CVS commit: pkgsrc/mail

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Tue Aug 11 15:21:53 UTC 2026

Modified Files:
        pkgsrc/mail/roundcube: Makefile Makefile.common PLIST distinfo
        pkgsrc/mail/roundcube-plugin-password: Makefile distinfo

Log Message:
mail/roundcube:

1.6.18 (2026-08-19)

* Password: Fix fatal error "Class 'Zxcvbn' not found" (#10274)
* Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF
  decoder (#10269)
* Security: Add basic validation for content proxied by the css proxy
* Security: Fix SSRF bypass via specific local address URLs using
  100.64.0.0/10 and fe80::/10 nets
* Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io
  hostnames evading is_local_url() check
* Security: Fix remote content blocking bypass via unclosed url() in a
  FuncIRI attribute
* Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution
  into the `search_filter`
* Security: Fix arbitrary Sieve script injection via a filter rule name
  bypassing `managesieve_disabled_actions`
* Security: Fix RCE via `cmd_learn` driver of markasjunk plugin
* Security: Fix IMAP command injection via mail search and LITERAL+
  byte-count desynchronization
* Security: Fix password's modoboa driver leak of an authentication token to
  a user-controlled host
* Security: Fix stored XSS in "Add to address book" action
* Security: Fix HTML/CSS sanitization bypass via SVG animate `by` attribute


To generate a diff of this commit:
cvs rdiff -u -r1.104 -r1.105 pkgsrc/mail/roundcube/Makefile
cvs rdiff -u -r1.45 -r1.46 pkgsrc/mail/roundcube/Makefile.common
cvs rdiff -u -r1.61 -r1.62 pkgsrc/mail/roundcube/PLIST
cvs rdiff -u -r1.102 -r1.103 pkgsrc/mail/roundcube/distinfo
cvs rdiff -u -r1.28 -r1.29 pkgsrc/mail/roundcube-plugin-password/Makefile
cvs rdiff -u -r1.47 -r1.48 pkgsrc/mail/roundcube-plugin-password/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/mail/roundcube/Makefile
diff -u pkgsrc/mail/roundcube/Makefile:1.104 pkgsrc/mail/roundcube/Makefile:1.105
--- pkgsrc/mail/roundcube/Makefile:1.104        Sun May 24 14:01:51 2026
+++ pkgsrc/mail/roundcube/Makefile      Tue Aug 11 15:21:52 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.104 2026/05/24 14:01:51 taca Exp $
+# $NetBSD: Makefile,v 1.105 2026/08/11 15:21:52 taca Exp $
 
 DISTNAME=      roundcubemail-${RC_VERS}
 PKGNAME=       ${PHP_PKG_PREFIX}-${DISTNAME:S/mail-/-/:S/-complete//}
@@ -18,6 +18,8 @@ DEPENDS+=     ${PHP_PKG_PREFIX}-pear-Net_IDN
 DEPENDS+=      ${PHP_PKG_PREFIX}-pear-Mail_Mime>=1.10.0:../../mail/pear-Mail_Mime
 DEPENDS+=      ${PHP_PKG_PREFIX}-pear-Auth_SASL>=1.0.6:../../mail/pear-Auth_SASL
 
+PHP_REQUIRE_MODULE=    json
+
 RC_SUBDIRS=    SQL bin installer plugins program skins vendor
 
 .for d in ${RC_SUBDIRS}
@@ -110,5 +112,5 @@ do-install:
                ${DESTDIR}${PREFIX}/${EGDIR}/defaults.inc.php
 
