[dependabot]

Dependabot's bump of mail-parser from 0.11.9 to 1.0 did not build: 1.0 is a rewrite with a read-only view API. This PR ports apps/receiver-rs/src/mail/parse.rs, the only user, to it and moves to 1.0.1, which fixes parameters folded after = (filename, name, boundary). It is rebased on main.

What the stored email document does

The document's shape stays the same. For ordinary mail its content does too:

• Attachments are 1.0's RFC 8621 list plus every other leaf that is not text shown in a body. RFC 8621 leaves out two kinds of part that 0.11 listed:

  • an image shown inline in both bodies, such as a photo pasted into an Apple Mail message;
  • a text part of an alternative that it discards.

  Both stay listed.

• Named HTML alternative: a text/html alternative with a name= after the text/plain stays the HTML body. RFC 8621 would make it an attachment, but mail clients show it as the message, and so did 0.11.

• Attachment bytes: text and HTML attachments are stored converted to UTF-8 from their charset, and a forwarded message is stored as its raw message, both as in 0.11.

• Sizes: when the bytes are not kept, decoded_len() gives the size without decoding.

• Blank fields: a blank Subject or Message-ID stays null. 1.0 reads it as "", which would change the forwarded JSON.

Changes 1.0 brings, all fixes

• A boundary string in the middle of a line no longer ends a part. 0.11 silently cut the text off there.
• An email that forwards several messages lists each one, not one merged attachment.
• Header names with a space, a control character or a leading colon (Fr om:, :From:) are no longer read as From or Subject.
• The last quantum of unpadded base64 is kept, and UTF-7 and UTF-16 text decode correctly.
• RFC 8621 edge cases: a text/plain marked Content-Disposition: attachment inside an alternative is now an attachment, and a headers-only root part marked attachment is listed as an empty attachment.
• Malformed input decodes differently: invalid quoted-printable escapes are kept as written, and bytes outside the base64 alphabet are skipped.

How it was checked

• Corpus diff: the old and new parse.rs ran side by side over mail-parser's corpora (309 messages, plus mbox and maildir samples) and hand-made Apple Mail, Outlook, cid: image, forwarded-message, Latin-1 CSV and UTF-16 messages. Everything not listed above came out identical in document, header map and attachment bytes.
• Independent review: a fresh review found no bugs. It ran the old and new parsers on 528 generated realistic structures, which came out identical. A 200k-iteration structural fuzz found no panics. The document keys never changed, NUL never appeared, sizes always matched the stored bytes, and the document was the same with and without kept contents. Hostile ~10 MB inputs (20k parts, 20k-deep nesting, 600k addresses, nested base64 messages) parsed in at most about 100 ms each. The one finding was the named-HTML case above, now fixed.
• Second review (CodeRabbit was rate-limited): a fresh Fable review found no bugs. It found three low-severity items, now fixed: a quadratic part scan when an alternative holds thousands of named HTML parts (now as fast as 0.11); the text of a named-HTML-only alternative (now converted from the HTML); and a changelog line for text parts that are now listed as attachments.
• Speed: an 11 MB message with three attachments parses in about 11 ms instead of 32 ms.
• New unit tests pin the decisions above. The two attachment-list tests fail with plain 1.0 attachments().
• Local runs: cargo test --locked (329 passed), cargo clippy --locked --all-targets -- -D warnings, cargo fmt --check. MSRV 1.98 matches the local toolchain and the rust:1.98 Docker builder.

The web version is 0.62.5 because #616 takes 0.62.4.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 1812b72d-9cf0-4b5a-9862-98c2fb8e628a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
cargo/encodify	1.0.2	Unknown	Unknown
cargo/hashify	0.3.2	Unknown	Unknown
cargo/mail-parser	1.0.1	Unknown	Unknown

Scanned Files

• apps/receiver-rs/Cargo.lock

[kroqdotdev]

@coderabbitai review

[coderabbitai]

Action not completed

Review skipped.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[kroqdotdev]

@coderabbitai full review

[coderabbitai]

Action not completed

Review skipped.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 23 minutes.