Fix parsing of IPv6 IPs in sftp client (#2151334)
Avoid ssh banner one-byte overflow (#2138344)
Avoid crash of sshd when Include folder does not exist (#2133087)

Omit client side from minimize-sha1-use.patch to prevent regression (#2093897)

Fix new issues found by static analyzers

Upstream: add a local implementation of BSD realpath() for sftp-server (#2064249)
Change product name from Fedora to RHEL in openssh-7.8p1-UsePAM-warning.patch (#1953807)
Include caveat for crypto-policy in sshd manpage (#2044354)
Change log level of FIPS specific log message to verbose (#2050511)
Clarify force_file_perms (-m) documentation in sftp-server manpage (#1862504)
Minimize the use of SHA1 as a proof of possession for RSA key (#2093897)

Upstream: ClientAliveCountMax=0 disable the connection killing behaviour (#2015828)

Add support for "Include" directive in sshd_config file (#1926103)

CVE-2021-41617 upstream fix (#2008885)

sshd -T requires -C when "Match" is used in sshd_config (#1836277)

CVE-2020-14145 openssh: Observable Discrepancy leading to an information
Hostbased ssh authentication fails if session ID contains a '/' (#1944125)

ssh doesn't restore the blocking mode on standard output (#1942901)

SFTP sort upon the modification time (#1909988)
ssh-keygen printing fingerprint issue with Windows keys (#1901518)
PIN is lost when iterating over tokens when adding pkcs11 keys to ssh-agent (#1843372)
ssh-agent segfaults during ssh-add -s pkcs11 (#1868996)
ssh-copy-id could not resolve ipv6 address ends with colon (#1933517)
sshd provides PAM an incorrect error code (#1879503)

Openssh client window fix (#1913041)

Do not print "no slots" warning by default (#1744220)
Unbreak connecting using gssapi through proxy commands (#1749862)
Document in manual pages that CASignatureAlgorithms are handled by crypto policies (#1790604)
Use SHA2-based signature algorithms by default for signing certificates (#1790610)
Prevent simple ProxyJump loops in configuration files (#1804099)
Teach ssh-keyscan to use SHA2 RSA variants (#1744108)
Do not fail hard if getrandom() is not available and no SSH_USE_STRONG_RNG is specified (#1812120)
Improve wording of crypto policies references in manual pages (#1812854)
Do not break X11 forwarding if IPv6 is disabled (#1662189)
Enable SHA2-based GSSAPI key exchange algorithms by default (#1816226)
Mark RDomain server configuration option unsupported in RHEL (#1807686)
Clarify crypto policies defaults in manual pages (#1724195)
Mention RSA SHA2 variants in ssh-keygen manual page (#1665900)

Restore entropy patch for CC certification (#1785655)

Fix typos in manual pages (#1668325)
Use the upstream support for PKCS#8 PEM files alongside with the legacy PEM files (#1712436)
Unbreak ssh-keygen -A in FIPS mode (#1732424)
Add missing RSA certificate types to offered hostkey types in FIPS mode (#1732449)

Allow specifying a pin-value in PKCS #11 URI in ssh-add (#1639698)
Whitelist another syscall variant for s390x cryptographic module (ibmca engine) (#1714915)