chore(release): v0.12.1

cargo-deny in the Supply Chain job started failing on a new advisory
against the locked rustls 0.23.35 (TLS 1.3 handshake messages accepted
across encryption level boundaries). Upgrade to the patched release.

CHANGELOG.md

@@ -9,6 +9,24 @@ generated trace matrix lives in [docs/traceability.md](docs/traceability.md).
 For how long each fixed defect had been shipping before it was found, see
 [docs/defect-windows.md](docs/defect-windows.md).
 
+## v0.12.1
+
+One change: the TLS library every connection to the server goes through has a
+published vulnerability, and this build carries the fixed release of it. Nothing
+in JellyTau itself changed.
+
+### 🔒 Security
+
+- **Updated the TLS library (rustls) to 0.23.45** for
+  [RUSTSEC-2026-0285](https://rustsec.org/advisories/RUSTSEC-2026-0285). The
+  version in v0.12.0 accepted TLS 1.3 handshake messages sent at the wrong
+  encryption level — the same fault as Go's CVE-2025-61730. The handshake stays
+  authenticated, so someone on the network could not alter or complete a
+  connection with it; the practical effect was that a server could send in
+  plaintext what should have been encrypted without the app refusing. Every
+  JellyTau build from the first release used an affected version. Found by the
+  dependency-advisory gate in CI, which is what it is there for.
+
 ## v0.12.0
 
 JellyTau works against Jellyfin 12. Jellyfin 12.0 shipped on 2026-09-08 and

package.json

@@ -1,6 +1,6 @@
 {
   "name": "jellytau",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "A cross-platform Jellyfin client built with Tauri, SvelteKit and Rust.",
   "author": "Duncan Tourolle <duncan@tourolle.paris>",
   "license": "MIT",

src-tauri/Cargo.lock

@@ -2275,7 +2275,7 @@ dependencies = [
 
 [[package]]
 name = "jellytau"
-version = "0.12.0"
+version = "0.12.1"
 dependencies = [
  "aes-gcm",
  "argon2",
@@ -4000,9 +4000,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.35"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "533f54bc6a7d4f647e46ad909549eda97bf5afc1585190ef692b4286b198bd8f"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "once_cell",
  "ring",

src-tauri/Cargo.toml

@@ -4,7 +4,7 @@ name = "jellytau"
 # `player-conformance`, and a second binary makes a bare `cargo run` —
 # which `tauri dev` issues — ambiguous.
 default-run = "jellytau"
-version = "0.12.0"
+version = "0.12.1"
 description = "A cross-platform Jellyfin client"
 authors = ["Duncan Tourolle <duncan@tourolle.paris>"]
 license = "MIT"

src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "JellyTau",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "identifier": "com.dtourolle.jellytau",
   "build": {
     "beforeDevCommand": "bun run dev",