[frequency403]

Summary

Updates SSH.NET from 2025.1.0 to 2026.0.0 (and SshNet.Keygen to 2026.0.0) to pick up security fixes and clear the NU1903 build warnings.

Changes Made

• Bug fix (non-breaking change)

• SSH.NET 2025.1.0 → 2026.0.0. Fixes:

  • GHSA-vhpg-4g9v-rppq: infinite loop in Channel.SendData when RemotePacketSize=0. Reachable through the SshClient/SftpClient connections the app opens (a malicious server could hang it).
  • GHSA-h5q6-2gr6-3g3m: uncapped data during protocol version exchange. Reachable for the same reason.
  • GHSA-q939-rpr3-3284, GHSA-mggc-4xg6-vcxf: ScpClient only, not used by the app; these caused the NU1903 warnings.
  • The upstream release notes list no breaking changes.

• SshNet.Keygen 2024.2.0.2 → 2026.0.0: required, since it pins SSH.NET [2026.0.0, 2027.0.0).

• SshNet.PuttyKeyFile stays at 2024.2.0.3 (no newer release). It is referenced in OpenSSH_GUI.Core.csproj but not used in code: PPK files are read by SSH.NET's PrivateKeyFile and written by SshNet.Keygen's ToPuttyFormat. It could be removed in a follow-up.

• New PuttyKeyFileCompatibilityTests: PPK files written by SshNet.Keygen (PuTTY v2/v3; RSA, ED25519, ECDSA; with and without passphrase) must load with SSH.NET's PrivateKeyFile and give the same public key. This guards the PPK read path, which had no test before.

Testing Performed

• Added unit tests (if applicable)
• Verified no regression in existing functionality

Test Evidence

• dotnet build OpenSSH_GUI.slnx -c Release: 0 errors, NU1903 warnings gone
• dotnet test OpenSSH_GUI.slnx -c Release: 230 passed, 3 skipped (Unix-only), 0 failed (Windows)
• Not tested: a live SSH/SFTP connection against a real server (no integration tests exist for ServerConnection).

Checklist

• Code follows project style guidelines
• Self-reviewed my code
• No new warnings/errors introduced
• All builds pass locally (dotnet build, dotnet test)

---

Notes for Reviewers:

• Priority: medium (two reachable DoS fixes)
• Breaking change: no

🤖 Generated with Claude Code

[github-actions]

Automated review by Claude: no blocking findings.

I read the whole diff. It bumps SSH.NET and SshNet.Keygen to 2026.0.0 in Directory.Packages.props, as central package management requires. It also adds a cross-platform PPK round-trip test that uses a temp directory and cleans it up. I did not build the code or run the tests, so I couldn't check the new package APIs. I found no change to host-key verification, file permissions, passphrase handling, backup/restore, resx strings or CI, so I found no blocking issues.