Patch bytes advisory

Author: lukewilliamboswell

Cargo.lock

@@ -14,7 +14,7 @@ crate-type = ["staticlib"]
 [dependencies]
 libc = "=0.2.172"
 libsqlite3-sys = { version = "=0.33.0", features = ["bundled"] }
-bytes = "=1.10.1"
+bytes = "=1.11.1"
 futures = "=0.3.31"
 hyper = { version = "=1.6.0", features = ["http1", "http2", "client", "server"] }
 http-body-util = "=0.1.3"

Cargo.toml

@@ -33,8 +33,10 @@ Release-readiness backlog for the Zig compiler migration PR.
   - Deleted obsolete `platform/EnvDecoding.todoroc`, `platform/InternalDateTime.todoroc`, and `platform/Tcp.todoroc`.
   - `./ci/all_tests.sh` now fails if any `.todoroc` files are present: [#109](https://github.com/roc-lang/basic-webserver/issues/109).
 
-- [ ] Triage the GitHub Dependabot alert before tagging.
+- [x] Triage the GitHub Dependabot alert before tagging.
   - GitHub reports one moderate vulnerability on the default branch: <https://github.com/roc-lang/basic-webserver/security/dependabot/4>
+  - Alert is [GHSA-434x-w66g-qw3r](https://github.com/advisories/GHSA-434x-w66g-qw3r) / CVE-2026-25541 for `bytes < 1.11.1`.
+  - `bytes` is now pinned to patched version `1.11.1`.
 
 - [x] Return `Path.Path` from `Env.cwd!`, `Env.exe_path!`, and `Env.temp_dir!`.
   - `cwd!` and `exe_path!` now return byte-preserving `Path.Path` values from Unix bytes or Windows UTF-16 code units.