Skip to content

Commit bedc97b

Browse files
committed
net-imap: Update 0.3.9->0.4.24
This commit upgrades the bundled net-imap gem in Ruby 3.2.11 from the original version of 0.3.9 to 04.24. This release contains a fix for the following high-severity issue with STARTTLS: - GHSA-vcgp-9326-pqcp There will be no further upstream releases to Ruby 3.2, thus we have to upgrade this gem ourselves. The 0.4.0 release has a few breaking changes, however there are several issues with the 0.3.10 version of `net-imap`: - It will be the last release to `net-imap` 0.3.x - The 0.3.x releases will not install in containerized build environments where the default locale is set to `POSIX` (Debian). This was resloved in the 0.4.3 release by: ruby/net-imap#210 - The 0.4.24 release contains fixes for additional medium-to-low severity issues: * GHSA-hm49-wcqc-g2xg * GHSA-q2mw-fvj9-vvcw * GHSA-87pf-fpwv-p7m7 * GHSA-75xq-5h9v-w6px CVE-2026-42246 CVE-2026-42257 CVE-2026-42256 CVE-2026-42258 CVE-2026-42245 Signed-off-by: Charlie Sharpsteen <charlie@overlookinfratech.com>
1 parent b2e1838 commit bedc97b

1 file changed

Lines changed: 20 additions & 0 deletions

File tree

configs/components/ruby-3.2.rb

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,26 @@
4545
# Upgrade erb 4.0.2 -> 4.0.3.1, fixes CVE-2026-41316
4646
pkg.apply_patch "#{base}/upgrade-erb-4.0.3.1.patch"
4747

48+
# Upgrade net-imap 0.3.9 -> 0.4.24, fixes CVE-2026-42246, other CVEs, and build issues.
49+
pkg.add_source(
50+
'https://rubygems.org/downloads/net-imap-0.4.24.gem',
51+
{
52+
# NOTE: Has to be MD5 due to vanagon limitations.
53+
sum: 'dfe894c164fcef8eb7145f0dd3b9ce4f'
54+
}
55+
)
56+
pkg.configure do
57+
[
58+
'cp ../net-imap-0.4.24.gem gems/',
59+
"sed -i.bak 's/^net-imap.*/net-imap 0.4.24 https:\\/\\/github.com\\/ruby\\/net-imap/' gems/bundled_gems",
60+
# This next bit can be done via "make extract-gems", but that requires us
61+
# to have a "baseruby" installed.
62+
'tar xf gems/net-imap-0.4.24.gem',
63+
'mkdir .bundle/gems/net-imap-0.4.24',
64+
'tar -C .bundle/gems/net-imap-0.4.24 -xzf data.tar.gz'
65+
]
66+
end
67+
4868
####################
4969
# ENVIRONMENT, FLAGS
5070
####################

0 commit comments

Comments
 (0)