CVS commit: pkgsrc/mail

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Sun Jul  5 16:03:50 UTC 2026

Modified Files:
        pkgsrc/mail/roundcube: Makefile.common PLIST distinfo
        pkgsrc/mail/roundcube-plugin-enigma: PLIST

Log Message:
mail/roundcube: update to 1.6.17

1.6.17 (2026-07-05)

* Enigma: Support automatic public key lookup (import) using HKP v1 protocol
  (#5314)

* Enigma: Kolab WOAT Support (#8626)

* Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193)

* Security: Fix various vulnerabilities in the password plugin using
  session-injected username

* Security: Fix stored XSS via unescaped attachment MIME type on the
  attachment-validation warning page [CVE-2026-54432]

* Security: Fix SSRF bypass via specific local address URLs - two new cases

* Security: Fix zero-click stored XSS in plain-text rendering
  [CVE-2026-54433]

* Security: Fix DoS via crafted compressed-RTF size in the TNEF
  (winmail.dat) file


To generate a diff of this commit:
cvs rdiff -u -r1.44 -r1.45 pkgsrc/mail/roundcube/Makefile.common
cvs rdiff -u -r1.60 -r1.61 pkgsrc/mail/roundcube/PLIST
cvs rdiff -u -r1.101 -r1.102 pkgsrc/mail/roundcube/distinfo
cvs rdiff -u -r1.6 -r1.7 pkgsrc/mail/roundcube-plugin-enigma/PLIST

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/mail/roundcube/Makefile.common
diff -u pkgsrc/mail/roundcube/Makefile.common:1.44 pkgsrc/mail/roundcube/Makefile.common:1.45
--- pkgsrc/mail/roundcube/Makefile.common:1.44  Sun May 24 13:05:18 2026
+++ pkgsrc/mail/roundcube/Makefile.common       Sun Jul  5 16:03:49 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.44 2026/05/24 13:05:18 taca Exp $
+# $NetBSD: Makefile.common,v 1.45 2026/07/05 16:03:49 taca Exp $
 #
 # used by mail/roundcube/Makefile
 # used by mail/roundcube/plugins.mk
@@ -10,7 +10,7 @@ GITHUB_PROJECT=       roundcubemail
 GITHUB_RELEASE=        ${RC_VERS}
 HOMEPAGE=      https://roundcube.net/
 
-RC_VERS=       1.6.16
+RC_VERS=       1.6.17
 
 USE_LANGUAGES=         # none
 USE_TOOLS+=            pax

Index: pkgsrc/mail/roundcube/PLIST
diff -u pkgsrc/mail/roundcube/PLIST:1.60 pkgsrc/mail/roundcube/PLIST:1.61
--- pkgsrc/mail/roundcube/PLIST:1.60    Sun May 24 13:05:18 2026
+++ pkgsrc/mail/roundcube/PLIST Sun Jul  5 16:03:49 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.60 2026/05/24 13:05:18 taca Exp $
+@comment $NetBSD: PLIST,v 1.61 2026/07/05 16:03:49 taca Exp $
 share/doc/roundcube/CHANGELOG.md
 share/doc/roundcube/INSTALL
 share/doc/roundcube/LICENSE
@@ -2113,11 +2113,15 @@ share/roundcube/vendor/guzzlehttp/guzzle
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/CurlFactoryInterface.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/CurlHandler.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/CurlMultiHandler.php
+share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/CurlShareHandleState.php
+share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/CurlVersion.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/EasyHandle.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/HeaderProcessor.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/MockHandler.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/Proxy.php
+share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/ProxyEnvironment.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/StreamHandler.php
+share/roundcube/vendor/guzzlehttp/guzzle/src/Handler/TlsVersion.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/HandlerStack.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/MessageFormatter.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/MessageFormatterInterface.php
@@ -2128,6 +2132,7 @@ share/roundcube/vendor/guzzlehttp/guzzle
 share/roundcube/vendor/guzzlehttp/guzzle/src/RequestOptions.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/RetryMiddleware.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/TransferStats.php
+share/roundcube/vendor/guzzlehttp/guzzle/src/TransportSharing.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/Utils.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/functions.php
 share/roundcube/vendor/guzzlehttp/guzzle/src/functions_include.php
@@ -2177,6 +2182,7 @@ share/roundcube/vendor/guzzlehttp/psr7/s
 share/roundcube/vendor/guzzlehttp/psr7/src/Query.php
 share/roundcube/vendor/guzzlehttp/psr7/src/Request.php
 share/roundcube/vendor/guzzlehttp/psr7/src/Response.php
+share/roundcube/vendor/guzzlehttp/psr7/src/Rfc3986.php
 share/roundcube/vendor/guzzlehttp/psr7/src/Rfc7230.php
 share/roundcube/vendor/guzzlehttp/psr7/src/ServerRequest.php
 share/roundcube/vendor/guzzlehttp/psr7/src/Stream.php
@@ -2405,3 +2411,14 @@ share/roundcube/vendor/symfony/deprecati
 share/roundcube/vendor/symfony/deprecation-contracts/README.md
 share/roundcube/vendor/symfony/deprecation-contracts/composer.json
 share/roundcube/vendor/symfony/deprecation-contracts/function.php
+share/roundcube/vendor/symfony/polyfill-php80/LICENSE
+share/roundcube/vendor/symfony/polyfill-php80/Php80.php
+share/roundcube/vendor/symfony/polyfill-php80/PhpToken.php
+share/roundcube/vendor/symfony/polyfill-php80/README.md
+share/roundcube/vendor/symfony/polyfill-php80/Resources/stubs/Attribute.php
+share/roundcube/vendor/symfony/polyfill-php80/Resources/stubs/PhpToken.php
+share/roundcube/vendor/symfony/polyfill-php80/Resources/stubs/Stringable.php
+share/roundcube/vendor/symfony/polyfill-php80/Resources/stubs/UnhandledMatchError.php
+share/roundcube/vendor/symfony/polyfill-php80/Resources/stubs/ValueError.php
+share/roundcube/vendor/symfony/polyfill-php80/bootstrap.php
+share/roundcube/vendor/symfony/polyfill-php80/composer.json

