Remove DSSKey references from SSH provider, bump paramiko to 4.0+

[joshuabvarghese]

closes: #54079

Summary

• Remove paramiko.DSSKey references from SSHHook (_pkey_loaders and _host_key_mappings)
• Bump paramiko minimum to >=4.0.0 in the ssh and sftp providers (previously capped at <4.0.0 in Limit paramiko to < 4.0.0 till we remove DSS support #54078 as a stopgap)
• Bump types-paramiko in devel-common/pyproject.toml to drop the matching <4.0.0 cap added in Restrict typing-paramiko to < 4 as we do with paramiko #54173
• Add a migration note to the SSH connection docs pointing DSA-key users to RSA/ECDSA/Ed25519
• Add a significant newsfragment documenting the breaking change

Motivation

paramiko 4.0 removed DSSKey (DSA) support entirely for security reasons. #54078 temporarily capped paramiko<4.0.0 to keep CI green, and #54173 did the same for types-paramiko, both explicitly deferring the real fix to this issue.

This PR does the follow-through: drops the DSA loader/host-key-mapping code paths so the provider no longer references a class that doesn't exist in modern paramiko, and lifts both version caps.

Migration

Users with SSH/SFTP connections configured to use a DSA (DSS) private key will need to generate a new RSA, ECDSA, or Ed25519 key (e.g. ssh-keygen -t ed25519) and update the connection's key_file/private_key accordingly. This is called out in the newsfragment and in the connection docs.

Testing

• pytest providers/ssh/tests/unit/ssh/hooks/test_ssh.py
• pytest providers/sftp/tests/unit/sftp/hooks/test_sftp.py
• Verified paramiko.DSSKey no longer exists under paramiko>=4.0.0 (confirms the prior code path would have raised AttributeError at import time, matching the CI failure in Limit paramiko to < 4.0.0 till we remove DSS support #54078)

---

• I acknowledge that I am not a maintainer/committer of the Apache Airflow project, this is my first contribution.

^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[boring-cyborg]

Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide
Here are some useful points:

• Pay attention to the quality of your code (ruff, mypy and type annotations). Our prek-hooks will help you with that.
• In case of a new feature add useful documentation (in docstrings or in docs/ directory). Adding a new operator? Check this short guide Consider adding an example Dag that shows how users should use it.
• Consider using Breeze environment for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
• Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
• Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
• Be sure to read the Airflow Coding style.
• Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
  Apache Airflow is a community-driven project and together we are making it better 🚀.
  In case of doubts contact the developers at:
  Mailing List: dev@airflow.apache.org
  Slack: https://s.apache.org/airflow-slack

[github-actions]

uv.lock on main just moved via #69669 ("Remove DSS key support from SSH provider for Paramiko 4"), commit 8b057a7 and this PR currently conflicts.

Quickest fix:

git fetch upstream main && git rebase upstream/main
rm uv.lock && uv lock
git add uv.lock && git rebase --continue
git push --force-with-lease

Automated nudge — ignore if you're not ready to rebase. This comment is updated in place on future uv.lock bumps.

[aaron-y-chen]

Thanks for contributing! Could you help fix the CI error? I also found a regression issue that might need to be fixed :)

[aaron-y-chen]

I think we should add a handler or document to avoid regression. For example, if users configured ssh-dss in host_key and then upgrade the ssh provider, this can fail with a KeyError.

e.g.
A connection like this:

Connection(
conn_id="ssh_with_dss_host_key",
host="localhost",
conn_type="ssh",
extra=json.dumps({"host_key": "ssh-dss AAAAB3NzaC1kc3MAAAAA"}),
)

would fail here because dss has been removed from _host_key_mappings:

airflow/providers/ssh/src/airflow/providers/ssh/hooks/ssh.py

Lines 229 to 232 in 4d56e6c

	ifhost_keyisnotNone:
	ifhost_key.startswith("ssh-"):
	key_type, host_key=host_key.split(None)[:2]
	key_constructor=self._host_key_mappings[key_type[4:]]

[aaron-y-chen]

Also, add a small regression test might be better I think :)

[joshuabvarghese]

Thanks for catching this, @nailo2c you're right, the host_key lookup would have hit a bare KeyError for anyone with an ssh-dss host key configured. Good catch.

Looking at this more, I noticed #69669 also addresses this issue and goes further — it fixes the equivalent regression in the SFTP hook too (which mine doesn't touch), handles more host key type variants (ecdsa-sha2-nistp*, legacy ssh-ecdsa, whitespace/tab-separated formats), and caps the paramiko version bound more carefully.

I'll close this one in favor of that PR rather than duplicate effort. Thanks again for the review!