Bug#1141965: With debdiff attachment

diff -Nru cyrus-imapd-3.10.2/debian/changelog cyrus-imapd-3.10.2/debian/changelog
--- cyrus-imapd-3.10.2/debian/changelog	2025-06-27 07:19:23.000000000 +0200
+++ cyrus-imapd-3.10.2/debian/changelog	2026-07-12 21:29:05.000000000 +0200
@@ -1,3 +1,10 @@
+cyrus-imapd (3.10.2-1+deb13u1) trixie; urgency=medium
+
+  * http_jmap: allow JMAP EventSource without WebSocket/wslay; backport
+    upstream commit d510b3d2b (released 3.12.0). (Closes: #1141956)
+
+ -- Edmund Lodewijks <[email protected]>  Sun, 12 Jul 2026 21:29:05 +0200
+
 cyrus-imapd (3.10.2-1) unstable; urgency=medium
 
   * New upstream version 3.10.2
diff -Nru cyrus-imapd-3.10.2/debian/patches/eventsource-without-websocket.patch cyrus-imapd-3.10.2/debian/patches/eventsource-without-websocket.patch
--- cyrus-imapd-3.10.2/debian/patches/eventsource-without-websocket.patch	1970-01-01 02:00:00.000000000 +0200
+++ cyrus-imapd-3.10.2/debian/patches/eventsource-without-websocket.patch	2026-07-12 21:22:46.000000000 +0200
@@ -0,0 +1,73 @@
+Description: JMAP: allow EventSource (push) without WebSocket/wslay
+ In 3.10.x jmap_push_poll is initialised only inside "if (ws_enabled)", so on
+ builds without libwslay the JMAP EventSource endpoint returns 204
+ unconditionally while the session still advertises eventSourceUrl (RFC 8620
+ §7.3). Move the initialisation out of the WebSocket guard.
+ .
+ The two cassandane tests from the upstream commit are omitted (not run at
+ Debian package build time).
+Origin: upstream, https://github.com/cyrusimap/cyrus-imapd/commit/d510b3d2bd5954b61770ec5ac51e00b0ed14b6b2
+Bug: https://github.com/cyrusimap/cyrus-imapd/pull/5246
+Bug-Debian: https://bugs.debian.org/1141956
+Applied-Upstream: 3.12.0
+Author: Ken Murchison <[email protected]>
+Last-Update: 2026-07-12
+Index: cyrus-imapd-3.10.2/imap/http_jmap.c
+===================================================================
+--- cyrus-imapd-3.10.2.orig/imap/http_jmap.c
++++ cyrus-imapd-3.10.2/imap/http_jmap.c
+@@ -196,10 +196,10 @@ static void jmap_init(struct buf *server
+ #endif
+     jmap_admin_init(&my_jmap_settings);
+ 
+-    if (ws_enabled) {
+-        jmap_push_poll = config_getduration(IMAPOPT_JMAP_PUSHPOLL, 's');
+-        if (jmap_push_poll < 0) jmap_push_poll = 0;
++    jmap_push_poll = config_getduration(IMAPOPT_JMAP_PUSHPOLL, 's');
++    if (jmap_push_poll < 0) jmap_push_poll = 0;
+ 
++    if (ws_enabled) {
+         json_object_set_new(my_jmap_settings.server_capabilities,
+                 JMAP_URN_WEBSOCKET,
+                 json_pack("{s:s s:b}",
+@@ -318,7 +318,8 @@ static int jmap_parse_path(const char *p
+             tgt->flags = JMAP_ENDPOINT_WS;
+             tgt->allow |= ALLOW_CONNECT;
+         }
+-        else if (!strncmp(tgt->collection,
++        else if (jmap_push_poll &&
++                 !strncmp(tgt->collection,
+                           JMAP_EVENTSOURCE_COL, strlen(JMAP_EVENTSOURCE_COL))) {
+             tgt->flags = JMAP_ENDPOINT_EVENTSOURCE;
+         }
+@@ -1269,8 +1270,11 @@ static int jmap_get_session(struct trans
+             json_string(JMAP_BASE_URL JMAP_DOWNLOAD_COL JMAP_DOWNLOAD_TPL));
+     json_object_set_new(jsession, "uploadUrl",
+             json_string(JMAP_BASE_URL JMAP_UPLOAD_COL JMAP_UPLOAD_TPL));
+-    json_object_set_new(jsession, "eventSourceUrl",
+-            json_string(JMAP_BASE_URL JMAP_EVENTSOURCE_COL JMAP_EVENTSOURCE_TPL));
++
++    if (jmap_push_poll) {
++        json_object_set_new(jsession, "eventSourceUrl",
++                            json_string(JMAP_BASE_URL JMAP_EVENTSOURCE_COL JMAP_EVENTSOURCE_TPL));
++    }
+ 
+     /* state */
+     char *inboxname = mboxname_user_mbox(httpd_userid, NULL);
+@@ -1423,14 +1427,14 @@ static int jmap_ws(struct transaction_t
+             /* Process the API request */
+             ret = jmap_api(txn, req, &res, &my_jmap_settings);
+         }
+-        else if (!strcmpsafe(type, "WebSocketPushEnable")) {
++        else if (jmap_push_poll && !strcmpsafe(type, "WebSocketPushEnable")) {
+             /* Log request */
+             spool_replace_header(xstrdup(":jmap"),
+                                  xstrdup("WebSocketPushEnable"), txn->req_hdrs);
+             ws_push_enable(txn, req);
+             ret = HTTP_NO_CONTENT;
+         }
+-        else if (!strcmpsafe(type, "WebSocketPushDisable")) {
++        else if (jmap_push_poll && !strcmpsafe(type, "WebSocketPushDisable")) {
+             /* Log request */
+             spool_replace_header(xstrdup(":jmap"),
+                                  xstrdup("WebSocketPushDisable"), txn->req_hdrs);
diff -Nru cyrus-imapd-3.10.2/debian/patches/series cyrus-imapd-3.10.2/debian/patches/series
--- cyrus-imapd-3.10.2/debian/patches/series	2025-06-27 07:10:48.000000000 +0200
+++ cyrus-imapd-3.10.2/debian/patches/series	2026-07-12 20:51:31.000000000 +0200
@@ -7,3 +7,4 @@
 0012-Use-UnicodeData.txt-from-system.patch
 0018-increase-test-timeout.patch
 #0019-propagate-XXFLAGS.patch
+eventsource-without-websocket.patch