Merge upstream v2.22.5

.github/dependabot.yml

@@ -7,6 +7,13 @@ version: 2
 updates:
   - package-ecosystem: "pub"
     directory: "/example/"
+    schedule:
+      interval: "weekly"
+      time: "09:00"
+      timezone: Europe/Madrid
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
     schedule:
       interval: "weekly"
       time: "09:00"

CHANGELOG.md

@@ -1,3 +1,30 @@
+## [2.22.5] - 2026-07-30
+- Exported `src/ssh_userauth.dart` in `lib/dartssh2.dart` to expose `SSHUserInfoRequest`, `SSHUserInfoPrompt`, `SSHAuthMethod`, and `SSHChangePasswordResponse` [#188]. Thanks [@vicajilau].
+
+## [2.22.4] - 2026-07-27
+- Advertised standard RFC 8731 key exchange name `curve25519-sha256` alongside legacy `curve25519-sha256@libssh.org` [#187]. Thanks [@nickn17].
+
+## [2.22.3] - 2026-07-20
+- Fixed an SSH channel leak in `SftpClient.close()` by closing the underlying SSH channel and returning `Future<void>` to allow awaiting channel teardown [#186]. Thanks [@keinstn].
+
+## [2.22.2] - 2026-07-15
+- Added `flush()` to `SSHSocket`, `SSHClient`, and `SSHChannel` to allow force flushing of buffered outgoing data [#183]. Thanks [@vicajilau].
+
+## [2.22.1] - 2026-07-13
+- Fixed a keepalive issue where overlapping pings could occur and caught errors during ping execution. Thanks [@vicajilau].
+
+## [2.22.0] - 2026-07-03
+- Added optional `handshakeTimeout` and `authTimeout` to `SSHClient` to limit connection negotiation and user authentication times [#182]. Thanks [@GT-610].
+
+## [2.21.1] - 2026-07-02
+- Fixed an `SSHTransport` busy-loop (100% CPU / ANR) that occurred when a partial packet remained in the read buffer [#179]. Thanks [@vicajilau].
+
+## [2.21.0] - 2026-07-01
+- Added `SSHSession.waitForExit({Duration? timeout})` to await remote process exit status with an optional timeout [#176]. Thanks [@GT-610].
+- Hardened SOCKS5 dynamic forwarding (half-close streaming, dialing guards, timeout cancellation, malformed UTF-8 decoding, and buffer limits) [#175]. Thanks [@GT-610].
+- Hardened SSH agent channel frame validation (rejecting empty or oversized frames) and fallback RSA signature type checks [#175]. Thanks [@GT-610].
+- Improved EC private key parsing with proper ASN.1 OID curve detection, public point derivation validation, and robust comments decoding [#175]. Thanks [@GT-610].
+
 ## [2.20.0] - 2026-06-30
 - **BREAKING**: Bumped the minimum Dart SDK constraint to `3.0.0` [#23]. Thanks [@vicajilau].
 - **BREAKING**: Declared `OpenSSHKeyPair` as an `abstract mixin class` to comply with Dart 3.0 class modifier rules [#23]. Thanks [@vicajilau].
@@ -253,7 +280,15 @@
 [#18]: https://github.com/TerminalStudio/dartssh2/issues/18
 [#17]: https://github.com/TerminalStudio/dartssh2/issues/17
 [#14]: https://github.com/TerminalStudio/dartssh2/pull/14
+[#175]: https://github.com/TerminalStudio/dartssh2/pull/175
+[#176]: https://github.com/TerminalStudio/dartssh2/pull/176
+[#179]: https://github.com/TerminalStudio/dartssh2/pull/179
+[#182]: https://github.com/TerminalStudio/dartssh2/pull/182
+[#183]: https://github.com/TerminalStudio/dartssh2/pull/183
+[#186]: https://github.com/TerminalStudio/dartssh2/pull/186
+[#187]: https://github.com/TerminalStudio/dartssh2/pull/187
 [#1]: https://github.com/TerminalStudio/dartssh/pull/1/files
+[#188]: https://github.com/TerminalStudio/dartssh2/issues/188
 
 [@linhanyu]: https://github.com/linhanyu
 [@Migarl]: https://github.com/Migarl
@@ -270,4 +305,5 @@
 [@bradmartin333]: https://github.com/bradmartin333
 [@Wackymax]: https://github.com/Wackymax
 [@gkc]: https://github.com/gkc
-[@vicajilau]: https://github.com/vicajilau
+[@vicajilau]: https://github.com/vicajilau
+[@GT-610]: https://github.com/GT-610

README.md

@@ -162,6 +162,24 @@ void main() async {
 
 `ident` defaults to `DartSSH_2.0`.
 
