CVS commit: pkgsrc/mail

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Mon Oct 19 14:07:22 UTC 2026

Modified Files:
        pkgsrc/mail/roundcube: Makefile.common PLIST distinfo
        pkgsrc/mail/roundcube-plugin-password: distinfo

Log Message:
mail/roundcube: update to 1.6.20

1.6.20 (2026-10-19)

* Security: Fix IMAP command injection via CRLF in `_uid` parameter of
  mail/headers and mail/viewsource action

* Security: Fix bug where an alias login wasn't qualified by IMAP host

* Security: Add a size limit to the CSS proxy content processing

* Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96

* Security: Fix remote content blocking bypass via SVG SMIL `by` attribute

* Security: Fix remote content blocking bypass via CSS escapes in FuncIRI
  attributes (again)

* Security: Fix passing potentally unsafe attachment content into
  ImageMagick on image resize

* Security: Fix mail header injection via the From display-name in the
  Bounce (resend) action

* Security: Fix mail header injection via
  References/In-Reply-To/Message-ID/From parameters

* Security: Fix object injection primitive in rcube_session::unserialize()
  via "!"-prefixed session keys

* Security: Fix ImageMagick resource limits bypass by GD fallback during
  thumbnail generation

* Security: Fix CSS scoping bypass in HTML messages using at-rules

* Security: Fix bug where deprecated action aliases bypassed
  `disabled_actions` setting

* Security: Fix IMAP command injection via CRLF in `_flag` parameter of
  mail/mark action

* Security: Fix CSRF validation bypass in the mark-as-junk action

* Security: Fix XSS issue in handling of password driver error responses

* Security: Fix mail header injection via subject of a message forwarded as
  attachment

* Security: Fix mail header injection via media type in an inline image data
  URI

* Security: Fix bug where Password Modoboa driver could change password for
  another account

* Security: Fix unsafe use of a login name in SquirrelMail import file path


To generate a diff of this commit:
cvs rdiff -u -r1.47 -r1.48 pkgsrc/mail/roundcube/Makefile.common
cvs rdiff -u -r1.62 -r1.63 pkgsrc/mail/roundcube/PLIST
cvs rdiff -u -r1.104 -r1.105 pkgsrc/mail/roundcube/distinfo
cvs rdiff -u -r1.49 -r1.50 pkgsrc/mail/roundcube-plugin-password/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/mail/roundcube/Makefile.common
diff -u pkgsrc/mail/roundcube/Makefile.common:1.47 pkgsrc/mail/roundcube/Makefile.common:1.48
--- pkgsrc/mail/roundcube/Makefile.common:1.47  Sun Sep  6 14:09:26 2026
+++ pkgsrc/mail/roundcube/Makefile.common       Mon Oct 19 14:07:22 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.47 2026/09/06 14:09:26 taca Exp $
+# $NetBSD: Makefile.common,v 1.48 2026/10/19 14:07:22 taca Exp $
 #
 # used by mail/roundcube/Makefile
 # used by mail/roundcube/plugins.mk
@@ -10,7 +10,7 @@ GITHUB_PROJECT=       roundcubemail
 GITHUB_RELEASE=        ${RC_VERS}
 HOMEPAGE=      https://roundcube.net/
 
-RC_VERS=       1.6.19
+RC_VERS=       1.6.20
 
 USE_LANGUAGES=         # none
 USE_TOOLS+=            pax

Index: pkgsrc/mail/roundcube/PLIST
diff -u pkgsrc/mail/roundcube/PLIST:1.62 pkgsrc/mail/roundcube/PLIST:1.63
--- pkgsrc/mail/roundcube/PLIST:1.62    Tue Aug 11 15:21:52 2026
+++ pkgsrc/mail/roundcube/PLIST Mon Oct 19 14:07:22 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.62 2026/08/11 15:21:52 taca Exp $
+@comment $NetBSD: PLIST,v 1.63 2026/10/19 14:07:22 taca Exp $
 share/doc/roundcube/CHANGELOG.md
 share/doc/roundcube/INSTALL
 share/doc/roundcube/LICENSE
@@ -2155,6 +2155,7 @@ share/roundcube/vendor/guzzlehttp/promis
 share/roundcube/vendor/guzzlehttp/promises/src/PromisorInterface.php
 share/roundcube/vendor/guzzlehttp/promises/src/RejectedPromise.php
 share/roundcube/vendor/guzzlehttp/promises/src/RejectionException.php
+share/roundcube/vendor/guzzlehttp/promises/src/State.php
 share/roundcube/vendor/guzzlehttp/promises/src/TaskQueue.php
 share/roundcube/vendor/guzzlehttp/promises/src/TaskQueueInterface.php
 share/roundcube/vendor/guzzlehttp/promises/src/Utils.php

