libssh2: Backport more security patches & fix source build

deps/checksums/libssh2

@@ -1,38 +1,38 @@
-LibSSH2.v1.11.103+0.aarch64-apple-darwin.tar.gz/md5/1a98f31c7775b9b866bf931bd9f880b5
-LibSSH2.v1.11.103+0.aarch64-apple-darwin.tar.gz/sha512/59ab8fcb8560a8404892ecebdc8397a553fd71437ebc2ad483bb2cfea2f4db836c4e5739fdc8289e277f015cbb5b19c4b1ac33f63e2293c4ea321e9083c839d9
-LibSSH2.v1.11.103+0.aarch64-linux-gnu.tar.gz/md5/41a364df8045e55fd6d29cc9348bd04a
-LibSSH2.v1.11.103+0.aarch64-linux-gnu.tar.gz/sha512/1f991c86e4d12b4e9f85044550cbb990befca7947bcb2c51cdd6a5d8103a8337798e95d08c1546e6089ab964876806a0084364fea31834dca7db8a00223b6e91
-LibSSH2.v1.11.103+0.aarch64-linux-musl.tar.gz/md5/ab9c1a93417f0b720d52bdcd98668755
-LibSSH2.v1.11.103+0.aarch64-linux-musl.tar.gz/sha512/d862d28b254f57dac2c146feaa3c122c6aa3d6bc11c12d6faaa72a09675ddeb1af8df127fb5146486f62a69a558e452755ec14113ab71f3d6c121ecdc814cbdb
-LibSSH2.v1.11.103+0.aarch64-unknown-freebsd.tar.gz/md5/daa9eea141fc175b5c18da63ac625c39
-LibSSH2.v1.11.103+0.aarch64-unknown-freebsd.tar.gz/sha512/c50a405d77cbb98d1d8c5f8f13c61578f0d003d706469affbaa4b97c3c069c9326c9a9e4690cc3c701d10dfb0f092dad0f8933de2a34e627a05d8b5b72d7d048
-LibSSH2.v1.11.103+0.armv6l-linux-gnueabihf.tar.gz/md5/ee3284a84cee742624a03abd75a7a3d8
-LibSSH2.v1.11.103+0.armv6l-linux-gnueabihf.tar.gz/sha512/418f6967fa36d4ff06ee528c5298f9287029854f57c307811f7d80734c81a0f61e02736418e363e56913e79fb350511a9ca639af630fa506577d2b906cba04fb
-LibSSH2.v1.11.103+0.armv6l-linux-musleabihf.tar.gz/md5/f3a2af9c040fb6abbf8b6ff514fc86b5
-LibSSH2.v1.11.103+0.armv6l-linux-musleabihf.tar.gz/sha512/e98a2868955b6f74eeed4d1549f4ce2413bdc310eea599c669a7c5c35a017c3a806762709f8b4e34d182d12432522b58de17acbf036b97f1c57307f4dc3ca7e7
-LibSSH2.v1.11.103+0.armv7l-linux-gnueabihf.tar.gz/md5/7127c877a1c4111438145d86a16aa40c
-LibSSH2.v1.11.103+0.armv7l-linux-gnueabihf.tar.gz/sha512/502cb1ec5da72ee9db3e43ec0a36324d7c5ff0cb310d07fc030989243f556dd95190ec9af006b700a5ec3acc81ed14c4153f0b9b8c7cccc012f54f276d18d842
-LibSSH2.v1.11.103+0.armv7l-linux-musleabihf.tar.gz/md5/63ab699e54bbb4968ff09fe74d34f52c
-LibSSH2.v1.11.103+0.armv7l-linux-musleabihf.tar.gz/sha512/b29fce620a6bd8cbc4547fffd9e421517a0a2b8f03e9f6b7d7f84ba416b7cba40b0e92f6eba79c6ebc6c340c8c930f76ec8a7dfffc0ef45c20cb84dab91e2755
-LibSSH2.v1.11.103+0.i686-linux-gnu.tar.gz/md5/a08556197eb139ef0a8db0eda0cdaab7
-LibSSH2.v1.11.103+0.i686-linux-gnu.tar.gz/sha512/547d81afe33e5f495af92f7b283f917450226b34e4b58bb4cc924db1ae50bb1614b98efe2eb77781f22a3064dae4a21332156da73bffe3ba0a9eaf3db11fc56b
