CVS commit: [pkgsrc-2026Q2] pkgsrc/mail
"Maya Rashish" <[email protected]>
| Newsgroups | gmane.os.netbsd.devel.pkgsrc.cvs |
|---|---|
| Message-ID | <[email protected]> |
Module Name: pkgsrc
Committed By: maya
Date: Thu Aug 20 02:03:28 UTC 2026
Modified Files:
pkgsrc/mail/roundcube [pkgsrc-2026Q2]: Makefile Makefile.common PLIST
distinfo
pkgsrc/mail/roundcube-plugin-password [pkgsrc-2026Q2]: distinfo
Log Message:
Pullup ticket #7229 - requested by taca
mail/roundcube: Security fix
mail/roundcube-plugin-password: Security fix
Revisions pulled up:
- mail/roundcube-plugin-password/Makefile 1.29
- mail/roundcube-plugin-password/distinfo 1.48
- mail/roundcube/Makefile 1.105
- mail/roundcube/Makefile.common 1.46
- mail/roundcube/PLIST 1.62
- mail/roundcube/distinfo 1.103
---
Module Name: pkgsrc
Committed By: taca
Date: Tue Aug 11 15:21:53 UTC 2026
Modified Files:
pkgsrc/mail/roundcube: Makefile Makefile.common PLIST distinfo
pkgsrc/mail/roundcube-plugin-password: Makefile distinfo
Log Message:
mail/roundcube:
1.6.18 (2026-08-19)
* Password: Fix fatal error "Class 'Zxcvbn' not found" (#10274)
* Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF
decoder (#10269)
* Security: Add basic validation for content proxied by the css proxy
* Security: Fix SSRF bypass via specific local address URLs using
100.64.0.0/10 and fe80::/10 nets
* Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io
hostnames evading is_local_url() check
* Security: Fix remote content blocking bypass via unclosed url() in a
FuncIRI attribute
* Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution
into the `search_filter`
* Security: Fix arbitrary Sieve script injection via a filter rule name
bypassing `managesieve_disabled_actions`
* Security: Fix RCE via `cmd_learn` driver of markasjunk plugin
* Security: Fix IMAP command injection via mail search and LITERAL+
byte-count desynchronization
* Security: Fix password's modoboa driver leak of an authentication token to
a user-controlled host
* Security: Fix stored XSS in "Add to address book" action
* Security: Fix HTML/CSS sanitization bypass via SVG animate `by` attribute
To generate a diff of this commit:
cvs rdiff -u -r1.104 -r1.104.2.1 pkgsrc/mail/roundcube/Makefile
cvs rdiff -u -r1.44.2.1 -r1.44.2.2 pkgsrc/mail/roundcube/Makefile.common
cvs rdiff -u -r1.60.2.1 -r1.60.2.2 pkgsrc/mail/roundcube/PLIST
cvs rdiff -u -r1.101.2.1 -r1.101.2.2 pkgsrc/mail/roundcube/distinfo
cvs rdiff -u -r1.46.2.1 -r1.46.2.2 \
pkgsrc/mail/roundcube-plugin-password/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
(unnamed)
(text/x-diff, 6.3 KB)
Modified files:
Index: pkgsrc/mail/roundcube/Makefile
diff -u pkgsrc/mail/roundcube/Makefile:1.104 pkgsrc/mail/roundcube/Makefile:1.104.2.1
--- pkgsrc/mail/roundcube/Makefile:1.104 Sun May 24 14:01:51 2026
+++ pkgsrc/mail/roundcube/Makefile Thu Aug 20 02:03:28 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.104 2026/05/24 14:01:51 taca Exp $
+# $NetBSD: Makefile,v 1.104.2.1 2026/08/20 02:03:28 maya Exp $
DISTNAME= roundcubemail-${RC_VERS}
