From f57f8d7bb66cd84e8f8eaf9fb74f7d90a1653aa9 Mon Sep 17 00:00:00 2001 From: James Maes Date: Thu, 23 Jul 2026 15:29:10 -0500 Subject: [PATCH 1/3] ci(security): add CodeQL automated static security analysis workflow --- .github/workflows/codeql.yml | 43 ++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 .github/workflows/codeql.yml diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..c834f2d --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,43 @@ +name: "CodeQL Security Analysis" + +on: + push: + branches: [ "main" ] + pull_request: + branches: [ "main" ] + schedule: + - cron: '30 1 * * 1' # Every Monday at 01:30 UTC + +permissions: + actions: read + contents: read + security-events: write + +jobs: + analyze: + name: Analyze CodeQL (${{ matrix.language }}) + runs-on: ubuntu-latest + timeout-minutes: 360 + strategy: + fail-fast: false + matrix: + include: + - language: javascript-typescript + build-mode: none + - language: actions + build-mode: none + + steps: + - name: Checkout Code + uses: actions/checkout@v4 + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: ${{ matrix.language }} + build-mode: ${{ matrix.build-mode }} + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:${{ matrix.language }}" -- 2.54.0 From c28147b70d02fdf821cd9a727187f8ef58908f75 Mon Sep 17 00:00:00 2001 From: James Maes Date: Thu, 23 Jul 2026 15:30:38 -0500 Subject: [PATCH 2/3] ci(dependabot): configure daily automated version updates for Cargo, npm, and GitHub Actions --- .github/dependabot.yml | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 47d51d5..1295c0c 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,13 +1,40 @@ version: 2 updates: + # 1. Rust Workspace Crates (Cargo) - package-ecosystem: "cargo" directory: "/" schedule: - interval: "weekly" + interval: "daily" + time: "04:00" open-pull-requests-limit: 10 + labels: + - "dependencies" + - "rust" + commit-message: + prefix: "deps(cargo)" + # 2. Tauri v2 Desktop GUI UI (npm) + - package-ecosystem: "npm" + directory: "/crates/nuncio-gui/ui" + schedule: + interval: "daily" + time: "04:00" + open-pull-requests-limit: 10 + labels: + - "dependencies" + - "gui" + commit-message: + prefix: "deps(npm)" + + # 3. GitHub Actions Workflows - package-ecosystem: "github-actions" directory: "/" schedule: interval: "weekly" + day: "monday" open-pull-requests-limit: 5 + labels: + - "dependencies" + - "actions" + commit-message: + prefix: "deps(actions)" -- 2.54.0 From afbc19b8591871f845f6fc1fd3268f223fa5e404 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 23 Jul 2026 20:30:43 +0000 Subject: [PATCH 3/3] build(deps): bump mail-parser from 0.9.4 to 0.11.5 Bumps [mail-parser](https://github.com/stalwartlabs/mail-parser) from 0.9.4 to 0.11.5. - [Release notes](https://github.com/stalwartlabs/mail-parser/releases) - [Changelog](https://github.com/stalwartlabs/mail-parser/blob/main/CHANGELOG.md) - [Commits](https://github.com/stalwartlabs/mail-parser/commits) --- updated-dependencies: - dependency-name: mail-parser dependency-version: 0.11.5 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- Cargo.lock | 27 +++++++++++++++------------ Cargo.toml | 2 +- 2 files changed, 16 insertions(+), 13 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 33c9ae9..7a0a26b 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1603,15 +1603,6 @@ version = "1.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4ef6b89e5b37196644d8796de5268852ff179b44e96276cf4290264843743bb7" -[[package]] -name = "encoding_rs" -version = "0.8.35" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3" -dependencies = [ - "cfg-if", -] - [[package]] name = "enumflags2" version = "0.7.12" @@ -2390,6 +2381,18 @@ version = "0.17.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a" +[[package]] +name = "hashify" +version = "0.2.9" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "dd1246c0e5493286aeb2dde35b1f4eb9c4ce00e628641210a5e553fc001a1f26" +dependencies = [ + "indexmap 2.14.0", + "proc-macro2", + "quote", + "syn 2.0.119", +] + [[package]] name = "hashlink" version = "0.10.0" @@ -3337,11 +3340,11 @@ checksum = "c41e0c4fef86961ac6d6f8a82609f55f31b05e4fce149ac5710e439df7619ba4" [[package]] name = "mail-parser" -version = "0.9.4" +version = "0.11.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "93c3b9e5d8b17faf573330bbc43b37d6e918c0a3bf8a88e7d0a220ebc84af9fc" +checksum = "47785d444be4d32c1709171c6219a90f667c0ad0ffe68b4b179e794f31f4f9e8" dependencies = [ - "encoding_rs", + "hashify", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index 3aec15d..13cc2cd 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -53,7 +53,7 @@ tempfile = "3.10" keyring = "2.1" age = "0.10" aes-gcm = "0.10" -mail-parser = "0.9" +mail-parser = "0.11" bytes = "1.6" lettre = { version = "0.11", default-features = false, features = ["tokio1-rustls-tls", "builder", "smtp-transport"] } async-imap = { version = "0.9", default-features = false, features = ["runtime-tokio"] } -- 2.54.0