+### Configure handshake and authentication timeouts
+
+You can specify optional timeouts for the transport handshake and user authentication:
+
+```dart
+void main() async {
+  final client = SSHClient(
+    await SSHSocket.connect('localhost', 22),
+    username: '<username>',
+    onPasswordRequest: () => '<password>',
+    handshakeTimeout: const Duration(seconds: 15),
+    authTimeout: const Duration(seconds: 15),
+  );
+}
+```
+
+By default, these parameters are `null` (no timeout is enforced). Without these timeouts, the connection or authentication process could hang indefinitely if the remote server becomes unresponsive.
+
 ### Spawn a shell on remote host
 
 ```dart
@@ -277,6 +295,25 @@ void main() async {
 
 Processes killed by signals do not have an exit code, instead they have an exit signal property.
 
+**Waiting for exit status with a timeout**
+
+Alternatively, you can wait for the remote process to report its exit status or exit signal with an optional timeout using `session.waitForExit()`:
+
+```dart
+void main() async {
+  final session = await client.execute('sleep 5');
+
+  // Wait for the exit status to be reported (or up to 10 seconds).
+  final exitCode = await session.waitForExit(timeout: Duration(seconds: 10));
+
+  if (exitCode != null) {
+    print('Process exited with code: $exitCode');
+  } else {
+    print('Process timed out or was terminated by a signal');
+  }
+}
+```
+
 ### Forward connections on local port 8080 to the server
 
 ```dart

lib/src/algorithm/ssh_kex_type.dart

@@ -7,6 +7,15 @@ class SSHKexType extends SSHAlgorithm {
     digestFactory: SHA256Digest.new,
   );
 
+  /// RFC 8731 name for the same algorithm as [x25519]. Servers hardened to a
+  /// single kex commonly offer only this spelling, and OpenSSH matches names
+  /// literally; without it the handshake dies with "no matching key exchange
+  /// method found".
+  static const x25519Rfc = SSHKexType._(
+    name: 'curve25519-sha256',
+    digestFactory: SHA256Digest.new,
+  );
+
   static const nistp256 = SSHKexType._(
     name: 'ecdh-sha2-nistp256',
     digestFactory: SHA256Digest.new,

lib/src/dynamic_forward_io.dart

@@ -171,9 +171,8 @@ class _SocksConnection {
       return;
     }
 
-    _buffer.add(chunk);
-
     try {
+      _buffer.add(chunk);
       await _consumeHandshake();
     } catch (_) {
       await close();

lib/src/http/http_date.dart

@@ -87,4 +87,4 @@ DateTime? parseHttpDate(String input) {
   }
 
   return null;
-}
+}

lib/src/kex/kex_nist.dart

@@ -128,9 +128,10 @@ String _getNameByCurve(ECDomainParameters curve) {
   late BigInt x;
   do {
     x = decodeBigIntWithSign(
-      1,
-      randomBytes((secretBits + 7) ~/ 8),
-    ) % curve.n;
+          1,
+          randomBytes((secretBits + 7) ~/ 8),
+        ) %
+        curve.n;
   } while (x == BigInt.zero);
 
   final c = curve.G * x;

lib/src/sftp/sftp_client.dart

@@ -258,12 +258,24 @@ class SftpClient {
   }
 
   /// Close the sftp session.
-  void close() {
+  ///
+  /// This also closes the underlying SSH channel that the sftp subsystem runs
+  /// on. Without this the channel is leaked: every [SSHClient.sftp] call opens
+  /// a fresh session channel, so an application that opens an sftp session per
+  /// operation would accumulate open channels on the connection until the
+  /// server refuses further `CHANNEL_OPEN`s.
+  Future<void> close() async {
+    if (_done.isCompleted) return;
+    final error = SftpAbortError("Connection closed");
     for (var waiter in _replyWaiters.values) {
-      waiter.completeError(SftpAbortError("Connection closed"));
+      waiter.completeError(error);
     }
     _replyWaiters.clear();
+    if (!_handshake.isCompleted) {
+      _handshake.completeError(error, StackTrace.current);
+    }
     _done.complete();
+    await _channel.close();
   }
 
   void _closeError(Object error, [StackTrace? stackTrace]) {

lib/src/socket/ssh_socket.dart

@@ -28,4 +28,7 @@ abstract class SSHSocket {
   Future<void> close();
 
   void destroy();
+
+  /// Force flush any buffered outgoing data.
+  Future<void> flush() async {}
 }

lib/src/socket/ssh_socket_io.dart

@@ -38,6 +38,11 @@ class _SSHNativeSocket implements SSHSocket {
     _socket.destroy();
   }
 
+  @override
+  Future<void> flush() async {
+    await _socket.flush();
+  }
+
   @override
   String toString() {
     final address = '${_socket.remoteAddress.host}:${_socket.remotePort}';

lib/src/ssh_algorithm.dart

@@ -92,6 +92,7 @@ class SSHAlgorithms {
     // Prefer modern KEX first; move legacy SHA-1/group1 variants to the end
     // as fallback-only to improve security defaults.
     this.kex = const [
+      SSHKexType.x25519Rfc,
       SSHKexType.x25519,
       SSHKexType.nistp521,
       SSHKexType.nistp384,