2025-02-17 16:23:09 by Takahiro Kambe | Files touched by this commit (1) |
Log message:
net/ruby-net-imap: reject ruby34 now
Ruby 3.4.2 has the same version as bundled gem.
Bump PKGREVISION.
|
2025-02-11 17:15:39 by Takahiro Kambe | Files touched by this commit (1) |  |
Log message:
net/ruby-net-imap: update PLIST
Forgot to commit with previous update.
|
2025-02-09 15:40:07 by Takahiro Kambe | Files touched by this commit (2) |  |
Log message:
net/ruby-net-imap: update to 0.5.6
0.5.6 (2025-02-08)
Security Fix
Fixes CVE-2025-25186 (GHSA-7fc5-f82f-cx69): A malicious server can exhaust
client memory by sending APPENDUID or COPYUID responses with very large
uid-set ranges. Net::IMAP::UIDPlusData expands these ranges into arrays of
integers.
Fix with minor API changes
Set config.parser_use_deprecated_uidplus_data to false to replace
UIDPlusData with AppendUIDData and CopyUIDData. These classes store their
UIDs as Net::IMAP::SequenceSet objects (not expanded into arrays of
integers). Code that does not handle APPENDUID or COPYUID responses should
not see any difference. Code that does handle these responses may need to
be updated.
For v0.3.8, this option is not available
For v0.4.19, the default value is true.
For v0.5.6, the default value is :up_to_max_size.
For v0.6.0, the only allowed value will be false (UIDPlusData will be
removed from v0.6).
Mitigate with backward compatible API
Adjust config.parser_max_deprecated_uidplus_data_size to limit the maximum
UIDPlusData UID set size.
When config.parser_use_deprecated_uidplus_data == true, larger sets will
crash.
When config.parser_use_deprecated_uidplus_data == :up_to_max_size, larger
sets will use AppendUIDData or CopyUIDData.
For v0.3,8, this limit is hard-coded to 10,000.
For v0.4.19, this limit defaults to 1000.
For v0.5.6, this limit defaults to 100.
For v0.6.0, the only allowed value will be 0 (UIDPlusData will be removed
from v0.6).
Please Note: unhandled responses
If the client does not add response handlers to prune unhandled responses, a
malicious server can still eventually exhaust all client memory, by
repeatedly sending malicious responses. However, net-imap has always
retained unhandled responses, and it has always been necessary for
long-lived connections to prune these responses. This is not significantly
different from connecting to a trusted server with a long-lived connection.
To limit the maximum number of retained responses, a simple handler might
look something like the following:
limit = 1000
imap.add_response_handler do |resp|
next unless resp.respond_to?(:name) && resp.respond_to?(:data)
name = resp.name
code = resp.data.code&.name if resp.data.in?(Net::IMAP::ResponseText)
imap.responses(name) { _1.slice!(0...-limit) }
imap.responses(code) { _1.slice!(0...-limit) }
end
Added
* Ensure ResponseParser config is mutable and non-global by @nevans in #381
* Add SequenceSet methods for querying about duplicates by @nevans in #384
* Add SequenceSet#each_ordered_number by @nevans in #386
* Add SequenceSet#find_ordered_index by @nevans in #396
* Add SequenceSet#ordered_at by @nevans in #397
* Add AppendUIDData and CopyUIDData classes by @nevans in #400
* Add parser config for APPENDUID/COPYUID, Deprecate UIDPlusData by @nevans
in #401
Fixed
* Fix SequenceSet#append when its @string is nil by @nevans in #376
* Fix SequenceSet merging in another SequenceSet by @nevans in #377
* Fix SequenceSet count dups with multiple "*" by @nevans in #387
* Re-raise #starttls error from receiver thread by @nevans in #395
Documentation
* Fix SequenceSet#cover? documentation by @nevans in #379
* Document COPYUID in tagged vs untagged responses by @nevans in #398
Other Changes
* Move UIDPlusData to its own file by @nevans in #391
* Parse uid-set as sequence-set without * by @nevans in #393
Miscellaneous
* Bump step-security/harden-runner from 2.10.2 to 2.10.3 by @dependabot in #375
* Bump step-security/harden-runner from 2.10.3 to 2.10.4 by @dependabot in #380
* Improve test coverage for SequenceSet enums by @nevans in #383
* Refactor SequenceSet enumerator tests by @nevans in #385
* Add "irb" to Gemfile to silence warning by @nevans in #388
* Omit flaky test with macOS platform by @hsbt in #389
* Improve UIDPlusData test coverage by @nevans in #392
* Rename UIDPLUS test file for consistency by @nevans in #399
|
2025-01-19 17:28:20 by Takahiro Kambe | Files touched by this commit (2) |  |
Log message:
net/ruby-net-imap: update to 0.5.5
0.5.5 (2025-01-04)
What's Changed
Breaking Changes
* Remove accidental Data#attributes method by @nevans in #371
* For ruby 3.2 and above, this PR is not a breaking change, and it fixes a
YAML serialization bug.
* Net::IMAP::Data#attributes was only available in ruby 3.1, with net-imap
v0.5.2 - v0.5.4. It can be replaced by #to_h.