-LibSSH2.v1.11.103+0.i686-linux-musl.tar.gz/md5/8ce875868b4a4bfa6c9f21d30770c235
-LibSSH2.v1.11.103+0.i686-linux-musl.tar.gz/sha512/3db147bfaf704c90cec969e61e00f52ef6f39ccb6fb1c91d54e4b7bae583826593645a97716bbc9445349f8a5b4ab40850af1db2672887e5583d63ce55d2deff
-LibSSH2.v1.11.103+0.i686-w64-mingw32.tar.gz/md5/51a8097218ef646197475c4ee14b24f0
-LibSSH2.v1.11.103+0.i686-w64-mingw32.tar.gz/sha512/5b44fed8bdb2c6fa7057469734fe4aa56c1768e0a3f0fe6fbb42a3e0a4b2cfb9200f45bd19f5c6c789400f9690adbcdd5d32d9f8ba303472ba224fae8167c0b4
-LibSSH2.v1.11.103+0.powerpc64le-linux-gnu.tar.gz/md5/98821b5c1c679237bf68aeccc3e7baf1
-LibSSH2.v1.11.103+0.powerpc64le-linux-gnu.tar.gz/sha512/e5560fd22d2bbdce95e9e94894b77eb465926306273e96a2c19bca10d89b10e880912520da6f5dbd6beef7b48d7fe85be55b84e583c31c9855b8f41777cd2597
-LibSSH2.v1.11.103+0.riscv64-linux-gnu.tar.gz/md5/e5a1a06e952b4b59728a374b4adcd8b1
-LibSSH2.v1.11.103+0.riscv64-linux-gnu.tar.gz/sha512/24d33c5b119d50b8f05f013f2f4b2f016a08270a171ad5e6eb45d81c682c13a5c74da67e158bffa30c88a6058a906e3d20d0a78d011eb144efc78bad64fe2ce7
-LibSSH2.v1.11.103+0.x86_64-apple-darwin.tar.gz/md5/8b07265fa4cf4b8b4fd726c84b4bcdb0
-LibSSH2.v1.11.103+0.x86_64-apple-darwin.tar.gz/sha512/dd10e1a14809bb10b4e27387146908d2aedd946aa498ccc6bdef8b5c57eaea0b317473c7a9841ec2076a33cef7f78f555a31953f4584fd5f446434ccfe5f71b3
-LibSSH2.v1.11.103+0.x86_64-linux-gnu.tar.gz/md5/646ad2a841aa3be54dd9de6dc24aa5fb
-LibSSH2.v1.11.103+0.x86_64-linux-gnu.tar.gz/sha512/581d90e9dc7b1074784d29a8134c6c7d215191cd61040806e0d66df1cc63369b34ea7596cf6ac4630b201ad17ab532d5afb6ef87b952cb6fc53fbcdd713a406e
-LibSSH2.v1.11.103+0.x86_64-linux-musl.tar.gz/md5/e0d087aeacf2ecd4c227928ed56002bf
-LibSSH2.v1.11.103+0.x86_64-linux-musl.tar.gz/sha512/e81765a26695776c3c73b074a49341f89a2102c0a7eb20dcb8405a4f4fa7df1a5abe5965e8ea7bfa61b7aa77b66269c946a50a2bba13b2b66bfd8988403e1f11
-LibSSH2.v1.11.103+0.x86_64-unknown-freebsd.tar.gz/md5/432429303e4316f772ea6ced8cc53fb8
-LibSSH2.v1.11.103+0.x86_64-unknown-freebsd.tar.gz/sha512/d4745573cd1bc567107416074f457451988a9fd2df34c87362bc2276888382627a0b63a3fcee79c6238bcb653e68c12ad8eddd35e4c3d0519eddd6985c76f282
-LibSSH2.v1.11.103+0.x86_64-w64-mingw32.tar.gz/md5/d464e02ceec8873a98708ee569ecf791
-LibSSH2.v1.11.103+0.x86_64-w64-mingw32.tar.gz/sha512/26d1ea35297b41f1ad281927ad802413b8105fc55d685486b4ae63d6353b00ec406d5f8e87208e9a91a023352303f0efa555625729d20aedb56359af97b92d6b
+LibSSH2.v1.11.104+0.aarch64-apple-darwin.tar.gz/md5/c80c3a6d9438c4d8c039c8dbd910719f
+LibSSH2.v1.11.104+0.aarch64-apple-darwin.tar.gz/sha512/584cfa26448cf6ad9ff6649fbd67931e6a450753ee3abf93e2b1e21b71efc633b9a205a8b689e7dc68ac1ed290abb76e6d1520150af13240ae9e70d8f33b272c
+LibSSH2.v1.11.104+0.aarch64-linux-gnu.tar.gz/md5/736fc613e088caa8b32155f3967e5c61
+LibSSH2.v1.11.104+0.aarch64-linux-gnu.tar.gz/sha512/befc5cc82f952370a92fba06a73a99c9902f107ab6d2221bc99bc81a69d638bf2c7b0d4d1fb9798e68c07ecf138b3643bd81468ce5f1fdc7ffcd3037f6e93641
+LibSSH2.v1.11.104+0.aarch64-linux-musl.tar.gz/md5/61b8210e45460273ed93a5e4f8a7cb8e
+LibSSH2.v1.11.104+0.aarch64-linux-musl.tar.gz/sha512/bf8afcda7042f7011741d3b7523272300ddb065209f1a74e4025bff34119f3940e8541a024bb1bbc2c3d0ebb2307322a5916a2fbbecafd3c8867c3c452011806
+LibSSH2.v1.11.104+0.aarch64-unknown-freebsd.tar.gz/md5/5acc317322895743e1a835a3e4b140e5
+LibSSH2.v1.11.104+0.aarch64-unknown-freebsd.tar.gz/sha512/8880f2e4d1fa6e46e26566dd15c2a60ad5b3cf3a139f290654bbca9912d0f4c0b80286b89ea57cf5dc3e17a70a933a57f4de96fb63e519f08de7ad5f72e72157
+LibSSH2.v1.11.104+0.armv6l-linux-gnueabihf.tar.gz/md5/777a4814e584b32693eb30bda0358b85
+LibSSH2.v1.11.104+0.armv6l-linux-gnueabihf.tar.gz/sha512/c5ea3a33987cda5e52c5544956c22c11e315312fbe9c417e33449b1e169b7403b384a36f75a7647572ea385d5f1ab0414280429033739a766b13d5ffd772d586
+LibSSH2.v1.11.104+0.armv6l-linux-musleabihf.tar.gz/md5/62cd1829dde7245638cc78431661a0e9
+LibSSH2.v1.11.104+0.armv6l-linux-musleabihf.tar.gz/sha512/b7436082ffa3737916210c3354bffeefa8cba4398af8b6ea4caf5ccc1736026682ba234a31a58e687a5493dffef4386a64c90374c375f01f916237d6f0c4c670
+LibSSH2.v1.11.104+0.armv7l-linux-gnueabihf.tar.gz/md5/8f75fa1d0032543d28c59e244c66a08c
+LibSSH2.v1.11.104+0.armv7l-linux-gnueabihf.tar.gz/sha512/bc47d7acc6b820bab92db3c852ea1603242720e5ff332b58f9d19ef7938f478a23e6db18bb9ea1e6992064d2b271e74eb53e9258fb8c5bd7e139024dd63e0e4a
+LibSSH2.v1.11.104+0.armv7l-linux-musleabihf.tar.gz/md5/f0dc168cbb2b7026f13ff0846a44f069
+LibSSH2.v1.11.104+0.armv7l-linux-musleabihf.tar.gz/sha512/ca5bf1fc1b378c8ae00a9345d0a0db96920ac480c7be169292c1c681ea4990579e0d349d3f0163a84ce863ac658e55f4b6867ad2be86060e3944374576b0e6d7
+LibSSH2.v1.11.104+0.i686-linux-gnu.tar.gz/md5/8d86f81eb69d005e2cdb24b306e5a0c9
+LibSSH2.v1.11.104+0.i686-linux-gnu.tar.gz/sha512/6faaf8989eca814921bd5cb453132b42d7681d811332984ca9a007add5b12241dba080dfba498ac349d33855c0f8198d7fb1190683e73bb7154d14dd599c8ee0
+LibSSH2.v1.11.104+0.i686-linux-musl.tar.gz/md5/cfc1a41e856cde7c27024266a5c6e99d
