CVS commit: pkgsrc/mail

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Sun Sep  6 14:09:26 UTC 2026

Modified Files:
        pkgsrc/mail/roundcube: Makefile.common distinfo
        pkgsrc/mail/roundcube-plugin-password: distinfo

Log Message:
mail/roundcube: update to 1.6.19

1.6.19 (2026-09-06)

* Fix PHP Warning: Undefined variable $tmp_command in
  .../plugins/markasjunk/drivers/cmd_learn.php (#10294)

* Security: Fix CSS declaration smuggling via un-encoded ampersand emission

* Security: Fix CSS property injection via body background attribute

* Security: Fix email header injection via bare CR in the subject field

* Security: Fix email header injection via C-escape \r in the recipient
  display name

* Security: Fix email header injection via identity's organization field

* Security: Fix zero-click stored XSS via TNEF MIME tag injection in the
  attachment URL

* Security: Fix XSS in the HTML editor using text/enriched part content

* Security: Fix cross-user access in contact group membership (add/remove)
  in the SQL address book

* Security: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet
  URL

* Security: Fix remote content blocking bypass via CSS escapes in FuncIRI
  attributes

* Security: Fix remote-content blocker bypass via SVG SMIL src animation

* Security: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal
  IPv6-mapped IPv4 addresses


To generate a diff of this commit:
cvs rdiff -u -r1.46 -r1.47 pkgsrc/mail/roundcube/Makefile.common
cvs rdiff -u -r1.103 -r1.104 pkgsrc/mail/roundcube/distinfo
cvs rdiff -u -r1.48 -r1.49 pkgsrc/mail/roundcube-plugin-password/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/mail/roundcube/Makefile.common
diff -u pkgsrc/mail/roundcube/Makefile.common:1.46 pkgsrc/mail/roundcube/Makefile.common:1.47
--- pkgsrc/mail/roundcube/Makefile.common:1.46  Tue Aug 11 15:21:52 2026
+++ pkgsrc/mail/roundcube/Makefile.common       Sun Sep  6 14:09:26 2026
@@ -1,4 +1,4 @@
-# $NetBSD: Makefile.common,v 1.46 2026/08/11 15:21:52 taca Exp $
+# $NetBSD: Makefile.common,v 1.47 2026/09/06 14:09:26 taca Exp $
 #
 # used by mail/roundcube/Makefile
 # used by mail/roundcube/plugins.mk
@@ -10,7 +10,7 @@ GITHUB_PROJECT=       roundcubemail
 GITHUB_RELEASE=        ${RC_VERS}
 HOMEPAGE=      https://roundcube.net/
 
-RC_VERS=       1.6.18
+RC_VERS=       1.6.19
 
 USE_LANGUAGES=         # none
 USE_TOOLS+=            pax

Index: pkgsrc/mail/roundcube/distinfo
diff -u pkgsrc/mail/roundcube/distinfo:1.103 pkgsrc/mail/roundcube/distinfo:1.104
--- pkgsrc/mail/roundcube/distinfo:1.103        Tue Aug 11 15:21:52 2026
+++ pkgsrc/mail/roundcube/distinfo      Sun Sep  6 14:09:26 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.103 2026/08/11 15:21:52 taca Exp $
+$NetBSD: distinfo,v 1.104 2026/09/06 14:09:26 taca Exp $
 
-BLAKE2s (roundcubemail-1.6.18-complete.tar.gz) = bcadb116bd8fbba0dab678104e80da56a17b5b0d5fa14b59a654cca4d9f72a0c
-SHA512 (roundcubemail-1.6.18-complete.tar.gz) = c2fb9916aac3078631fcee2fb9c3c2a3b882faab6a0d8238f35ce7575dafb21f623b133e9f23910bde412aa88597d876201c281972b25d4671099f2a628b7dcf
-Size (roundcubemail-1.6.18-complete.tar.gz) = 5954664 bytes
+BLAKE2s (roundcubemail-1.6.19-complete.tar.gz) = 5901f236523b95552aba203a00029c92c0402eed0a14bc62e78090099a4db6dd
+SHA512 (roundcubemail-1.6.19-complete.tar.gz) = 81be8fd41f4b99b39a6ff46cfecf12a76fe750b7554e7b7d462795f6df83416f0a5355a6a099941055c6d1991aef75491e1fcd2b067e5714a00d485552996dc9
+Size (roundcubemail-1.6.19-complete.tar.gz) = 5955504 bytes
 SHA1 (patch-config_config.inc.php.sample) = 92a48a97b16fe3f5f4b9441fce762a559d8daca7
 SHA1 (patch-program_include_iniset.php) = 8a6c13c0c87d583ed60e43c01a4173d9d802a6a1
 SHA1 (patch-program_lib_Roundcube_rcube__mime.php) = bfefc6850d3db230dd4224491e895fe25a32e87a

Index: pkgsrc/mail/roundcube-plugin-password/distinfo
diff -u pkgsrc/mail/roundcube-plugin-password/distinfo:1.48 pkgsrc/mail/roundcube-plugin-password/distinfo:1.49
--- pkgsrc/mail/roundcube-plugin-password/distinfo:1.48 Tue Aug 11 15:21:52 2026
+++ pkgsrc/mail/roundcube-plugin-password/distinfo      Sun Sep  6 14:09:26 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.48 2026/08/11 15:21:52 taca Exp $
+$NetBSD: distinfo,v 1.49 2026/09/06 14:09:26 taca Exp $
 
-BLAKE2s (roundcubemail-1.6.18-complete.tar.gz) = bcadb116bd8fbba0dab678104e80da56a17b5b0d5fa14b59a654cca4d9f72a0c
-SHA512 (roundcubemail-1.6.18-complete.tar.gz) = c2fb9916aac3078631fcee2fb9c3c2a3b882faab6a0d8238f35ce7575dafb21f623b133e9f23910bde412aa88597d876201c281972b25d4671099f2a628b7dcf
-Size (roundcubemail-1.6.18-complete.tar.gz) = 5954664 bytes
+BLAKE2s (roundcubemail-1.6.19-complete.tar.gz) = 5901f236523b95552aba203a00029c92c0402eed0a14bc62e78090099a4db6dd
+SHA512 (roundcubemail-1.6.19-complete.tar.gz) = 81be8fd41f4b99b39a6ff46cfecf12a76fe750b7554e7b7d462795f6df83416f0a5355a6a099941055c6d1991aef75491e1fcd2b067e5714a00d485552996dc9
+Size (roundcubemail-1.6.19-complete.tar.gz) = 5955504 bytes
 SHA1 (patch-plugins_password_helpers_passwd-expect) = 15e427a3c90bf7c0437a023b3f099abb5a139165