Skip to main content

max / goingson

Bump ammonia and lettre to clear RUSTSEC advisories ammonia 4.1.3 -> 4.1.4 fixes RUSTSEC-2026-0213, XSS via SVG animate and set tags. This one is on the render path: ammonia is docengine's sanitizer, so it reaches anything the app renders. lettre 0.11.20 -> 0.11.22 clears RUSTSEC-2026-0141 (9.1). Not exploitable here, since the TLS stack is rustls and the advisory is Boring-only, but the fix is a patch bump. Takes cargo audit from 6 vulnerabilities to 4. The remainder are two quick-xml advisories needing a semver-major >=0.41.0, reachable only through tauri-winrt-notification and plist. Correcting the note in the task that prompted this: quick-xml is not on the iCal path, which is not XML.
Co-Authored-By
Claude Opus 5 (1M context) <noreply@anthropic.com>
Author: Max Johnson <me@maxj.phd> · 2026-07-27 17:51 UTC
Signed with PGP, not checked
Commit: 8d783e229ecace9bab444ff76408cf61fd5526c4
Parent: facab7e
1 file changed, +90 insertions, -23 deletions
M Cargo.lock +90 -23
@@ -71,9 +71,9 @@
71 71
72 72 [[package]]
73 73 name = "ammonia"
74 - version = "4.1.3"
74 + version = "4.1.4"
75 75 source = "registry+https://github.com/rust-lang/crates.io-index"
76 - checksum = "68b9d3370580a12f4b7a10fdcc18b28942c083ba570e3d954fe59d10951b85a2"
76 + checksum = "dc6d763210e2eb7670d1a5183a08bebefa3f97db2a738a684f2ce00bd49f681d"
77 77 dependencies = [
78 78 "cssparser 0.37.0",
79 79 "html5ever 0.39.0",
@@ -1339,7 +1339,7 @@
1339 1339 "libc",
1340 1340 "option-ext",
1341 1341 "redox_users",
1342 - "windows-sys 0.61.2",
1342 + "windows-sys 0.59.0",
1343 1343 ]
1344 1344
1345 1345 [[package]]
@@ -1574,7 +1574,7 @@
1574 1574 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
1575 1575 dependencies = [
1576 1576 "libc",
1577 - "windows-sys 0.61.2",
1577 + "windows-sys 0.59.0",
1578 1578 ]
1579 1579
1580 1580 [[package]]
@@ -2288,7 +2288,7 @@
2288 2288 "rfd",
2289 2289 "rusqlite",
2290 2290 "rustls",
2291 - "rustls-platform-verifier",
2291 + "rustls-platform-verifier 0.6.2",
2292 2292 "serde",
2293 2293 "serde_json",
2294 2294 "sha2 0.11.0",
@@ -3059,6 +3059,36 @@
3059 3059 "windows-sys 0.45.0",
3060 3060 ]
3061 3061
3062 + [[package]]
3063 + name = "jni"
3064 + version = "0.22.4"
3065 + source = "registry+https://github.com/rust-lang/crates.io-index"
3066 + checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
3067 + dependencies = [
3068 + "cfg-if",
3069 + "combine",
3070 + "jni-macros",
3071 + "jni-sys 0.4.1",
3072 + "log",
3073 + "simd_cesu8",
3074 + "thiserror 2.0.18",
3075 + "walkdir",
3076 + "windows-link 0.2.1",
3077 + ]
3078 +
3079 + [[package]]
3080 + name = "jni-macros"
3081 + version = "0.22.4"
3082 + source = "registry+https://github.com/rust-lang/crates.io-index"
3083 + checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
3084 + dependencies = [
3085 + "proc-macro2",
3086 + "quote",
3087 + "rustc_version",
3088 + "simd_cesu8",
3089 + "syn 2.0.117",
3090 + ]
3091 +
3062 3092 [[package]]
3063 3093 name = "jni-sys"
3064 3094 version = "0.3.1"
@@ -3233,9 +3263,9 @@
3233 3263
3234 3264 [[package]]
3235 3265 name = "lettre"
3236 - version = "0.11.20"
3266 + version = "0.11.22"
3237 3267 source = "registry+https://github.com/rust-lang/crates.io-index"
3238 - checksum = "471816f3e24b85e820dee02cde962379ea1a669e5242f19c61bcbcffedf4c4fb"
3268 + checksum = "0da65617f6cb926332d039cb578aad56178da86e128db6a1b09f4c94fa5b3349"
3239 3269 dependencies = [
3240 3270 "async-trait",
3241 3271 "base64 0.22.1",
@@ -3251,7 +3281,7 @@
3251 3281 "percent-encoding",
3252 3282 "quoted_printable",
3253 3283 "rustls",
3254 - "rustls-platform-verifier",
3284 + "rustls-platform-verifier 0.7.0",
3255 3285 "socket2",
3256 3286 "tokio",
3257 3287 "tokio-rustls",
@@ -3762,7 +3792,7 @@
3762 3792 source = "registry+https://github.com/rust-lang/crates.io-index"
3763 3793 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
3764 3794 dependencies = [
3765 - "windows-sys 0.61.2",
3795 + "windows-sys 0.59.0",
3766 3796 ]
3767 3797
3768 3798 [[package]]
@@ -5090,7 +5120,7 @@
5090 5120 "pin-project-lite",
5091 5121 "rustls",
5092 5122 "rustls-pki-types",
