Description

Five workspace dependencies in the root Cargo.toml have no crate-level consumers following the sidecar migration. They are compiled and audited by cargo deny despite nothing using them, adding unnecessary compile time, binary size, and supply chain attack surface.

Identified via independent security audit of main branch (June 2026) cross-referenced with a Ponytail /ponytail-audit scan.

Expected Behavior

Unused dependencies are removed from the workspace. cargo deny check audits only dependencies that are actually in use.

Steps to Reproduce

1. Clone the repository
2. Run: grep -r "lettre|imap|rustls-connector|mailparse|rustls-pemfile" crates/ --include="*.rs"
3. Observe: zero results — no crate in the workspace imports any of these five dependencies
4. The entries remain in Cargo.toml at lines 261-266 and 124

LibreFang Version

v2026.6.10-beta.17 (commit 6196f13)

Operating System

Windows

Logs / Screenshots

No response