<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="34">
<package pkgid="53cce0594acb6236fb0327d652cc0f338b90e44fd0de32ccfd79f76dc3a0ca592711f45330eb953f0e057248cd491231c6a5d5c08ccb0396513dc8a9fd60f711" name="cyradm" arch="noarch">
  <version epoch="0" ver="3.10.1" rel="1.14"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
</package>
<package pkgid="554aa382fa5f0aa3976e060de0aa03ddae8fbcd6270b02462a924eb92c7732ac7c1132124f5ca7d8a23607e0c419b469022e2992f2845a1e647f6b9f24a860a4" name="cyradm" arch="noarch">
  <version epoch="0" ver="3.10.3" rel="1.2"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1751025600">- update to version 3.10.2
  * STARTTLS changes
    The industry is deprecating STARTTLS (aka opportunistic TLS) in
    favor of implicit TLS over a dedicated port. STARTTLS is now
    disabled by default.
    Installations that need to service clients that use opportunistic
    TLS should enable the allowstarttls imapd.conf(5) option for the
    services that need it. For example, for a service configured
    with the name imap in cyrus.conf(5), set imap_allowstarttls: on
    to enable STARTTLS.
  * Security changes
    + master: tighten up pidfile/etc handling
  * Build changes
  * Fixed: fix zoneinfo_db code for GCC 15 (gh#cyrusimap/cyrus-imapd#5450)
  * Bug fixes
    + Fixed: deadlock on shutdown (gh#cyrusimap/cyrus-imapd#5309)
    + Fixed: recognise service-specific SASL options in
    cyr_info conf-lint (gh#cyrusimap/cyrus-imapd#5424)
    + Fixed: charset.c needs stdbool.h (gh#cyrusimap/cyrus-imapd#5423)
    + Fixed: fix double-free in http_admin (gh#cyrusimap/cyrus-imapd#5420)
    + Fixed: pop3d: add basic prometheus support
    (gh#cyrusimap/cyrus-imapd#5460)
    + Fixed: imapd: typo in SASL-IR capability
    (gh#cyrusimap/cyrus-imapd#5481)
    + Fixed: httpd fails to parse OpenSSL version for status string
    (gh#cyrusimap/cyrus-imapd#5454)
- update patches
  * cyrus-imapd-3.10.1-rename.patch to cyrus-imapd-3.10.2-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1781697600">- fix systemd script for openSUSE Leap 16 or newer
  * remove var-run.mount from the requirements
- set correct license tag BSD-Attribution-HPND-disclaimer</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.3" date="1784116800">- update to version 3.10.3
  * Security Fixes
    + CVE-2026-47084 LOCALDELETE bypassed ACL checks
    An authenticated but non-admin user could invoke the admin-only
    LOCALDELETE IMAP command and delete mailboxes for which they
    had no permissions.
    + CVE-2026-47086 GENURLAUTH issued tokens bypassing ACLs
    Any authenticated user could mint a URLAUTH token (via the
    GENURLAUTH command) for any mailbox they could name, even
    without read access on it. This would allow reading mail from
    mailboxes despite having no granted permissions.
    + CVE-2026-47087 URLAUTH does not honor revoked authorizer access
    A URLAUTH URL minted while the authorizer had access continued
    to work after that access was revoked.
    + CVE-2026-47081 XAPPLEPUSHSERVICE folder existence oracle and push hijack
    An authenticated IMAP user could probe for the existence of
    arbitrary mailboxes on other users' accounts via the
    XAPPLEPUSHSERVICE command and then create Apple Push Notification
    Service notifications for new mail in those mailboxes to their
    own APNS device. This did not leak any data about the content
    of mailboxes. Instead, a "mailbox has changed" notice would be
    pushed when the mailbox modseq changed.
    + CVE-2026-47089 LISTRIGHTS not limited to users with admin access
    An authenticated user could call IMAP LISTRIGHTS against any
    mailbox they could name and learn what principals had what
    access to it. (This action should have been restricted to users
    with admin access on the target mailbox.)