5093 - "rustls-platform-verifier",
5123 + "rustls-platform-verifier 0.6.2",
5094 5124 "serde",
5095 5125 "serde_json",
5096 5126 "serde_urlencoded",
@@ -5196,7 +5226,7 @@
5196 5226 "errno",
5197 5227 "libc",
5198 5228 "linux-raw-sys",
5199 - "windows-sys 0.61.2",
5229 + "windows-sys 0.59.0",
5200 5230 ]
5201 5231
5202 5232 [[package]]
@@ -5243,7 +5273,7 @@
5243 5273 dependencies = [
5244 5274 "core-foundation 0.10.1",
5245 5275 "core-foundation-sys",
5246 - "jni",
5276 + "jni 0.21.1",
5247 5277 "log",
5248 5278 "once_cell",
5249 5279 "rustls",
@@ -5253,7 +5283,28 @@
5253 5283 "security-framework",
5254 5284 "security-framework-sys",
5255 5285 "webpki-root-certs",
5256 - "windows-sys 0.61.2",
5286 + "windows-sys 0.59.0",
5287 + ]
5288 +
5289 + [[package]]
5290 + name = "rustls-platform-verifier"
5291 + version = "0.7.0"
5292 + source = "registry+https://github.com/rust-lang/crates.io-index"
5293 + checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
5294 + dependencies = [
5295 + "core-foundation 0.10.1",
5296 + "core-foundation-sys",
5297 + "jni 0.22.4",
5298 + "log",
5299 + "once_cell",
5300 + "rustls",
5301 + "rustls-native-certs",
5302 + "rustls-platform-verifier-android",
5303 + "rustls-webpki",
5304 + "security-framework",
5305 + "security-framework-sys",
5306 + "webpki-root-certs",
5307 + "windows-sys 0.59.0",
5257 5308 ]
5258 5309
5259 5310 [[package]]
@@ -5751,6 +5802,22 @@
5751 5802 source = "registry+https://github.com/rust-lang/crates.io-index"
5752 5803 checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
5753 5804
5805 + [[package]]
5806 + name = "simd_cesu8"
5807 + version = "1.2.0"
5808 + source = "registry+https://github.com/rust-lang/crates.io-index"
5809 + checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
5810 + dependencies = [
5811 + "rustc_version",
5812 + "simdutf8",
5813 + ]
5814 +
5815 + [[package]]
5816 + name = "simdutf8"
5817 + version = "0.1.5"
5818 + source = "registry+https://github.com/rust-lang/crates.io-index"
5819 + checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
5820 +
5754 5821 [[package]]
5755 5822 name = "siphasher"
5756 5823 version = "0.3.11"
@@ -5785,7 +5852,7 @@
5785 5852 checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
5786 5853 dependencies = [
5787 5854 "libc",
5788 - "windows-sys 0.61.2",
5855 + "windows-sys 0.60.2",
5789 5856 ]
5790 5857
5791 5858 [[package]]
@@ -6299,7 +6366,7 @@
6299 6366 "gdkwayland-sys",
6300 6367 "gdkx11-sys",
6301 6368 "gtk",
6302 - "jni",
6369 + "jni 0.21.1",
6303 6370 "libc",
6304 6371 "log",
6305 6372 "ndk",
@@ -6366,7 +6433,7 @@
6366 6433 "heck 0.5.0",
6367 6434 "http",
6368 6435 "image",
6369 - "jni",
6436 + "jni 0.21.1",
6370 6437 "libc",
6371 6438 "log",
6372 6439 "mime",
@@ -6629,7 +6696,7 @@
6629 6696 "dpi",
6630 6697 "gtk",
6631 6698 "http",
6632 - "jni",
6699 + "jni 0.21.1",
6633 6700 "objc2",
6634 6701 "objc2-ui-kit",
6635 6702 "objc2-web-kit",
@@ -6652,7 +6719,7 @@
6652 6719 dependencies = [
6653 6720 "gtk",
6654 6721 "http",
6655 - "jni",
6722 + "jni 0.21.1",
6656 6723 "log",
6657 6724 "objc2",
6658 6725 "objc2-app-kit",
@@ -6741,7 +6808,7 @@
6741 6808 "getrandom 0.4.2",
6742 6809 "once_cell",
6743 6810 "rustix",
6744 - "windows-sys 0.61.2",
6811 + "windows-sys 0.59.0",
6745 6812 ]
6746 6813
6747 6814 [[package]]
@@ -6775,7 +6842,7 @@
6775 6842 "parking_lot",
6776 6843 "rustix",
6777 6844 "signal-hook",
6778 - "windows-sys 0.61.2",
6845 + "windows-sys 0.60.2",
6779 6846 ]
6780 6847
6781 6848 [[package]]
@@ -7309,7 +7376,7 @@
7309 7376 dependencies = [
7310 7377 "memoffset",
7311 7378 "tempfile",
7312 - "windows-sys 0.61.2",
7379 + "windows-sys 0.60.2",
7313 7380 ]
7314 7381
7315 7382 [[package]]
@@ -7909,7 +7976,7 @@
7909 7976 source = "registry+https://github.com/rust-lang/crates.io-index"
7910 7977 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
7911 7978 dependencies = [
7912 - "windows-sys 0.61.2",
7979 + "windows-sys 0.59.0",
7913 7980 ]
7914 7981
7915 7982 [[package]]
@@ -8494,7 +8561,7 @@
8494 8561 "gtk",
8495 8562 "http",
8496 8563 "javascriptcore-rs",
8497 - "jni",
8564 + "jni 0.21.1",
8498 8565 "libc",
8499 8566 "ndk",
8500 8567 "objc2",