Index: pkgsrc/mail/roundcube/distinfo
diff -u pkgsrc/mail/roundcube/distinfo:1.104 pkgsrc/mail/roundcube/distinfo:1.105
--- pkgsrc/mail/roundcube/distinfo:1.104        Sun Sep  6 14:09:26 2026
+++ pkgsrc/mail/roundcube/distinfo      Mon Oct 19 14:07:22 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.104 2026/09/06 14:09:26 taca Exp $
+$NetBSD: distinfo,v 1.105 2026/10/19 14:07:22 taca Exp $
 
-BLAKE2s (roundcubemail-1.6.19-complete.tar.gz) = 5901f236523b95552aba203a00029c92c0402eed0a14bc62e78090099a4db6dd
-SHA512 (roundcubemail-1.6.19-complete.tar.gz) = 81be8fd41f4b99b39a6ff46cfecf12a76fe750b7554e7b7d462795f6df83416f0a5355a6a099941055c6d1991aef75491e1fcd2b067e5714a00d485552996dc9
-Size (roundcubemail-1.6.19-complete.tar.gz) = 5955504 bytes
+BLAKE2s (roundcubemail-1.6.20-complete.tar.gz) = f75cf0ca9a092ab6e03c6429d0dad4ef7cffc8b99458e79e9d5b250cc673176d
+SHA512 (roundcubemail-1.6.20-complete.tar.gz) = 87eb021329fcca8acdbdf0fb62e19826aa12cba575b3fef7cfe32f8f3a96d10561ed980fbabc2bac35bff4e7fc5b316373274292a46b2cdf26473c0bd1be3692
+Size (roundcubemail-1.6.20-complete.tar.gz) = 5960668 bytes
 SHA1 (patch-config_config.inc.php.sample) = 92a48a97b16fe3f5f4b9441fce762a559d8daca7
 SHA1 (patch-program_include_iniset.php) = 8a6c13c0c87d583ed60e43c01a4173d9d802a6a1
 SHA1 (patch-program_lib_Roundcube_rcube__mime.php) = bfefc6850d3db230dd4224491e895fe25a32e87a

Index: pkgsrc/mail/roundcube-plugin-password/distinfo
diff -u pkgsrc/mail/roundcube-plugin-password/distinfo:1.49 pkgsrc/mail/roundcube-plugin-password/distinfo:1.50
--- pkgsrc/mail/roundcube-plugin-password/distinfo:1.49 Sun Sep  6 14:09:26 2026
+++ pkgsrc/mail/roundcube-plugin-password/distinfo      Mon Oct 19 14:07:22 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.49 2026/09/06 14:09:26 taca Exp $
+$NetBSD: distinfo,v 1.50 2026/10/19 14:07:22 taca Exp $
 
-BLAKE2s (roundcubemail-1.6.19-complete.tar.gz) = 5901f236523b95552aba203a00029c92c0402eed0a14bc62e78090099a4db6dd
-SHA512 (roundcubemail-1.6.19-complete.tar.gz) = 81be8fd41f4b99b39a6ff46cfecf12a76fe750b7554e7b7d462795f6df83416f0a5355a6a099941055c6d1991aef75491e1fcd2b067e5714a00d485552996dc9
-Size (roundcubemail-1.6.19-complete.tar.gz) = 5955504 bytes
+BLAKE2s (roundcubemail-1.6.20-complete.tar.gz) = f75cf0ca9a092ab6e03c6429d0dad4ef7cffc8b99458e79e9d5b250cc673176d
+SHA512 (roundcubemail-1.6.20-complete.tar.gz) = 87eb021329fcca8acdbdf0fb62e19826aa12cba575b3fef7cfe32f8f3a96d10561ed980fbabc2bac35bff4e7fc5b316373274292a46b2cdf26473c0bd1be3692
+Size (roundcubemail-1.6.20-complete.tar.gz) = 5960668 bytes
 SHA1 (patch-plugins_password_helpers_passwd-expect) = 15e427a3c90bf7c0437a023b3f099abb5a139165