Skip to content

Bump net-imap from 0.6.4 to 0.6.4.1 in /spec/tester_mongo_rails_6#1656

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/spec/tester_mongo_rails_6/net-imap-0.6.4.1
Open

Bump net-imap from 0.6.4 to 0.6.4.1 in /spec/tester_mongo_rails_6#1656
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/bundler/spec/tester_mongo_rails_6/net-imap-0.6.4.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 9, 2026

Copy link
Copy Markdown

Bumps net-imap from 0.6.4 to 0.6.4.1.

Release notes

Sourced from net-imap's releases.

v0.6.4.1

What's Changed

🔒 Security

This release fixes several more security vulnerabilities which are related to the fixes in v0.6.4. Please see the linked security advisories for more information.

  • (moderate) Command Injection via non-synchronizing literal in "raw" argument (CVE-2026-47240, GHSA-8p34-64r3-mwg8) This vulnerability depends how the server interprets non-synchronizing literals. The connection is not vulnerable if the server supports non-synchronizing literals.
  • (moderate) Command Injection via unvalidated ID and ENABLE arguments (CVE-2026-47242, GHSA-46q3-7gv7-qmgg)
  • (low) Denial of Service via incomplete "raw" argument validation (CVE-2026-47241, GHSA-c4fp-cxrr-mj66) This results in the affected command hanging until the connection is closed. If another thread attempts to send a concurrent pipelined command, the first thread will return with a syntax error and the second thread will hang until the connection closes.

Added

Fixed

Documentation

Other Changes

Miscellaneous

Full Changelog: ruby/net-imap@v0.6.4...v0.6.4.1

Commits
  • 357f3b5 🔖 Bump version to 0.6.4.1
  • e066b83 🔀 Merge pull request #701 from ruby/security/validate-non_sync_literal-support
  • 0ea9eba ✅ Fix flaky tests for MacOS, TruffleRuby
  • 5cad699 🔀 Merge pull request #700 from ruby/security/fix-raw_data-trailing-literal-ma...
  • 5a0af4a 🔀 Merge pull request #699 from ruby/security/validate-enable-arguments
  • b9d1972 🔀 Merge pull request #698 from ruby/security/validate-quoted-data
  • 07e002b ♻️ Use QuotedString internally to send quoted string
  • ae9f83b ♻️ Extract str.bytesize lvar in send_literal
  • d6ddd29 🐛 Prevent trailing {0} in RawData validation
  • 1f97168 🥅 Validate #enable arguments are all atoms
  • Additional commits viewable in compare view

@github-actions github-actions Bot enabled auto-merge (squash) June 9, 2026 18:46
Bumps [net-imap](https://github.com/ruby/net-imap) from 0.6.4 to 0.6.4.1.
- [Release notes](https://github.com/ruby/net-imap/releases)
- [Commits](ruby/net-imap@v0.6.4...v0.6.4.1)

---
updated-dependencies:
- dependency-name: net-imap
  dependency-version: 0.6.4.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/bundler/spec/tester_mongo_rails_6/net-imap-0.6.4.1 branch from 3a02ed6 to 2bed288 Compare June 22, 2026 23:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants