mirror of
https://github.com/tinyhumansai/openhuman.git
synced 2026-07-27 21:08:00 +00:00
a1462b088e
## Summary
- Bumps `lettre` from `0.11.19` (resolved `0.11.21`) to `0.11.22` to clear [RUSTSEC-2026-0141](https://rustsec.org/advisories/RUSTSEC-2026-0141.html) on both `Cargo.lock` and `app/src-tauri/Cargo.lock`.
- The advisory affects only the `boring-tls` backend; OpenHuman builds with `rustls-tls`, so this is not exploitable at runtime — the bump just clears the `cargo-audit` warning the weekly code-review report (#2084) has been surfacing since 2026-05-18.
## Problem
- `cargo-audit` flags `lettre@0.11.21` for RUSTSEC-2026-0141 / [GHSA-4pj9-g833-qx53](https://github.com/lettre/lettre/security/advisories/GHSA-4pj9-g833-qx53): an inverted boolean disabled TLS hostname verification on the `boring-tls` backend across `0.10.1..0.11.21`.
- Fixed upstream in `0.11.22` (released 2026-05-14).
- Both lockfiles (root + `app/src-tauri/`) resolved `lettre` to the vulnerable `0.11.21`.
## Solution
- Root `Cargo.toml`: `lettre = "0.11.19"` -> `lettre = "0.11.22"`.
- `cargo update -p lettre` in both workspaces refreshed the resolved version to `0.11.22`.
- No call-site changes: the two consumer modules (`src/openhuman/audio_toolkit/ops.rs` and `src/openhuman/channels/providers/email_channel.rs`) only use stable surface (`Message`, `SmtpTransport`, `Transport`, `Credentials`, message-builder types). `0.11.20` raised MSRV to 1.85, but OpenHuman targets Rust 1.93 per `rust-toolchain.toml`, so the bump is compatible.
## Submission Checklist
- [x] N/A: Tests added or updated — pure dependency bump with no behavior change; existing `email_channel` and `audio_toolkit` unit tests cover the consumer sites.
- [x] N/A: Diff coverage >= 80% — `Cargo.toml` / `Cargo.lock` changes have no executable lines for `cargo-llvm-cov` to score.
- [x] N/A: Coverage matrix updated — no feature row added/removed/renamed.
- [x] N/A: All affected feature IDs from the matrix are listed — no matrix row affected.
- [x] No new external network dependencies introduced.
- [x] N/A: Manual smoke checklist updated — dependency-only change, no release-cut surface.
- [x] Linked issue closed via `Closes #2274` in `## Related`.
## Impact
- Runtime/platform impact: none in practice — `rustls-tls` backend is unaffected by RUSTSEC-2026-0141. Clears the `cargo-audit` advisory flag in the weekly code-review report.
- Compatibility impact: back-compatible patch-version bump within the same `0.11.x` line.
- Security impact: forward-looking — removes vulnerable version pin so a future build that ever toggles to `boring-tls` would not regress into the advisory.
## Related
- Closes #2274
- Surfaced by: #2084 (weekly code-review report — 2026-05-18)
- Upstream advisory: https://rustsec.org/advisories/RUSTSEC-2026-0141.html
- Upstream changelog: https://github.com/lettre/lettre/blob/v0.11.22/CHANGELOG.md
---
## AI Authored PR Metadata
### Linear Issue
- Key: N/A
- URL: N/A
### Commit & Branch
- Branch: `fix/lettre-rustsec-2026-0141`
- Commit SHA: 7d3dbdb0
### Validation Run
- [x] N/A: `pnpm --filter openhuman-app format:check` — Rust-only dependency change.
- [x] N/A: `pnpm typecheck` — Rust-only dependency change.
- [x] Focused tests: `cargo test --manifest-path Cargo.toml --lib email_channel` (50/50 pass) and `cargo test --manifest-path Cargo.toml --lib audio_toolkit` (10/10 pass).
- [x] Rust fmt/check: `cargo fmt --check` clean; `cargo check --manifest-path Cargo.toml` clean (pre-existing warnings only); `cargo clippy --lib --no-deps` no new warnings.
- [x] N/A: Tauri fmt/check — no `app/src-tauri/src/**` changes; only `app/src-tauri/Cargo.lock` updated to refresh the transitive `lettre` pin.
### Validation Blocked
- N/A
### Behavior Changes
- Intended behavior change: none in this codebase (build uses `rustls-tls` feature, not `boring-tls`).
- User-visible effect: weekly code-review report no longer flags `lettre@0.11.21` for RUSTSEC-2026-0141 after merge.
