From 381f626704513f739cdac61e5cccee48e2ed0f1f Mon Sep 17 00:00:00 2001
From: l0ng-ai <24760907+l0ng-ai@users.noreply.github.com>
Date: Sat, 15 Aug 2026 23:16:08 +0800
Subject: [PATCH] docs(deps): the russh rebase has nowhere to land yet
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The note already said what to do about the fork being older than the
client-side pre-auth fixes: rebase onto v0.62.6 and move the rev forward.
Checking today, there is nothing to move it to — every branch on the fork
sits at or before v0.62.2, its default branch head is still the v0.62.2 tag
commit, and upstream has published nothing after v0.62.6.

So the rebase is work somebody has to do rather than a newer rev waiting to
be picked up, which is worth saying: it is the difference between a one-line
bump and a fork to maintain.
---
 Cargo.toml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/Cargo.toml b/Cargo.toml
index 62756c97..ed0ead70 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -361,7 +361,11 @@ smol = "2"
 #     the fork's position are verified, the exploitability is upstream's word.
 #
 #     Until #738 ships in a release, the fix is to rebase the fork onto v0.62.6
-#     (or later) and move this rev forward.
+#     (or later) and move this rev forward. Re-checked 2026-08-15: there is
+#     nothing to move it *to*. The fork's own branches all sit at or before
+#     v0.62.2 — its default branch head is still the v0.62.2 tag commit — so
+#     the rebase is work somebody has to do, not a newer rev waiting to be
+#     picked up. Upstream has published nothing since v0.62.6 either.
 russh = { git = "https://github.com/ayamir/russh", rev = "0d1d073350ed823069252075cbf3db9672d5b490" }
 
 [workspace.lints.clippy]