.github/workflows/ci-post-merge.yml

@@ -64,7 +64,7 @@ jobs:
           toolchain: ${{ matrix.version }}
 
       - name: Install just, cargo-hack, cargo-nextest, cargo-ci-cache-clean
-        uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
+        uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2.75.10
         with:
           tool: just,cargo-hack,cargo-nextest,cargo-ci-cache-clean
 
@@ -121,7 +121,7 @@ jobs:
           toolchain: nightly
 
       - name: Install cargo-hack & cargo-minimal-versions
-        uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
+        uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2.75.10
         with:
           tool: cargo-hack,cargo-minimal-versions
 

.github/workflows/ci.yml

@@ -73,7 +73,7 @@ jobs:
           toolchain: ${{ matrix.version.version }}
 
       - name: Install just, cargo-hack, cargo-nextest, cargo-ci-cache-clean
-        uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
+        uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2.75.10
         with:
           tool: just,cargo-hack,cargo-nextest,cargo-ci-cache-clean
 
@@ -114,7 +114,7 @@ jobs:
 
       - name: deny check
         if: matrix.version.name == 'stable' && matrix.target.os == 'ubuntu-latest'
-        uses: EmbarkStudios/cargo-deny-action@91bf2b620e09e18d6eb78b92e7861937469acedb # v2.0.17
+        uses: EmbarkStudios/cargo-deny-action@175dc7fd4fb85ec8f46948fb98f44db001149081 # v2.0.16
 
   docs:
     name: Documentation
@@ -129,7 +129,7 @@ jobs:
           toolchain: nightly
 
       - name: Install just
-        uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
+        uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2.75.10
         with:
           tool: just
 

.github/workflows/coverage.yml

@@ -23,7 +23,7 @@ jobs:
           components: llvm-tools-preview
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
+        uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2.75.10
         with:
           tool: cargo-llvm-cov
 

.github/workflows/lint.yml

@@ -56,7 +56,7 @@ jobs:
           toolchain: ${{ vars.RUST_VERSION_EXTERNAL_TYPES }}
 
       - name: Install just
-        uses: taiki-e/install-action@055f5df8c3f65ea01cd41e9dc855becd88953486 # v2.75.18
+        uses: taiki-e/install-action@85b24a67ef0c632dfefad70b9d5ce8fddb040754 # v2.75.10
         with:
           tool: just
 

bytestring/src/lib.rs

@@ -185,8 +185,7 @@ impl From<Box<str>> for ByteString {
 impl From<ByteString> for String {
     #[inline]
     fn from(value: ByteString) -> Self {
-        // SAFETY: UTF-8 validity is guaranteed during construction.
-        unsafe { String::from_utf8_unchecked(value.0.into()) }
+        String::from_utf8(value.0.into()).expect("ByteString invariant violated")
     }
 }
 

deny.toml

@@ -75,8 +75,6 @@ ignore = [
     { id = "RUSTSEC-2024-0336", reason = "for compatibility" },
     { id = "RUSTSEC-2025-0134", reason = "for compatibility" },
     { id = "RUSTSEC-2026-0049", reason = "for compatibility" },
-    { id = "RUSTSEC-2026-0098", reason = "for compatibility" },
-    { id = "RUSTSEC-2026-0099", reason = "for compatibility" },
 ]
 # If this is true, then cargo deny will use the git executable to fetch advisory database.
 # If this is false, then it uses a built-in git library.