### Parity Contract
- Legacy behavior preserved: `Message`/`SmtpTransport`/`Transport`/`Credentials` and message-builder API surface unchanged in `0.11.22`.
- Guard/fallback/dispatch parity checks: not applicable — dependency-only bump.
### Duplicate / Superseded PR Handling
- Duplicate PR(s): none known (searched open and closed PRs touching `lettre`; the only prior hit was #1970 which introduced the dependency).
- Canonical PR: this PR.
- Resolution: N/A.
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **Chores**
* Updated the email service library to the latest patch version for improved stability and bug fixes.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/tinyhumansai/openhuman/pull/2275?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: justin <justin80605@gmail.com>
Co-authored-by: Steven Enamakel <enamakel@tinyhumans.ai>
225 lines
9.2 KiB
TOML
225 lines
9.2 KiB
TOML
[package]
|
|
name = "openhuman"
|
|
version = "0.54.4"
|
|
edition = "2021"
|
|
description = "OpenHuman core business logic and RPC server"
|
|
autobins = false
|
|
|
|
[[bin]]
|
|
name = "openhuman-core"
|
|
path = "src/main.rs"
|
|
|
|
[[bin]]
|
|
name = "slack-backfill"
|
|
path = "src/bin/slack_backfill.rs"
|
|
|
|
[[bin]]
|
|
name = "gmail-backfill-3d"
|
|
path = "src/bin/gmail_backfill_3d.rs"
|
|
|
|
[[bin]]
|
|
name = "memory-tree-init-smoke"
|
|
path = "src/bin/memory_tree_init_smoke.rs"
|
|
|
|
[[bin]]
|
|
name = "inference-probe"
|
|
path = "src/bin/inference_probe.rs"
|
|
|
|
[lib]
|
|
name = "openhuman_core"
|
|
crate-type = ["rlib"]
|
|
|
|
[dependencies]
|
|
serde = { version = "1", features = ["derive"] }
|
|
serde_json = "1"
|
|
serde_yaml = "0.9"
|
|
# (Removed `html2md` dep. dhat-rs profiling on real Gmail inboxes
|
|
# showed `html2md::walk` and `html2md::tables::handle` allocating
|
|
# ~894 MB peak heap on a 10 KB HTML input from Otter.ai-style emails
|
|
# (deeply-nested table-as-layout HTML). Cause: recursive walker holding
|
|
# per-frame Vec state across nesting layers + 5 sequential
|
|
# `regex::replace_all` passes in `clean_markdown` each producing a
|
|
# fresh full-size String. We now use a linear-time tag-and-entity
|
|
# stripper (`fast_html_to_text` in
|
|
# providers/gmail/post_process.rs) and prefer the email's
|
|
# `text/plain` MIME part when available.)
|
|
reqwest = { version = "0.12", default-features = false, features = ["json", "blocking", "rustls-tls", "native-tls", "stream", "http2", "multipart", "socks"] }
|
|
tokio = { version = "1", features = ["full", "sync"] }
|
|
once_cell = "1.19"
|
|
parking_lot = "0.12"
|
|
log = "0.4"
|
|
nu-ansi-term = "0.46"
|
|
env_logger = "0.11"
|
|
base64 = "0.22"
|
|
aes-gcm = "0.10"
|
|
argon2 = "0.5"
|
|
rand = "0.10"
|
|
dirs = "5"
|
|
sha2 = "0.10"
|
|
hmac = "0.12"
|
|
# Archive extraction for the Node.js runtime bootstrap. Unix Node
|
|
# distributions ship as .tar.xz, Windows as .zip. `xz2` with `static`
|
|
# bundles liblzma so we don't need it as a system dependency.
|
|
tar = "0.4"
|
|
xz2 = { version = "0.1", features = ["static"] }
|
|
zip = { version = "2", default-features = false, features = ["deflate"] }
|
|
# gzip decoder for the Piper tar.gz binary releases on macOS / Linux. Already
|
|
# pulled in transitively by zip's `deflate` feature; declared directly so
|
|
# the installer module can `use flate2::read::GzDecoder`.
|
|
flate2 = "1"
