chore: update dependencies

[dobby-coder]

Security vulnerabilities (fix first)

CVE / Advisory	Package	Severity	Current	Fixed in	Notes
RUSTSEC-2026-0141	lettre	High (CVSS 4.0 AV:N/AC:L)	0.11.19	>= 0.11.22	Inverted-boolean bug silently disables TLS hostname verification when using the boring-tls backend, enabling SMTP MITM. Affects 0.10.1–0.11.21. Note: this project does not explicitly enable boring-tls; upgrade is still strongly recommended as a precaution.
RUSTSEC-2026-0097	rand	Unsound (memory safety)	0.10.0	>= 0.10.1	Aliased mutable reference / UB when a custom log logger calls rand::rng() during reseeding (with log + thread_rng features enabled).

Outdated packages

Package	Current	Latest	Bump type	Notes
lettre	0.11.19	0.11.22	patch	See security advisory above
rand	0.10.0	0.10.1	patch	See security advisory above
tokio	1.48.0	1.52.3	patch
uuid	1.18.1	1.23.4	minor
reqwest	0.13.0	0.13.4	patch
serde_json	1.0.145	1.0.150	patch
chrono	0.4.42	0.4.45	patch
log	0.4.28	0.4.33	patch
url	2.5.7	2.5.8	patch
tokio-util	0.7.17	0.7.18	patch
minreq	2.14.1	3.0.0	major	Review changelog and API changes before upgrading

Worker instructions

• Fix all CVEs first, in severity order (critical→high→medium→low). Every CVE must be resolved in this PR.
  • lettre: bump to "0.11.22" in Cargo.toml
  • rand: bump to "0.10.1" in Cargo.toml
• Then all minor/patch bumps. Evaluate majors individually (update + refactor; do not skip majors).
  • minreq is a major bump (2.x → 3.x): read the changelog, adapt call sites if needed.
• Note: cargo-outdated and cargo-audit were not installed in the scan environment; use cargo update and verify Cargo.lock reflects latest versions. Run cargo audit if you can install it via cargo install cargo-audit.
• Build + run full local test suite after each batch (cargo fmt --check && cargo clippy -- -D warnings && cargo test); fix any compile/test failures.
• Create a DRAFT PR once local tests pass. Title: chore: update dependencies. Assign reviewer rubenhensen.
• Include the following on its own line in the PR body: Closes #<this issue number>
• Monitor CI (gh pr checks --watch); fix CI failures (fmt, clippy, test); when green: gh pr ready.
• If no test suite exists, note that in the PR body.

[dobby-coder]

/dobby

[dobby-coder]

Dobby looked at this but isn't routing it anywhere: Bare /dobby command with no action from the bot itself is noise and not actionable. If that's wrong, ping Dobby again or be explicit with /dobby review, /dobby fix, or /dobby ask.

[dobby-coder]

/dobby fix — resolve the dependency updates listed in this issue. This routine owns dependency-related CVEs, so fix every CVE first in severity order (critical → high → medium → low), then minor/patch, then evaluate major bumps individually. The full CVE table and outdated-package list are in the issue body above. Verify each CVE still applies to current main before changing anything (dependabot or a prior PR may have landed some). Build and run the full local test suite after each batch, open a PR that closes this issue, keep CI green, and mark it ready once all checks pass.

Re-spawn: the 2026-06-29 dep-scan posted a bare /dobby here which the webhook dropped as self-referential noise, so no worker ever picked this up. Re-triggering with explicit intent.

[dobby-coder]

PR #181 is good to go — gatekeeper found 0 blocking issues across all rule checks. Every version bump in the body matches the Cargo.toml diff exactly (lettre 0.11.19→0.11.22 for RUSTSEC-2026-0141, rand 0.10.0→0.10.1 for RUSTSEC-2026-0097, minreq 2→3 with the https-native-tls rename), tests are green, fmt/clippy pass. I've flipped it out of draft: #181