From 1374b4dff0b8cc50f1367744401296968e69f4fa Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Thu, 1 Oct 2026 09:29:33 +0000
Subject: [PATCH] fix(deps): update rust crate russh to 0.63.0 [security]

---
 Cargo.lock                  | 35 +++++++++++++++++------------------
 crates/cmdr-sftp/Cargo.toml |  2 +-
 2 files changed, 18 insertions(+), 19 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 93167fbc5..9ebecc043 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5323,18 +5323,6 @@ dependencies = [
  "regex",
 ]
 
-[[package]]
-name = "internal-russh-num-bigint"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae8e22120c32fb4d19ec55fba35015f57095cd95a2e3b732e44457f5915b2ee8"
-dependencies = [
- "num-integer",
- "num-traits",
- "rand 0.10.2",
- "rand_core 0.10.1",
-]
-
 [[package]]
 name = "interpolate_name"
 version = "0.2.4"
@@ -6319,7 +6307,7 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
 dependencies = [
- "num-bigint",
+ "num-bigint 0.4.8",
  "num-complex",
  "num-integer",
  "num-iter",
@@ -6337,6 +6325,18 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-bigint"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93e7820bc0a80a0238e650327316f929ba18d5be054b647490a3a6a339f3e7c0"
+dependencies = [
+ "num-integer",
+ "num-traits",
+ "rand 0.10.2",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "num-complex"
 version = "0.4.6"
@@ -6400,7 +6400,7 @@ version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
 dependencies = [
- "num-bigint",
+ "num-bigint 0.4.8",
  "num-integer",
  "num-traits",
 ]
@@ -8539,9 +8539,9 @@ dependencies = [
 
 [[package]]
 name = "russh"
-version = "0.62.7"
+version = "0.63.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9decb68e4e44e1079700e54f17c8f23806ec53d7e0db73ab1c71d9dabc666812"
+checksum = "036204edbd199552a5b3832f63c60dcdf395dc44c7f06b4af1c0e8139cc11bce"
 dependencies = [
  "aes 0.9.1",
  "aws-lc-rs",
@@ -8570,13 +8570,12 @@ dependencies = [
  "hex-literal",
  "hmac 0.13.0",
  "inout 0.2.2",
- "internal-russh-num-bigint",
  "keccak",
  "log",
  "md5",
  "ml-kem",
  "module-lattice",
- "num-bigint",
+ "num-bigint 0.5.1",
  "p256",
  "p384",
  "p521",
diff --git a/crates/cmdr-sftp/Cargo.toml b/crates/cmdr-sftp/Cargo.toml
index 8e1ba1940..509ddb7d1 100644
--- a/crates/cmdr-sftp/Cargo.toml
+++ b/crates/cmdr-sftp/Cargo.toml
@@ -33,7 +33,7 @@ cmdr-fs = { path = "../cmdr-fs" }
 # crate shipped eight breaking minors in eight months, so a bump has to be one
 # file's problem. `aws-lc-rs` is russh's default crypto backend and is already in
 # `Cargo.lock` through `rustls`.
-russh = "0.62.7"
+russh = "0.63.0"
 # The SFTP protocol engine over russh's channel stream. Modeled on
 # openssh-portable's own `sftp-client.c`, and the only candidate that both
 # negotiates `limits@openssh.com` and exposes per-extension predicates.