CVE fix (#267)

* deps(rust): bump time to 0.3.47 to fix CVE-2026-25727

The time crate prior to 0.3.47 is vulnerable to a stack-exhaustion DoS
when parsing untrusted input with the RFC 2822 well-known format
(GHSA-r6v5-fh4h-64xc / CVE-2026-25727).

Upgrade time to 0.3.47 in the agent and hypervisor workspaces, which
clears the GitHub Dependabot alert filed against hypervisor/Cargo.lock.

agent/Cargo.lock changes are limited to the time family
(time, time-core, time-macros, num-conv).

hypervisor/Cargo.lock additionally pulls in serde 1.0.228 (with the
new serde_core split crate), serde_derive 1.0.228, deranged 0.5.x and
syn 2.0.87 because time 0.3.47 now depends on serde_core ^1.0.220.
All of these are SemVer-compatible patch/minor bumps with no API breakage.

Assisted-by: CodeBuddy:Claude-Opus-4.7
Signed-off-by: Yi Wang <foxywang@tencent.com>

* hypervisor: bump rate_limiter vmm-sys-util to 0.12.1 to fix CVE-2023-50711

vmm-sys-util < 0.12.0 has a flaw in FamStructWrapper::deserialize that
fails to verify header length matches the flexible array length, allowing
out-of-bounds memory access from Rust-safe code (CVE-2023-50711, GHSA-875g-mfp6-g7f9).

Switch hypervisor/rate_limiter to the workspace-pinned vmm-sys-util 0.12.1,
matching every other crate in the hypervisor workspace and removing the
last reference to the affected 0.11.x line.

Refresh CubeShim/Cargo.lock accordingly: vmm-sys-util 0.11.2 is removed
from the dependency graph. The remaining lock churn is purely textual
renaming from "vmm-sys-util 0.12.1" to "vmm-sys-util" (cargo drops the
version suffix once only one version is present); no other crate or
version is affected.

Assisted-by: CodeBuddy:Claude-Opus-4.7
Signed-off-by: Yi Wang <foxywang@tencent.com>

* deps: bump bytes to 1.11.1 to fix CVE-2026-25541

bytes >= 1.2.1, < 1.11.1 has an unchecked addition in BytesMut::reserve
(unique reclaim path) that can wrap usize in release builds, causing
self.cap to exceed the actual allocation and leading to out-of-bounds
slices in subsequent APIs such as spare_capacity_mut() (CVE-2026-25541,
GHSA-434x-w66g-qw3r, RUSTSEC-2026-0007).

bytes is a transitive dependency in both the hypervisor workspace and
the CubeShim workspace; refresh both Cargo.lock files together so
'make shim' (which links hypervisor via path) builds with --locked. No
Cargo.toml change is required and no other dependency is touched.

Assisted-by: CodeBuddy:Claude-Opus-4.7
Signed-off-by: Yi Wang <foxywang@tencent.com>

* agent: bump bytes to 1.11.1 to fix CVE-2026-25541

bytes >= 1.2.1, < 1.11.1 has an unchecked addition in BytesMut::reserve
(unique reclaim path) that can wrap usize in release builds, causing
self.cap to exceed the actual allocation and leading to out-of-bounds
slices in subsequent APIs such as spare_capacity_mut() (CVE-2026-25541,
GHSA-434x-w66g-qw3r, RUSTSEC-2026-0007).

bytes is a transitive dependency in the agent workspace and its libs
sub-workspace; refresh both Cargo.lock files to pin bytes 1.11.1. No
Cargo.toml change is required and no other dependency is touched.

Assisted-by: CodeBuddy:Claude-Opus-4.7
Signed-off-by: Yi Wang <foxywang@tencent.com>

* deps: bump env_logger to 0.10.2 to drop unmaintained atty (GHSA-g98v-hv3f-hcfr)

atty is unmaintained: the maintainer has been unreachable for over a year,
no fix release is available, and Dependabot reports a potential unaligned
read on Windows when a custom global allocator is used (GHSA-g98v-hv3f-hcfr).

atty is not a direct dependency of this repository; it is pulled in
transitively via env_logger 0.8.x / 0.9.x. env_logger 0.10 replaced atty
with is-terminal, so bumping all four hypervisor crates that pin
env_logger removes atty from the dependency graph.

CubeShim links hypervisor through a path dependency (notably virtiofsd ->
env_logger 0.8.4), so refresh both hypervisor/Cargo.lock and
CubeShim/Cargo.lock together to keep 'make shim --locked' working.

The codebase only uses env_logger::init() / env_logger::try_init(), which
are stable across 0.8 -> 0.10, so no source change is required.

This commit removes the atty link via env_logger. The agent workspace
still pulls atty transitively through clap 3.0.1; that path will be
addressed when clap is upgraded to v4.

Assisted-by: CodeBuddy:Claude-Opus-4.7
Signed-off-by: Yi Wang <foxywang@tencent.com>

---------

Signed-off-by: Yi Wang <foxywang@tencent.com>

Author: up2wing

CubeShim/Cargo.lock

@@ -56,7 +56,7 @@ prometheus = { version = "0.13.0", features = ["process"] }
 procfs = "0.12.0"
 anyhow = "1.0.99"
 cgroups = { package = "cgroups-rs", version = "0.3.0" }
-time = "0.3.41"
+time = "0.3.47"
 
 # Tracing
 tracing = "0.1.26"