+LibSSH2.v1.11.104+0.i686-linux-musl.tar.gz/sha512/13a084bd0fcbd05b26f481213c078f7d97b5883d9f6e7cc1ce2d933d19a208a67418fa971b0ac618b1cd86c8597a3c8558b278748d1c74277d8d19c547d78566
+LibSSH2.v1.11.104+0.i686-w64-mingw32.tar.gz/md5/bdc82199535a44d12e02057b3233f722
+LibSSH2.v1.11.104+0.i686-w64-mingw32.tar.gz/sha512/08abb65d7a890f82bfd2865abf66f104d531d9fe611383fa9d3013dc62919737134162ded1b932d61792b0ee45f546ffb3af39259943b1b081c82dda8c31607f
+LibSSH2.v1.11.104+0.powerpc64le-linux-gnu.tar.gz/md5/8d20e5281ba4cb27d6982e03458df3bd
+LibSSH2.v1.11.104+0.powerpc64le-linux-gnu.tar.gz/sha512/d6e716683a4f34abe416eb98e58ec4146bff479da768a77ed15eb0c379b9b07bf55ee5a6335773a504633c75712f38ea51d8caef0f72546af9e27ddd0fa4a1f7
+LibSSH2.v1.11.104+0.riscv64-linux-gnu.tar.gz/md5/848644503dbbc1d8bb10532f5a9c16dd
+LibSSH2.v1.11.104+0.riscv64-linux-gnu.tar.gz/sha512/4dbd9d29f0b17492808dc7a1899f00f100e0970c388e019da6060bfd779dea03239fb2a1111e6e2619f5a99050a8e15792885187a71abbc244510beca139c916
+LibSSH2.v1.11.104+0.x86_64-apple-darwin.tar.gz/md5/f7e379473de8225ff24549a7214bc334
+LibSSH2.v1.11.104+0.x86_64-apple-darwin.tar.gz/sha512/443977b263834d83b7d7f8b0b3073dd7b4d39f972dc40224a6514837cefd7c736fc2e09e6914558382b7df9f66ef0367ea6af4972ccfa77c78f57f687cbf8ab5
+LibSSH2.v1.11.104+0.x86_64-linux-gnu.tar.gz/md5/84533c6f0454fcf3ff2935c9f2aac41d
+LibSSH2.v1.11.104+0.x86_64-linux-gnu.tar.gz/sha512/1aee8b4bada0f95f2cbf44e97ed42ccf07ae22edc10c097c08e593fc196c294062b2e1c54d034609f83e17752168467f5e7040b7d72736d88cc3e98985311667
+LibSSH2.v1.11.104+0.x86_64-linux-musl.tar.gz/md5/2b3ec00615dfacc2bf35e260e59a1fc2
+LibSSH2.v1.11.104+0.x86_64-linux-musl.tar.gz/sha512/ff8cf9b6b205fe5bfb0f28fb1dd33a69b0bad7ee495b516762db42942c29347afa1028bd08897b601d42638d59cb9c21f24d388cdff4f57e3b9b1a31aa6a8aeb
+LibSSH2.v1.11.104+0.x86_64-unknown-freebsd.tar.gz/md5/6882b80e65a546a9a98e257c57f041a5
+LibSSH2.v1.11.104+0.x86_64-unknown-freebsd.tar.gz/sha512/d08e663684c6007167ab23417135262775b47e144c9d1c102f7214c882faf98e30a8734c7e90b3f9b32b26437928f37fc5dccb168bcdd76342f3e87de0140c1b
+LibSSH2.v1.11.104+0.x86_64-w64-mingw32.tar.gz/md5/7b301030186b141d20be22fbbb9ef61a
+LibSSH2.v1.11.104+0.x86_64-w64-mingw32.tar.gz/sha512/a5e8816d323d063706346780e76169954f78249974ff5f50ee5789f5af278bfed1ef98868297c9fa7cdfab978fe6b859812316c1f65124e68e923f11b9c2b86c
 libssh2-a312b43325e3383c865a87bb1d26cb52e3292641.tar.gz/md5/06d5e2881ac023583c7fd6665d628a87
 libssh2-a312b43325e3383c865a87bb1d26cb52e3292641.tar.gz/sha512/5dee8cce91853eb8c9968d7453b1ad0c3cd1411901d288f1731b7c7e4adf380313f61c2a66eee0d3b89eba79e420e13269bb3738bcf2c59f0b88276aa785fa8c