    + CVE-2026-47085 URLAUTH token forgery via missing mboxkey
    If an attacker knew a folder name on the victim's account
    for which the victim had never issued an auth URL, they could
    forge a working URLAUTH token by computing HMAC-SHA1 with a
    predictable key, allowing them read access to the mailbox.
    + CVE-2026-47083 ESEARCH cross-user content oracle
    Using the ESEARCH command, an authenticated IMAP user could
    enumerate folder names under any account they could name.
    Search would return UIDs of messages matching search, creating
    a content oracle without allowing arbitrary reads of the target's
    content.
    + CVE-2026-47088 Heap exposure in nested MIME comment parsing
    An authenticated IMAP user could specially craft an email
    containing an RFC 822 comment ending with a backslash. When
    parsing the message, the server would read past the message
    end in memory and read into the heap, returning the read content
    to the user.
    + CVE-2026-47082 Vacation "fcc" skips destination-mailbox ACL
    A user whose vacation Sieve script used :fcc (to save a copy
    of the sent message) could deliver vacation auto-reply copies
    into any mailbox the script could name, regardless of whether
    the script owner had insert permissions on the destination
    mailbox.
  * Build changes
    + Fixed: cunit+valgrind libtool invocation
    + Fixed: fix cunit stuff to properly integrate with autotools
    + Fixed: update cunit valgrind suppressions
    + Fixed: unused parameter warning in cyrdbbench
    + Fixed: consolidate cassandane 'other' configuration sections
    + Fixed: add --with-zoneinfo-dir configure option to set zoneinfo_dir at compile time
    + Fixed: add min/max other version cassandane magic
    + Fixed: update cassandane valgrind suppressions
  * Bug fixes
    + Fixed: fix leaks in imap SELECT and SETQUOTA
    (gh#cyrusimap/cyrus-imapd#5436)
    + Fixed: don't leak cached TLS sessions
    (gh#cyrusimap/cyrus-imapd#5437)
    + Fixed: fix proxy of LIST (SUBSCRIBED) to backends
    (gh#cyrusimap/cyrus-imapd#5602)
    + Fixed: squat crash attempting to search
    (gh#cyrusimap/cyrus-imapd#3562)
    + Fixed: VANISHED not working with cyrus proxy
    (gh#cyrusimap/cyrus-imapd#4787)
    + Fixed: auditlog rename of UUID mailboxes
    (gh#cyrusimap/cyrus-imapd#5908)
    + Fixed: various memory leaks (gh#cyrusimap/cyrus-imapd#6022)
- spec file changes
  * update cyrus-imapd-3.10.2-rename.patch to cyrus-imapd-3.10.3-rename.patch
  * remove never used old cassandane parts</changelog>
</package>
<package pkgid="035e04a7b7d15b738e55b1e605326709612f69707a19d4f3669d55045d3295e18a0767dca224b98172ca6519e1e4f4822b39847e2c63c0984ff1237098d71df4" name="cyrus-imapd" arch="i586">
  <version epoch="0" ver="3.10.1" rel="1.14"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
</package>
<package pkgid="e2a951b0fd98d298d3c7e75147bd19cafa11ce9cdb24242bc878be0440dbc6866dc26ca9a8c02a35f7ce24543af334ceb2b4d76f0dc73e42f4e993c21fb46087" name="cyrus-imapd" arch="src">
  <version epoch="0" ver="3.10.1" rel="1.14"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
</package>
<package pkgid="facf1434fc3ff0f496bbfab2cbda518b2b5591b4c6118eab416d4c5000d57578a4b9dcfec6102ab5c7b86c777b768ecb44ac2d482ad322c8ca1fe2d00e7c44e5" name="cyrus-imapd" arch="src">
  <version epoch="0" ver="3.10.3" rel="1.2"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1751025600">- update to version 3.10.2
  * STARTTLS changes
    The industry is deprecating STARTTLS (aka opportunistic TLS) in
    favor of implicit TLS over a dedicated port. STARTTLS is now
    disabled by default.
