From 7d3dbdb049cb3e61748aa65b0b5ee189acc4626a Mon Sep 17 00:00:00 2001
From: justin <justin80605@gmail.com>
Date: Wed, 20 May 2026 11:55:34 +0800
Subject: [PATCH] fix(deps): bump lettre to 0.11.22 to clear RUSTSEC-2026-0141
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The previous pin (`lettre = "0.11.19"` resolved as `0.11.21`) is flagged
by `cargo-audit` for RUSTSEC-2026-0141: an inverted boolean disabled TLS
hostname verification on the `boring-tls` backend in `0.10.1..0.11.21`.

OpenHuman builds `lettre` with `default-features = false, features =
["builder", "smtp-transport", "rustls-tls"]`, so the `boring-tls`
backend is never active and this is not exploitable at runtime — but
the weekly code-review report (#2084) and `cargo-audit` keep flagging
the pin until the resolved version moves past the patched cutoff.

`0.11.22` is the fixed release. The patch is API-compatible; `0.11.20`
raised MSRV to 1.85 but OpenHuman targets Rust 1.93 per
`rust-toolchain.toml`. The two consumer sites
(`src/openhuman/audio_toolkit/ops.rs` and
`src/openhuman/channels/providers/email_channel.rs`) only touch
`Message`, `SmtpTransport`, `Transport`, `Credentials`, and message-
builder types, none of which changed.

- `Cargo.toml`: `0.11.19` -> `0.11.22`
- `Cargo.lock`: `lettre` `0.11.21` -> `0.11.22`
- `app/src-tauri/Cargo.lock`: `lettre` `0.11.21` -> `0.11.22`

Verified locally:
- `cargo check --manifest-path Cargo.toml` clean (pre-existing
  warnings only)
- `cargo test --lib email_channel` 50/50 pass
- `cargo test --lib audio_toolkit` 10/10 pass
- `cargo fmt --check` clean
- `cargo clippy --lib --no-deps` no new warnings

Closes #2274
---
 Cargo.lock               | 4 ++--
 Cargo.toml               | 2 +-
 app/src-tauri/Cargo.lock | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 3cb13cdea..252b37e2c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3669,9 +3669,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "lettre"
-version = "0.11.21"
+version = "0.11.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dabda5859ee7c06b995b9d1165aa52c39110e079ef609db97178d86aeb051fa7"
+checksum = "0da65617f6cb926332d039cb578aad56178da86e128db6a1b09f4c94fa5b3349"
 dependencies = [
  "base64 0.22.1",
  "email-encoding",
diff --git a/Cargo.toml b/Cargo.toml
index 04036fe15..293f01101 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -114,7 +114,7 @@ webpki-roots = "1.0.6"
 sysinfo = { version = "0.33", default-features = false, features = ["system"] }
 clap = { version = "4.5", features = ["derive"] }
 clap_complete = "4.5"
-lettre = { version = "0.11.19", default-features = false, features = ["builder", "smtp-transport", "rustls-tls"] }
+lettre = { version = "0.11.22", default-features = false, features = ["builder", "smtp-transport", "rustls-tls"] }
 mail-parser = "0.11.2"
 async-imap = { version = "0.11", features = ["runtime-tokio"], default-features = false }
 axum = { version = "0.8", default-features = false, features = ["http1", "json", "tokio", "query", "ws", "macros"] }
diff --git a/app/src-tauri/Cargo.lock b/app/src-tauri/Cargo.lock
index bef84a563..e904ccdfe 100644
--- a/app/src-tauri/Cargo.lock
+++ b/app/src-tauri/Cargo.lock
@@ -3943,9 +3943,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "lettre"
-version = "0.11.21"
+version = "0.11.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dabda5859ee7c06b995b9d1165aa52c39110e079ef609db97178d86aeb051fa7"
+checksum = "0da65617f6cb926332d039cb578aad56178da86e128db6a1b09f4c94fa5b3349"
 dependencies = [
  "base64 0.22.1",
  "email-encoding",