chore(deps): update rust crate memmap2 to v0.9.11 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
memmap2	workspace.dependencies	patch	0.9.10 → 0.9.11

---

Unchecked pointer offset in crate memmap2

RUSTSEC-2026-0186

More information

Details

Affected versionf of memmap2 did not perform enough validation on the offset and len parameters of
Mmap::[unchecked_]advise_range(),
MmapMut::[unchecked_]advise_ranage()
and MmapMut::flush[_async]_range().

This can cause undefined behavior due to invalid values being passed to pointer::offset() and pointer::add()
when passing an out-of-bounds range to any of the affected functions.

The flaw was corrected in commit [cee7cf0] and released in version 0.9.11.

The invalid pointer is not dereferenced,
but it is passed to the madvise and msync syscalls and their Windows equivalents.

[cee7cf0] https://github.com/RazrFalcon/memmap2-rs/pull/170/changes/cee7cf03a9ee095982a3c37b7aac8e3f68f1a00c

Severity

Unknown

References

• https://crates.io/crates/memmap2
• https://rustsec.org/advisories/RUSTSEC-2026-0186.html
• https://github.com/RazrFalcon/memmap2-rs/issues/169
• https://github.com/RazrFalcon/memmap2-rs/pull/170

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

Release Notes

RazrFalcon/memmap2-rs (memmap2)

v0.9.11

Compare Source

Fixed

• Fix unchecked pointer arithmatic in advice_range, unchecked_advise_range, flush_range and flush_async_range.

Changed

• Bump the MSRV from 1.63 to 1.65.

---

Configuration

📅 Schedule: (in timezone America/Denver)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 91b15f4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR