mail/roundcube-plugin-password 1.6.19 NetBSD

1.6.20 (2026-10-19) * Security: Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/viewsource action * Security: Fix bug where an alias login wasn't qualified by IMAP host * Security: Add a size limit to the CSS proxy content processing * Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96 * Security: Fix remote content blocking bypass via SVG SMIL `by` attribute * Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again) * Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize * Security: Fix mail header injection via the From display-name in the Bounce (resend) action * Security: Fix mail header injection via …

1.6.19 (2026-09-06) * Fix PHP Warning: Undefined variable $tmp_command in .../plugins/markasjunk/drivers/cmd_learn.php (#10294) * Security: Fix CSS declaration smuggling via un-encoded ampersand emission * Security: Fix CSS property injection via body background attribute * Security: Fix email header injection via bare CR in the subject field * Security: Fix email header injection via C-escape \r in the recipient display name * Security: Fix email header injection via identity's organization field * Security: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL * Security: Fix XSS in the HTML editor using text/enriched part content * Security: Fix cross-user access in contact group membership (add/remove) in the SQL address book …

1.6.18 (2026-08-19) * Password: Fix fatal error "Class 'Zxcvbn' not found" (#10274) * Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269) * Security: Add basic validation for content proxied by the css proxy * Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets * Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check * Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute * Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the `search_filter` * Security: Fix arbitrary Sieve script injection via a filter rule name bypassing `managesieve_disabled_actions` …

Forgot to update distinfo.