Download Transit

Security

• Updated the SSH transport, russh, from 0.62.5 to 0.63.3. The client-side

fixes this brings: channel-scoped event handlers no longer fire for channel

IDs the client never opened (GHSA-47hw-gvq5-r2gm, high), the hybrid ML-KEM

key exchange now rejects an all-zero X25519 value (GHSA-w3jg-pjxf-73p4), and

a server can no longer steer the session into a MAC-requiring cipher with no

MAC and panic it (GHSA-p8qx-h547-fjw9). The release also fixes data written

across a key re-exchange, terminal-mode encoding in the PTY request, and the

inactivity timeout during a stalled write. Two further russh advisories in

the same range (GHSA-35g8-35p8-c8fw, GHSA-g6xm-f9xp-qq35) are server-side

only; Transit is never an SSH server.

• Updated pageant to 0.2.3 (GHSA-g4mp-vgx3-xrvm — a malicious Pageant agent

on Windows could cause an out-of-bounds read).

• SSH host certificates are refused. russh 0.63 adds host-certificate

support, which replaces the host-key check rather than adding to it.

Transit's trust model is the pinned host key you approved on first connect,

and it has no certificate-authority trust store, so it never offers

certificate algorithms during the handshake, and if a server presents a

certificate anyway the connection is refused with a clear error rather than

prompting or pinning anything. Servers that hold a host certificate still

offer their plain host key, so nothing changes for them.

• Pinned brace-expansion to 5.0.12 via overrides (GHSA-qhr7-859c-m2p7,

GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr — denial of service on hostile

brace patterns). Build-time only; it does not ship in the Tauri bundle.

• Updated rustls to 0.23.45 (RUSTSEC-2026-0285 — TLS 1.3 handshake messages

were incorrectly accepted across encryption-level boundaries). rustls secures

every connection to Transit Cloud as well as the agent's HTTPS model endpoints

and the REST device transport, so unlike the npm pins below this one is in the

shipped binary. The bump carries rustls-webpki 0.103.15 and aws-lc-rs

1.18.1 / aws-lc-sys 0.45.0 with it. Also refreshed two yanked crates, der

0.8.2 and wnaf 0.14.1.

• Pinned two transitive advisories via overrides: ip-address to 10.7.2

(GHSA-rpw4-54j3-4h4q — Address6.isLinkLocal() matched fe80::/64 instead

of fe80::/10; GHSA-2vr4-cq9g-pvrc — no classifier recognised the NAT64

range) and undici to 6.29.0 (GHSA-3wwx-pv8p-q78v — DoS via an unhandled

error). Both are build-time only: undici arrives through

license-checker-rseidelsohn → arborist → node-gyp, so neither ships in the

Tauri bundle. The ip-address override had been sitting at ^10.4.0 and

aged into the advisory range — Dependabot does not open PRs against

overrides entries, so these do not self-heal.

Changed

• Updated Tauri from 2.11 to 2.12, with its plugins (clipboard, deep link,

dialog, log, opener, process, single-instance, updater) moved in lockstep on

both the JavaScript and Rust sides.

• Routine dependency refresh: React 19.3, TanStack Query 5.104, Vite 8.3,

zod 4.6, and the test runner to Vitest 5.