CVS commit: [pkgsrc-2026Q3] pkgsrc/mail

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Oct 21 00:45:21 UTC 2026

Modified Files:
        pkgsrc/mail/roundcube [pkgsrc-2026Q3]: Makefile.common PLIST distinfo
        pkgsrc/mail/roundcube-plugin-password [pkgsrc-2026Q3]: distinfo

Log Message:
Pullup ticket #7293 - requested by taca
mail/roundcube: Security fix
mail/roundcube-plugin-password: Security fix

Revisions pulled up:
- mail/roundcube-plugin-password/distinfo                       1.50
- mail/roundcube/Makefile.common                                1.48
- mail/roundcube/PLIST                                          1.63
- mail/roundcube/distinfo                                       1.105

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Mon Oct 19 14:07:22 UTC 2026

   Modified Files:
        pkgsrc/mail/roundcube: Makefile.common PLIST distinfo
        pkgsrc/mail/roundcube-plugin-password: distinfo

   Log Message:
   mail/roundcube: update to 1.6.20

   1.6.20 (2026-10-19)

   * Security: Fix IMAP command injection via CRLF in `_uid` parameter of
     mail/headers and mail/viewsource action

   * Security: Fix bug where an alias login wasn't qualified by IMAP host

   * Security: Add a size limit to the CSS proxy content processing

   * Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96

   * Security: Fix remote content blocking bypass via SVG SMIL `by` attribute

   * Security: Fix remote content blocking bypass via CSS escapes in FuncIRI
     attributes (again)

   * Security: Fix passing potentally unsafe attachment content into
     ImageMagick on image resize

   * Security: Fix mail header injection via the From display-name in the
     Bounce (resend) action

   * Security: Fix mail header injection via
     References/In-Reply-To/Message-ID/From parameters

   * Security: Fix object injection primitive in rcube_session::unserialize()
     via "!"-prefixed session keys

   * Security: Fix ImageMagick resource limits bypass by GD fallback during
     thumbnail generation

   * Security: Fix CSS scoping bypass in HTML messages using at-rules

   * Security: Fix bug where deprecated action aliases bypassed
     `disabled_actions` setting

   * Security: Fix IMAP command injection via CRLF in `_flag` parameter of
     mail/mark action

   * Security: Fix CSRF validation bypass in the mark-as-junk action

   * Security: Fix XSS issue in handling of password driver error responses

   * Security: Fix mail header injection via subject of a message forwarded as
     attachment

   * Security: Fix mail header injection via media type in an inline image data
     URI

   * Security: Fix bug where Password Modoboa driver could change password for
     another account

   * Security: Fix unsafe use of a login name in SquirrelMail import file path


To generate a diff of this commit:
cvs rdiff -u -r1.47 -r1.47.2.1 pkgsrc/mail/roundcube/Makefile.common
cvs rdiff -u -r1.62 -r1.62.2.1 pkgsrc/mail/roundcube/PLIST
cvs rdiff -u -r1.104 -r1.104.2.1 pkgsrc/mail/roundcube/distinfo
cvs rdiff -u -r1.49 -r1.49.2.1 pkgsrc/mail/roundcube-plugin-password/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/mail/roundcube/Makefile.common
diff -u pkgsrc/mail/roundcube/Makefile.common:1.47 pkgsrc/mail/roundcube/Makefile.common:1.47.2.1
--- pkgsrc/mail/roundcube/Makefile.common:1.47  Sun Sep  6 14:09:26 2026
+++ pkgsrc/mail/roundcube/Makefile.common       Wed Oct 21 00:45:21 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.47 2026/09/06 14:09:26 taca Exp $
+# $NetBSD: Makefile.common,v 1.47.2.1 2026/10/21 00:45:21 maya Exp $
 #
 # used by mail/roundcube/Makefile
 # used by mail/roundcube/plugins.mk
@@ -10,7 +10,7 @@ GITHUB_PROJECT=       roundcubemail
 GITHUB_RELEASE=        ${RC_VERS}
 HOMEPAGE=      https://roundcube.net/
 
