packages/mail, branch master

mutt: update to 2.4.3

2026-10-10T07:35:33Z

Fixes CVE 2026-107570. Changelog since last version: https://gitlab.com/muttmua/mutt/-/compare/mutt-2-4-2-rel...mutt-2-4-3-rel Signed-off-by: Romain Isnel

exim: update to 4.100.1

2026-09-27T23:14:32Z

Security release: - Proxy protocol: fix an out-of-bounds read in V1 header parsing (GCVE-25-2026-09-50-1). - Proxy protocol: do not use uninitialised data as the length of an incompletely received V2 header (GCVE-25-2026-09-55-1). - GnuTLS: fix a use-after-free when a client closes the connection during session startup (GCVE-25-2026-09-51-1). - Block more SMTP smuggling variants, extending the fixes for CVE-2023-51766 (GCVE-25-2026-09-56-1). All patches apply without changes. Link: https://code.exim.org/exim/exim/src/tag/exim-4.100.1/doc/doc-txt/ChangeLog Signed-off-by: Josef Schlehofer

exim: add download URL for superseded releases

2026-09-27T23:14:32Z

downloads.exim.org keeps only the current release in exim4/ and moves older tarballs to exim4/old/. Since 4.100.1 came out, the download of 4.100 from the primary URL fails with 404 and only works through the OpenWrt mirror. Add exim4/old/ as a second source URL. Signed-off-by: Josef Schlehofer

mutt: update to 2.4.2

2026-09-05T15:39:01Z

Changelog since last version: https://gitlab.com/muttmua/mutt/-/compare/mutt-2-1-5-rel...mutt-2-4-2-rel Signed-off-by: Romain Isnel

msmtp: update to 1.8.34

2026-09-04T18:54:34Z

Release note: https://marlam.de/msmtp/news/msmtp-1-8-34/ Signed-off-by: Romain Isnel

exim: update to 4.100

2026-08-24T01:30:57Z

Security release, plus one further release the same day. 4.99.5: JH/01 Restrict named-queue names. Previously, files could be corrupted by poor choices of name. (GCVE-25-2026-07-45-1) JH/02 Do not expand a local_part gotten from a .forward file, under force_command in a pipe transport. (GCVE-25-2026-07-45-3) 4.100: fixes a use-after-free in duplicate processing combined with continued transport; fixes crashes after deferred local deliveries from an uninitialised pointer, and excessive DNS lookups on temporary errors for remote deliveries, both from a mistaken 4.99 optimisation; fixes a memory leak in DNS lookups present since 4.95; fixes Proxy-protocol connections evaluating host-based ACL options (host_reject_connection, helo_verify_hosts, message_size_limit, and others) against the proxy's own address/name instead of the real client behind it. Also: dbm lookups no longer return tainted data by mistake, RFC2047-encoding header size counting, DMARC for empty envelope senders, and a number of smaller build/portability fixes. Refreshed patches/030-openssl-deprecated.patch, patches/100-localscan_dlopen.patch and patches/200-fix-build.patch for context moved by the version bump. patches/100 also needed six log_write() call sites fixed: 4.100 dropped log_write()'s leading selector argument, so the patch's dlopen-failure diagnostics were passing LOG_MAIN|LOG_REJECT into the format-string slot. All four patches, including 050, now carry git am headers. Extended patches/050-fix-crosscompile.patch: 4.100 fixed the dkim.o partial-link rule in src/miscmods/Makefile (raw `ld -r` -> `$(LD) -r`) but left the sibling dmarc.o/dmarc_native.o and sieve_filter.o rules on the unqualified `ld`, which cannot parse a foreign architecture's relocations when cross-compiling. Applied the same fix to both; these are the only two `ld -r` sites left in the pristine 4.100 tree. Build-verified locally for the gnutls and ldap variants on x86_64/musl. Signed-off-by: Daniel Golle

tree-wide: remove redundant test.sh files

2026-07-04T20:42:46Z

Generic version checks were introduced in actions-shared-workflows, making these individual test.sh files obsolete. Signed-off-by: Josef Schlehofer

exim: update to version 4.99.4

2026-06-10T20:28:20Z

Maintenance release on the 4.99 stable series. https://github.com/Exim/exim/blob/exim-4.99.4/doc/doc-txt/ChangeLog Signed-off-by: Daniel Golle

exim: update to 4.99.3 (security release)

2026-05-14T22:13:25Z

4.99.3 (security release): * Addresses EXIM-Security-2026-05-01.1: a remotely reachable Use-After-Free vulnerability in Exim's BDAT (binary data transmission) body parsing path when using the GnuTLS backend. This can lead to heap corruption and potential code execution. Affects 4.97 through 4.99.x when built with GnuTLS support AND with STARTTLS and CHUNKING advertised. Reported by xbow security. Previous security releases folded into this bump: 4.99.2 (security release): * Addresses Exim-Security-2026-04.1, covering 4 CVEs: - CVE-2026-40684: Possible crash with malicious DNS data (musl libc) - CVE-2026-40685: Possible OOB read/write on corrupt JSON in header - CVE-2026-40686: Possible OOB read with large UTF8 trailing characters - CVE-2026-40687: Possible OOB read/write with SPA authenticator 4.99.1 (security release): * Re-incarnation of CVE-2025-26794, ports fixes from 4.98.1/4.98.2. Link: https://exim.org/static/doc/security/EXIM-Security-2026-05-01.1/ Link: https://git.exim.org/exim.git/blob/refs/tags/exim-4.99.3:/doc/doc-txt/ChangeLog Signed-off-by: Daniel Golle

treewide: cleanup URLs

2026-05-08T20:28:27Z

This commit converts plain HTTP URLs to HTTPS, and updates old or outdated URLs. Signed-off-by: Yanase Yuki