    Installations that need to service clients that use opportunistic
    TLS should enable the allowstarttls imapd.conf(5) option for the
    services that need it. For example, for a service configured
    with the name imap in cyrus.conf(5), set imap_allowstarttls: on
    to enable STARTTLS.
  * Security changes
    + master: tighten up pidfile/etc handling
  * Build changes
  * Fixed: fix zoneinfo_db code for GCC 15 (gh#cyrusimap/cyrus-imapd#5450)
  * Bug fixes
    + Fixed: deadlock on shutdown (gh#cyrusimap/cyrus-imapd#5309)
    + Fixed: recognise service-specific SASL options in
    cyr_info conf-lint (gh#cyrusimap/cyrus-imapd#5424)
    + Fixed: charset.c needs stdbool.h (gh#cyrusimap/cyrus-imapd#5423)
    + Fixed: fix double-free in http_admin (gh#cyrusimap/cyrus-imapd#5420)
    + Fixed: pop3d: add basic prometheus support
    (gh#cyrusimap/cyrus-imapd#5460)
    + Fixed: imapd: typo in SASL-IR capability
    (gh#cyrusimap/cyrus-imapd#5481)
    + Fixed: httpd fails to parse OpenSSL version for status string
    (gh#cyrusimap/cyrus-imapd#5454)
- update patches
  * cyrus-imapd-3.10.1-rename.patch to cyrus-imapd-3.10.2-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1781697600">- fix systemd script for openSUSE Leap 16 or newer
  * remove var-run.mount from the requirements
- set correct license tag BSD-Attribution-HPND-disclaimer</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.3" date="1784116800">- update to version 3.10.3
  * Security Fixes
    + CVE-2026-47084 LOCALDELETE bypassed ACL checks
    An authenticated but non-admin user could invoke the admin-only
    LOCALDELETE IMAP command and delete mailboxes for which they
    had no permissions.
    + CVE-2026-47086 GENURLAUTH issued tokens bypassing ACLs
    Any authenticated user could mint a URLAUTH token (via the
    GENURLAUTH command) for any mailbox they could name, even
    without read access on it. This would allow reading mail from
    mailboxes despite having no granted permissions.
    + CVE-2026-47087 URLAUTH does not honor revoked authorizer access
    A URLAUTH URL minted while the authorizer had access continued
    to work after that access was revoked.
    + CVE-2026-47081 XAPPLEPUSHSERVICE folder existence oracle and push hijack
    An authenticated IMAP user could probe for the existence of
    arbitrary mailboxes on other users' accounts via the
    XAPPLEPUSHSERVICE command and then create Apple Push Notification
    Service notifications for new mail in those mailboxes to their
    own APNS device. This did not leak any data about the content
    of mailboxes. Instead, a "mailbox has changed" notice would be
    pushed when the mailbox modseq changed.
    + CVE-2026-47089 LISTRIGHTS not limited to users with admin access
    An authenticated user could call IMAP LISTRIGHTS against any
    mailbox they could name and learn what principals had what
    access to it. (This action should have been restricted to users
    with admin access on the target mailbox.)
    + CVE-2026-47085 URLAUTH token forgery via missing mboxkey
    If an attacker knew a folder name on the victim's account
    for which the victim had never issued an auth URL, they could
    forge a working URLAUTH token by computing HMAC-SHA1 with a
    predictable key, allowing them read access to the mailbox.
    + CVE-2026-47083 ESEARCH cross-user content oracle
    Using the ESEARCH command, an authenticated IMAP user could
    enumerate folder names under any account they could name.
    Search would return UIDs of messages matching search, creating
    a content oracle without allowing arbitrary reads of the target's
    content.