-RC_VERS=       1.6.19
+RC_VERS=       1.6.20
 
 USE_LANGUAGES=         # none
 USE_TOOLS+=            pax

Index: pkgsrc/mail/roundcube/PLIST
diff -u pkgsrc/mail/roundcube/PLIST:1.62 pkgsrc/mail/roundcube/PLIST:1.62.2.1
--- pkgsrc/mail/roundcube/PLIST:1.62    Tue Aug 11 15:21:52 2026
+++ pkgsrc/mail/roundcube/PLIST Wed Oct 21 00:45:21 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.62 2026/08/11 15:21:52 taca Exp $
+@comment $NetBSD: PLIST,v 1.62.2.1 2026/10/21 00:45:21 maya Exp $
 share/doc/roundcube/CHANGELOG.md
 share/doc/roundcube/INSTALL
 share/doc/roundcube/LICENSE
@@ -2155,6 +2155,7 @@ share/roundcube/vendor/guzzlehttp/promis
 share/roundcube/vendor/guzzlehttp/promises/src/PromisorInterface.php
 share/roundcube/vendor/guzzlehttp/promises/src/RejectedPromise.php
 share/roundcube/vendor/guzzlehttp/promises/src/RejectionException.php
+share/roundcube/vendor/guzzlehttp/promises/src/State.php
 share/roundcube/vendor/guzzlehttp/promises/src/TaskQueue.php
 share/roundcube/vendor/guzzlehttp/promises/src/TaskQueueInterface.php
 share/roundcube/vendor/guzzlehttp/promises/src/Utils.php

Index: pkgsrc/mail/roundcube/distinfo
diff -u pkgsrc/mail/roundcube/distinfo:1.104 pkgsrc/mail/roundcube/distinfo:1.104.2.1
--- pkgsrc/mail/roundcube/distinfo:1.104        Sun Sep  6 14:09:26 2026
+++ pkgsrc/mail/roundcube/distinfo      Wed Oct 21 00:45:21 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.104 2026/09/06 14:09:26 taca Exp $
+$NetBSD: distinfo,v 1.104.2.1 2026/10/21 00:45:21 maya Exp $
 
-BLAKE2s (roundcubemail-1.6.19-complete.tar.gz) = 5901f236523b95552aba203a00029c92c0402eed0a14bc62e78090099a4db6dd
-SHA512 (roundcubemail-1.6.19-complete.tar.gz) = 81be8fd41f4b99b39a6ff46cfecf12a76fe750b7554e7b7d462795f6df83416f0a5355a6a099941055c6d1991aef75491e1fcd2b067e5714a00d485552996dc9
-Size (roundcubemail-1.6.19-complete.tar.gz) = 5955504 bytes
+BLAKE2s (roundcubemail-1.6.20-complete.tar.gz) = f75cf0ca9a092ab6e03c6429d0dad4ef7cffc8b99458e79e9d5b250cc673176d
+SHA512 (roundcubemail-1.6.20-complete.tar.gz) = 87eb021329fcca8acdbdf0fb62e19826aa12cba575b3fef7cfe32f8f3a96d10561ed980fbabc2bac35bff4e7fc5b316373274292a46b2cdf26473c0bd1be3692
+Size (roundcubemail-1.6.20-complete.tar.gz) = 5960668 bytes
 SHA1 (patch-config_config.inc.php.sample) = 92a48a97b16fe3f5f4b9441fce762a559d8daca7
 SHA1 (patch-program_include_iniset.php) = 8a6c13c0c87d583ed60e43c01a4173d9d802a6a1
 SHA1 (patch-program_lib_Roundcube_rcube__mime.php) = bfefc6850d3db230dd4224491e895fe25a32e87a

Index: pkgsrc/mail/roundcube-plugin-password/distinfo
diff -u pkgsrc/mail/roundcube-plugin-password/distinfo:1.49 pkgsrc/mail/roundcube-plugin-password/distinfo:1.49.2.1
--- pkgsrc/mail/roundcube-plugin-password/distinfo:1.49 Sun Sep  6 14:09:26 2026
+++ pkgsrc/mail/roundcube-plugin-password/distinfo      Wed Oct 21 00:45:21 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.49 2026/09/06 14:09:26 taca Exp $
+$NetBSD: distinfo,v 1.49.2.1 2026/10/21 00:45:21 maya Exp $
 
-BLAKE2s (roundcubemail-1.6.19-complete.tar.gz) = 5901f236523b95552aba203a00029c92c0402eed0a14bc62e78090099a4db6dd
-SHA512 (roundcubemail-1.6.19-complete.tar.gz) = 81be8fd41f4b99b39a6ff46cfecf12a76fe750b7554e7b7d462795f6df83416f0a5355a6a099941055c6d1991aef75491e1fcd2b067e5714a00d485552996dc9
-Size (roundcubemail-1.6.19-complete.tar.gz) = 5955504 bytes
+BLAKE2s (roundcubemail-1.6.20-complete.tar.gz) = f75cf0ca9a092ab6e03c6429d0dad4ef7cffc8b99458e79e9d5b250cc673176d
+SHA512 (roundcubemail-1.6.20-complete.tar.gz) = 87eb021329fcca8acdbdf0fb62e19826aa12cba575b3fef7cfe32f8f3a96d10561ed980fbabc2bac35bff4e7fc5b316373274292a46b2cdf26473c0bd1be3692
+Size (roundcubemail-1.6.20-complete.tar.gz) = 5960668 bytes
 SHA1 (patch-plugins_password_helpers_passwd-expect) = 15e427a3c90bf7c0437a023b3f099abb5a139165