deps/libssh2.mk

@@ -32,45 +32,65 @@ endif
 
 LIBSSH2_SRC_PATH := $(SRCCACHE)/$(LIBSSH2_SRC_DIR)
 
-$(SRCCACHE)/libssh2-$(LIBSSH2_VER)/libssh2-CVE-2026-7598-256d04b60d80bf1190e96b0ad1e91b2174d744b1.patch-applied: $(SRCCACHE)/libssh2-$(LIBSSH2_VER)/source-extracted
+$(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-7598-256d04b60d80bf1190e96b0ad1e91b2174d744b1.patch-applied: $(LIBSSH2_SRC_PATH)/source-extracted
 	cd $(dir $@) && \
 		patch -p1 -f < $(SRCDIR)/patches/libssh2-CVE-2026-7598-256d04b60d80bf1190e96b0ad1e91b2174d744b1.patch
 	echo 1 > $@
 
-$(SRCCACHE)/libssh2-$(LIBSSH2_VER)/libssh2-CVE-2025-15661.patch-applied: $(SRCCACHE)/libssh2-$(LIBSSH2_VER)/libssh2-CVE-2026-7598-256d04b60d80bf1190e96b0ad1e91b2174d744b1.patch-applied
+$(LIBSSH2_SRC_PATH)/libssh2-CVE-2025-15661.patch-applied: $(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-7598-256d04b60d80bf1190e96b0ad1e91b2174d744b1.patch-applied
 	cd $(dir $@) && \
 		patch -p1 -f < $(SRCDIR)/patches/libssh2-CVE-2025-15661.patch
 	echo 1 > $@
 
-$(SRCCACHE)/libssh2-$(LIBSSH2_VER)/libssh2-CVE-2026-55199.patch-applied: $(SRCCACHE)/libssh2-$(LIBSSH2_VER)/libssh2-CVE-2025-15661.patch-applied
+$(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-55199.patch-applied: $(LIBSSH2_SRC_PATH)/libssh2-CVE-2025-15661.patch-applied
 	cd $(dir $@) && \
 		patch -p1 -f < $(SRCDIR)/patches/libssh2-CVE-2026-55199.patch
 	echo 1 > $@
 
-$(SRCCACHE)/libssh2-$(LIBSSH2_VER)/libssh2-CVE-2026-55200.patch-applied: $(SRCCACHE)/libssh2-$(LIBSSH2_VER)/libssh2-CVE-2026-55199.patch-applied
+$(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-55200.patch-applied: $(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-55199.patch-applied
 	cd $(dir $@) && \
 		patch -p1 -f < $(SRCDIR)/patches/libssh2-CVE-2026-55200.patch
 	echo 1 > $@
 
-$(SRCCACHE)/libssh2-$(LIBSSH2_VER)/libssh2-CVE-2026-58050-3449752.patch-applied: $(SRCCACHE)/libssh2-$(LIBSSH2_VER)/libssh2-CVE-2026-55200.patch-applied
+$(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-58050-3449752.patch-applied: $(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-55200.patch-applied
 	cd $(dir $@) && \
 		patch -p1 -f < $(SRCDIR)/patches/libssh2-CVE-2026-58050-3449752.patch
 	echo 1 > $@
 