Index: pkgsrc/mail/roundcube/distinfo
diff -u pkgsrc/mail/roundcube/distinfo:1.101 pkgsrc/mail/roundcube/distinfo:1.102
--- pkgsrc/mail/roundcube/distinfo:1.101        Sun May 24 13:51:33 2026
+++ pkgsrc/mail/roundcube/distinfo      Sun Jul  5 16:03:49 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.101 2026/05/24 13:51:33 taca Exp $
+$NetBSD: distinfo,v 1.102 2026/07/05 16:03:49 taca Exp $
 
-BLAKE2s (roundcubemail-1.6.16-complete.tar.gz) = 9f6d8f810b23ba938456e8b390f2951f5f10c67a096f4851486e609deabfab18
-SHA512 (roundcubemail-1.6.16-complete.tar.gz) = 08481d09413ed71fbd31580141821a68f66d4e73bba23e630a7bb3bc0dc878af2b5172051e3f9be7beff09f5625d5443f235913ff4d87ae729f5efeb49923be3
-Size (roundcubemail-1.6.16-complete.tar.gz) = 5879804 bytes
+BLAKE2s (roundcubemail-1.6.17-complete.tar.gz) = 355e5e12e01a1b8445a32dee7fd5829f83c88487fb6c75efc4642d4b6c355d47
+SHA512 (roundcubemail-1.6.17-complete.tar.gz) = 87748173587fbf0205287bd02d11cf81388fdc5805ce6e500971639d77a98c644265605351016c2299aaf2394b4057ab31a870fbe8e549ad593699b5e9b9e680
+Size (roundcubemail-1.6.17-complete.tar.gz) = 5921414 bytes
 SHA1 (patch-config_config.inc.php.sample) = 92a48a97b16fe3f5f4b9441fce762a559d8daca7
 SHA1 (patch-program_include_iniset.php) = 8a6c13c0c87d583ed60e43c01a4173d9d802a6a1
 SHA1 (patch-program_lib_Roundcube_rcube__mime.php) = bfefc6850d3db230dd4224491e895fe25a32e87a

Index: pkgsrc/mail/roundcube-plugin-enigma/PLIST
diff -u pkgsrc/mail/roundcube-plugin-enigma/PLIST:1.6 pkgsrc/mail/roundcube-plugin-enigma/PLIST:1.7
--- pkgsrc/mail/roundcube-plugin-enigma/PLIST:1.6       Fri Jul  7 12:57:21 2023
+++ pkgsrc/mail/roundcube-plugin-enigma/PLIST   Sun Jul  5 16:03:49 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.6 2023/07/07 12:57:21 taca Exp $
+@comment $NetBSD: PLIST,v 1.7 2026/07/05 16:03:49 taca Exp $
 share/examples/roundcube/plugins/enigma/config.inc.php
 share/roundcube/plugins/enigma/README
 share/roundcube/plugins/enigma/bin/import_keys.sh
@@ -12,6 +12,7 @@ share/roundcube/plugins/enigma/lib/enigm
 share/roundcube/plugins/enigma/lib/enigma_engine.php
 share/roundcube/plugins/enigma/lib/enigma_error.php
 share/roundcube/plugins/enigma/lib/enigma_key.php
+share/roundcube/plugins/enigma/lib/enigma_key_lookup.php
 share/roundcube/plugins/enigma/lib/enigma_mime_message.php
 share/roundcube/plugins/enigma/lib/enigma_signature.php
 share/roundcube/plugins/enigma/lib/enigma_subkey.php