Bumps the cargo group with 3 updates in the /packages/computeruse directory: [bytes](https://github.com/tokio-rs/bytes), [quinn-proto](https://github.com/quinn-rs/quinn) and [rustls-webpki](https://github.com/rustls/webpki). Bumps the cargo group with 1 update in the /packages/rust directory: [bytes](https://github.com/tokio-rs/bytes). Updates `bytes` from 1.10.1 to 1.11.1

Release notes

Sourced from bytes's releases.

Bytes v1.11.1

1.11.1 (February 3rd, 2026)

Fix integer overflow in BytesMut::reserve

Bytes v1.11.0

1.11.0 (November 14th, 2025)

Bump MSRV to 1.57 (#788)

Fixed

fix: BytesMut only reuse if src has remaining (#803)

Specialize BytesMut::put::<Bytes> (#793)

Reserve capacity in BytesMut::put (#794)

Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

Guarantee address in slice() for empty slices. (#780)

Rename Vtable::to_* -> Vtable::into_* (#776)

Fix latest clippy warnings (#787)

Ignore BytesMut::freeze doctest on wasm (#790)

Move drop_fn of from_owner into vtable (#801)

Changelog

Sourced from bytes's changelog.

1.11.1 (February 3rd, 2026)

Fix integer overflow in BytesMut::reserve

1.11.0 (November 14th, 2025)

Bump MSRV to 1.57 (#788)

Fixed

fix: BytesMut only reuse if src has remaining (#803)

Specialize BytesMut::put::<Bytes> (#793)

Reserve capacity in BytesMut::put (#794)

Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

Guarantee address in slice() for empty slices. (#780)

Rename Vtable::to_* -> Vtable::into_* (#776)

Fix latest clippy warnings (#787)

Ignore BytesMut::freeze doctest on wasm (#790)

Move drop_fn of from_owner into vtable (#801)

Commits

417dccd Release bytes v1.11.1 (#820)
d0293b0 Merge commit from fork
a7952fb chore: prepare bytes v1.11.0 (#804)
60cbb77 fix: BytesMut only reuse if src has remaining (#803)
7ce330f Move drop_fn of from_owner into vtable (#801)
4b53a29 Tweak BytesMut::remaining_mut (#795)
016fdbd Reserve capacity in BytesMut::put (#794)
ef7f257 Specialize BytesMut::put::<Bytes> (#793)
8b4f54d Ignore BytesMut::freeze doctest on wasm (#790)
16132ad Fix latest clippy warnings (#787)
Additional commits viewable in compare view

Updates `quinn-proto` from 0.11.13 to 0.11.14

Release notes

Sourced from quinn-proto's releases.

quinn-proto 0.11.14

@jxs reported a denial of service issue in quinn-proto 5 days ago:

https://github.com/quinn-rs/quinn/security/advisories/GHSA-6xvm-j4wr-6v98

We coordinated with them to release this version to patch the issue. Unfortunately the maintainers missed these issues during code review and we did not have enough fuzzing coverage -- we regret the oversight and have added an additional fuzzing target.

Organizations that want to participate in coordinated disclosure can contact us privately to discuss terms.

What's Changed

Fix over-permissive proto dependency edge by @Ralith in quinn-rs/quinn#2385

0.11.x: avoid unwrapping VarInt decoding during parameter parsing by @djc in quinn-rs/quinn#2559

Commits

2c315aa proto: bump version to 0.11.14
8ad47f4 Use newer rustls-pki-types PEM parser API
c81c028 ci: fix workflow syntax
0050172 ci: pin wasm-bindgen-cli version
8a6f82c Take semver-compatible dependency updates
e52db4a Apply suggestions from clippy 1.91
6df7275 chore: Fix unnecessary_unwrap clippy
c8eefa0 proto: avoid unwrapping varint decoding during parameters parsing
9723a97 fuzz: add fuzzing target for parsing transport parameters
eaf0ef3 Fix over-permissive proto dependency edge (#2385)
Additional commits viewable in compare view

Updates `rustls-webpki` from 0.103.4 to 0.103.10

Release notes

Sourced from rustls-webpki's releases.

0.103.10

Correct selection of candidate CRLs by Distribution Point and Issuing Distribution Point. If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be ignored.

The impact was that correct provided CRLs would not be consulted to check revocation. With UnknownStatusPolicy::Deny (the default) this would lead to incorrect but safe Error::UnknownRevocationStatus. With UnknownStatusPolicy::Allow this would lead to inappropriate acceptance of revoked certificates.

