Update dependency ssh2-sftp-client to v11

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
ssh2-sftp-client	^5.0.0 -> ^11.0.0

---

Release Notes

theophilusx/ssh2-sftp-client (ssh2-sftp-client)

v11.0.0: New event handling strategy

Compare Source

This release introduces a new event handling strategy.

• Global event listeners no longer raise errors. Only log events and invalidate connection object.
• Constructor allows passing in custom global event listeners whi8chn can do whatever is appropriate for the client
• All temporary local event listeners wil now call the associated promise rejedct method. Previously reject was only called for error events, but this caused problems for some badly behaving sftp servers which ended connections without signalling any error condition. This would cause promises to be stuck in an unfulfilled state.

While the above changes do not change the existing API, the change in global listener behaviour may result in changes for client code behaviour, so this update is marked as a whole new version. However, most clients should not experience any change an in fact, things should be more stable with less liklihood of uncaught errors killing top level processes. It is expected that few clients will need to supply custom global event listeners as the defaults should work fror the vast majority of clients 'out of the box'. Chances are very high you will be able to update to this vwersion from 10.0.3 with no impact or nee3d for code change.

v10.0.3: Documentation fix Mk2

Compare Source

Restore missing README.md file

v10.0.2: Typo fix in packagte.json

Compare Source

Just a stupid fat finger error fix!

v10.0.0: Bug fix and security update

Compare Source

• Bump to depend on ssh2 1.15.0, which has the fix for CVE-2023-48795
• Add new promiseLimit setting to limit the number of concurrent promises used by downloadDir/uploadDir. Default is set to 10. Testing indicated for most situations, increasing much above 10 had little benefit and eventually, once number was large enough, actually degraded performance as node would spend more time context switching than data transferring.
• Some minor code clenup and added quite a few new tests
• Changed minimum supported node version. While testing with v16.20.2 still appears to work, it is HIGHLY recommended that at least node 18.18.2 is used. Bottom line, if you log an issue, you need to be on node >= v18.

v9.1.0: Maintenance Release

Compare Source

• Re-factoring of some methods to enable them to better catch network errors within surrounding promise.
• Fix error in handling options in some methods which prevented setting file permissions
• Added additional tests and test coverage

v9.0.4: Minor bug fix release

Compare Source

• Fixes an issue with module hanging and failing to return any error when a corrupted private key was supplied. Now returns an error that the module was unable to parse the private key.

v9.0.3: Minor bug fix release

Compare Source

Fix two minor bugs

• Sometimes, when initialisation of sftp sub-system failed, the module would attempt to call sftp.end(), which would fail with an undefined reference error

• When calling the get() method and supplying a destination stream for the data, if the soruce file did not exist on the remote server, the destination stream was not closed and could result in a resource leak.

v9.0.2: Minor bug fixes

Compare Source

A couple of fairly minor changes to address some edge case issues

• DOn't throw error or reject promise if end() method called when there is no active sftp connection. If end() is called and there is no active connection, just turn into a noop. Better to call end() when not needed than miss calling it because it might cause an error in some scenarios.
• Don't throw exception or reject a promise when an 'unexpected' end or close event is seen. Logic for determining when a close or end event was 'unexpected' was not reliable enough. Besides, trying to identify unexpected close/end signals didn't really add any value. Now if a close or end signal occurs which was not 'expected', we will just log it. We do invalidate the sftp connection whenever we see an end/close event regardless.
• Now use nullish coalescing instead of or'iing to set the various params for retry configuration. Previously, using or'ing meant you couldn't set a param to 0. Using ?? now allows this.
• Made some minor changes to when the flags used to track event handling are reset. Previously, they were reset after temporary listeners were removed. We now do the reset after new temporary listeners are added.

None of the above changes are API breaking (for v9). Should be able to upgrade from any previous 9.x version with no issue.

v9.0.1: Minor bug fix

Compare Source

Minor bug fix version

The get() method was not always returning a buffer when no destination argument was supplied due to a race condition between concat-stream and readStream finish event. When triggered, get() would return the concat-stream object instead of the buffer object it contains.

v9.0.0: Major Release - New methods, API updates

Compare Source

This is a major new version which includes both new methods and API changes as well as some code cleanup and refactoring to improve performance.

