From 05bd80d98fe783706f7a772cdf9fc1670626c216 Mon Sep 17 00:00:00 2001
From: thedancingdeveloper
 <306930456+thedancingdeveloper@users.noreply.github.com>
Date: Sun, 30 Aug 2026 21:32:24 +0000
Subject: [PATCH] release: v1.4.6

Security and dependency maintenance release. No end-user feature or behavior
changes.

- Dependency remediation clearing ~42 Dependabot alerts (#96): Rust benchnzb
  crate bumps (rustls-webpki, quinn-proto, serde_with, rand), Angular framework
  21.2.18 -> 21.2.22 (i18n XSS + HttpTransferCache cache poisoning), and
  frontend dev-dependency transitives (npm audit clean).
- opentelemetry 0.28 -> 0.32 (#97), fixing opentelemetry_sdk unbounded memory
  allocation in W3C Baggage propagation (CVE-2026-48504).
- CodeQL code scanning for Rust and the Angular frontend, plus secret scanning
  and Dependabot security updates enabled on the repository (#98).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NcRDAbyqhY88qnQBaMtue8
---
 Cargo.lock                   | 4 ++--
 Cargo.toml                   | 2 +-
 desktop/src-tauri/Cargo.lock | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 1d137aa..80fb77c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1655,7 +1655,7 @@ dependencies = [
 
 [[package]]
 name = "mock-nntp-server"
-version = "1.4.5"
+version = "1.4.6"
 dependencies = [
  "anyhow",
  "clap",
@@ -2786,7 +2786,7 @@ dependencies = [
 
 [[package]]
 name = "rustnzb"
-version = "1.4.5"
+version = "1.4.6"
 dependencies = [
  "anyhow",
  "arc-swap",
diff --git a/Cargo.toml b/Cargo.toml
index 27b1914..7b5eb79 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -15,7 +15,7 @@ default-members = ["apps/rustnzb"]
 exclude = ["benchnzb", "desktop"]
 
 [workspace.package]
-version = "1.4.5"
+version = "1.4.6"
 edition = "2024"
 license = "MIT"
 
diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock
index 2b80a7e..195afde 100644
--- a/desktop/src-tauri/Cargo.lock
+++ b/desktop/src-tauri/Cargo.lock
@@ -4345,7 +4345,7 @@ dependencies = [
 
 [[package]]
 name = "rustnzb"
-version = "1.4.5"
+version = "1.4.6"
 dependencies = [
  "anyhow",
  "axum",