CVS commit: pkgsrc/mail

"Takahiro Kambe" <[email protected]>
Newsgroups gmane.os.netbsd.devel.pkgsrc.cvs
Message-ID <[email protected]> 
Module Name:	pkgsrc
Committed By:	taca
Date:		Tue Aug 11 15:21:53 UTC 2026

Modified Files:
	pkgsrc/mail/roundcube: Makefile Makefile.common PLIST distinfo
	pkgsrc/mail/roundcube-plugin-password: Makefile distinfo

Log Message:
mail/roundcube:

1.6.18 (2026-08-19)

* Password: Fix fatal error "Class 'Zxcvbn' not found" (#10274)
* Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF
  decoder (#10269)
* Security: Add basic validation for content proxied by the css proxy
* Security: Fix SSRF bypass via specific local address URLs using
  100.64.0.0/10 and fe80::/10 nets
* Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io
  hostnames evading is_local_url() check
* Security: Fix remote content blocking bypass via unclosed url() in a
  FuncIRI attribute
* Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution
  into the `search_filter`
* Security: Fix arbitrary Sieve script injection via a filter rule name
  bypassing `managesieve_disabled_actions`
* Security: Fix RCE via `cmd_learn` driver of markasjunk plugin
* Security: Fix IMAP command injection via mail search and LITERAL+
  byte-count desynchronization
* Security: Fix password's modoboa driver leak of an authentication token to
  a user-controlled host
* Security: Fix stored XSS in "Add to address book" action
* Security: Fix HTML/CSS sanitization bypass via SVG animate `by` attribute


To generate a diff of this commit:
cvs rdiff -u -r1.104 -r1.105 pkgsrc/mail/roundcube/Makefile
cvs rdiff -u -r1.45 -r1.46 pkgsrc/mail/roundcube/Makefile.common
cvs rdiff -u -r1.61 -r1.62 pkgsrc/mail/roundcube/PLIST
cvs rdiff -u -r1.102 -r1.103 pkgsrc/mail/roundcube/distinfo
cvs rdiff -u -r1.28 -r1.29 pkgsrc/mail/roundcube-plugin-password/Makefile
cvs rdiff -u -r1.47 -r1.48 pkgsrc/mail/roundcube-plugin-password/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
(unnamed) (text/x-diff, 6.9 KB) 
Modified files:

Index: pkgsrc/mail/roundcube/Makefile
diff -u pkgsrc/mail/roundcube/Makefile:1.104 pkgsrc/mail/roundcube/Makefile:1.105
--- pkgsrc/mail/roundcube/Makefile:1.104	Sun May 24 14:01:51 2026
+++ pkgsrc/mail/roundcube/Makefile	Tue Aug 11 15:21:52 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.104 2026/05/24 14:01:51 taca Exp $
+# $NetBSD: Makefile,v 1.105 2026/08/11 15:21:52 taca Exp $
 
 DISTNAME=	roundcubemail-${RC_VERS}
 PKGNAME=	${PHP_PKG_PREFIX}-${DISTNAME:S/mail-/-/:S/-complete//}
@@ -18,6 +18,8 @@ DEPENDS+=	${PHP_PKG_PREFIX}-pear-Net_IDN
 DEPENDS+=	${PHP_PKG_PREFIX}-pear-Mail_Mime>=1.10.0:../../mail/pear-Mail_Mime
 DEPENDS+=	${PHP_PKG_PREFIX}-pear-Auth_SASL>=1.0.6:../../mail/pear-Auth_SASL
 
+PHP_REQUIRE_MODULE=	json
+
 RC_SUBDIRS=	SQL bin installer plugins program skins vendor
 
 .for d in ${RC_SUBDIRS}
@@ -110,5 +112,5 @@ do-install:
 		${DESTDIR}${PREFIX}/${EGDIR}/defaults.inc.php
 
