chore(deps): bump net-imap from 0.6.4 to 0.6.4.1#2638
Conversation
Bumps [net-imap](https://github.com/ruby/net-imap) from 0.6.4 to 0.6.4.1. - [Release notes](https://github.com/ruby/net-imap/releases) - [Commits](ruby/net-imap@v0.6.4...v0.6.4.1) --- updated-dependencies: - dependency-name: net-imap dependency-version: 0.6.4.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
mroderick
left a comment
mroderick
left a comment
There was a problem hiding this comment.
Dependency Upgrade Review: net-imap 0.6.4 → 0.6.4.1
PR Scope
Dependency-only — only changed (1 addition, 1 deletion). No code modifications.
Changes in Dependency
net-imap 0.6.4.1 — Security patch release:
- Fixes command injection via non-synchronizing literal in raw arguments (CVE-2026-47240)
- Fixes command injection via unvalidated ID and ENABLE arguments (CVE-2026-47242)
- Fixes DoS via incomplete raw argument validation (CVE-2026-47241)
- Fixes deadlock in
- Validates Atom and Flag are not empty
- Various internal validation improvements
Usage in Repository
Indirect dependency — is pulled in by (2.9.0), which is a Rails dependency. This app does not directly use APIs. It uses Action Mailer for email delivery, which relies on for SMTP, not IMAP.
Compatibility Assessment
Compatible — This is a patch-level security fix (0.6.4 → 0.6.4.1) with no API changes. The fixes are internal validation hardening that doesn't affect how the mail gem or Action Mailer uses this library.
Test Coverage
Validated — — 70 examples, 0 failures.
Confidence Rating
High — Patch-level security fix with no runtime API changes. The app doesn't use IMAP directly. Mailer tests pass cleanly.
mroderick
left a comment
mroderick
left a comment
There was a problem hiding this comment.
Dependency Upgrade Review: net-imap 0.6.4 → 0.6.4.1
PR Scope
Dependency-only — only Gemfile.lock changed (1 addition, 1 deletion). No code modifications.
Changes in Dependency
net-imap 0.6.4.1 — Security patch release:
- Fixes command injection via non-synchronizing literal in raw arguments (CVE-2026-47240)
- Fixes command injection via unvalidated ID and ENABLE arguments (CVE-2026-47242)
- Fixes DoS via incomplete raw argument validation (CVE-2026-47241)
- Fixes deadlock in
#disconnect - Validates Atom and Flag are not empty
- Various internal validation improvements
Usage in Repository
Indirect dependency — net-imap is pulled in by mail (2.9.0), which is a Rails dependency. This app does not directly use Net::IMAP APIs. It uses Action Mailer for email delivery, which relies on mail for SMTP, not IMAP.
Compatibility Assessment
Compatible — This is a patch-level security fix (0.6.4 → 0.6.4.1) with no API changes. The fixes are internal validation hardening that doesn't affect how the mail gem or Action Mailer uses this library.
Test Coverage
Validated — spec/mailers/ — 70 examples, 0 failures.
Confidence Rating
High — Patch-level security fix with no runtime API changes. The app doesn't use IMAP directly. Mailer tests pass cleanly.
1 participant
Bumps net-imap from 0.6.4 to 0.6.4.1.
Release notes
Sourced from net-imap's releases.
Commits
357f3b5🔖 Bump version to 0.6.4.1e066b83🔀 Merge pull request #701 from ruby/security/validate-non_sync_literal-support0ea9eba✅ Fix flaky tests for MacOS, TruffleRuby5cad699🔀 Merge pull request #700 from ruby/security/fix-raw_data-trailing-literal-ma...5a0af4a🔀 Merge pull request #699 from ruby/security/validate-enable-argumentsb9d1972🔀 Merge pull request #698 from ruby/security/validate-quoted-data07e002b♻️ Use QuotedString internally to send quoted stringae9f83b♻️ Extract str.bytesize lvar in send_literald6ddd29🐛 Prevent trailing{0}in RawData validation1f97168🥅 Validate#enablearguments are all atomsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.