I was curious and went to take a look. The commits are some of the least-focused things I've seen in a long time (beyond "initial code dump" or "commit this week's work before vacation" kinds of things). The addition one is a victim of squash merging just taking a huge dump on usable history…so that would need more PR history digging to untangle that I have little interest in doing. The "fix" commit seems to more just be a happenstance. The merging PR mentions a GHSA, but the actual identifying bits are placeholder "xxx" bits. It reeks of LLM-leveraging rather than LLM-assistance to me. I do at least see multiple rounds of review (though all LLM-mediated) on the fixing PR (I didn't dig into the actual contents though).

This certainly lowers rustfs' viability in my view (though I have no use for an object store to need to make such a decision in the first place).