 .include "Makefile.common"
-.include "../../lang/php/json.mk"
+.include "../../lang/php/compat.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/mail/roundcube/Makefile.common
diff -u pkgsrc/mail/roundcube/Makefile.common:1.45 pkgsrc/mail/roundcube/Makefile.common:1.46
--- pkgsrc/mail/roundcube/Makefile.common:1.45	Sun Jul  5 16:03:49 2026
+++ pkgsrc/mail/roundcube/Makefile.common	Tue Aug 11 15:21:52 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.45 2026/07/05 16:03:49 taca Exp $
+# $NetBSD: Makefile.common,v 1.46 2026/08/11 15:21:52 taca Exp $
 #
 # used by mail/roundcube/Makefile
 # used by mail/roundcube/plugins.mk
@@ -10,7 +10,7 @@ GITHUB_PROJECT=	roundcubemail
 GITHUB_RELEASE=	${RC_VERS}
 HOMEPAGE=	https://roundcube.net/
 
-RC_VERS=	1.6.17
+RC_VERS=	1.6.18
 
 USE_LANGUAGES=		# none
 USE_TOOLS+=		pax

Index: pkgsrc/mail/roundcube/PLIST
diff -u pkgsrc/mail/roundcube/PLIST:1.61 pkgsrc/mail/roundcube/PLIST:1.62
--- pkgsrc/mail/roundcube/PLIST:1.61	Sun Jul  5 16:03:49 2026
+++ pkgsrc/mail/roundcube/PLIST	Tue Aug 11 15:21:52 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.61 2026/07/05 16:03:49 taca Exp $
+@comment $NetBSD: PLIST,v 1.62 2026/08/11 15:21:52 taca Exp $
 share/doc/roundcube/CHANGELOG.md
 share/doc/roundcube/INSTALL
 share/doc/roundcube/LICENSE
@@ -2089,7 +2089,6 @@ share/roundcube/vendor/guzzlehttp/guzzle
 share/roundcube/vendor/guzzlehttp/guzzle/README.md
 share/roundcube/vendor/guzzlehttp/guzzle/UPGRADING.md
 share/roundcube/vendor/guzzlehttp/guzzle/composer.json
-share/roundcube/vendor/guzzlehttp/guzzle/package-lock.json
 share/roundcube/vendor/guzzlehttp/guzzle/src/BodySummarizer.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/BodySummarizerInterface.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Client.php
@@ -2117,6 +2116,7 @@ share/roundcube/vendor/guzzlehttp/guzzle
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/CurlVersion.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/EasyHandle.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/HeaderProcessor.php
+share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/HostValidator.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/MockHandler.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/Proxy.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/ProxyEnvironment.php
@@ -2126,6 +2126,7 @@ share/roundcube/vendor/guzzlehttp/guzzle
 share/roundcube/vendor/guzzlehttp/guzzle/src/MessageFormatter.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/MessageFormatterInterface.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Middleware.php
+share/roundcube/vendor/guzzlehttp/guzzle/src/Multiplexing.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Pool.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/PrepareBodyMiddleware.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/RedirectMiddleware.php

Index: pkgsrc/mail/roundcube/distinfo
diff -u pkgsrc/mail/roundcube/distinfo:1.102 pkgsrc/mail/roundcube/distinfo:1.103
--- pkgsrc/mail/roundcube/distinfo:1.102	Sun Jul  5 16:03:49 2026
+++ pkgsrc/mail/roundcube/distinfo	Tue Aug 11 15:21:52 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.102 2026/07/05 16:03:49 taca Exp $
+$NetBSD: distinfo,v 1.103 2026/08/11 15:21:52 taca Exp $
 
