RoundCube

Recent Commits

• Aleksander Machniak (05 Jul 26)

  Fix phpstan error

• Aleksander Machniak (05 Jul 26)

  Update changelog [skip ci]

• Aleksander Machniak (05 Jul 26)

  Revert redundant username sanitization

• Aleksander Machniak (05 Jul 26)

  Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file

• Aleksander Machniak (05 Jul 26)

  Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433]

• Aleksander Machniak (05 Jul 26)

  Fix SSRF bypass via specific local address URLs - two new cases

• Aleksander Machniak (05 Jul 26)

  Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432]

• Aleksander Machniak (05 Jul 26)

  Fix various vulnerabilities in the password plugin using session-injected username

• Aleksander Machniak (04 Jul 26)

  Fix phpstan issues

• Aleksander Machniak (04 Jul 26)

  Fix "Creation of dynamic property rcube_message_header::$replaces is deprecated" warning (#10246)

• Aleksander Machniak (29 Jun 26)

  Update localization

• Tomasz Chiliński (29 Jun 26)

  bugfix: typo in POST param (was: _curppasswd, changed to: _curpasswd) (#10244)

• Aleksander Machniak (25 Jun 26)

  Fix PHP deprecation warning (#10241)

• Aleksander Machniak (24 Jun 26)

  Fix support for untyped tokens in OIDC backchannel logout, require unset `nonce` (#10097)

• Aleksander Machniak (23 Jun 26)

  Fix bug where redis/memcache session could have been updated more often than needed Unify the "redundant write" check with what the DB driver does

• Michael Voříšek (23 Jun 26)

  Improve PHP CS Fixer config/speed (#10240) * Revert "Fix php-cs-fixer" This reverts commit d91a4189429ec088202d38b04bee8ec9d13215a3. * fix properly

• Aleksander Machniak (22 Jun 26)

  Fix php-cs-fixer

• Aleksander Machniak (19 Jun 26)

  Revert "Remove outdated phpstan ignore line" My local phpstan run got something wrong, but unable to reproduce

• Aleksander Machniak (19 Jun 26)

  Fix CS in composer.json

• Aleksander Machniak (19 Jun 26)

  Fix composer.json syntax error

• Aleksander Machniak (19 Jun 26)

  Remove outdated phpstan ignore line

• Aleksander Machniak (19 Jun 26)

  Fix 32bit support, remove paragonie/sodium_compat dependency (#10236)

• Aleksander Machniak (19 Jun 26)

  Update changelog [skip ci]

• David Collado Boyer (19 Jun 26)

  Free Imagick resources after failing (#10231) Co-authored-by: dcollado <[email protected]>

• Aleksander Machniak (17 Jun 26)

  Get more specific error when auth cookie check fails

• Aleksander Machniak (29 May 26)

  Add missing test data file

• Aleksander Machniak (08 Jun 26)

  Add missing dependencies from the last commit

• Aleksander Machniak (08 Jun 26)

  OAuth: Validate JWT token signature (#10210) For now only with oauth_jskw_uri set.

• Torsten Mattetat (07 Jun 26)

  Fix incorrect unfolding of folded lines for vCard 2.1 imports (#9647) (#10218) * Fix incorrect unfolding of folded lines for vCard 2.1 imports (#9647) vCard line unfolding was hardcoded to the RFC 2425 rule used by vCard 3.0/4.0, which drops the folding whitespace entirely. vCard 2.1 follows RFC 822, where a CRLF immediately followed by a LWSP-char is equivalent to that LWSP-char, i.e. the folding whitespace must be kept. As a result, a folded value such as NOTE:an example was imported as "anexample" instead of "an example". Extract a version-aware unfold() helper and use it in both vcard_decode() and detect_encoding(), keeping the folding whitespace for vCard 2.1 while preserving the existing behaviour for 3.0/4.0. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> * ci: re-trigger checks (transient Windows infra failures) --------- Co-authored-by: Claude Opus 4.8 (1M context) <[email protected]>

• Aleksander Machniak (07 Jun 26)

  Fix PHP warning (#10215)