Possible fix(deps): 4 vulnerable dependencies in Cargo.lock

[begininvoke]

I think there may be a problem in native/Cargo.lock around line 1988.

The russh-cryptovec crate (<= 0.60.2) contains unsafe memory handling that allows attacker‑controlled frame lengths to trigger unchecked buffer growth. This can lead to out‑of‑bounds writes, memory corruption, and potentially remote code execution when processing SSH traffic. Because the library is used in both client and server contexts, the vulnerability has a broad attack surface and is classified as HIGH severity.

Something like this might fix it:

*** Begin Patch
*** Update File: Cargo.toml
@@
- russh-cryptovec = "0.59.0"
+ russh-cryptovec = "0.60.3"
*** End Patch

After updating the version, run `cargo update -p russh-cryptovec` to regenerate Cargo.lock with the patched crate. If russh-cryptovec is only pulled transitively (e.g., via the `russh` crate), bump the `russh` dependency to a version >= 0.60.3, which will bring in the fixed cryptovec version.

For reference: rule CVE-2026-46673. Rated high.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.

[sleepinginsummer]

Thanks for the report. This is the same CVE reported in #3 and has already been fixed in v0.5.1 (commit f1acbc1).

The current main branch now contains:

russh = "0.60.3"

The resolved dependency tree is:

russh v0.60.3
└── russh-cryptovec v0.60.3

russh-cryptovec is a transitive dependency in this project, so we fixed it by upgrading the direct russh dependency rather than adding a new direct dependency. The lockfile checksums were regenerated by Cargo.

Validation completed before release:

• npm test: 40 passed
• release build: passed
• dependency tree confirmed both crates at 0.60.3
• SSH and su smoke tests passed in direct and daemon modes

Release: https://github.com/sleepinginsummer/agent-ssh-cli/releases/tag/v0.5.1

The versions referenced in this issue (russh 0.60.2 / russh-cryptovec 0.59.0) are no longer present on main, so this appears to have been generated from a stale pre-fix snapshot.