• API Changes

  • list() method now accepts a filter function instead of a regular expression to filter the list of items returned.
  • Ability to set autoClose in options passed into get() and put() methods has been removed. Tis option caused confusion for developers and made the logic overly complicated for rare use cases. You can not just use the new createReadStream() and createWriteStream() when you want low level control.
  • Ability to set 'end' property in pipe() operations used by get() and put() methods has been removed because it complicated the logic of get() and put() methods when only useful for a very small number of edge cases. Use getReadStream and getWriteStream and manage pipe() manually should you require this type of low level control
  • The 3rd argument to uploadDir() and downloadDir() methods has been changed. Previously, this argument was a filter function. It is now an object which can have properties of 'filter', to supply a filter function and useFastGet/useFastPut, a boolean used to tell the method to use the potentially faster fastGet() or fastPut() method to transfer data.

• New Methods

  • createReadStream(): returns a read stream connected to a remote file on the sftp server
  • createWriteStream(): returns a write stream connected to a remote file on the sftp server
  • rcopy(): create a remote copy of a remote file on the sftp server

• Other Changes

  • downloadDi()/uploadDir() now uses asynchronous calls to transfer files to help improve speed
  • The retry code used to retry making a connection after initial failure has been refactored and improved to more reliably handle retry options.
  • Management of temporary event listeners has been refactored to make management of event listeners when using internal calls to various methods more efficient.

Although not benchmarked, the performance of this version appears to be significantly better than previous versions. Running the test suite completes much faster, despite quite a new new tests being added for the new methods.

v8.1.0: Minor update

Compare Source

• Add longname property to description of each file in list() call
• Change rmdir() to only do asynchronous processes on file deletion. Directory deletion done synchronously.
• Bump ssh2 dependency version to 1.10.0

v8.0.0: Major release with some breaking changes

Compare Source

This release changes the API for the uploadDir() and downloadDir() methods. This is a breaking change. Previously, these methods accepted an optional 3rd argument, a regular expression used to filter which files and directories would be included in the transfer. This argument has now been changed to be an optional predicate filter function. The function will be called for each file or directory in the tree specified as the 1st argument and should return true if the target should be included in the transfer, false to exclude it. See README for full details.

The rmdir() method has been refactored to better exploit asynchronous processing of directory tree removal. For broad shallow directory trees, significant performance improvements have been observed. The rmdir() API has not changed.

Bumped the ssh2 dependency to v1.9.0

v7.2.3: Minor bug fix and version bump

Compare Source

Bump to ssh2 v1.8.0

Change uploadDir/downloadDir to use put() and get() instead of fastPut() and fastGet() becuase the latter are not supported by all sftp servers.

v7.2.2: Bump ssh2 dependency to 1.6.0 plus removeTempListeners bug fix

Compare Source

This release bumps the ssh2 dependency to 1.6.0, which includes some bug fixes for issues affecting sftp.

This release also fixes a bug in removeTempListeners() where it was using the old data structure for tracking temporary listeners rather than the new structure introduced in 7.2.1

v7.2.1: Minor bugfix release

Compare Source

Fix a bug in get() requests which occurs when using slower destination devices for retrieved files. In some circumstances, attempting to access a downloaded file immediately after download would result in errors because file contents had not yet been fully flushed and stream cleaned up. The fix was to change the event used to resolve the get() promise to use the finish signal on the write stream rather than on the read stream. Previous version used the read stream signal because in some use cases, the client code does not want to close the write stream. Fix now looks to see what options have been passed in to get() and will use the write stream events when it can and only use the read stream events when this is not possible. This could still result in errors when the client has decided to explicitly manage the write stream, but in that case, it is also down to the responsibility of the client not to attempt to access the downloaded data until they have cleaned up the streams correctly.

v7.2.0: Bugfix release

Compare Source

• Fix problem with ssh connections not being correctly closed and released when sftp channel creation fails.
• Fix problem with global tracking of temporary listeners and some listeners being removed too early when function calls other function provided by the library
• Add additional check in mkdir to increase efficiency of mkdir calls in general case
• Bump versions of development libraries

While this version does not change the API, as it does represent fundamental change to the way temporary event listeners are managed, it is being released as a new minor version rather than just a new patch version.

v7.1.0

Compare Source

v7.0.4: Update to use new ssh2 version 1.4.0.

