v0.6.6

What's Changed

Fixed

• 🐛 Fix incorrect regexp for testing if string is quotable by @nevans in #723
  This bug was introduced by v0.6.5 as part of #712.
  It causes some valid string arguments (which should be sent as IMAP literal values) to raise a DataFormatError exception (without sending).

Full Changelog: v0.6.5...v0.6.6

v0.6.5

What's Changed

Added

• 🧵 Add thread join timeout to #disconnect by @nevans in #689
• ✨ Add #utf8_enabled? by @nevans in #715
• ✨ Remember set of enabled server capabilities by @nevans in #716
  Adds #enabled and #enabled? methods.

Fixed

• 🥅 Fix premature tagged response guard for IDLE by @nevans in #688
• 🥅 Test for NULL bytes before sending string args by @nevans in #712
• 🐛 Use literal syntax for invalid UTF8 or non-UTF8 strings by @nevans in #713

Other Changes

• 🧵🥅 Reraise receiver thread errors with caller's backtrace by @nevans in #691
• 🧵🥅 Reraise #starttls receiver thread errors with caller's backtrace by @nevans in #711
• ♻️ Extract InvalidTaggedResponseError error by @nevans in #687
• 🧵 Refactor thread synchronization for sending commands by @nevans in #692
• 🧵Refactor receive responses thread sync by @nevans in #694
• ♻️ Extract handle_response from receive_responses by @nevans in #695

Miscellaneous

• 🔀 Merge v0.6.4.1 patches by @nevans in #702
• Fix flaky test_starttls_stripping_ok_sent_before_response by @hsbt in #709
• ⬆️ Bump actions/checkout from 6 to 7 by @dependabot[bot] in #708
• ✅⚡ Faster tests by @nevans in #714
• Pin simplecov version by @nobu in #717
• simplecov-{html,json} have been incorporated in SimpleCov 1.0.0 by @nobu in #718
• ⬆️ Bump step-security/harden-runner from 2.19.4 to 2.20.0 by @dependabot[bot] in #719
• ✅ Fix issues with simplecov v1.0 upgrade by @nevans in #721

Full Changelog: v0.6.4.1...v0.6.5

v0.4.25

Important

The 0.4.x release branch will only receive security fixes, and will be unsupported when ruby 3.3 is EOL.
Please upgrade to a newer version.

What's Changed

Special thanks to @hsbt for backporting most of these PRs, in #707!

🔒 Security

This release fixes several more security vulnerabilities which are related to the fixes in v0.4.24. Please see the linked security advisories for more information.

• (moderate) Command Injection via non-synchronizing literal in "raw" argument (CVE-2026-47240, GHSA-8p34-64r3-mwg8)
  This vulnerability depends how the server interprets non-synchronizing literals.
  The connection is not vulnerable if the server supports non-synchronizing literals.
  • 🥅 Validate non-synchronizing literals support (backports #701)
• (moderate) Command Injection via unvalidated ID and ENABLE arguments (CVE-2026-47242, GHSA-46q3-7gv7-qmgg)
  • 🥅 Validate ID values contain only valid bytes (backports #698)
  • 🥅 Validate #enable arguments are all atoms (backports #699)
    NOTE: #enable should never be called with untrusted input.
• (low) Denial of Service via incomplete "raw" argument validation (CVE-2026-47241, GHSA-c4fp-cxrr-mj66)
  This results in the affected command hanging until the connection is closed. If another thread attempts to send a concurrent pipelined command, the first thread will return with a syntax error and the second thread will hang until the connection closes.
  • Reported by @fg0x0
  • 🐛 Prevent trailing {0} in RawData validation (backports #700)

Fixed

• Remove dead code resulting from cherry-pick of 6f82e28. by @jackorp in #706
• 🏷️ Allow 64-bit Integer arguments (backports #675)
• 🥅 Validate that Atom and Flag are not empty (backports #684)
• 🧵 Fix deadlock in #disconnect (backports #686)

Documentation

• ⚠️ Boost visibility of raw data argument documentation warnings (backports #677)

Other Changes

• 🧵 Close socket in #disconnect before waiting for lock & thread join (backports #493)
• 🥅 Ensure send_number_data input is an Integer (backports #676)
• ♻️ Improve RawData.new, Add RawData.split (backports #679)
• 🥅 Validate response literal byte size format (backports #681)

Miscellaneous

• ✅ Fix flaky tests with FakeServer#Connection#close mutex (backports half of #520
• ✅ Improvements to tests' FakeServer (backports #678)
• Backport the security fixes to v0.4 for a 0.4.25 release by @hsbt in #707

New Contributors

• @jackorp made their first contribution in #706

Full Changelog: v0.4.24...v0.4.25

v0.6.4.1

What's Changed

🔒 Security

This release fixes several more security vulnerabilities which are related to the fixes in v0.6.4. Please see the linked security advisories for more information.