-$(SRCCACHE)/libssh2-$(LIBSSH2_VER)/libssh2-CVE-2026-58051-a9758da.patch-applied: $(SRCCACHE)/libssh2-$(LIBSSH2_VER)/libssh2-CVE-2026-58050-3449752.patch-applied
+$(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-58051-a9758da.patch-applied: $(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-58050-3449752.patch-applied
 	cd $(dir $@) && \
 		patch -p1 -f < $(SRCDIR)/patches/libssh2-CVE-2026-58051-a9758da.patch
 	echo 1 > $@
 
-$(SRCCACHE)/libssh2-$(LIBSSH2_VER)/libssh2-unconst-backport.patch-applied: $(SRCCACHE)/libssh2-$(LIBSSH2_VER)/libssh2-CVE-2026-58051-a9758da.patch-applied
+$(LIBSSH2_SRC_PATH)/libssh2-unconst-backport.patch-applied: $(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-58051-a9758da.patch-applied
 	cd $(dir $@) && \
 		patch -p1 -f < $(SRCDIR)/patches/libssh2-unconst-backport.patch
 	echo 1 > $@
 
-$(SRCCACHE)/libssh2-$(LIBSSH2_VER)/source-patched: $(SRCCACHE)/libssh2-$(LIBSSH2_VER)/libssh2-unconst-backport.patch-applied
+$(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-66032.patch-applied: $(LIBSSH2_SRC_PATH)/libssh2-unconst-backport.patch-applied
+	cd $(dir $@) && \
+		patch -p1 -f < $(SRCDIR)/patches/libssh2-CVE-2026-66032.patch
+	echo 1 > $@
+
+$(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-66033.patch-applied: $(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-66032.patch-applied
+	cd $(dir $@) && \
+		patch -p1 -f < $(SRCDIR)/patches/libssh2-CVE-2026-66033.patch
+	echo 1 > $@
+
+$(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-66034.patch-applied: $(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-66033.patch-applied
+	cd $(dir $@) && \
+		patch -p1 -f < $(SRCDIR)/patches/libssh2-CVE-2026-66034.patch
+	echo 1 > $@
+
+$(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-66035.patch-applied: $(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-66034.patch-applied
+	cd $(dir $@) && \
+		patch -p1 -f < $(SRCDIR)/patches/libssh2-CVE-2026-66035.patch
+	echo 1 > $@
+
+$(LIBSSH2_SRC_PATH)/source-patched: $(LIBSSH2_SRC_PATH)/libssh2-CVE-2026-66035.patch-applied
 	echo 1 > $@
 
-$(BUILDDIR)/$(LIBSSH2_SRC_DIR)/build-configured: $(SRCCACHE)/libssh2-$(LIBSSH2_VER)/source-patched
+$(BUILDDIR)/$(LIBSSH2_SRC_DIR)/build-configured: $(LIBSSH2_SRC_PATH)/source-patched
 	mkdir -p $(dir $@)
 	cd $(dir $@) && \
 	$(CMAKE) $(CMAKE_GENERATOR_COMMAND) $(dir $<) $(LIBSSH2_OPTS)

deps/patches/libssh2-CVE-2026-66032.patch

@@ -0,0 +1,24 @@
+From 5e4776146552d898b9c0e1b313cd093fa8dc92d0 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Thu, 2 Jul 2026 11:00:23 -0700
+Subject: [PATCH] Prevent dangling pointer by nullifying data (#2180)
+
+Set data to NULL after freeing it to avoid dangling pointer. fixes
+GHSA-px3w-7g75-hg7w.
+
+Credit: VladimirEliTokarev
+Forwarded: not-needed
+---
+ src/sftp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/src/sftp.c
++++ b/src/sftp.c
+@@ -1279,6 +1279,7 @@
+                                "got HANDLE FXOK"));
+
+                 LIBSSH2_FREE(session, data);
++                data = NULL;
+
+                 /* silly situation, but check for a HANDLE */
+                 rc = sftp_packet_require(sftp, SSH_FXP_HANDLE,