    + CVE-2026-47088 Heap exposure in nested MIME comment parsing
    An authenticated IMAP user could specially craft an email
    containing an RFC 822 comment ending with a backslash. When
    parsing the message, the server would read past the message
    end in memory and read into the heap, returning the read content
    to the user.
    + CVE-2026-47082 Vacation "fcc" skips destination-mailbox ACL
    A user whose vacation Sieve script used :fcc (to save a copy
    of the sent message) could deliver vacation auto-reply copies
    into any mailbox the script could name, regardless of whether
    the script owner had insert permissions on the destination
    mailbox.
  * Build changes
    + Fixed: cunit+valgrind libtool invocation
    + Fixed: fix cunit stuff to properly integrate with autotools
    + Fixed: update cunit valgrind suppressions
    + Fixed: unused parameter warning in cyrdbbench
    + Fixed: consolidate cassandane 'other' configuration sections
    + Fixed: add --with-zoneinfo-dir configure option to set zoneinfo_dir at compile time
    + Fixed: add min/max other version cassandane magic
    + Fixed: update cassandane valgrind suppressions
  * Bug fixes
    + Fixed: fix leaks in imap SELECT and SETQUOTA
    (gh#cyrusimap/cyrus-imapd#5436)
    + Fixed: don't leak cached TLS sessions
    (gh#cyrusimap/cyrus-imapd#5437)
    + Fixed: fix proxy of LIST (SUBSCRIBED) to backends
    (gh#cyrusimap/cyrus-imapd#5602)
    + Fixed: squat crash attempting to search
    (gh#cyrusimap/cyrus-imapd#3562)
    + Fixed: VANISHED not working with cyrus proxy
    (gh#cyrusimap/cyrus-imapd#4787)
    + Fixed: auditlog rename of UUID mailboxes
    (gh#cyrusimap/cyrus-imapd#5908)
    + Fixed: various memory leaks (gh#cyrusimap/cyrus-imapd#6022)
- spec file changes
  * update cyrus-imapd-3.10.2-rename.patch to cyrus-imapd-3.10.3-rename.patch
  * remove never used old cassandane parts</changelog>
</package>
<package pkgid="f6ce79862f3909f097b243a802553ebe83d2263e2e4e6fcb17f2c679736f7f681e93e75f9f92f2d89eba937edaba92c6a026482d93bacb4b42e2b3f461c06cbe" name="cyrus-imapd" arch="x86_64">
  <version epoch="0" ver="3.10.3" rel="1.2"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1751025600">- update to version 3.10.2
  * STARTTLS changes
    The industry is deprecating STARTTLS (aka opportunistic TLS) in
    favor of implicit TLS over a dedicated port. STARTTLS is now
    disabled by default.
    Installations that need to service clients that use opportunistic
    TLS should enable the allowstarttls imapd.conf(5) option for the
    services that need it. For example, for a service configured
    with the name imap in cyrus.conf(5), set imap_allowstarttls: on
    to enable STARTTLS.
  * Security changes
    + master: tighten up pidfile/etc handling
  * Build changes
  * Fixed: fix zoneinfo_db code for GCC 15 (gh#cyrusimap/cyrus-imapd#5450)
  * Bug fixes
    + Fixed: deadlock on shutdown (gh#cyrusimap/cyrus-imapd#5309)
    + Fixed: recognise service-specific SASL options in
    cyr_info conf-lint (gh#cyrusimap/cyrus-imapd#5424)
    + Fixed: charset.c needs stdbool.h (gh#cyrusimap/cyrus-imapd#5423)
    + Fixed: fix double-free in http_admin (gh#cyrusimap/cyrus-imapd#5420)
    + Fixed: pop3d: add basic prometheus support
    (gh#cyrusimap/cyrus-imapd#5460)
    + Fixed: imapd: typo in SASL-IR capability
    (gh#cyrusimap/cyrus-imapd#5481)
    + Fixed: httpd fails to parse OpenSSL version for status string
    (gh#cyrusimap/cyrus-imapd#5454)
- update patches
  * cyrus-imapd-3.10.1-rename.patch to cyrus-imapd-3.10.2-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1781697600">- fix systemd script for openSUSE Leap 16 or newer
  * remove var-run.mount from the requirements
- set correct license tag BSD-Attribution-HPND-disclaimer</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.3" date="1784116800">- update to version 3.10.3
  * Security Fixes
    + CVE-2026-47084 LOCALDELETE bypassed ACL checks
    An authenticated but non-admin user could invoke the admin-only
    LOCALDELETE IMAP command and delete mailboxes for which they
    had no permissions.
    + CVE-2026-47086 GENURLAUTH issued tokens bypassing ACLs
    Any authenticated user could mint a URLAUTH token (via the
    GENURLAUTH command) for any mailbox they could name, even
    without read access on it. This would allow reading mail from
    mailboxes despite having no granted permissions.
    + CVE-2026-47087 URLAUTH does not honor revoked authorizer access
    A URLAUTH URL minted while the authorizer had access continued
    to work after that access was revoked.
    + CVE-2026-47081 XAPPLEPUSHSERVICE folder existence oracle and push hijack
    An authenticated IMAP user could probe for the existence of
    arbitrary mailboxes on other users' accounts via the
    XAPPLEPUSHSERVICE command and then create Apple Push Notification
    Service notifications for new mail in those mailboxes to their
    own APNS device. This did not leak any data about the content
    of mailboxes. Instead, a "mailbox has changed" notice would be
    pushed when the mailbox modseq changed.
    + CVE-2026-47089 LISTRIGHTS not limited to users with admin access
    An authenticated user could call IMAP LISTRIGHTS against any
    mailbox they could name and learn what principals had what
    access to it. (This action should have been restricted to users
    with admin access on the target mailbox.)
    + CVE-2026-47085 URLAUTH token forgery via missing mboxkey
    If an attacker knew a folder name on the victim's account
    for which the victim had never issued an auth URL, they could
    forge a working URLAUTH token by computing HMAC-SHA1 with a
    predictable key, allowing them read access to the mailbox.
    + CVE-2026-47083 ESEARCH cross-user content oracle
    Using the ESEARCH command, an authenticated IMAP user could
    enumerate folder names under any account they could name.
    Search would return UIDs of messages matching search, creating
    a content oracle without allowing arbitrary reads of the target's
    content.
    + CVE-2026-47088 Heap exposure in nested MIME comment parsing
    An authenticated IMAP user could specially craft an email
    containing an RFC 822 comment ending with a backslash. When
    parsing the message, the server would read past the message
    end in memory and read into the heap, returning the read content
    to the user.
    + CVE-2026-47082 Vacation "fcc" skips destination-mailbox ACL
    A user whose vacation Sieve script used :fcc (to save a copy
    of the sent message) could deliver vacation auto-reply copies
    into any mailbox the script could name, regardless of whether
    the script owner had insert permissions on the destination
    mailbox.
  * Build changes
    + Fixed: cunit+valgrind libtool invocation
    + Fixed: fix cunit stuff to properly integrate with autotools
    + Fixed: update cunit valgrind suppressions
    + Fixed: unused parameter warning in cyrdbbench
    + Fixed: consolidate cassandane 'other' configuration sections
    + Fixed: add --with-zoneinfo-dir configure option to set zoneinfo_dir at compile time
    + Fixed: add min/max other version cassandane magic
    + Fixed: update cassandane valgrind suppressions
  * Bug fixes
    + Fixed: fix leaks in imap SELECT and SETQUOTA
    (gh#cyrusimap/cyrus-imapd#5436)
    + Fixed: don't leak cached TLS sessions
    (gh#cyrusimap/cyrus-imapd#5437)
    + Fixed: fix proxy of LIST (SUBSCRIBED) to backends
    (gh#cyrusimap/cyrus-imapd#5602)
    + Fixed: squat crash attempting to search
    (gh#cyrusimap/cyrus-imapd#3562)
    + Fixed: VANISHED not working with cyrus proxy
    (gh#cyrusimap/cyrus-imapd#4787)
    + Fixed: auditlog rename of UUID mailboxes
    (gh#cyrusimap/cyrus-imapd#5908)
    + Fixed: various memory leaks (gh#cyrusimap/cyrus-imapd#6022)
- spec file changes
  * update cyrus-imapd-3.10.2-rename.patch to cyrus-imapd-3.10.3-rename.patch
  * remove never used old cassandane parts</changelog>
</package>
<package pkgid="c40c618dd6b551a056f7d3149c8ae9fd82e14f69f953e13b33ed699b1fa2e45f084e1f83840a87a93a6a855db0953e4b46e63ff3bc9babd79ad705e72cb6da7e" name="cyrus-imapd-devel" arch="i586">
  <version epoch="0" ver="3.10.1" rel="1.14"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
</package>
<package pkgid="0fc6f6915237d1e7958c64daf2e5b10fc4c8866fc2c5095d70eea544ba7f72a14080d646c80a0dfec33d6f5d27fab734840a9340d492d5d6a1c1627fd67c8348" name="cyrus-imapd-devel" arch="x86_64">
  <version epoch="0" ver="3.10.3" rel="1.2"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1751025600">- update to version 3.10.2
  * STARTTLS changes
    The industry is deprecating STARTTLS (aka opportunistic TLS) in
    favor of implicit TLS over a dedicated port. STARTTLS is now
    disabled by default.
    Installations that need to service clients that use opportunistic
    TLS should enable the allowstarttls imapd.conf(5) option for the
    services that need it. For example, for a service configured
    with the name imap in cyrus.conf(5), set imap_allowstarttls: on
    to enable STARTTLS.
  * Security changes
    + master: tighten up pidfile/etc handling
  * Build changes
  * Fixed: fix zoneinfo_db code for GCC 15 (gh#cyrusimap/cyrus-imapd#5450)
  * Bug fixes
    + Fixed: deadlock on shutdown (gh#cyrusimap/cyrus-imapd#5309)
    + Fixed: recognise service-specific SASL options in
    cyr_info conf-lint (gh#cyrusimap/cyrus-imapd#5424)
    + Fixed: charset.c needs stdbool.h (gh#cyrusimap/cyrus-imapd#5423)
    + Fixed: fix double-free in http_admin (gh#cyrusimap/cyrus-imapd#5420)
    + Fixed: pop3d: add basic prometheus support
    (gh#cyrusimap/cyrus-imapd#5460)
    + Fixed: imapd: typo in SASL-IR capability
    (gh#cyrusimap/cyrus-imapd#5481)
    + Fixed: httpd fails to parse OpenSSL version for status string
    (gh#cyrusimap/cyrus-imapd#5454)
- update patches
  * cyrus-imapd-3.10.1-rename.patch to cyrus-imapd-3.10.2-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1781697600">- fix systemd script for openSUSE Leap 16 or newer
  * remove var-run.mount from the requirements
- set correct license tag BSD-Attribution-HPND-disclaimer</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.3" date="1784116800">- update to version 3.10.3
  * Security Fixes
    + CVE-2026-47084 LOCALDELETE bypassed ACL checks
    An authenticated but non-admin user could invoke the admin-only
    LOCALDELETE IMAP command and delete mailboxes for which they
    had no permissions.
    + CVE-2026-47086 GENURLAUTH issued tokens bypassing ACLs
    Any authenticated user could mint a URLAUTH token (via the
    GENURLAUTH command) for any mailbox they could name, even
    without read access on it. This would allow reading mail from
    mailboxes despite having no granted permissions.
