[devolutionsbot]

🤖 New release

• picky: 7.0.0-rc.29 -> 7.0.0-rc.30 (✓ API compatible changes)

Changelog

[7.0.0-rc.30] - 2026-11-13

Bug Fixes

• Wipe private key bytes and passphrases when they're freed (#542) (29c0644a4a)

  On top of fix(ffi): stop AuthenticodeValidator from keeping borrowed dates #541. Disposing a key from .NET now zeroes what it held
  instead of just freeing it.

  • Pem: the decoded bytes, since a PEM can carry a private key
  • SshPrivateKey: the passphrase. picky already wipes the key itself
  • SshPrivateKey.ToRepr / PuttyPpk.ToRepr: the temporary string
    holding the encoded key
  • Ppk (picky core): the private key buffer is Zeroizing now, so the
    copies made while encrypting, decrypting and converting get wiped too.
    make_padding allocates its final size up front so a resize can't leave
    a plaintext copy behind. Field is private, no API change

  What this doesn't cover (it's all outside picky):

  • the Diplomat write buffer behind every ToRepr string, and the
    byte[] C# builds for a string argument (Diplomat.Utf8.Clone).
    That's the generator, so it's a follow-up in
    Devolutions/diplomat
  • the .NET string you get back from ToRepr or pass in as a
    passphrase. It's immutable, nothing to wipe

  New tests: passphrase-protected SSH key and encrypted PPK round trips.
  Neither had .NET coverage before.

---

This PR was generated with release-plz.