deps/patches/libssh2-CVE-2026-66033.patch

@@ -0,0 +1,40 @@
+From a2ed82d40964bbc0d64cd717aa0a5a892117d2e6 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit@vsz.me>
+Date: Thu, 23 Jul 2026 10:32:04 +0200
+Subject: [PATCH] openssl: fix potential OOB read/write with AES-GCM in
+ `ssh2_cipher_crypt()`
+
+By applying two bounds checks to non-debug builds.
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-c4f7-cvfc-33j7
+Follow-up to 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797
+
+Closes #2401
+Forwarded: not-needed
+---
+ src/openssl.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/src/openssl.c
++++ b/src/openssl.c
+@@ -1042,13 +1042,15 @@
+     const int aadlen = (is_aesgcm && IS_FIRST(firstlast)) ? 4 : 0;
+     /* size of AT, if present */
+     const int authenticationtag = IS_LAST(firstlast) ? authlen : 0;
+-    /* length to encrypt */
+-    const int cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;
++    unsigned int cryptlen; /* length to encrypt */
+
+     (void)algo;
+
+-    assert(blocksize <= sizeof(buf));
+-    assert(cryptlen >= 0);
++    if(blocksize > sizeof(buf) ||
++       blocksize < (size_t)(aadlen + authenticationtag))
++        return 1;
++
++    cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;
+
+ #if LIBSSH2_AES_GCM
+     /* First block */

deps/patches/libssh2-CVE-2026-66034.patch

@@ -0,0 +1,31 @@
+From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit@vsz.me>
+Date: Sat, 4 Jul 2026 11:19:49 +0200
+Subject: [PATCH] publickey: fix potential OOB read in
+ `libssh2_publickey_list_fetch()`
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-w6g9-cpfp-22gc
+
+Closes #2202
+Forwarded: not-needed
+---
+ src/publickey.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/src/publickey.c
++++ b/src/publickey.c
+@@ -988,6 +988,13 @@
+                 }
+
+                 if(comment_len) {
++                    if(pkey->listFetch_s + comment_len >
++                       pkey->listFetch_data + pkey->listFetch_data_len) {
++                        _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL,
++                                 "ListFetch data too short");
++                        goto err_exit;
++                    }
++
+                     list[keys].num_attrs = 1;
+                     list[keys].attrs =
+                         LIBSSH2_ALLOC(session,

deps/patches/libssh2-CVE-2026-66035.patch

@@ -0,0 +1,37 @@
+From 42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit@vsz.me>
+Date: Fri, 3 Jul 2026 18:22:55 +0200
+Subject: [PATCH] transport: fix potential heap overflow on ETM decrypt
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-6c79-444r-wx26
+
+Closes #2198
+Forwarded: not-needed
+---
+ src/transport.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/src/transport.c
++++ b/src/transport.c
+@@ -242,6 +242,12 @@
+                 unsigned char *decrypt_buffer;
+                 int blocksize = session->remote.crypt->blocksize;
+
++                if(p->total_num < mac_len + 4 + (size_t)blocksize) {
++                    LIBSSH2_FREE(session, p->payload);
++                    return LIBSSH2_ERROR_DECRYPT;
++                }
++                decrypt_size = (ssize_t)(p->total_num - mac_len - 4);
++
+                 rc = decrypt(session, p->payload + 4,
+                              first_block, blocksize, FIRST_BLOCK);
+                 if(rc) {
+@@ -249,7 +255,6 @@
+                 }
+
+                 /* we need buffer for decrypt */
+-                decrypt_size = p->total_num - mac_len - 4;
+                 decrypt_buffer = LIBSSH2_ALLOC(session, decrypt_size);
+                 if(!decrypt_buffer) {
+                     return LIBSSH2_ERROR_ALLOC;

stdlib/LibSSH2_jll/Project.toml

@@ -1,6 +1,6 @@
 name = "LibSSH2_jll"
 uuid = "29816b5a-b9ab-546f-933c-edad1886dfa8"
-version = "1.11.103+0"
+version = "1.11.104+0"
 
 [deps]
 OpenSSL_jll = "458c3c95-2e84-50aa-8efc-19380b2a3a95"