|
|
# Real timeout for `node --version` probes in the runtime resolver. Guards
|
|
# against a broken shim on PATH hanging the bootstrap forever.
|
|
wait-timeout = "0.2"
|
|
uuid = { version = "1", features = ["v4"] }
|
|
anyhow = "1.0"
|
|
async-trait = "0.1"
|
|
chacha20poly1305 = "0.10"
|
|
hex = "0.4"
|
|
tokio-util = { version = "0.7", features = ["rt", "io"] }
|
|
tokio-tungstenite = { version = "0.24", features = ["rustls-tls-webpki-roots"] }
|
|
futures = "0.3"
|
|
rusqlite = { version = "0.37", features = ["bundled"] }
|
|
chrono = { version = "0.4", features = ["serde"] }
|
|
iana-time-zone = "0.1"
|
|
cron = "0.12"
|
|
futures-util = "0.3"
|
|
directories = "6"
|
|
toml = "1.0"
|
|
shellexpand = "3.1"
|
|
schemars = "1.2"
|
|
tracing = { version = "0.1", default-features = false }
|
|
tracing-log = "0.2"
|
|
tracing-subscriber = { version = "0.3", default-features = false, features = ["fmt", "ansi", "env-filter"] }
|
|
tracing-appender = "0.2"
|
|
prometheus = { version = "0.14", default-features = false }
|
|
urlencoding = "2.1"
|
|
thiserror = "2.0"
|
|
ring = "0.17"
|
|
prost = { version = "0.14", default-features = false }
|
|
postgres = { version = "0.19", features = ["with-chrono-0_4"] }
|
|
chrono-tz = "0.10"
|
|
dialoguer = { version = "0.12", features = ["fuzzy-select"] }
|
|
dotenvy = "0.15"
|
|
console = "0.16"
|
|
regex = "1.10"
|
|
walkdir = "2"
|
|
glob = "0.3"
|
|
unicode-segmentation = "1"
|
|
unicode-width = "0.2"
|
|
hostname = "0.4.2"
|
|
rustls = { version = "0.23", features = ["ring"] }
|
|
rustls-pki-types = "1.14.0"
|
|
tokio-rustls = "0.26.4"
|
|
webpki-roots = "1.0.6"
|
|
sysinfo = { version = "0.33", default-features = false, features = ["system"] }
|
|
clap = { version = "4.5", features = ["derive"] }
|
|
clap_complete = "4.5"
|
|
lettre = { version = "0.11.22", default-features = false, features = ["builder", "smtp-transport", "rustls-tls"] }
|
|
mail-parser = "0.11.2"
|
|
async-imap = { version = "0.11", features = ["runtime-tokio"], default-features = false }
|
|
axum = { version = "0.8", default-features = false, features = ["http1", "json", "tokio", "query", "ws", "macros"] }
|
|
tower = { version = "0.5", default-features = false }
|
|
opentelemetry = { version = "0.32", default-features = false, features = ["trace", "metrics"] }
|
|
opentelemetry_sdk = { version = "0.32", default-features = false, features = ["trace", "metrics"] }
|
|
opentelemetry-otlp = { version = "0.32", default-features = false, features = ["trace", "metrics", "http-proto", "reqwest-client", "reqwest-rustls-webpki-roots"] }
|
|
sentry = { version = "0.47.0", default-features = false, features = ["backtrace", "contexts", "panic", "tracing", "debug-images", "reqwest", "rustls"] }
|
|
tokio-stream = { version = "0.1.18", features = ["full"] }
|
|
url = "2"
|
|
socketioxide = { version = "0.15", features = ["extensions"] }
|
|
whisper-rs = "0.16"
|
|
image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
|
|
tempfile = "3"
|
|
cpal = "0.15"
|
|
hound = "3.5"
|
|
enigo = "0.3"
|
|
arboard = "3"
|
|
rdev = "0.5"
|
|
fs2 = "0.4"
|
|
# Cross-platform battery probe for the scheduler gate. Maintained fork of
|
|
# the abandoned `battery` crate; same `use battery::*;` API surface. Used
|
|
# only by `openhuman::scheduler_gate::signals` to decide when to throttle
|
|
# background LLM work on laptops.
|
|
starship-battery = "0.10"
|
|
ethers-core = { version = "2.0.14", default-features = false }
|
|
ethers-signers = { version = "2.0.14", default-features = false }
|
|
|
|
matrix-sdk = { version = "0.16", optional = true, default-features = false, features = ["e2e-encryption", "rustls-tls", "markdown"] }
|
|
fantoccini = { version = "0.22.0", optional = true, default-features = false, features = ["rustls-tls"] }
