chore(deps): update bytes to 1.11.1 to fix RUSTSEC-2026-0007

[jdx]

Summary

• Update bytes crate from 1.11.0 to 1.11.1
• Fixes integer overflow vulnerability in BytesMut::reserve (RUSTSEC-2026-0007)

Test plan

• cargo deny check passes

🤖 Generated with Claude Code

---

Note

Medium Risk
Updates a foundational Rust dependency (bytes), which can have broad impact on buffer/memory behavior even as a patch release. Change is low in scope but could surface subtle runtime or compatibility regressions in consumers.

Overview
Updates the bytes crate in Cargo.lock from 1.11.0 to 1.11.1 (refreshing the associated checksum) to pick up the latest fixes.

Removes the RUSTSEC-2026-0002 advisory ignore entry from deny.toml, tightening cargo deny advisory enforcement.

^{Written by Cursor Bugbot for commit 009fbb5. This will update automatically on new commits. Configure here.}

[Copilot]

Pull request overview

This PR updates the bytes crate dependency from 1.11.0 to 1.11.1 to address a security vulnerability (RUSTSEC-2026-0007) involving an integer overflow in BytesMut::reserve. The PR also pins the cargo-deny version in the CI workflow.

Changes:

• Updated bytes crate to fix integer overflow vulnerability
• Pinned cargo-deny tool version to 0.18.6 in GitHub Actions workflow

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[gemini-code-assist]

Summary of Changes

Hello @jdx, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request performs a crucial dependency update to enhance the project's security. By upgrading the bytes crate, it directly mitigates a known integer overflow vulnerability, thereby strengthening the application's resilience against potential security risks.

Highlights

• Dependency Update: The bytes crate has been updated from version 1.11.0 to 1.11.1.
• Security Fix: This update addresses the RUSTSEC-2026-0007 vulnerability, which involved an integer overflow in BytesMut::reserve.

Changelog

• Cargo.lock
  • Updated the bytes crate version from 1.11.0 to 1.11.1.
  • Updated the corresponding checksum for the bytes crate to reflect the new version.

Ignored Files

• Ignored by pattern: .github/workflows/** (1)
  • .github/workflows/test.yml

Activity

• The pull request was created by jdx with the explicit goal of updating the bytes dependency to fix a security vulnerability.
• The author has confirmed that cargo deny check passes, indicating that the dependency update does not introduce new security issues or policy violations.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request updates the bytes crate from version 1.11.0 to 1.11.1 to address the security vulnerability RUSTSEC-2026-0007. The change in Cargo.lock is correct and effectively mitigates the reported integer overflow issue. This is a good security practice and the change is approved.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is ON, but a Cloud Agent failed to start.}

[cursor]

Undocumented removal of unrelated security advisory ignore

Medium Severity

The ignore entry for RUSTSEC-2026-0002 (lru crate soundness issue) was removed, but this change is completely unrelated to the stated PR purpose of updating bytes to fix RUSTSEC-2026-0007. The project still uses lru version 0.16.3 which the advisory affects. The original comment indicated "waiting for upstream fix" - if the fix is now available this removal may be intentional, but it's undocumented in the PR description. This appears to be an accidental deletion during editing of this security configuration file.

 

[github-actions]

Hyperfine Performance

mise x -- echo

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.2.2 x -- echo	21.6 ± 0.4	20.5	24.1	1.00
mise x -- echo	22.1 ± 0.8	20.5	28.7	1.03 ± 0.04

mise env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.2.2 env	20.9 ± 0.8	19.9	27.6	1.00
mise env	21.7 ± 0.6	20.5	24.7	1.04 ± 0.05

mise hook-env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.2.2 hook-env	21.9 ± 0.5	20.7	25.8	1.00
mise hook-env	22.4 ± 0.6	21.1	24.4	1.03 ± 0.04

mise ls

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.2.2 ls	19.3 ± 0.4	18.4	20.9	1.00
mise ls	19.7 ± 0.4	18.9	21.4	1.02 ± 0.03

xtasks/test/perf

Command	mise-2026.2.2	mise	Variance
install (cached)	115ms	113ms	+1%
ls (cached)	71ms	71ms	+0%
bin-paths (cached)	76ms	75ms	+1%
task-ls (cached)	539ms	550ms	-2%