PKGNAME= ${PHP_PKG_PREFIX}-${DISTNAME:S/mail-/-/:S/-complete//}
@@ -18,6 +18,8 @@ DEPENDS+= ${PHP_PKG_PREFIX}-pear-Net_IDN
DEPENDS+= ${PHP_PKG_PREFIX}-pear-Mail_Mime>=1.10.0:../../mail/pear-Mail_Mime
DEPENDS+= ${PHP_PKG_PREFIX}-pear-Auth_SASL>=1.0.6:../../mail/pear-Auth_SASL
+PHP_REQUIRE_MODULE= json
+
RC_SUBDIRS= SQL bin installer plugins program skins vendor
.for d in ${RC_SUBDIRS}
@@ -110,5 +112,5 @@ do-install:
${DESTDIR}${PREFIX}/${EGDIR}/defaults.inc.php
.include "Makefile.common"
-.include "../../lang/php/json.mk"
+.include "../../lang/php/compat.mk"
.include "../../mk/bsd.pkg.mk"
Index: pkgsrc/mail/roundcube/Makefile.common
diff -u pkgsrc/mail/roundcube/Makefile.common:1.44.2.1 pkgsrc/mail/roundcube/Makefile.common:1.44.2.2
--- pkgsrc/mail/roundcube/Makefile.common:1.44.2.1 Tue Jul 14 19:17:24 2026
+++ pkgsrc/mail/roundcube/Makefile.common Thu Aug 20 02:03:28 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.44.2.1 2026/07/14 19:17:24 bsiegert Exp $
+# $NetBSD: Makefile.common,v 1.44.2.2 2026/08/20 02:03:28 maya Exp $
#
# used by mail/roundcube/Makefile
# used by mail/roundcube/plugins.mk
@@ -10,7 +10,7 @@ GITHUB_PROJECT= roundcubemail
GITHUB_RELEASE= ${RC_VERS}
HOMEPAGE= https://roundcube.net/
-RC_VERS= 1.6.17
+RC_VERS= 1.6.18
USE_LANGUAGES= # none
USE_TOOLS+= pax
Index: pkgsrc/mail/roundcube/PLIST
diff -u pkgsrc/mail/roundcube/PLIST:1.60.2.1 pkgsrc/mail/roundcube/PLIST:1.60.2.2
--- pkgsrc/mail/roundcube/PLIST:1.60.2.1 Tue Jul 14 19:17:24 2026
+++ pkgsrc/mail/roundcube/PLIST Thu Aug 20 02:03:28 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.60.2.1 2026/07/14 19:17:24 bsiegert Exp $
+@comment $NetBSD: PLIST,v 1.60.2.2 2026/08/20 02:03:28 maya Exp $
share/doc/roundcube/CHANGELOG.md
share/doc/roundcube/INSTALL
share/doc/roundcube/LICENSE
@@ -2089,7 +2089,6 @@ share/roundcube/vendor/guzzlehttp/guzzle
share/roundcube/vendor/guzzlehttp/guzzle/README.md
share/roundcube/vendor/guzzlehttp/guzzle/UPGRADING.md
share/roundcube/vendor/guzzlehttp/guzzle/composer.json
-share/roundcube/vendor/guzzlehttp/guzzle/package-lock.json
share/roundcube/vendor/guzzlehttp/guzzle/src/BodySummarizer.php
share/roundcube/vendor/guzzlehttp/guzzle/src/BodySummarizerInterface.php
share/roundcube/vendor/guzzlehttp/guzzle/src/Client.php
@@ -2117,6 +2116,7 @@ share/roundcube/vendor/guzzlehttp/guzzle
share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/CurlVersion.php
share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/EasyHandle.php
share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/HeaderProcessor.php
+share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/HostValidator.php
share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/MockHandler.php
share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/Proxy.php
share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/ProxyEnvironment.php
@@ -2126,6 +2126,7 @@ share/roundcube/vendor/guzzlehttp/guzzle
share/roundcube/vendor/guzzlehttp/guzzle/src/MessageFormatter.php
