CVS commit: [pkgsrc-2026Q2] pkgsrc/mail

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: [pkgsrc-2026Q2] pkgsrc/mail
From: "Maya Rashish" <maya%netbsd.org@localhost>
Date: Thu, 20 Aug 2026 02:03:28 +0000

Module Name:    pkgsrc
Committed By:   maya
Date:           Thu Aug 20 02:03:28 UTC 2026

Modified Files:
        pkgsrc/mail/roundcube [pkgsrc-2026Q2]: Makefile Makefile.common PLIST
            distinfo
        pkgsrc/mail/roundcube-plugin-password [pkgsrc-2026Q2]: distinfo

Log Message:
Pullup ticket #7229 - requested by taca
mail/roundcube: Security fix
mail/roundcube-plugin-password: Security fix

Revisions pulled up:
- mail/roundcube-plugin-password/Makefile                       1.29
- mail/roundcube-plugin-password/distinfo                       1.48
- mail/roundcube/Makefile                                       1.105
- mail/roundcube/Makefile.common                                1.46
- mail/roundcube/PLIST                                          1.62
- mail/roundcube/distinfo                                       1.103

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Tue Aug 11 15:21:53 UTC 2026

   Modified Files:
        pkgsrc/mail/roundcube: Makefile Makefile.common PLIST distinfo
        pkgsrc/mail/roundcube-plugin-password: Makefile distinfo

   Log Message:
   mail/roundcube:

   1.6.18 (2026-08-19)

   * Password: Fix fatal error "Class 'Zxcvbn' not found" (#10274)
   * Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF
     decoder (#10269)
   * Security: Add basic validation for content proxied by the css proxy
   * Security: Fix SSRF bypass via specific local address URLs using
     100.64.0.0/10 and fe80::/10 nets
   * Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io
     hostnames evading is_local_url() check
   * Security: Fix remote content blocking bypass via unclosed url() in a
     FuncIRI attribute
   * Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution
     into the `search_filter`
   * Security: Fix arbitrary Sieve script injection via a filter rule name
     bypassing `managesieve_disabled_actions`
   * Security: Fix RCE via `cmd_learn` driver of markasjunk plugin
   * Security: Fix IMAP command injection via mail search and LITERAL+
     byte-count desynchronization
   * Security: Fix password's modoboa driver leak of an authentication token to
     a user-controlled host
   * Security: Fix stored XSS in "Add to address book" action
   * Security: Fix HTML/CSS sanitization bypass via SVG animate `by` attribute


To generate a diff of this commit:
cvs rdiff -u -r1.104 -r1.104.2.1 pkgsrc/mail/roundcube/Makefile
cvs rdiff -u -r1.44.2.1 -r1.44.2.2 pkgsrc/mail/roundcube/Makefile.common
cvs rdiff -u -r1.60.2.1 -r1.60.2.2 pkgsrc/mail/roundcube/PLIST
cvs rdiff -u -r1.101.2.1 -r1.101.2.2 pkgsrc/mail/roundcube/distinfo
cvs rdiff -u -r1.46.2.1 -r1.46.2.2 \
    pkgsrc/mail/roundcube-plugin-password/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/mail/roundcube/Makefile
diff -u pkgsrc/mail/roundcube/Makefile:1.104 pkgsrc/mail/roundcube/Makefile:1.104.2.1
--- pkgsrc/mail/roundcube/Makefile:1.104        Sun May 24 14:01:51 2026
+++ pkgsrc/mail/roundcube/Makefile      Thu Aug 20 02:03:28 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile,v 1.104 2026/05/24 14:01:51 taca Exp $
+# $NetBSD: Makefile,v 1.104.2.1 2026/08/20 02:03:28 maya Exp $
 
 DISTNAME=      roundcubemail-${RC_VERS}
 PKGNAME=       ${PHP_PKG_PREFIX}-${DISTNAME:S/mail-/-/:S/-complete//}
@@ -18,6 +18,8 @@ DEPENDS+=     ${PHP_PKG_PREFIX}-pear-Net_IDN
 DEPENDS+=      ${PHP_PKG_PREFIX}-pear-Mail_Mime>=1.10.0:../../mail/pear-Mail_Mime
 DEPENDS+=      ${PHP_PKG_PREFIX}-pear-Auth_SASL>=1.0.6:../../mail/pear-Auth_SASL
 