• (moderate) Command Injection via non-synchronizing literal in "raw" argument (CVE-2026-47240, GHSA-8p34-64r3-mwg8)
  This vulnerability depends how the server interprets non-synchronizing literals.
  The connection is not vulnerable if the server supports non-synchronizing literals.
  • 🥅 Validate non-synchronizing literals support by @nevans in #701
• (moderate) Command Injection via unvalidated ID and ENABLE arguments (CVE-2026-47242, GHSA-46q3-7gv7-qmgg)
  • 🥅 Validate ID values contain only valid bytes by @nevans in #698
  • 🥅 Validate #enable arguments are all atoms by @nevans in #699
    NOTE: #enable should never be called with untrusted input.
• (low) Denial of Service via incomplete "raw" argument validation (CVE-2026-47241, GHSA-c4fp-cxrr-mj66)
  This results in the affected command hanging until the connection is closed. If another thread attempts to send a concurrent pipelined command, the first thread will return with a syntax error and the second thread will hang until the connection closes.
  • Reported by @fg0x0
  • 🐛 Prevent trailing {0} in RawData validation by @nevans in #700

Added

• 🔍 Add more detail to Net::IMAP#inspect TLS info by @nevans in #674

Fixed

• 🔧 Disallow config.max_non_synchronizing_literal = nil by @nevans in #672
• 🧵 Fix deadlock in #disconnect by @nevans in #686
• 🥅 Validate that Atom and Flag are not empty by @nevans in #684

Documentation

• ⚠️ Boost visibility of raw data argument documentation warnings by @nevans in #677

Other Changes

• 🏷️ Allow 64-bit Integer arguments by @nevans in #675
• 🥅 Ensure send_number_data input is an Integer by @nevans in #676
• ♻️ Improve RawData.new, Add RawData.split by @nevans in #679
• 🏷️ Less strict number string coercion, to match RFCs by @nevans in #680
• 🥅 Validate response literal byte size format by @nevans in #681

Miscellaneous

• ⬆️ Bump step-security/harden-runner from 2.19.0 to 2.19.1 by @dependabot[bot] in #673
• ✅ Improvements to tests' FakeServer by @nevans in #678
• ⬆️ Bump step-security/harden-runner from 2.19.1 to 2.19.3 by @dependabot[bot] in #682
• ⬆️ Bump step-security/harden-runner from 2.19.3 to 2.19.4 by @dependabot[bot] in #683

Full Changelog: v0.6.4...v0.6.4.1

v0.5.15

What's Changed

🔒 Security

This release fixes several more security vulnerabilities which are related to the fixes in v0.5.14. Please see the linked security advisories for more information.

• (moderate) Command Injection via non-synchronizing literal in "raw" argument (CVE-2026-47240, GHSA-8p34-64r3-mwg8)
  This vulnerability depends how the server interprets non-synchronizing literals.
  The connection is not vulnerable if the server supports non-synchronizing literals.
  • 🥅 Validate non-synchronizing literals support by @nevans in #703 (backports #701)
• (moderate) Command Injection via unvalidated ID and ENABLE arguments (CVE-2026-47242, GHSA-46q3-7gv7-qmgg)
  • 🥅 Validate ID values contain only valid bytes by @nevans in #703 (backports #698)
  • 🥅 Validate #enable arguments are all atoms by @nevans in #703 (backport #699)
    NOTE: #enable should never be called with untrusted input.
• (low) Denial of Service via incomplete "raw" argument validation (CVE-2026-47241, GHSA-c4fp-cxrr-mj66)
  This results in the affected command hanging until the connection is closed. If another thread attempts to send a concurrent pipelined command, the first thread will return with a syntax error and the second thread will hang until the connection closes.
  • Reported by @fg0x0
  • 🐛 Prevent trailing {0} in RawData validation by @nevans in #703 (backports #700)

Fixed

• 🥅 Validate that Atom and Flag are not empty by @nevans in #685 (backports #684)
• 🧵 Fix deadlock in #disconnect by @nevans in #697 (backports #686)