-BLAKE2s (roundcubemail-1.6.17-complete.tar.gz) = 355e5e12e01a1b8445a32dee7fd5829f83c88487fb6c75efc4642d4b6c355d47
-SHA512 (roundcubemail-1.6.17-complete.tar.gz) = 87748173587fbf0205287bd02d11cf81388fdc5805ce6e500971639d77a98c644265605351016c2299aaf2394b4057ab31a870fbe8e549ad593699b5e9b9e680
-Size (roundcubemail-1.6.17-complete.tar.gz) = 5921414 bytes
+BLAKE2s (roundcubemail-1.6.18-complete.tar.gz) = bcadb116bd8fbba0dab678104e80da56a17b5b0d5fa14b59a654cca4d9f72a0c
+SHA512 (roundcubemail-1.6.18-complete.tar.gz) = c2fb9916aac3078631fcee2fb9c3c2a3b882faab6a0d8238f35ce7575dafb21f623b133e9f23910bde412aa88597d876201c281972b25d4671099f2a628b7dcf
+Size (roundcubemail-1.6.18-complete.tar.gz) = 5954664 bytes
 SHA1 (patch-config_config.inc.php.sample) = 92a48a97b16fe3f5f4b9441fce762a559d8daca7
 SHA1 (patch-program_include_iniset.php) = 8a6c13c0c87d583ed60e43c01a4173d9d802a6a1
 SHA1 (patch-program_lib_Roundcube_rcube__mime.php) = bfefc6850d3db230dd4224491e895fe25a32e87a

Index: pkgsrc/mail/roundcube-plugin-password/Makefile
diff -u pkgsrc/mail/roundcube-plugin-password/Makefile:1.28 pkgsrc/mail/roundcube-plugin-password/Makefile:1.29
--- pkgsrc/mail/roundcube-plugin-password/Makefile:1.28	Thu Jul 16 19:04:10 2026
+++ pkgsrc/mail/roundcube-plugin-password/Makefile	Tue Aug 11 15:21:52 2026
@@ -1,10 +1,9 @@
-# $NetBSD: Makefile,v 1.28 2026/07/16 19:04:10 wiz Exp $
+# $NetBSD: Makefile,v 1.29 2026/08/11 15:21:52 taca Exp $
 
 PLUGIN=		password
 
 MAINTAINER=	[email protected]
 COMMENT=	Password change plugin for roundcube
-PKGREVISION=	1
 LICENSE=	gnu-gpl-v3
 
 DEPENDS+=	tcl-expect>=5.32.1:../../lang/tcl-expect

Index: pkgsrc/mail/roundcube-plugin-password/distinfo
diff -u pkgsrc/mail/roundcube-plugin-password/distinfo:1.47 pkgsrc/mail/roundcube-plugin-password/distinfo:1.48
--- pkgsrc/mail/roundcube-plugin-password/distinfo:1.47	Sun Jul  5 16:07:50 2026
+++ pkgsrc/mail/roundcube-plugin-password/distinfo	Tue Aug 11 15:21:52 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.47 2026/07/05 16:07:50 taca Exp $
+$NetBSD: distinfo,v 1.48 2026/08/11 15:21:52 taca Exp $
 
-BLAKE2s (roundcubemail-1.6.17-complete.tar.gz) = 355e5e12e01a1b8445a32dee7fd5829f83c88487fb6c75efc4642d4b6c355d47
-SHA512 (roundcubemail-1.6.17-complete.tar.gz) = 87748173587fbf0205287bd02d11cf81388fdc5805ce6e500971639d77a98c644265605351016c2299aaf2394b4057ab31a870fbe8e549ad593699b5e9b9e680
-Size (roundcubemail-1.6.17-complete.tar.gz) = 5921414 bytes
+BLAKE2s (roundcubemail-1.6.18-complete.tar.gz) = bcadb116bd8fbba0dab678104e80da56a17b5b0d5fa14b59a654cca4d9f72a0c
+SHA512 (roundcubemail-1.6.18-complete.tar.gz) = c2fb9916aac3078631fcee2fb9c3c2a3b882faab6a0d8238f35ce7575dafb21f623b133e9f23910bde412aa88597d876201c281972b25d4671099f2a628b7dcf
+Size (roundcubemail-1.6.18-complete.tar.gz) = 5954664 bytes
 SHA1 (patch-plugins_password_helpers_passwd-expect) = 15e427a3c90bf7c0437a023b3f099abb5a139165
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.