mirror of
https://github.com/tinyhumansai/openhuman.git
synced 2026-07-29 22:23:01 +00:00
justin
7d3dbdb049
The previous pin (`lettre = "0.11.19"` resolved as `0.11.21`) is flagged by `cargo-audit` for RUSTSEC-2026-0141: an inverted boolean disabled TLS hostname verification on the `boring-tls` backend in `0.10.1..0.11.21`. OpenHuman builds `lettre` with `default-features = false, features = ["builder", "smtp-transport", "rustls-tls"]`, so the `boring-tls` backend is never active and this is not exploitable at runtime — but the weekly code-review report (#2084) and `cargo-audit` keep flagging the pin until the resolved version moves past the patched cutoff. `0.11.22` is the fixed release. The patch is API-compatible; `0.11.20` raised MSRV to 1.85 but OpenHuman targets Rust 1.93 per `rust-toolchain.toml`. The two consumer sites (`src/openhuman/audio_toolkit/ops.rs` and `src/openhuman/channels/providers/email_channel.rs`) only touch `Message`, `SmtpTransport`, `Transport`, `Credentials`, and message- builder types, none of which changed. - `Cargo.toml`: `0.11.19` -> `0.11.22` - `Cargo.lock`: `lettre` `0.11.21` -> `0.11.22` - `app/src-tauri/Cargo.lock`: `lettre` `0.11.21` -> `0.11.22` Verified locally: - `cargo check --manifest-path Cargo.toml` clean (pre-existing warnings only) - `cargo test --lib email_channel` 50/50 pass - `cargo test --lib audio_toolkit` 10/10 pass - `cargo fmt --check` clean - `cargo clippy --lib --no-deps` no new warnings Closes #2274
Tauri + React + Typescript
This template should help get you started developing with Tauri, React and Typescript in Vite.