Log message:
mail/roundcube: update to 1.6.3

From release announce:

We just published a security update to the version 1.6 of Roundcube Webmail.
It provides a fix to a recently reported XSS vulnerability:

Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in
plain text messages, reported by Niraj Shivtarkar.  See the full changelog
in the release notes in the release notes on the Github download page.

We strongly recommend to update all productive installations of Roundcube
1.6.x with this new version.

1.6.3 (2023-09-15)

* Fix bug where installto.sh/update.sh scripts were removing some essential
  options from the config file (#9051)

* Update jQuery-UI to version 1.13.2 (#9041)

* Fix regression that broke use_secure_urls feature (#9052)

* Fix potential PHP fatal error when opening a message with message/rfc822
  part (#8953)

* Fix bug where a duplicate `<title>` tag in HTML email could cause some
  parts being cut off (#9029)

* Fix bug where a list of folders could have been sorted incorrectly (#9057)

* Fix regression where LDAP addressbook 'filter' option was ignored (#9061)

* Fix wrong order of a multi-folder search result when sorting by size
  (#9065)

* Fix so install/update scripts do not require PEAR (#9037)

* Fix regression where some mail parts could have been decoded incorrectly,
  or not at all (#9096)

* Fix handling of an error case in Cyrus IMAP BINARY FETCH, fallback to
  non-binary FETCH (#9097)

* Fix PHP8 deprecation warning in the reconnect plugin (#9083)

* Fix "Show source" on mobile with x_frame_options = deny (#9084)

* Fix various PHP warnings (#9098)

* Fix deprecated use of ldap_connect() in password's ldap_simple driver
  (#9060)

* Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in
  plain text messages

Log message:
*: recursive bump for Python 3.11 as new default

Log message:
mail/roundcube: update to 1.6.2

1.6.2 (2023-07-02)

* Add Uyghur localization
* Fix regression in OAuth request URI caused by use of REQUEST_URI instead
  of SCRIPT_NAME as a default (#8878)
* Fix bug where false attachment reminder was displayed on HTML mail with
  inline images (#8885)
* Fix bug where a non-ASCII character in app.js could cause error in
  javascript engine (#8894)
* Fix JWT decoding with url safe base64 schema (#8890)
* Fix bug where .wav instead of .mp3 file was used for the new mail
  notification in Firefox (#8895)
* Fix PHP8 warning (#8891)
* Fix support for Windows-31J charset (#8869)
* Fix so LDAP VLV option is disabled by default as documented (#8833)
* Fix so an email address with name is supported as input to the managesieve
  notify :from parameter (#8918)
* Fix Help plugin menu (#8898)
* Fix invalid onclick handler on the logo image when using non-array
  skin_logo setting (#8933)
* Fix duplicate recipients in "To" and "Cc" on reply (#8912)
* Fix bug where it wasn't possible to scroll lists by clicking middle mouse
  button (#8942)
* Fix bug where label text in a single-input dialog could be partially
  invisible in some locales (#8905)
* Fix bug where LDAP (fulltext) search didn't work without 'search_fields'
  in config (#8874)
* Fix extra leading newlines in plain text converted from HTML (#8973)
* Fix so recipients with a domain ending with .s are allowed (#8854)
* Fix so vCard output does not contain non-standard/redundant TYPE=OTHER and
  TYPE=INTERNET (#8838)
* Fix QR code images for contacts with non-ASCII characters (#9001)
* Fix PHP8 warnings when using list_flags and list_cols properties by
  plugins (#8998)
* Fix bug where subfolders could loose subscription on parent folder rename
  (#8892)
* Fix connecting to LDAP using an URI with ldapi:// scheme (#8990)
* Fix insecure shell command params handling in cmd_learn driver of
  markasjunk plugin (#9005)
* Fix bug where some mail headers didn't work in cmd_learn driver of
  markasjunk plugin (#9005)
* Fix PHP fatal error when importing vcf file using PHP 8.2 (#9025)
* Fix so output of log_date_format with microseconds contains time in server
  time zone, not UTC

Log message:
mail/roundcube: update to 1.6.0

pkgsrc changes:
* Add "USE_TOOLS+= pax" to plugins.mk.
* Add some note to MESSAGES.
* update DESCR.

