chore(monorepo): update rust crate bytes to v1.11.1 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
bytes	dependencies	minor	1.7.1 → 1.11.1
bytes	workspace.dependencies	minor	1.7.1 → 1.11.1

GitHub Vulnerability Alerts

CVE-2026-25541

Details

In the unique reclaim path of BytesMut::reserve, the condition

if v_capacity >= new_cap + offset

uses an unchecked addition. When new_cap + offset overflows usize in release builds, this condition may incorrectly pass, causing self.cap to be set to a value that exceeds the actual allocated capacity. Subsequent APIs such as spare_capacity_mut() then trust this corrupted cap value and may create out-of-bounds slices, leading to UB.

This behavior is observable in release builds (integer overflow wraps), whereas debug builds panic due to overflow checks.

PoC

use bytes::*;

fn main() {
    let mut a = BytesMut::from(&b"hello world"[..]);
    let mut b = a.split_off(5);

    // Ensure b becomes the unique owner of the backing storage
    drop(a);

    // Trigger overflow in new_cap + offset inside reserve
    b.reserve(usize::MAX - 6);

    // This call relies on the corrupted cap and may cause UB & HBO
    b.put_u8(b'h');
}

Workarounds

Users of BytesMut::reserve are only affected if integer overflow checks are configured to wrap. When integer overflow is configured to panic, this issue does not apply.

This vulnerability is also known as RUSTSEC-2026-0007.

---

Release Notes

tokio-rs/bytes (bytes)

v1.11.1

Compare Source

• Fix integer overflow in BytesMut::reserve

v1.11.0

Compare Source

• Bump MSRV to 1.57 (#​788)

Fixed

• fix: BytesMut only reuse if src has remaining (#​803)
• Specialize BytesMut::put::<Bytes> (#​793)
• Reserve capacity in BytesMut::put (#​794)
• Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#​795)

Internal changes

• Guarantee address in slice() for empty slices. (#​780)
• Rename Vtable::to_* -> Vtable::into_* (#​776)
• Fix latest clippy warnings (#​787)
• Ignore BytesMut::freeze doctest on wasm (#​790)
• Move drop_fn of from_owner into vtable (#​801)

v1.10.1

Compare Source

Fixed

• Fix memory leak when using to_vec with Bytes::from_owner (#​773)

v1.10.0

Compare Source

Added

• Add feature to support platforms without atomic CAS (#​467)
• try_get_* methods for Buf trait (#​753)
• Implement Buf::chunks_vectored for Take (#​617)
• Implement Buf::chunks_vectored for VecDeque<u8> (#​708)

Fixed

• Remove incorrect guarantee for chunks_vectored (#​754)
• Ensure that tests pass under panic=abort (#​749)

v1.9.0

Compare Source

Added

• Add Bytes::from_owner to enable externally-allocated memory (#​742)

Documented

• Fix typo in Buf::chunk() comment (#​744)

Internal changes

• Replace BufMut::put with BufMut::put_slice in Writer impl (#​745)
• Rename hex_impl! to fmt_impl! and reuse it for fmt::Debug (#​743)

v1.8.0

Compare Source

• Guarantee address in split_off/split_to for empty slices (#​740)

v1.7.2

Compare Source

Fixed

• Fix default impl of Buf::{get_int, get_int_le} (#​732)

Documented

• Fix double spaces in comments and doc comments (#​731)

Internal changes

• Ensure BytesMut::advance reduces capacity (#​728)

---

Configuration

📅 Schedule: Branch creation - "" in timezone America/New_York, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks