github,

Stanislav Osipov, Amy Lin, Anders Borum, Chris Emsen, chrisgch,

Christian Ghisler, Christoph Reiter, Daniel Stenberg, Dhiraj Mishra,

Eli Schwartz, geral-victor on github, Jacob Barthelmeh, Justin Smith,

Kian Kasad, Lars Nordin, Lucas Queiroz, Marcel Raad, Oblivionsage, oss-patch,

Pascal Neuperger, Paul Howarth, Ryan Kelley, skuodi on github,

Stephan Eggermont, trustytrojan