This vulnerability is thought to be of limited impact. This is because both the certificate and CRL are signed -- an attacker would need to compromise a trusted issuing authority to trigger this bug. An attacker with such capabilities could likely bypass revocation checking through other more impactful means (such as publishing a valid, empty CRL.)

More likely, this bug would be latent in normal use, and an attacker could leverage faulty revocation checking to continue using a revoked credential.

This vulnerability is identified by GHSA-pwjx-qhcg-rvj4. Thank you to @1seal for the report.

What's Changed

Freshen up rel-0.103 by @ctz in rustls/webpki#455

Prepare 0.103.10 by @ctz in rustls/webpki#458

Full Changelog: https://github.com/rustls/webpki/compare/v/0.103.9...v/0.103.10

0.103.9

What's Changed

[backport] ci: avoid denying warnings on nightly toolchains by @alex in rustls/webpki#437

Backport lifetime change and bump version for release by @alex in rustls/webpki#436

0.103.8

What's Changed

backport valid_uri_names (#404) to rel-0.103 by @alex in rustls/webpki#408

Full Changelog: https://github.com/rustls/webpki/compare/v/0.103.7...v/0.103.8

0.103.7

New feature: Add KeyPurposeId::to_decoded_oid() to help external ExtendedKeyUsageValidators fill RequiredEkuNotFoundContext::present.

What's Changed

Warn on unnameable types by @djc in rustls/webpki#387

Expose KeyPurposeId::to_decoded_oid() by @djc in rustls/webpki#385

Fix --cfg docsrs uses by @ctz in rustls/webpki#390

Full Changelog: https://github.com/rustls/webpki/compare/v/0.103.6...v/0.103.7

0.103.6

The extensible EKU validation released as part of 0.103.5 was actually not usable due to missing type exports, and contained a regression where empty ExtendedKeyUsage extensions would not trigger an error. Both issues are fixed in this release.

What's Changed

Export more types to enable ExtendedKeyUsageValidator implementations by @djc in rustls/webpki#381

Error on empty EKU extensions by @djc in rustls/webpki#382

... (truncated)

Commits

348ce01 Prepare 0.103.10
dbde592 crl: fix authoritative_for() support for multiple URIs
9c4838e avoid std::prelude imports
009ef66 fix rust 1.94 ambiguous panic macro warnings
c41360d build(deps): bump taiki-e/cache-cargo-install-action from 2 to 3
e401d00 generate.py: reformat for black 2026.1.0
06cedec Take semver-compatible deps
6bc9931 Bump version to 0.103.9
92dbfc6 Tie lifetime of valid_dns_names/valid_uri_names to struct lifetime
2c46166 ci: sync cargo-check-external-types nightly
Additional commits viewable in compare view

Updates `bytes` from 1.11.0 to 1.11.1

Release notes

Sourced from bytes's releases.

Bytes v1.11.1

1.11.1 (February 3rd, 2026)

Fix integer overflow in BytesMut::reserve

Bytes v1.11.0

1.11.0 (November 14th, 2025)

Bump MSRV to 1.57 (#788)

Fixed

fix: BytesMut only reuse if src has remaining (#803)

Specialize BytesMut::put::<Bytes> (#793)

Reserve capacity in BytesMut::put (#794)

Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

Guarantee address in slice() for empty slices. (#780)

Rename Vtable::to_* -> Vtable::into_* (#776)

Fix latest clippy warnings (#787)

Ignore BytesMut::freeze doctest on wasm (#790)

Move drop_fn of from_owner into vtable (#801)

Changelog

Sourced from bytes's changelog.

1.11.1 (February 3rd, 2026)

Fix integer overflow in BytesMut::reserve

1.11.0 (November 14th, 2025)

Bump MSRV to 1.57 (#788)

Fixed

fix: BytesMut only reuse if src has remaining (#803)

Specialize BytesMut::put::<Bytes> (#793)

Reserve capacity in BytesMut::put (#794)

Change BytesMut::remaining_mut to use isize::MAX instead of usize::MAX (#795)

Internal changes

Guarantee address in slice() for empty slices. (#780)

Rename Vtable::to_* -> Vtable::into_* (#776)

Fix latest clippy warnings (#787)

Ignore BytesMut::freeze doctest on wasm (#790)

Move drop_fn of from_owner into vtable (#801)

Commits

417dccd Release bytes v1.11.1 (#820)
d0293b0 Merge commit from fork
a7952fb chore: prepare bytes v1.11.0 (#804)
60cbb77 fix: BytesMut only reuse if src has remaining (#803)
7ce330f Move drop_fn of from_owner into vtable (#801)
4b53a29 Tweak BytesMut::remaining_mut (#795)
016fdbd Reserve capacity in BytesMut::put (#794)
ef7f257 Specialize BytesMut::put::<Bytes> (#793)
8b4f54d Ignore BytesMut::freeze doctest on wasm (#790)
16132ad Fix latest clippy warnings (#787)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/elizaOS/eliza/network/alerts).