Documentation

• ⚠️ Boost visibility of raw data argument documentation warnings by @nevans in #696 (backports #677)

Other Changes

• 🏷️ Allow 64-bit Integer arguments in #696 (backports #675)
• 🥅 Ensure send_number_data input is an Integer in #696 (backports #676)
• ♻️ Improve RawData.new, Add RawData.split by @nevans in #696 (backports #679)
• 🥅 Validate response literal byte size format by @nevans in #696 (backports #681)

Miscellaneous

• ✅ Improvements to tests' FakeServer in #696 (backports #678)

Full Changelog: v0.5.14...v0.5.15

v0.6.4

What's Changed

🔒 Security

This release contains fixes for multiple vulnerabilities concerning STARTTLS stripping, argument validation, and denial of service attacks.

Warning

#664 fixes a STARTTLS stripping vulnerability (GHSA-vcgp-9326-pqcp).
Without this fix, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS.

Important

Argument validation is significantly improved. Several injection vulnerabilities have been fixed:
#657 fixes CRLF/command/argument injection via Symbol arguments (GHSA-75xq-5h9v-w6px).
#658 fixes CRLF/command/argument injection via the attr argument to #store/#uid_store (GHSA-hm49-wcqc-g2xg)
#659 fixes CRLF/command/argument injection via the storage_limit argument to #setquota (GHSA-hm49-wcqc-g2xg).
#660 fixes CRLF/command injection via RawData (GHSA-hm49-wcqc-g2xg):

• #search and #uid_search send criteria as raw data, when it is a String
• #fetch and #uid_fetch send attr as raw data, when it is a String.
  When attr is an Array, its String members are sent as raw data.

Caution

RawData does not defend against other forms of argument injection! It is an intentionally low-level API.

Note

Two denial of service vulnerabilities have been addressed.
These are generally only relevant when connecting to an untrusted hostile server (or without TLS).

#642 fixes quadratic time complexity when reading large responses containing many string literals (GHSA-q2mw-fvj9-vvcw).
#654 adds a configurable max_iterations count for SCRAM-* authentication (GHSA-87pf-fpwv-p7m7).

The default ScramAuthenticator#max_iterations is 2**31 - 1 (max 32-bit signed int), which was already OpenSSL's maximum value. It provides no protection against hostile servers unless it is explicitly set to a lower value by the user.

Breaking Changes

• ⚡ ResponseReader memoizes Config#max_response_size in #642.
  Changes to #max_response_size now take effect once per response, not on every IO#read.
  NOTE: It is not expected that this will affect any current usage. See the PR for details.

Added

• ✨ Support BINARY extention to #append (RFC3516) by @nevans in #616
• ✨ Support LITERAL+ and LITERAL- non-synchronizing literals (RFC7888) by @nevans in #649
• 🔒 Add ScramAuthenticator#max_iterations by @nevans in #654
• 🏷️ Add number64 and nz-number64 to NumValidator by @nevans in #625
• ♻️ Add MailboxQuota#quota_root alias by @nevans in #636
• 🔍 Simplify Net::IMAP#inspect with basic state by @nevans in #612
• 🥅 Add ResponseParseError#parser_methods (and override #==) by @nevans in #615

Fixed

• 🔒 Fix STARTTLS stripping vulnerability in #664, reported by @Masamuneee
• Argument validation, reported by @manunio
  • 🔒️ Strictly validate symbol (\flag) arguments in #657
  • 🔒️ Validate and send STORE attr as an atom in #658
  • 🔒 Validate #setquota storage limit argument in #659
  • 🔒 Validate RawData for CRLF injection in #660
  • 📚 Improve documentation of RawData arguments in #661
• ⚡ Much faster ResponseReader performance by @nevans in #642
• 🥅 Successfully parse invalid response code data by @nevans in #614
• Fix JRuby SSL connection failure: use SSLContext#setup instead of #freeze by @idahomst in #627
• 🐛 Fix InvalidResponseError in #get_tagged_response by @nevans in #633
• Pass an Exception to #raise by @eregon in #643
• 🐛 Fix empty SearchResult#to_sequence_set in #644, reported by @Quintasan
• 🐛 Wait to continue RawData literals by @nevans in #660

Documentation

• 📚 Fix rdoc 7.2 compatibility (section bugfix) by @nevans in #617
• 📚 Switch back to rdoc's darkfish generator (🚧TMP) by @nevans in #618
• 📚 Use .document and .rdoc_options files, where possible by @nevans in #619
• Update README example: Expunge is implicit in MOVE by @sebbASF in #623
• 📚️ Fix QUOTA documentation by @nevans in #636
• 📚 Minor documentation fixes by @nevans in #638
• 📚 Improve documentation of RawData arguments by @nevans in #661

Other Changes

• Handle deep response recursion as ResponseParseError by @Masamuneee in #629

Miscellaneous

• ✅ Fix typo in FakeServer (tests only) by @nevans in #620
• ⬆️ Bump step-security/harden-runner from 2.14.2 to 2.15.0 by @dependabot[bot] in #621
• Bump step-security/harden-runner from 2.15.0 to 2.15.1 by @dependabot[bot] in #626
• ⬆️ Bump step-security/harden-runner from 2.15.1 to 2.16.0 by @dependabot[bot] in #628
• ⬆️ Bump actions/configure-pages from 5 to 6 by @dependabot[bot] in #635
• ✅ Test #setquota by @nevans in #636
• ⬆️ Bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #634
• ⬆️ Bump step-security/harden-runner from 2.16.0 to 2.17.0 by @dependabot[bot] in #639
• Test TruffleRuby release in CI for improved stability by @eregon in #640
• ⬆️ Bump actions/upload-pages-artifact from 4 to 5 by @dependabot[bot] in #646
• ⬆️ Bump step-security/harden-runner from 2.17.0 to 2.19.0 by @dependabot[bot] in #647

New Contributors

• @sebbASF made their first contribution in #623
• @idahomst made their first contribution in #627
• @Masamuneee made their first contribution in #629
• @eregon made their first contribution in #640

Full Changelog: v0.6.3...v0.6.4

v0.5.14

What's Changed

🔒 Security

This release contains fixes for multiple vulnerabilities concerning STARTTLS stripping, argument validation, and denial of service attacks.

Warning

#665 fixes a STARTTLS stripping vulnerability (GHSA-vcgp-9326-pqcp).
Without this fix, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS.

Important

Argument validation is significantly improved. Several command injection vulnerabilities have been fixed:
#662 fixes CRLF/command/argument injection via Symbol arguments (GHSA-75xq-5h9v-w6px).
#662 fixes CRLF/command/argument injection via the attr argument to #store/#uid_store (GHSA-hm49-wcqc-g2xg)
#662 fixes CRLF/command/argument injection via the storage_limit argument to #setquota (GHSA-hm49-wcqc-g2xg).
#662 fixes CRLF/command injection via RawData (GHSA-hm49-wcqc-g2xg):

• #search and #uid_search send criteria as raw data, when it is a String
• #fetch and #uid_fetch send attr as raw data, when it is a String.
  When attr is an Array, its String members are sent as raw data.

Caution

RawData does not defend against other forms of argument injection! It is an intentionally low-level API.

Note

Two denial of service vulnerabilities have been addressed.
These are generally only relevant when connecting to an untrusted hostile server (or without TLS).

#650 fixes quadratic time complexity when reading large responses containing many string literals (GHSA-q2mw-fvj9-vvcw).
#656 adds a configurable max_iterations count for SCRAM-* authentication (GHSA-87pf-fpwv-p7m7).

Added

• 🔒 Add ScramAuthenticator#max_iterations (backports #654) in #656, reported by @Masamuneee

Fixed

• 🔒 Fix STARTTLS stripping vulnerability (backports #664) in #665, reported by @Masamuneee
• 🔒 Fix CRLF injection vulnerabilities (backports #657, #658, #659, #660, #636, #661) in #662, reported by @manunio
• ⚡ Much faster ResponseReader performance (backports #642) in #650, reported by @Masamuneee
• 🐛 Config version_defaults should be attr_reader (backports #594) by @nevans in #631
• 🐛 Wait to continue RawData literals (backports #660) by @nevans in #662

Other Changes

• ♻️ Improve internal literal sending (partially backports #616, #649) by @nevans in #652

Miscellaneous

• ✅ Fix Data polyfill tests for ruby 4.1 by @nevans in #632

Full Changelog: v0.5.13...v0.5.14

v0.4.24

Important

The 0.4.x release branch will only receive security fixes, and will be unsupported when ruby 3.3 is EOL.
Please upgrade to a newer version.

What's Changed

🔒 Security

This release contains fixes for multiple vulnerabilities concerning STARTTLS stripping, argument validation, and denial of service attacks.