1.6.0 (2022-07-28)

We proudly announce the release of the next major version 1.6 of Roundcube
webmail.  With this milestone we cleaned up the codebase and bring full
support for PHP 8.1.  The most noteworthy changes, as already announced with
the beta release, are:

* PHP 8.1 support
* Dropped support for PHP < 7.3
* Support responses (snippets) in HTML format
* Option to purge deleted mails older than 30, 60 or 90 days
* Unified and simplified services connection config options
* Removed the Classic and Larry skins from the release packages
* SQLite: Use foreign keys, require SQLite >= 3.6.19

See the full changelog in the release notes on the Github download page.

Breaking Changes to 1.5 and prior versions

The following config options have either been removed or renamed:

1. IMAP:

   * renamed default_host to imap_host
   * removed default_port option (non-standard port can be set via
     imap_host)
   * set "localhost:143" as a default for imap_host

2. SMTP:

* renamed smtp_server to smtp_host
* removed smtp_port option (non-standard port can be set via smtp_host)
* set "localhost:587" as a default for smtp_host

3. LDAP:

* removed port option from ldap_public array (non-standard port can be set
  via host)
* removed use_tls option from ldap_public array (use tls:// prefix in host)

4. Managesieve:

* removed managesieve_port option (non-standard port can be set via
  managesieve_host)
* removed managesieve_usetls option (set tls:// prefix to managesieve_host)

Log message:
mail/roundcube: update to 1.5.3

1.5.3 (2022-06-26)

* Enigma: Fix initial synchronization of private keys
* Enigma: Fix double quoted-printable encoding of pgp-signed messages with
  no attachments (#8413)
* Fix various PHP8 warnings (#8392)
* Fix mail headers injection via the subject field on mail compose (#8404)
* Fix bug where small message/rfc822 parts could not be decoded (#8408)
* Fix setting HTML mode on reply/forward of a signed message (#8405)
* Fix handling of RFC2231-encoded attachment names inside of a
  message/rfc822 part (#8418)
* Fix bug where some mail parts (images) could have not be listed as
  attachments (#8425)
* Fix bug where attachment icons were stuck at the top of the messages list
  in Safari (#8433)
* Fix handling of message/rfc822 parts that are small and are multipart
  structures with a single part (#8458)
* Fix bug where session could time out if DB and PHP timezone were different
  (#8303)
* Fix bug where DSN flag state wasn't stored with a draft (#8371)
* Fix broken encoding of HTML content encapsulated in a RTF attachment
  (#8444)
* Fix problem with aria-hidden=true on toolbar menus in the Elastic
  skin (#8517)
* Fix bug where title tag content was displayed in the body if it contained
  HTML tags (#8540)
* Fix support for DSN specification without host e.g. pgsql:///dbname
  (#8558)

Log message:
*: Revbump packages that use Python at runtime without a PKGNAME prefix

Log message:
mail/roundcube: update to 1.5.0

1.5.0 (2021-10-17)

Quote from release announce:

We proudly announce the final release of the next major version 1.5 of
Roundcube webmail. With this milestone we introduce new features and full
PHP 8.0 support. The most noteworthy additions are:

   - Dark mode for Elastic skin
   - OAuth2/XOauth support (with plugin hooks)
   - Collected recipients and trusted senders
   - Moving recipients between inputs with drag & drop
   - Full unicode support with MySQL database
   - Support of IMAP LITERAL- extension RFC 7888
     <https://datatracker.ietf.org/doc/html/rfc7888>
   - Support of RFC 2231 <https://datatracker.ietf.org/doc/html/rfc2231>
     encoded names
   - Cache refactoring

Log message:
roundcube: use PKG_SYSCONFDIR for plug-in configuration files

This moves the configuration files for Roundcube plug-ins to $PKG_SYSCONFDIR,
where they should belong instead of $RC_DIR/$PLUGIN_DIR.

This works without any further patches, because Roundcube falls back to
RCUBE_CONFIG_DIR.'/'.$this->ID . '.inc.php' for plug-ins basically.

Bumps PKGREVISION for the plug-ins using ../../mail/roundcube/plugins.mk
(enigma, password, and zipdownload).

Tested on NetBSD/amd64.

OK taca@