+PHP_REQUIRE_MODULE=    json
+
 RC_SUBDIRS=    SQL bin installer plugins program skins vendor
 
 .for d in ${RC_SUBDIRS}
@@ -110,5 +112,5 @@ do-install:
                ${DESTDIR}${PREFIX}/${EGDIR}/defaults.inc.php
 
 .include "Makefile.common"
-.include "../../lang/php/json.mk"
+.include "../../lang/php/compat.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/mail/roundcube/Makefile.common
diff -u pkgsrc/mail/roundcube/Makefile.common:1.44.2.1 pkgsrc/mail/roundcube/Makefile.common:1.44.2.2
--- pkgsrc/mail/roundcube/Makefile.common:1.44.2.1      Tue Jul 14 19:17:24 2026
+++ pkgsrc/mail/roundcube/Makefile.common       Thu Aug 20 02:03:28 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.44.2.1 2026/07/14 19:17:24 bsiegert Exp $
+# $NetBSD: Makefile.common,v 1.44.2.2 2026/08/20 02:03:28 maya Exp $
 #
 # used by mail/roundcube/Makefile
 # used by mail/roundcube/plugins.mk
@@ -10,7 +10,7 @@ GITHUB_PROJECT=       roundcubemail
 GITHUB_RELEASE=        ${RC_VERS}
 HOMEPAGE=      https://roundcube.net/
 
-RC_VERS=       1.6.17
+RC_VERS=       1.6.18
 
 USE_LANGUAGES=         # none
 USE_TOOLS+=            pax

Index: pkgsrc/mail/roundcube/PLIST
diff -u pkgsrc/mail/roundcube/PLIST:1.60.2.1 pkgsrc/mail/roundcube/PLIST:1.60.2.2
--- pkgsrc/mail/roundcube/PLIST:1.60.2.1        Tue Jul 14 19:17:24 2026
+++ pkgsrc/mail/roundcube/PLIST Thu Aug 20 02:03:28 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.60.2.1 2026/07/14 19:17:24 bsiegert Exp $
+@comment $NetBSD: PLIST,v 1.60.2.2 2026/08/20 02:03:28 maya Exp $
 share/doc/roundcube/CHANGELOG.md
 share/doc/roundcube/INSTALL
 share/doc/roundcube/LICENSE
@@ -2089,7 +2089,6 @@ share/roundcube/vendor/guzzlehttp/guzzle
 share/roundcube/vendor/guzzlehttp/guzzle/README.md
 share/roundcube/vendor/guzzlehttp/guzzle/UPGRADING.md
 share/roundcube/vendor/guzzlehttp/guzzle/composer.json
-share/roundcube/vendor/guzzlehttp/guzzle/package-lock.json
 share/roundcube/vendor/guzzlehttp/guzzle/src/BodySummarizer.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/BodySummarizerInterface.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Client.php
@@ -2117,6 +2116,7 @@ share/roundcube/vendor/guzzlehttp/guzzle
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/CurlVersion.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/EasyHandle.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/HeaderProcessor.php
+share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/HostValidator.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/MockHandler.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/Proxy.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/ProxyEnvironment.php
@@ -2126,6 +2126,7 @@ share/roundcube/vendor/guzzlehttp/guzzle
 share/roundcube/vendor/guzzlehttp/guzzle/src/MessageFormatter.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/MessageFormatterInterface.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Middleware.php
+share/roundcube/vendor/guzzlehttp/guzzle/src/Multiplexing.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Pool.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/PrepareBodyMiddleware.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/RedirectMiddleware.php

Index: pkgsrc/mail/roundcube/distinfo
diff -u pkgsrc/mail/roundcube/distinfo:1.101.2.1 pkgsrc/mail/roundcube/distinfo:1.101.2.2
--- pkgsrc/mail/roundcube/distinfo:1.101.2.1    Tue Jul 14 19:17:24 2026
+++ pkgsrc/mail/roundcube/distinfo      Thu Aug 20 02:03:28 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.101.2.1 2026/07/14 19:17:24 bsiegert Exp $
+$NetBSD: distinfo,v 1.101.2.2 2026/08/20 02:03:28 maya Exp $
 
