deps: bump russh from 0.62.7 to 0.63.1

[dependabot]

Bumps russh from 0.62.7 to 0.63.1.

Release notes

Sourced from russh's releases.

v0.63.1

Security fixes

GHSA-47hw-gvq5-r2gm - client-side Handler callbacks reachable with invalid channel IDs

A mirror of GHSA-m65r-rprj-r5rg for the client side - Handler per-channel callbacks are called even when the server supplies an invalid (never opened) channel ID. Depending on what the handler does this can lead to a vulnerability.

GHSA-p8qx-h547-fjw9 - MAC-requiring block cipher can be negotiated without MAC and panic

Two peers disagreeing on supported MACs can end up negotiating none MAC for a cipher that requires one, which leads to the session task panicking.

v0.63.0

Features

• 09f6582: Support host certificates on the client side (#752) (@​biao29) #752

  • This changes the signature of Handler::check_server_key to take a new PublicKeyOrCertificate enum instead of &PublicKey

• d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

  • Adds a Config::certificates that functions similarly to Config::keys

Fixes

• f2354c7: improve strict kex checks (Eugene)
• 0363fde: fixed PKCS#8 parsing panicking on incorrect contents (Eugene)
• 46c927a: use constant-time comparison for agent unlock (Eugene)
• 8da8967: sanitize Curve25519 params (Eugene)

Full Changelog: Eugeny/russh@v0.62.7...v0.63.0

v0.63.0-beta.1

Features

• 09f6582: Support host certificates on the client side (#752) (@​biao29) #752
• d7601ae: Support host certificates on the server side (#641) (Georg von Zengen) #641

Full Changelog: Eugeny/russh@v0.62.7...v0.63.0-beta.1

Commits

• d3ae702 v0.63.1
• 2885385 fixed mac negotiation
• 3430fd2 correctly handle unexpected channel IDs
• dbe2234 v0.63.0
• c7c673c strict kex tests
• f2354c7 improve strict kex checks
• 8da8967 sanitize Curve25519 params
• 46c927a use constant-time comparison for agent unlock
• 0363fde fixed PKCS#8 parsing panicking on incorrect contents
• ef9fbe1 Update README.md
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)