# ConnectOnion 1.9.3rc14 (release candidate)

> **Compatibility:** Python 3.11+. Synology SSH inspections require Paramiko 5.1.0+; SHA-1-only NAS SSH setups need an update.
>
> **Intel Mac:** Prepare the [native build tools](https://docs.connectonion.com/releases/1.9.3rc13) before installing.
>
> **Scheduling:** Native Codex Schedule migration is not included. Existing scheduling stays in place.

Stable remains 1.9.2. This opt-in preview supersedes rc13 for Synology users:

```bash
uv tool install --python ">=3.11" --force 'connectonion==1.9.3rc14'
```

For Synology's optional SSH tools:

```bash
uv tool install --python ">=3.11" --force 'connectonion[synology]==1.9.3rc14'
```

## Close the optional-dependency audit gap

The Synology extra previously capped Paramiko below version 5, retaining 4.0.0
and its SHA-1 advisory (CVE-2026-44405 / GHSA-r374-rxx8-8654). It now requires
Paramiko 5.1.0 or newer. CI exports and audits all extras, including optional
features, rather than only the default installation.

Validation used an isolated loopback SSH server, not Synology hardware.
The checks do not certify a particular NAS model or firmware.

Paramiko 5 removes RSA signatures and key exchange based on SHA-1. Older NAS
SSH configurations that only support those algorithms need a firmware or SSH
configuration update, or modern keys such as Ed25519. Host-key checking is not
relaxed. See the [upstream changes](https://www.paramiko.org/changelog.html).

## Keep the rc13 fixes

This preview retains Pillow >=13.0.0, pypdf >=6.21.2 and cryptography >=50.0.2,
Python >=3.11, and REM's internal Codex thread archival. Intel Macs still need
the native build prerequisites described in the [rc13 notes](https://docs.connectonion.com/releases/1.9.3rc13).

The original default-only audit did not cover the Synology extra. The expanded
audit covers it; no advisory is dismissed or ignored to make the check pass.
Native scheduling is still unverified and the local production scheduler is
not migrated by this dependency update.