[Snyk] Security upgrade SSH.NET from 2020.0.2 to 2026.0.0

[joao-r-reis]

Snyk has created this PR to fix 1 vulnerabilities in the nuget dependencies of this project.

Snyk changed the following file(s):

• src/Cassandra.IntegrationTests/Cassandra.IntegrationTests.csproj

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	External Control of File Name or Path SNYK-DOTNET-SSHNET-18748188	706

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 External Control of File Name or Path

[joao-r-reis]

This major version upgrade from SSH.NET 2020.0.2 to 2026.0.0 introduces significant breaking changes, primarily related to the removal of support for legacy cryptographic algorithms. This will require verification of server configurations to ensure compatibility.

Key Breaking Changes:

• Removal of Legacy Algorithms (v2025.0.0): Support for the DSA (ssh-dss) signature algorithm, along with other legacy ciphers and MAC algorithms (like MD5-based HMACs), has been completely removed. Connections to servers that rely exclusively on these older algorithms will fail. [5]
• SftpClient Behavioral Changes (v2025.1.0):
  • Methods like CreateText and WriteAllText now truncate the destination file if it exists, aligning with standard System.IO.File behavior. The previous behavior was to append or fail. [2, 3]
  • ReadLines() now streams lines as they are enumerated, requiring the SSH connection to remain open during the process. Previously, it read all lines into memory at once. [2, 3]
• Security Fix Behavioral Change (v2026.0.0): A fix for a path traversal vulnerability (CVE-2026-48798) in ScpClient's recursive download now throws an ScpException if the server provides an invalid file path. Code not prepared to handle this exception may break. [8]

Recommendation:

• Verify Server Compatibility: Before upgrading, you MUST confirm that all target SSH/SFTP servers support modern key exchange algorithms, ciphers, and MACs. Servers relying on DSA keys or legacy ciphers must be updated. [5]
• Review SftpClient Usage: Review code that uses WriteAll* methods to ensure the new file-truncating behavior is acceptable. For ReadLines, ensure the client is not disposed before the enumeration is complete.
• Test Thoroughly: Due to the number of changes, thorough testing of connection, authentication, and file transfer operations against all production and test servers is critical.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.