    + CVE-2026-47087 URLAUTH does not honor revoked authorizer access
    A URLAUTH URL minted while the authorizer had access continued
    to work after that access was revoked.
    + CVE-2026-47081 XAPPLEPUSHSERVICE folder existence oracle and push hijack
    An authenticated IMAP user could probe for the existence of
    arbitrary mailboxes on other users' accounts via the
    XAPPLEPUSHSERVICE command and then create Apple Push Notification
    Service notifications for new mail in those mailboxes to their
    own APNS device. This did not leak any data about the content
    of mailboxes. Instead, a "mailbox has changed" notice would be
    pushed when the mailbox modseq changed.
    + CVE-2026-47089 LISTRIGHTS not limited to users with admin access
    An authenticated user could call IMAP LISTRIGHTS against any
    mailbox they could name and learn what principals had what
    access to it. (This action should have been restricted to users
    with admin access on the target mailbox.)
    + CVE-2026-47085 URLAUTH token forgery via missing mboxkey
    If an attacker knew a folder name on the victim's account
    for which the victim had never issued an auth URL, they could
    forge a working URLAUTH token by computing HMAC-SHA1 with a
    predictable key, allowing them read access to the mailbox.
    + CVE-2026-47083 ESEARCH cross-user content oracle
    Using the ESEARCH command, an authenticated IMAP user could
    enumerate folder names under any account they could name.
    Search would return UIDs of messages matching search, creating
    a content oracle without allowing arbitrary reads of the target's
    content.
    + CVE-2026-47088 Heap exposure in nested MIME comment parsing
    An authenticated IMAP user could specially craft an email
    containing an RFC 822 comment ending with a backslash. When
    parsing the message, the server would read past the message
    end in memory and read into the heap, returning the read content
    to the user.
    + CVE-2026-47082 Vacation "fcc" skips destination-mailbox ACL
    A user whose vacation Sieve script used :fcc (to save a copy
    of the sent message) could deliver vacation auto-reply copies
    into any mailbox the script could name, regardless of whether
    the script owner had insert permissions on the destination
    mailbox.
  * Build changes
    + Fixed: cunit+valgrind libtool invocation
    + Fixed: fix cunit stuff to properly integrate with autotools
    + Fixed: update cunit valgrind suppressions
    + Fixed: unused parameter warning in cyrdbbench
    + Fixed: consolidate cassandane 'other' configuration sections
    + Fixed: add --with-zoneinfo-dir configure option to set zoneinfo_dir at compile time
    + Fixed: add min/max other version cassandane magic
    + Fixed: update cassandane valgrind suppressions
  * Bug fixes
    + Fixed: fix leaks in imap SELECT and SETQUOTA
    (gh#cyrusimap/cyrus-imapd#5436)
    + Fixed: don't leak cached TLS sessions
    (gh#cyrusimap/cyrus-imapd#5437)
    + Fixed: fix proxy of LIST (SUBSCRIBED) to backends
    (gh#cyrusimap/cyrus-imapd#5602)
    + Fixed: squat crash attempting to search
    (gh#cyrusimap/cyrus-imapd#3562)
    + Fixed: VANISHED not working with cyrus proxy
    (gh#cyrusimap/cyrus-imapd#4787)
    + Fixed: auditlog rename of UUID mailboxes
    (gh#cyrusimap/cyrus-imapd#5908)
    + Fixed: various memory leaks (gh#cyrusimap/cyrus-imapd#6022)
- spec file changes
  * update cyrus-imapd-3.10.2-rename.patch to cyrus-imapd-3.10.3-rename.patch
  * remove never used old cassandane parts</changelog>
</package>
<package pkgid="241d94d2a6d1c957c30488be703cace6d99514d9c1c3b07e6ef51f5af4de8372d5f21feb244a6d51e553aaa61b6942007056409190b4cbb70b277f7cc899b906" name="cyrus-imapd-doc" arch="noarch">
  <version epoch="0" ver="3.10.1" rel="1.14"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
</package>
<package pkgid="7e52211022a2eeb8942c923d4210a5ae4684ad3a5df7fb3ed91db76d16191bc8b68f511105239e88985a6669ada37b11a4dd3fbd38d55cbca91620ad4416798a" name="cyrus-imapd-doc" arch="noarch">
  <version epoch="0" ver="3.10.3" rel="1.2"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1751025600">- update to version 3.10.2
  * STARTTLS changes
    The industry is deprecating STARTTLS (aka opportunistic TLS) in
    favor of implicit TLS over a dedicated port. STARTTLS is now
    disabled by default.
