The dependency bincode 1.3.3 used in bat is unmaintained https://rustsec.org/advisories/RUSTSEC-2025-0141 which means any projects using bat will get a security alert if they use tools like cargo audit or cargo deny check advisories.