Added
* RFC9586 UIDONLY support by @avdi in #366
Documentation
* Fix rdoc issues by @nevans in #372
* Use standard www.rfc-editor.org links for RFCs by @nevans in #374
* Documentation updates by @nevans in #373
New Contributors
* @avdi made their first contribution in #366
|
2025-01-02 06:41:25 by Takahiro Kambe | Files touched by this commit (3) |  |
Log message:
net/ruby-net-imap: update to 0.5.4
pkgsrc change: restrict Ruby's version (not for Ruby 3.4).
0.5.4 (2024-12-23)
What's Changed
Added
* Add support for PARTIAL extension (RFC9394) by @nevans in #367
Fixed
* Fix partial-range encoding of exclusive ranges by @nevans in #370
Documentation
* Fix documentation for #fetch by @nevans in #369
0.5.3 (2024-12-22)
What's Changed
Added
* Add support for VANISHED responses by @nevans in #329
Documentation
* Fix rdoc issues by @nevans in #365
0.5.2 (2024-12-17)
What's Changed
Added
* Raise ArgumentError on multiple search charset args by @nevans in #363
* Add keyword argument for search charset by @nevans in #364
* Add basic ESEARCH support (RFC4466, RFC4731) by @nevans in #333
Fixed
* Return empty SearchResult for no search result by @nevans in #362
Documentation
* Fix README example by @nevans in #354
* Add release.yml for better release note generation by @nevans in #355
* Fix rdoc 6.8 CSS styles by @nevans in #356
* Update IMAP#search docs (again) by @nevans in #360
* Consistent heading levels inside method rdoc by @nevans in #361
Other Changes
* Add Data polyfill for ruby 3.1 by @nevans in #352
* Refactor internal command data classes by @nevans in #358
Miscellaneous
* Drop YAML.unsafe_load_file refinement (tests only) by @nevans in #353
* Bump step-security/harden-runner from 2.10.1 to 2.10.2 by @dependabot in
#357
* Enabled windows-latest on GHA by @hsbt in #359
|
2024-12-09 16:27:03 by Takahiro Kambe | Files touched by this commit (3) |  |
Log message:
net/ruby-net-imap: update to 0.5.1
pkgsrc change: do not restrict Ruby's version.
Changes from 0.3.7 are too many to write here, please refer:
<https://github.com/ruby/net-imap/releases>.
|
2023-12-14 16:24:43 by Takahiro Kambe | Files touched by this commit (4) |
Log message:
net/ruby-net-imap: add version 0.3.7
devel/ruby-redmine51 require net-imap gem version 0.3.4 but ruby31 bundles
0.2.3. So, it add latest version of net-imap gem 0.3.x as ruby-net-imap.
Ruby client api for Internet Message Access Protocol.
Changes from 0.2.3:
0.3.0 (2022-11-17)
What's Changed
* Added dependabot.yml for actions by @hsbt in #59
* Bump actions/checkout from 2 to 3 by @dependabot in #60
* Adding RFC licenses by @nevans in #57
* Warn when using deprecated SASL mechanisms by @nevans in #62
New Contributors
* @dependabot made their first contribution in #60
0.3.1 (2022-11-17)
What's Changed
* Add XOAUTH2 authenticator by @ssunday in #63
New Contributors
* @ssunday made their first contribution in #63
0.3.2 (2022-12-09)
What's Changed
* Support UIDPLUS extension by @hoffi in #65
* Fixes "bundle exec rake" clash with test/unit by @nevans in #67
* Fix some UIDPLUS issues by @nevans in #69
* Fixes date-time format, and adds decode_datetime by @nevans in #66
* Add SASLprep. Code generated & tested with RFC3454 by @nevans in #64
* Add the UNSELECT command by @nevans in #72
* Fix mailbox attrs by @nevans in #73
* RFCs and references by @nevans in #71
* Nodocs and remove warning by @nevans in #70
* ResponseParser docs by @nevans in #76
* Response Data docs by @nevans in #75
New Contributors
* @hoffi made their first contribution in #65
0.3.3 (2022-12-21)
What's Changed
* Revert "Fixes "bundle exec rake", clash with test/unit" by \
@znz in #88
New Contributors
* @znz made their first contribution in #88
0.3.4 (2023-01-18)
What's Changed
* Net::IMAP Client docs by @nevans in #74
0.3.5 (2023-06-12)
* Fix #response documentation error, by @nevans in 87ba74e
* Add RFC3454 data, to support offline testing, by @nevans in #137
* Adds Ruby 3.2 to the CI matrix, by @petergoldstein in #99
* Use reusing workflow, by @hsbt in #151
* Decode UTF-7 more strictly, by @nobu in #152
* ️Continue testing 0.3.x branch against ruby 2.6, by @nevans in 115d190
* Fix decode utf-7 test for ruby 2.6, by @nevans in 7a60c8f
* Fix XOAUTH2 authenticator for ruby 2.6, by @nevans in bd4faa0
0.3.6 (2023-06-12)
* Fixes file permissions regression in v0.3.5 release, reported by
@aaronjensen in #154
0.3.7 (2023-07-26)
What's Changed
* Backport: Fix for Digest MD5 bad challenges by @nobu in #160 PR for
backport is #161
|
2023-09-09 16:01:35 by Takahiro Kambe | Files touched by this commit (4) |  |
Log message:
net/ruby-net-imap: remove package
* This package was kept only for devel/ruby-remdine50 on Ruby 3.0.
* Ruby 3.1 and 3.2 contains ruby-net-imap as default gem.
|