Greptile Summary

This is a Dependabot-generated dependency bump PR that updates three Rust crates across two workspace directories (`packages/computeruse` and `packages/rust`), addressing two security advisories and one integer overflow bug fix. **Key changes:** - `bytes` 1.10.1 → 1.11.1 (in `packages/computeruse`): Fixes an integer overflow in `BytesMut::reserve`. The `Cargo.toml` minimum version constraint is correspondingly tightened from `"1.5"` to `"1.11"` to guarantee this fix is always resolved. - `quinn-proto` 0.11.13 → 0.11.14 (in `packages/computeruse`): Patches a Denial-of-Service vulnerability ([GHSA-6xvm-j4wr-6v98](https://github.com/quinn-rs/quinn/security/advisories/GHSA-6xvm-j4wr-6v98)) caused by an unwrap panic during malformed VarInt transport parameter parsing. - `rustls-webpki` 0.103.4 → 0.103.10 (in `packages/computeruse`): Patches an incorrect CRL revocation check ([GHSA-pwjx-qhcg-rvj4](https://github.com/rustls/webpki/security/advisories/GHSA-pwjx-qhcg-rvj4)) where only the first distribution point was evaluated against the CRL's Issuing Distribution Point, potentially allowing revoked certificates to be accepted when `UnknownStatusPolicy::Allow` is set. - `bytes` 1.11.0 → 1.11.1 (in `packages/rust`): Same integer overflow fix as above.

Confidence Score: 5/5

- This PR is safe to merge — it is a routine Dependabot security/bug-fix dependency bump with no logic changes. - All changes are confined to Cargo lock files and a single version constraint in a Cargo.toml. The updates address two published security advisories (GHSA-6xvm-j4wr-6v98 and GHSA-pwjx-qhcg-rvj4) and one integer overflow bug in bytes. No application code was modified. The updated checksums in the lock files match the published crate versions. The Cargo.toml constraint tightening from "1.5" to "1.11" is correct and intentional — it ensures the minimum resolved version always includes the integer overflow fix. - No files require special attention.

Important Files Changed

| Filename | Overview | |----------|----------| | packages/computeruse/Cargo.lock | Lock file updated with three dependency bumps: bytes 1.10.1→1.11.1 (integer overflow fix), quinn-proto 0.11.13→0.11.14 (DoS security fix GHSA-6xvm-j4wr-6v98), and rustls-webpki 0.103.4→0.103.10 (CRL revocation security fix GHSA-pwjx-qhcg-rvj4). Checksums updated correctly. | | packages/computeruse/crates/computeruse-cli/Cargo.toml | bytes version constraint tightened from "1.5" (>=1.5.0, <2.0.0) to "1.11" (>=1.11.0, <2.0.0) to ensure the integer overflow fix in BytesMut::reserve is always included. | | packages/rust/Cargo.lock | Lock file updated with bytes 1.11.0→1.11.1 bump. Checksum updated correctly. |

Flowchart

```mermaid %%{init: {'theme': 'neutral'}}%% flowchart TD A[Dependabot PR #6633] --> B[packages/computeruse] A --> C[packages/rust] B --> D[Cargo.toml\nbytes: 1.5 → 1.11] B --> E[Cargo.lock\n3 packages updated] E --> F[bytes\n1.10.1 → 1.11.1\nFix: integer overflow in BytesMut::reserve] E --> G[quinn-proto\n0.11.13 → 0.11.14\nSecurity: GHSA-6xvm-j4wr-6v98\nDoS via malformed transport params] E --> H[rustls-webpki\n0.103.4 → 0.103.10\nSecurity: GHSA-pwjx-qhcg-rvj4\nIncorrect CRL revocation checking] C --> I[Cargo.lock\n1 package updated] I --> J[bytes\n1.11.0 → 1.11.1\nFix: integer overflow in BytesMut::reserve] style G fill:#ff9999 style H fill:#ff9999 style F fill:#ffcc99 style J fill:#ffcc99 ``` _{Last reviewed commit: ["chore(deps): bump th..."](https://github.com/elizaos/eliza/commit/4e7ddad90e75f6a7ea82a73a158fdbc788777b33)}