Changelog for openssh: 10.4p1 -> 10.5p1
Source: ChangeLog

depend
update version
upstream: add regress test for servers that hang durig banner write;
upstream: openssh-10.5
upstream: remove ml-dsa/x25519 from the default algorithm list for
upstream: make reading server banner non-blocking; prevents one
Use clang-20 when building hardenedmalloc for tests.
upstream: remove mlkem768brainpoolp256r1-sha256; requested by
upstream: move comment to a better place; suggested by markus@
upstream: add some options to allow setting or clearing the
upstream: Allow session-bind@openssh.com requests when the agent is
upstream: avoid potential realloc use-after-free in the client if a
upstream: fix up synopsis and tweak wording for -Z
upstream: document existence of
Re-allow PAMServiceName inside a Match block.
Rerun VM tests on regress Makefile change too
Run tests on regress Makefile changes too.
upstream: disable pubkey-priority test until I can fix it to not pick
upstream: Fix expected output for implicit ordering test. ok djm@
Don't enable Brainpool on AWS-LC or BoringSSL.
Correct filename in comment.
Fix OpenSSL ECC detection message.
Make EC_KEY_METHOD_new optional again.
upstream: crank up MaxAuthTries to avoid failures here
upstream: regression test for pubkey ordering in the client; ok
upstream: Tweak ordering of certificates tried during pubkey
upstream: Add a "ssh -Z user@host" mode that dumps the pubkeys that
upstream: fix ML-KEM/ECDH interop problem (does not affect
Require NISTP521 in libcrypto.
Remove support for libcrypto w/out ECC.
Add includes.h for compat interfaces.
upstream: Use ssh_mldsa44_ed25519_cleanup consistently to avoid
upstream: Fix $OpenBSD marker for easier syncing.
upstream: ssh: update kex unit test
upstream: Make mlkem768ecdh build with OPENSSL=no. ok djm@
upstream: pass back errors from ed25519 key generation, which
upstream: Move check of public key type against allowed algorithms
upstream: Fix double frees (impossible to reach outside of a test
upstream: ssh: implement mlkem768brainpoolp256r1-sha256; ok djm@
upstream: ssh: implement mlkem768nistp256-sha256; ok djm@
upstream: use sshpkt_fatal instead of plain fatal() for errors in
upstream: Automatically detect IPv6 support
upstream: Factor out all of the IPv6 addresses into variables.
Sync missed case-insensitivity changes.
Add obsd79 target.
Wording.
upstream: verify that ChannelTimeout in a Match block is effective
upstream: verify that RekeyLimit in a Match block is effective
upstream: Use -Ohashalg to restrict output to specfic hash instead
upstream: fix ChannelTimeout and RekeyLimit not being applied in
upstream: s/= - 1/= -1/; from serity---
upstream: move to a better place
upstream: use crypto_api.h #define constants for lengths; no
upstream: make authorized_keys "restrict" keyword apply correctly
upstream: in sshd config dump mode, write all directives in mixed
upstream: read ~/.ssh/id_mldsa44_ed25519 private key files by
upstream: document mldsa44-ed25519 host key and public key
upstream: when signing hostkey proofs for a client UpdateHostKeys
upstream: setproctitle(3) to identify sshd-session when its
upstream: delete list of ssh_config(5) options under
upstream: enable the ssh-mldsa44-ed25519@openssh.com signature
upstream: prefer fstat to stat when it's trivial to do so
upstream: Add tests for ecdsa 256, 384 and 521 keys in DNS
upstream: check sshd_config output case insensitively
upstream: Add SSHFP tests for ed25519 key type.
upstream: Restructure the SSHFP test in preparation for adding
remove README.tun
add some parentheses to clarify a && || condition
upstream: unused variables
upstream: fix GSSAPI option names, that I somehow screwed up while
Add 10.4 branch to status page.