 .include "Makefile.common"
-.include "../../lang/php/json.mk"
+.include "../../lang/php/compat.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/mail/roundcube/Makefile.common
diff -u pkgsrc/mail/roundcube/Makefile.common:1.45 pkgsrc/mail/roundcube/Makefile.common:1.46
--- pkgsrc/mail/roundcube/Makefile.common:1.45  Sun Jul  5 16:03:49 2026
+++ pkgsrc/mail/roundcube/Makefile.common       Tue Aug 11 15:21:52 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.45 2026/07/05 16:03:49 taca Exp $
+# $NetBSD: Makefile.common,v 1.46 2026/08/11 15:21:52 taca Exp $
 #
 # used by mail/roundcube/Makefile
 # used by mail/roundcube/plugins.mk
@@ -10,7 +10,7 @@ GITHUB_PROJECT=       roundcubemail
 GITHUB_RELEASE=        ${RC_VERS}
 HOMEPAGE=      https://roundcube.net/
 
-RC_VERS=       1.6.17
+RC_VERS=       1.6.18
 
 USE_LANGUAGES=         # none
 USE_TOOLS+=            pax

Index: pkgsrc/mail/roundcube/PLIST
diff -u pkgsrc/mail/roundcube/PLIST:1.61 pkgsrc/mail/roundcube/PLIST:1.62
--- pkgsrc/mail/roundcube/PLIST:1.61    Sun Jul  5 16:03:49 2026
+++ pkgsrc/mail/roundcube/PLIST Tue Aug 11 15:21:52 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.61 2026/07/05 16:03:49 taca Exp $
+@comment $NetBSD: PLIST,v 1.62 2026/08/11 15:21:52 taca Exp $
 share/doc/roundcube/CHANGELOG.md
 share/doc/roundcube/INSTALL
 share/doc/roundcube/LICENSE
@@ -2089,7 +2089,6 @@ share/roundcube/vendor/guzzlehttp/guzzle
 share/roundcube/vendor/guzzlehttp/guzzle/README.md
 share/roundcube/vendor/guzzlehttp/guzzle/UPGRADING.md
 share/roundcube/vendor/guzzlehttp/guzzle/composer.json
-share/roundcube/vendor/guzzlehttp/guzzle/package-lock.json
 share/roundcube/vendor/guzzlehttp/guzzle/src/BodySummarizer.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/BodySummarizerInterface.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Client.php
@@ -2117,6 +2116,7 @@ share/roundcube/vendor/guzzlehttp/guzzle
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/CurlVersion.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/EasyHandle.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/HeaderProcessor.php
+share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/HostValidator.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/MockHandler.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/Proxy.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/ProxyEnvironment.php
@@ -2126,6 +2126,7 @@ share/roundcube/vendor/guzzlehttp/guzzle
 share/roundcube/vendor/guzzlehttp/guzzle/src/MessageFormatter.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/MessageFormatterInterface.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Middleware.php
+share/roundcube/vendor/guzzlehttp/guzzle/src/Multiplexing.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Pool.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/PrepareBodyMiddleware.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/RedirectMiddleware.php

Index: pkgsrc/mail/roundcube/distinfo
diff -u pkgsrc/mail/roundcube/distinfo:1.102 pkgsrc/mail/roundcube/distinfo:1.103
--- pkgsrc/mail/roundcube/distinfo:1.102        Sun Jul  5 16:03:49 2026
+++ pkgsrc/mail/roundcube/distinfo      Tue Aug 11 15:21:52 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.102 2026/07/05 16:03:49 taca Exp $
+$NetBSD: distinfo,v 1.103 2026/08/11 15:21:52 taca Exp $
 
