security: fix audit vulnerabilities (RUSTSEC-2026-0007, RUSTSEC-2021-0141)

- Update bytes 1.11.0 -> 1.11.1 (fixes integer overflow in BytesMut::reserve, CVE-2026-25541)
- Replace unmaintained dotenv 0.15.0 with dotenvy 0.15.7 (RUSTSEC-2021-0141)
- Note: rsa 0.9.10 (RUSTSEC-2023-0071) has no patch yet, pulled transitively via jsonwebtoken

Cargo.lock

@@ -278,9 +278,9 @@ checksum = "8f1fe948ff07f4bd06c30984e69f5b4899c516a3ef74f34df92a2df2ab535495"
 
 [[package]]
 name = "bytes"
-version = "1.11.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b35204fbdc0b3f4446b89fc1ac2cf84a8a68971995d0bf2e925ec7cd960f9cb3"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "bzip2"
@@ -546,12 +546,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "dotenv"
-version = "0.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77c90badedccf4105eca100756a0b1289e191f6fcbdadd3cee1d2f614f97da8f"
-
 [[package]]
 name = "dotenvy"
 version = "0.15.7"
@@ -1706,7 +1700,7 @@ dependencies = [
  "base64",
  "bytes",
  "chrono",
- "dotenv",
+ "dotenvy",
  "flate2",
  "fs2",
  "futures",

Cargo.toml

@@ -10,7 +10,7 @@ axum = { version = "0.8.8", features = ["multipart", "http1", "tokio", "macros"]
 tokio = { version = "1.49.0", features = ["full"] }
 tokio-util = { version = "0.7.18", features = ["io", "codec"] }
 tokio-stream = { version = "0.1.18", features = ["fs"] }
-bytes = "1.11.0"
+bytes = "1.11.1"
 tempfile = "3.25.0"
 tower = "0.5.3"
 tower-http = { version = "0.6.8", features = ["fs", "compression-gzip", "trace", "cors", "add-extension", "request-id"] }
@@ -36,7 +36,7 @@ argon2 = "0.5.3"
 rand_core = { version = "0.6", features = ["std", "getrandom"] }
 hyper = { version = "1.8.1", features = ["full"] }
 quick-xml = "0.39.0"
-dotenv = "0.15.0"
+dotenvy = "0.15.7"
 lru = "0.16.3"
 memmap2 = "0.9"
 http-range-header = "0.4"

src/bin/migrate.rs

@@ -10,10 +10,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     // Load environment variables (.env.local first, then .env)
     if let Ok(path) = env::var("DOTENV_PATH") {
-        dotenv::from_path(Path::new(&path)).ok();
+        dotenvy::from_path(Path::new(&path)).ok();
     } else {
-        dotenv::from_filename(".env.local").ok();
-        dotenv::dotenv().ok();
+        dotenvy::from_filename(".env.local").ok();
+        dotenvy::dotenv().ok();
     }
 
     // Get DATABASE_URL from environment variables