Compare Source

Update to ssh2 v1.4.0

Minor fix in tests for local resources to make more consistent across platforms.

v7.0.3: Minor bug fix

Compare Source

Fix typo in handling stream closure for put() method.

v7.0.2: Update to ssh2 1.3.0

Compare Source

Update to ssh2 1.3.0, which includes the patch for handshake timeout issues seen on some platforms.

Cleaned up some error reporting messages to improve consistency.

Added entry to FAQ on dealing with issues uploading larger files due to TCP packet fragmentation and some firewalls.

Improved test coverage, which is now over 94%.

v7.0.1: Updated ssh2 and some additional path checks

Compare Source

This version depends on the most recent ssh2 v1.2.0 release.

A number of additional path checks have been added, mainly to provide more informative error messages when interacting with an sftp server on Windows platforms. The default global error handler has also been changed. It now just reports there was an unexpected error rather than re-throw the error. Throwing the error was not terribly useful as it is difficult for clients to catch such errors. Therefore, when an unexpected error is caught by the default global error listener, it will just report the error to the console and unset the client sftp property to prevent any further API calls until a new connection is established.

v7.0.0: New SSH2 version dependency

Compare Source

Update to use new ssh2 version 1.1.0, which is a complete re-write of ssh2
Updated to use new retry code for retrying connection creation
Update get/put methods to use different resolution strategy and allow setting of options on streams and pipe() operation.

v6.0.1: Minor bug fix

Compare Source

Fix an issue with connect retries not releasing 'ready' listeners. This could result in a memory leak warning if the same ssh2-sftp-client object was used for multiple connections where more than 10 connections were made/attempted.

This version also includes updated tests and improved test coverage as well as a small reduction in download size.

v6.0.0: Major Version Update

Compare Source

• Refactored event listeners to ensure end and close event listeners are added. Some sftp servers can abruptly close a connection without raising an error event. This could result in scripts hanging because the promise doe snot get resolved. Have now added end and close listeners to reject a promise if these events are raised which shold prevent or reduce such hangs.
• Refactored the retry code for connections. Now using the promise-retry package instead of just the plain retry package. This change means number of attempts tried is no longer reported in error messages when all attempts are exhausted. However, you can get this information in the debug trace if required.
• Added a new argument to the delete() method which will stop delete() from being rejected if the target object does not exist. Sometimes, you don't care if the target object for delete does not exist and don't want to see an error. Defaults to false.
• Added a n optional filter argument to the uploadDir and downloadDir methods. The filter is a regular expression which is used to match the files and sub-directories to be considered in the upload/download process. Can be used to exclude files/directories you don't want to upload/download.
• Removed a lot of argument validation code. This code was used to provide more meaningful error messages (sometimes, remote servers just report 'Failure', and provide no details about what the failure was. However, this additional argument checking was having a performance hit, especially when files being transferred were small. Decided to remove this validation code in favour of better performance. Turning on debug will often provide additional information which can be used to track down errors when necessary. Note that this does mean the error message text has changed. If you match errors based on the text of the error, you will need to review your code to ensure it still works.

Note that this version still uses ssh 0.8.9, which is known to have issues with node v14.x. The issue is caused by changes in node v14 which were rolled back in node version 15.3.x. The ssh2 maintainer is currently doing a re-write of the ssh2 module to address this and some other design issues. Once that re-write is complete and a new version of ssh2 is released, we will release a new version of ssh2-sftp-client. In the meantime, avoid using node v14.x.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.