From 1c5cf97cc547afb1fa16ed85c8865d0e24a12bdc Mon Sep 17 00:00:00 2001
From: Dionisio <dpozo@futurespace.es>
Date: Sat, 14 Feb 2026 01:37:03 +0100
Subject: [PATCH] security: fix audit vulnerabilities (RUSTSEC-2026-0007,
 RUSTSEC-2021-0141)

- Update bytes 1.11.0 -> 1.11.1 (fixes integer overflow in BytesMut::reserve, CVE-2026-25541)
- Replace unmaintained dotenv 0.15.0 with dotenvy 0.15.7 (RUSTSEC-2021-0141)
- Note: rsa 0.9.10 (RUSTSEC-2023-0071) has no patch yet, pulled transitively via jsonwebtoken
---
 Cargo.lock         | 12 +++---------
 Cargo.toml         |  4 ++--
 src/bin/migrate.rs |  6 +++---
 3 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index a8583978..363bbbd1 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -278,9 +278,9 @@ checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
 
 [[package]]
 name = "bytes"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "bzip2"
@@ -546,12 +546,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "dotenv"
-version = "0.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77c90badedccf4105eca100756a0b1289e191f6fcbdadd3cee1d2f614f97da8f"
-
 [[package]]
 name = "dotenvy"
 version = "0.15.7"
@@ -1706,7 +1700,7 @@ dependencies = [
  "base64",
  "bytes",
  "chrono",
- "dotenv",
+ "dotenvy",
  "flate2",
  "fs2",
  "futures",
diff --git a/Cargo.toml b/Cargo.toml
index 576d7c9a..c9bfdd95 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,7 +10,7 @@ axum = { version = "0.8.8", features = ["multipart", "http1", "tokio", "macros"]
 tokio = { version = "1.49.0", features = ["full"] }
 tokio-util = { version = "0.7.18", features = ["io", "codec"] }
 tokio-stream = { version = "0.1.18", features = ["fs"] }
-bytes = "1.11.0"
+bytes = "1.11.1"
 tempfile = "3.25.0"
 tower = "0.5.3"
 tower-http = { version = "0.6.8", features = ["fs", "compression-gzip", "trace", "cors", "add-extension", "request-id"] }
@@ -36,7 +36,7 @@ argon2 = "0.5.3"
 rand_core = { version = "0.6", features = ["std", "getrandom"] }
 hyper = { version = "1.8.1", features = ["full"] }
 quick-xml = "0.39.0"
-dotenv = "0.15.0"
+dotenvy = "0.15.7"
 lru = "0.16.3"
 memmap2 = "0.9"
 http-range-header = "0.4"
diff --git a/src/bin/migrate.rs b/src/bin/migrate.rs
index 155356e6..6f10b1ec 100644
--- a/src/bin/migrate.rs
+++ b/src/bin/migrate.rs
@@ -10,10 +10,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     // Load environment variables (.env.local first, then .env)
     if let Ok(path) = env::var("DOTENV_PATH") {
-        dotenv::from_path(Path::new(&path)).ok();
+        dotenvy::from_path(Path::new(&path)).ok();
     } else {
-        dotenv::from_filename(".env.local").ok();
-        dotenv::dotenv().ok();
+        dotenvy::from_filename(".env.local").ok();
+        dotenvy::dotenv().ok();
     }
 
     // Get DATABASE_URL from environment variables