-BLAKE2s (roundcubemail-1.6.17-complete.tar.gz) = 355e5e12e01a1b8445a32dee7fd5829f83c88487fb6c75efc4642d4b6c355d47
-SHA512 (roundcubemail-1.6.17-complete.tar.gz) = 87748173587fbf0205287bd02d11cf81388fdc5805ce6e500971639d77a98c644265605351016c2299aaf2394b4057ab31a870fbe8e549ad593699b5e9b9e680
-Size (roundcubemail-1.6.17-complete.tar.gz) = 5921414 bytes
+BLAKE2s (roundcubemail-1.6.18-complete.tar.gz) = bcadb116bd8fbba0dab678104e80da56a17b5b0d5fa14b59a654cca4d9f72a0c
+SHA512 (roundcubemail-1.6.18-complete.tar.gz) = c2fb9916aac3078631fcee2fb9c3c2a3b882faab6a0d8238f35ce7575dafb21f623b133e9f23910bde412aa88597d876201c281972b25d4671099f2a628b7dcf
+Size (roundcubemail-1.6.18-complete.tar.gz) = 5954664 bytes
 SHA1 (patch-config_config.inc.php.sample) = 92a48a97b16fe3f5f4b9441fce762a559d8daca7
 SHA1 (patch-program_include_iniset.php) = 8a6c13c0c87d583ed60e43c01a4173d9d802a6a1
 SHA1 (patch-program_lib_Roundcube_rcube__mime.php) = bfefc6850d3db230dd4224491e895fe25a32e87a

Index: pkgsrc/mail/roundcube-plugin-password/Makefile
diff -u pkgsrc/mail/roundcube-plugin-password/Makefile:1.28 pkgsrc/mail/roundcube-plugin-password/Makefile:1.29
--- pkgsrc/mail/roundcube-plugin-password/Makefile:1.28 Thu Jul 16 19:04:10 2026
+++ pkgsrc/mail/roundcube-plugin-password/Makefile      Tue Aug 11 15:21:52 2026
@@ -1,10 +1,9 @@
-# $NetBSD: Makefile,v 1.28 2026/07/16 19:04:10 wiz Exp $
+# $NetBSD: Makefile,v 1.29 2026/08/11 15:21:52 taca Exp $
 
 PLUGIN=                password
 
 MAINTAINER=    taca%NetBSD.org@localhost
 COMMENT=       Password change plugin for roundcube
-PKGREVISION=   1
 LICENSE=       gnu-gpl-v3
 
 DEPENDS+=      tcl-expect>=5.32.1:../../lang/tcl-expect

Index: pkgsrc/mail/roundcube-plugin-password/distinfo
diff -u pkgsrc/mail/roundcube-plugin-password/distinfo:1.47 pkgsrc/mail/roundcube-plugin-password/distinfo:1.48
--- pkgsrc/mail/roundcube-plugin-password/distinfo:1.47 Sun Jul  5 16:07:50 2026
+++ pkgsrc/mail/roundcube-plugin-password/distinfo      Tue Aug 11 15:21:52 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.47 2026/07/05 16:07:50 taca Exp $
+$NetBSD: distinfo,v 1.48 2026/08/11 15:21:52 taca Exp $
 
-BLAKE2s (roundcubemail-1.6.17-complete.tar.gz) = 355e5e12e01a1b8445a32dee7fd5829f83c88487fb6c75efc4642d4b6c355d47
-SHA512 (roundcubemail-1.6.17-complete.tar.gz) = 87748173587fbf0205287bd02d11cf81388fdc5805ce6e500971639d77a98c644265605351016c2299aaf2394b4057ab31a870fbe8e549ad593699b5e9b9e680
-Size (roundcubemail-1.6.17-complete.tar.gz) = 5921414 bytes
+BLAKE2s (roundcubemail-1.6.18-complete.tar.gz) = bcadb116bd8fbba0dab678104e80da56a17b5b0d5fa14b59a654cca4d9f72a0c
+SHA512 (roundcubemail-1.6.18-complete.tar.gz) = c2fb9916aac3078631fcee2fb9c3c2a3b882faab6a0d8238f35ce7575dafb21f623b133e9f23910bde412aa88597d876201c281972b25d4671099f2a628b7dcf
+Size (roundcubemail-1.6.18-complete.tar.gz) = 5954664 bytes
 SHA1 (patch-plugins_password_helpers_passwd-expect) = 15e427a3c90bf7c0437a023b3f099abb5a139165