-BLAKE2s (roundcubemail-1.6.17-complete.tar.gz) = 355e5e12e01a1b8445a32dee7fd5829f83c88487fb6c75efc4642d4b6c355d47
-SHA512 (roundcubemail-1.6.17-complete.tar.gz) = 87748173587fbf0205287bd02d11cf81388fdc5805ce6e500971639d77a98c644265605351016c2299aaf2394b4057ab31a870fbe8e549ad593699b5e9b9e680
-Size (roundcubemail-1.6.17-complete.tar.gz) = 5921414 bytes
+BLAKE2s (roundcubemail-1.6.18-complete.tar.gz) = bcadb116bd8fbba0dab678104e80da56a17b5b0d5fa14b59a654cca4d9f72a0c
+SHA512 (roundcubemail-1.6.18-complete.tar.gz) = c2fb9916aac3078631fcee2fb9c3c2a3b882faab6a0d8238f35ce7575dafb21f623b133e9f23910bde412aa88597d876201c281972b25d4671099f2a628b7dcf
+Size (roundcubemail-1.6.18-complete.tar.gz) = 5954664 bytes
 SHA1 (patch-config_config.inc.php.sample) = 92a48a97b16fe3f5f4b9441fce762a559d8daca7
 SHA1 (patch-program_include_iniset.php) = 8a6c13c0c87d583ed60e43c01a4173d9d802a6a1
 SHA1 (patch-program_lib_Roundcube_rcube__mime.php) = bfefc6850d3db230dd4224491e895fe25a32e87a

Index: pkgsrc/mail/roundcube-plugin-password/distinfo
diff -u pkgsrc/mail/roundcube-plugin-password/distinfo:1.46.2.1 pkgsrc/mail/roundcube-plugin-password/distinfo:1.46.2.2
--- pkgsrc/mail/roundcube-plugin-password/distinfo:1.46.2.1     Tue Jul 14 19:17:24 2026
+++ pkgsrc/mail/roundcube-plugin-password/distinfo      Thu Aug 20 02:03:28 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.46.2.1 2026/07/14 19:17:24 bsiegert Exp $
+$NetBSD: distinfo,v 1.46.2.2 2026/08/20 02:03:28 maya Exp $
 
-BLAKE2s (roundcubemail-1.6.17-complete.tar.gz) = 355e5e12e01a1b8445a32dee7fd5829f83c88487fb6c75efc4642d4b6c355d47
-SHA512 (roundcubemail-1.6.17-complete.tar.gz) = 87748173587fbf0205287bd02d11cf81388fdc5805ce6e500971639d77a98c644265605351016c2299aaf2394b4057ab31a870fbe8e549ad593699b5e9b9e680
-Size (roundcubemail-1.6.17-complete.tar.gz) = 5921414 bytes
+BLAKE2s (roundcubemail-1.6.18-complete.tar.gz) = bcadb116bd8fbba0dab678104e80da56a17b5b0d5fa14b59a654cca4d9f72a0c
+SHA512 (roundcubemail-1.6.18-complete.tar.gz) = c2fb9916aac3078631fcee2fb9c3c2a3b882faab6a0d8238f35ce7575dafb21f623b133e9f23910bde412aa88597d876201c281972b25d4671099f2a628b7dcf
+Size (roundcubemail-1.6.18-complete.tar.gz) = 5954664 bytes
 SHA1 (patch-plugins_password_helpers_passwd-expect) = 15e427a3c90bf7c0437a023b3f099abb5a139165

Prev by Date: CVS commit: [pkgsrc-2026Q2] pkgsrc/lang/php
Next by Date: CVS commit: [pkgsrc-2026Q2] pkgsrc/www/php-ja-wordpress
Previous by Thread: CVS commit: [pkgsrc-2026Q2] pkgsrc/lang/php
Next by Thread: CVS commit: [pkgsrc-2026Q2] pkgsrc/www/php-ja-wordpress
Indexes:

Home | Main Index | Thread Index | Old Index