share/roundcube/vendor/guzzlehttp/guzzle/src/MessageFormatterInterface.php
share/roundcube/vendor/guzzlehttp/guzzle/src/Middleware.php
+share/roundcube/vendor/guzzlehttp/guzzle/src/Multiplexing.php
share/roundcube/vendor/guzzlehttp/guzzle/src/Pool.php
share/roundcube/vendor/guzzlehttp/guzzle/src/PrepareBodyMiddleware.php
share/roundcube/vendor/guzzlehttp/guzzle/src/RedirectMiddleware.php
Index: pkgsrc/mail/roundcube/distinfo
diff -u pkgsrc/mail/roundcube/distinfo:1.101.2.1 pkgsrc/mail/roundcube/distinfo:1.101.2.2
--- pkgsrc/mail/roundcube/distinfo:1.101.2.1 Tue Jul 14 19:17:24 2026
+++ pkgsrc/mail/roundcube/distinfo Thu Aug 20 02:03:28 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.101.2.1 2026/07/14 19:17:24 bsiegert Exp $
+$NetBSD: distinfo,v 1.101.2.2 2026/08/20 02:03:28 maya Exp $
-BLAKE2s (roundcubemail-1.6.17-complete.tar.gz) = 355e5e12e01a1b8445a32dee7fd5829f83c88487fb6c75efc4642d4b6c355d47
-SHA512 (roundcubemail-1.6.17-complete.tar.gz) = 87748173587fbf0205287bd02d11cf81388fdc5805ce6e500971639d77a98c644265605351016c2299aaf2394b4057ab31a870fbe8e549ad593699b5e9b9e680
-Size (roundcubemail-1.6.17-complete.tar.gz) = 5921414 bytes
+BLAKE2s (roundcubemail-1.6.18-complete.tar.gz) = bcadb116bd8fbba0dab678104e80da56a17b5b0d5fa14b59a654cca4d9f72a0c
+SHA512 (roundcubemail-1.6.18-complete.tar.gz) = c2fb9916aac3078631fcee2fb9c3c2a3b882faab6a0d8238f35ce7575dafb21f623b133e9f23910bde412aa88597d876201c281972b25d4671099f2a628b7dcf
+Size (roundcubemail-1.6.18-complete.tar.gz) = 5954664 bytes
SHA1 (patch-config_config.inc.php.sample) = 92a48a97b16fe3f5f4b9441fce762a559d8daca7
SHA1 (patch-program_include_iniset.php) = 8a6c13c0c87d583ed60e43c01a4173d9d802a6a1
SHA1 (patch-program_lib_Roundcube_rcube__mime.php) = bfefc6850d3db230dd4224491e895fe25a32e87a
Index: pkgsrc/mail/roundcube-plugin-password/distinfo
diff -u pkgsrc/mail/roundcube-plugin-password/distinfo:1.46.2.1 pkgsrc/mail/roundcube-plugin-password/distinfo:1.46.2.2
--- pkgsrc/mail/roundcube-plugin-password/distinfo:1.46.2.1 Tue Jul 14 19:17:24 2026
+++ pkgsrc/mail/roundcube-plugin-password/distinfo Thu Aug 20 02:03:28 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.46.2.1 2026/07/14 19:17:24 bsiegert Exp $
+$NetBSD: distinfo,v 1.46.2.2 2026/08/20 02:03:28 maya Exp $
-BLAKE2s (roundcubemail-1.6.17-complete.tar.gz) = 355e5e12e01a1b8445a32dee7fd5829f83c88487fb6c75efc4642d4b6c355d47
-SHA512 (roundcubemail-1.6.17-complete.tar.gz) = 87748173587fbf0205287bd02d11cf81388fdc5805ce6e500971639d77a98c644265605351016c2299aaf2394b4057ab31a870fbe8e549ad593699b5e9b9e680
-Size (roundcubemail-1.6.17-complete.tar.gz) = 5921414 bytes
+BLAKE2s (roundcubemail-1.6.18-complete.tar.gz) = bcadb116bd8fbba0dab678104e80da56a17b5b0d5fa14b59a654cca4d9f72a0c
+SHA512 (roundcubemail-1.6.18-complete.tar.gz) = c2fb9916aac3078631fcee2fb9c3c2a3b882faab6a0d8238f35ce7575dafb21f623b133e9f23910bde412aa88597d876201c281972b25d4671099f2a628b7dcf
+Size (roundcubemail-1.6.18-complete.tar.gz) = 5954664 bytes
SHA1 (patch-plugins_password_helpers_passwd-expect) = 15e427a3c90bf7c0437a023b3f099abb5a139165