fix: update bytes to 1.11.1 to fix RUSTSEC-2026-0007

[diegomrsantos]

Issue Addressed

Fixes cargo audit failure due to RUSTSEC-2026-0007 (integer overflow vulnerability in BytesMut::reserve).

Proposed Changes

• Update bytes crate from 1.11.0 to 1.11.1 via Cargo.lock

Additional Info

This is a lockfile-only update. The bytes 1.11.1 release patches the integer overflow vulnerability.

[claude-code-actions-sigp]

Claude finished @diegomrsantos's task in 1m 13s —— View job

---

Code Review Complete

Summary

This PR addresses a security vulnerability (RUSTSEC-2026-0007) by updating the bytes crate from version 1.11.0 to 1.11.1 in the lockfile. The change is minimal, targeted, and appropriate for a security patch.

Review Findings

✅ Security

• Addresses integer overflow vulnerability in BytesMut::reserve
• Clean lockfile-only update to patched version
• No additional changes that could introduce new issues

✅ Code Quality

• Minimal, surgical change (only 2 lines modified)
• Exactly one dependency updated - no transitive dependency drift
• Lockfile changes are correctly formatted

✅ Performance

• No performance concerns with this patch version update
• The bytes crate 1.11.1 patch focuses on correctness, not performance changes

✅ Testing

• CI checks are running (test-suite and local testnet in progress)
• Lockfile-only updates typically don't require additional test coverage
• Existing tests will validate compatibility with the patched version

✅ Documentation

• PR description clearly states the vulnerability being fixed
• Appropriate issue reference format
• The "Additional Info" section correctly notes this is a lockfile-only update

Observations

1. Transitive Dependency: The bytes crate is not a direct dependency in any Cargo.toml files in the repository - it's pulled in transitively by other dependencies. This is expected and not a concern.

2. Clean Update: The diff shows only the bytes package version and checksum changed - no other dependencies were inadvertently updated. This is the correct approach for security patches.

3. CI Status: The "Pull Request" check has already passed. The test-suite and local testnet checks are still running, which is expected for validating the change doesn't break anything.

Recommendation

Approve ✓

This is a clean security patch that follows best practices:

• Minimal change scope
• Direct response to a security advisory
• Proper documentation
• No unnecessary modifications

The PR can be merged once CI checks pass.

---

[shane-moore]

lgtm!