Warning

#666 fixes a STARTTLS stripping vulnerability (GHSA-vcgp-9326-pqcp).
Without this fix, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS.

Important

Argument validation is significantly improved. Several injection vulnerabilities have been fixed:
#663 fixes CRLF/command/argument injection via Symbol arguments (GHSA-75xq-5h9v-w6px).
#663 fixes CRLF/command/argument injection via the attr argument to #store/#uid_store (GHSA-hm49-wcqc-g2xg)
#663 fixes CRLF/command/argument injection via the storage_limit argument to #setquota (GHSA-hm49-wcqc-g2xg).
#663 fixes CRLF/command injection via RawData (GHSA-hm49-wcqc-g2xg):

• #search and #uid_search send criteria as raw data, when it is a String
• #fetch and #uid_fetch send attr as raw data, when it is a String.
  When attr is an Array, its String members are sent as raw data.

Caution

RawData does not defend against other forms of argument injection! It is an intentionally low-level API.

Note

Two denial of service vulnerabilities have been addressed.
These are generally only relevant when connecting to an untrusted hostile server (or without TLS).

#651 fixes quadratic time complexity when reading large responses containing many string literals (GHSA-q2mw-fvj9-vvcw).
#655 adds a configurable max_iterations count for SCRAM-* authentication (GHSA-87pf-fpwv-p7m7).

The default ScramAuthenticator#max_iterations is 2**31 - 1 (max 32-bit signed int), which was already OpenSSL's maximum value. It provides no protection against hostile servers unless it is explicitly set to a lower value by the user.

Added

• 🔒 Add ScramAuthenticator#max_iterations (backports #654) in #655, reported by @Masamuneee

Fixed

• 🔒 Fix STARTTLS stripping vulnerability (backports #664) in #666, reported by @Masamuneee
• 🔒 Fix CRLF injection vulnerabilities (backports #657, #658, #659, #660, #636, #661) in #663, reported by @manunio
• ⚡ Much faster ResponseReader performance (backports #642) in #651, reported by @Masamuneee
• 🐛 Wait to continue RawData literals (backports #660) by @nevans in #663

Other Changes

• ♻️ Improve internal literal sending (partially backports #358, #616, #649) by @nevans in #653

Full Changelog: v0.4.23...v0.4.24

v0.3.10

Important

0.3.10 is the final release for the 0.3.x release series. Please upgrade to a newer version.

What's Changed

🔒 Security

Warning

#667 fixes a STARTTLS stripping vulnerability (GHSA-vcgp-9326-pqcp).
Without this fix, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS.

Fixes

• 🔒 Fix STARTTLS stripping vulnerability (backports #664, #395, #198) in #667, reported by @Masamuneee

Full Changelog: v0.3.9...v0.3.10

v0.6.3

What's Changed

Added

• 🥅 Add parser state and #detailed_message to ResponseParseError by @nevans in #599
  • 🥅💄 Support (monochrome) highlights in parse error details by @nevans in #603
  • 🥅💄 Auto-highlight parse error detailed_message using TERM and FORCE_COLOR by @nevans in #607
  • 🥅💄 Add color highlights to parse error details (default honors NO_COLOR) by @nevans in #609
• 🔧 Add Config#overrides? (opposite of #inherited?) by @nevans in #610
• 🔧 Add recursive Config#inherits_defaults? by @nevans in #611

Fixed

• 🐛 Parse resp-text with invalid resp-text-code by @nevans in #601
• 🐛 Config.version_defaults should be read only by @nevans in #594

Other Changes

• 🥅 Only print parser debug for unhandled errors by @nevans in #600
• ♻️ Don't hardcode parser deprecation warning uplevel by @nevans in #602
• ♻️ Simplify Config::AttrAccessors a little by @nevans in #606
• ♻️ Set Config[:default] as alias of Config[VERSION] by @nevans in #608

Fixes for unreleased code:

• 🐛 Return ResponseText from resp-text fallback by @nevans in #605
• 🐛 Fix parse error parser_backtrace (for ruby <= 3.3) by @nevans in #604

Miscellaneous

• Delete test/net/imap/test_data_lite.rb by @nobu in #593
• ⬆️ Bump step-security/harden-runner from 2.14.0 to 2.14.1 by @dependabot[bot] in #596
• Bump step-security/harden-runner from 2.14.1 to 2.14.2 by @dependabot[bot] in #598

Full Changelog: v0.6.2...v0.6.3