Skip to content

deps: bump net-imap from 0.6.4 to 0.6.4.1 in /examples/uptime_monitor_rails - #70

Merged
d11wtq merged 1 commit into
mainfrom
dependabot/bundler/examples/uptime_monitor_rails/net-imap-0.6.4.1
Aug 3, 2026
Merged

deps: bump net-imap from 0.6.4 to 0.6.4.1 in /examples/uptime_monitor_rails#70
d11wtq merged 1 commit into
mainfrom
dependabot/bundler/examples/uptime_monitor_rails/net-imap-0.6.4.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor

Bumps net-imap from 0.6.4 to 0.6.4.1.

Release notes

Sourced from net-imap's releases.

v0.6.4.1

What's Changed

🔒 Security

This release fixes several more security vulnerabilities which are related to the fixes in v0.6.4. Please see the linked security advisories for more information.

  • (moderate) Command Injection via non-synchronizing literal in "raw" argument (CVE-2026-47240, GHSA-8p34-64r3-mwg8) This vulnerability depends how the server interprets non-synchronizing literals. The connection is not vulnerable if the server supports non-synchronizing literals.
  • (moderate) Command Injection via unvalidated ID and ENABLE arguments (CVE-2026-47242, GHSA-46q3-7gv7-qmgg)
  • (low) Denial of Service via incomplete "raw" argument validation (CVE-2026-47241, GHSA-c4fp-cxrr-mj66) This results in the affected command hanging until the connection is closed. If another thread attempts to send a concurrent pipelined command, the first thread will return with a syntax error and the second thread will hang until the connection closes.

Added

Fixed

Documentation

Other Changes

Miscellaneous

Full Changelog: ruby/net-imap@v0.6.4...v0.6.4.1

Commits
  • 357f3b5 🔖 Bump version to 0.6.4.1
  • e066b83 🔀 Merge pull request #701 from ruby/security/validate-non_sync_literal-support
  • 0ea9eba ✅ Fix flaky tests for MacOS, TruffleRuby
  • 5cad699 🔀 Merge pull request #700 from ruby/security/fix-raw_data-trailing-literal-ma...
  • 5a0af4a 🔀 Merge pull request #699 from ruby/security/validate-enable-arguments
  • b9d1972 🔀 Merge pull request #698 from ruby/security/validate-quoted-data
  • 07e002b ♻️ Use QuotedString internally to send quoted string
  • ae9f83b ♻️ Extract str.bytesize lvar in send_literal
  • d6ddd29 🐛 Prevent trailing {0} in RawData validation
  • 1f97168 🥅 Validate #enable arguments are all atoms
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code labels Aug 3, 2026
Bumps [net-imap](https://github.com/ruby/net-imap) from 0.6.4 to 0.6.4.1.
- [Release notes](https://github.com/ruby/net-imap/releases)
- [Commits](ruby/net-imap@v0.6.4...v0.6.4.1)

---
updated-dependencies:
- dependency-name: net-imap
  dependency-version: 0.6.4.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/bundler/examples/uptime_monitor_rails/net-imap-0.6.4.1 branch from 68d32f0 to 179ea58 Compare August 3, 2026 04:55
@d11wtq
d11wtq merged commit b55033b into main Aug 3, 2026
13 checks passed
@dependabot
dependabot Bot deleted the dependabot/bundler/examples/uptime_monitor_rails/net-imap-0.6.4.1 branch August 3, 2026 04:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file ruby Pull requests that update ruby code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant