Update dependency ssh2-sftp-client to v12 #175

renovate · 2025-03-19T03:12:58Z

Note

Mend has cancelled the proposed renaming of the Renovate GitHub app being renamed to mend[bot].

This notice will be removed on 2025-10-07.

This PR contains the following updates:

Package	Change	Age	Confidence
ssh2-sftp-client	`^10.0.3` -> `^12.0.0`

Release Notes

theophilusx/ssh2-sftp-client (ssh2-sftp-client)

`v12.0.1`: Minor Bug Fix

Compare Source

Changed the error handlers on read/write streams to be 'on' rather than 'once' handlers. When definmed as 'once' handlers, multi8ple errors could result in the second error bubbling up to the top level and causing the node process to exit with an unhandled error event.

Also fixed a typo in an error code specification which could result in an undefined symbol error.

Fixed some documentation typos.

`v12.0.0`: Major Version Change - Remove retry support

Compare Source

The main change in this version is the removal of the connectiuon retry support. There are 2 main reasons this support has been removed -

It provided little benefit over the added connection logic complexity. In 90% of cases, a connection which fails on the first attempt fails all subsequent retries. Very rarely does a connection which fails on the first attempt succeed with one of the retry attempts. This approach did have some benefit in the past when networks were slower and often more congested, but advances in technology, network speeds and infrastructure quality mean the sorts of problems we use to encounter and less prevelent.
The inclusion of retry support significantly complicates the event handling logic and creates some rare, but not unknown, corner cases where events don't get correctly handled and can result in the connection promise handing indefinitely, being neither resolved or rejected. The retry support also had a performance hit which could actually cause connection problems, especially on a slower network using a slower key excahgne or cipher.

The other reason to remove this support is that should someone want to have such support, it can easily be added in their own use case via one of the retry promise packages available and can be tailored to their specific needs. Maintaining a flexible and general implementation which did not have any negative impact is much harder and adds an additional maintenance burdon which is only beneficial for a small number of use cases.

The other change in this version is that we are no longer testing against v18.x of node. Highly recommended that at least version v20.x is used.

`v11.0.0`: New event handling strategy

Compare Source

This release introduces a new event handling strategy.

Global event listeners no longer raise errors. Only log events and invalidate connection object.
Constructor allows passing in custom global event listeners whi8chn can do whatever is appropriate for the client
All temporary local event listeners wil now call the associated promise rejedct method. Previously reject was only called for error events, but this caused problems for some badly behaving sftp servers which ended connections without signalling any error condition. This would cause promises to be stuck in an unfulfilled state.

While the above changes do not change the existing API, the change in global listener behaviour may result in changes for client code behaviour, so this update is marked as a whole new version. However, most clients should not experience any change an in fact, things should be more stable with less liklihood of uncaught errors killing top level processes. It is expected that few clients will need to supply custom global event listeners as the defaults should work fror the vast majority of clients 'out of the box'. Chances are very high you will be able to update to this vwersion from 10.0.3 with no impact or nee3d for code change.