|
|
serde-big-array = { version = "0.5", optional = true }
|
|
pdf-extract = { version = "0.10", optional = true }
|
|
# WhatsApp Web — upstream `whatsapp-rust` 0.5. Replaces the previous `wa-rs`
|
|
# 0.2 fork: upstream now ships its own SqliteStore (so we no longer need the
|
|
# 1.3K-line custom RusqliteStore) and dispatches `Event::Message` for
|
|
# LID-addressed contacts and group sender-key (skmsg) messages — both of
|
|
# which the 0.2 fork silently dropped after decryption.
|
|
whatsapp-rust = { version = "0.5", optional = true, default-features = false, features = ["sqlite-storage", "tokio-runtime"] }
|
|
whatsapp-rust-tokio-transport = { version = "0.5", optional = true, default-features = false }
|
|
whatsapp-rust-ureq-http-client = { version = "0.5", optional = true }
|
|
wacore = { version = "0.5", optional = true, default-features = false }
|
|
|
|
[target.'cfg(target_os = "macos")'.dependencies]
|
|
whisper-rs = { version = "0.16", features = ["metal"] }
|
|
# Contacts framework bindings for address book seeding.
|
|
objc2 = "0.6"
|
|
objc2-foundation = { version = "0.3", features = ["NSArray", "NSError", "NSObject", "NSString", "NSPredicate"] }
|
|
objc2-contacts = { version = "0.3.2", features = ["CNContact", "CNContactFetchRequest", "CNContactStore", "CNLabeledValue", "CNPhoneNumber"] }
|
|
block2 = "0.6"
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
landlock = { version = "0.4", optional = true }
|
|
rppal = { version = "0.22", optional = true }
|
|
|
|
[dev-dependencies]
|
|
# Enable sentry's TestTransport for runtime smoke of the observability
|
|
# before_send filter (see tests/observability_smoke.rs). `default-features
|
|
# = false` here is load-bearing — sentry's default feature set pulls in
|
|
# actix-web / actix-http / actix-server / sentry-actix and ~13 transitive
|
|
# crates we never use (and that bloat the dev Cargo.lock noticeably).
|
|
# TestTransport only needs the `test` feature.
|
|
sentry = { version = "0.47.0", default-features = false, features = ["test"] }
|
|
# Mock HTTP server for provider E2E tests (inference_provider_e2e).
|
|
wiremock = "0.6"
|
|
|
|
[features]
|
|
sandbox-landlock = ["dep:landlock"]
|
|
sandbox-bubblewrap = []
|
|
channel-matrix = ["dep:matrix-sdk"]
|
|
peripheral-rpi = ["dep:rppal"]
|
|
browser-native = ["dep:fantoccini"]
|
|
fantoccini = ["browser-native"]
|
|
landlock = ["sandbox-landlock"]
|
|
rag-pdf = ["dep:pdf-extract"]
|
|
whatsapp-web = ["dep:whatsapp-rust", "dep:whatsapp-rust-tokio-transport", "dep:whatsapp-rust-ureq-http-client", "dep:wacore", "serde-big-array"]
|
|
# Exposes the destructive `openhuman.test_reset` RPC. Off by default; the E2E
|
|
# build (app/scripts/e2e-build.sh) flips it on. Shipped binaries never have
|
|
# this feature so the wipe RPC isn't even registered, let alone reachable.
|
|
e2e-test-support = []
|
|
|
|
# Fix whisper-rs-sys CRT mismatch on Windows MSVC (LNK2038).
|
|
# Upstream cmake build defaults to /MD but Rust uses /MT.
|
|
# This fork adds config.static_crt(true) to the build script.
|
|
# See: https://github.com/tinyhumansai/openhuman/issues/273
|
|
[patch.crates-io]
|
|
whisper-rs-sys = { git = "https://github.com/tinyhumansai/whisper-rs-sys.git", branch = "main" }
|
|
|
|
# Emit just enough DWARF in release builds for Sentry to symbolicate Rust
|
|
# panics + render surrounding source lines. `line-tables-only` keeps the
|
|
# binary small (only file+line tables, no full type info) while still
|
|
# letting `sentry-cli debug-files upload --include-sources` produce a
|
|
# usable `.src.zip`. `split-debuginfo = "packed"` writes the debug data
|
|
# into a separate `.dSYM` bundle on macOS so the shipped executable
|
|
# itself stays slim.
|
|
[profile.release]
|
|
debug = "line-tables-only"
|
|
split-debuginfo = "packed"
|
|
|
|
# Fast CI builds: trade runtime perf for compile speed
|
|
[profile.ci]
|
|
inherits = "release"
|
|
opt-level = 1
|
|
codegen-units = 16
|
|
lto = false
|
|
incremental = false
|
|
strip = true
|
|
debug = false
|