    Installations that need to service clients that use opportunistic
    TLS should enable the allowstarttls imapd.conf(5) option for the
    services that need it. For example, for a service configured
    with the name imap in cyrus.conf(5), set imap_allowstarttls: on
    to enable STARTTLS.
  * Security changes
    + master: tighten up pidfile/etc handling
  * Build changes
  * Fixed: fix zoneinfo_db code for GCC 15 (gh#cyrusimap/cyrus-imapd#5450)
  * Bug fixes
    + Fixed: deadlock on shutdown (gh#cyrusimap/cyrus-imapd#5309)
    + Fixed: recognise service-specific SASL options in
    cyr_info conf-lint (gh#cyrusimap/cyrus-imapd#5424)
    + Fixed: charset.c needs stdbool.h (gh#cyrusimap/cyrus-imapd#5423)
    + Fixed: fix double-free in http_admin (gh#cyrusimap/cyrus-imapd#5420)
    + Fixed: pop3d: add basic prometheus support
    (gh#cyrusimap/cyrus-imapd#5460)
    + Fixed: imapd: typo in SASL-IR capability
    (gh#cyrusimap/cyrus-imapd#5481)
    + Fixed: httpd fails to parse OpenSSL version for status string
    (gh#cyrusimap/cyrus-imapd#5454)
- update patches
  * cyrus-imapd-3.10.1-rename.patch to cyrus-imapd-3.10.2-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1781697600">- fix systemd script for openSUSE Leap 16 or newer
  * remove var-run.mount from the requirements
- set correct license tag BSD-Attribution-HPND-disclaimer</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.3" date="1784116800">- update to version 3.10.3
  * Security Fixes
    + CVE-2026-47084 LOCALDELETE bypassed ACL checks
    An authenticated but non-admin user could invoke the admin-only
    LOCALDELETE IMAP command and delete mailboxes for which they
    had no permissions.
    + CVE-2026-47086 GENURLAUTH issued tokens bypassing ACLs
    Any authenticated user could mint a URLAUTH token (via the
    GENURLAUTH command) for any mailbox they could name, even
    without read access on it. This would allow reading mail from
    mailboxes despite having no granted permissions.
    + CVE-2026-47087 URLAUTH does not honor revoked authorizer access
    A URLAUTH URL minted while the authorizer had access continued
    to work after that access was revoked.
    + CVE-2026-47081 XAPPLEPUSHSERVICE folder existence oracle and push hijack
    An authenticated IMAP user could probe for the existence of
    arbitrary mailboxes on other users' accounts via the
    XAPPLEPUSHSERVICE command and then create Apple Push Notification
    Service notifications for new mail in those mailboxes to their
    own APNS device. This did not leak any data about the content
    of mailboxes. Instead, a "mailbox has changed" notice would be
    pushed when the mailbox modseq changed.
    + CVE-2026-47089 LISTRIGHTS not limited to users with admin access
    An authenticated user could call IMAP LISTRIGHTS against any
    mailbox they could name and learn what principals had what
    access to it. (This action should have been restricted to users
    with admin access on the target mailbox.)
    + CVE-2026-47085 URLAUTH token forgery via missing mboxkey
    If an attacker knew a folder name on the victim's account
    for which the victim had never issued an auth URL, they could
    forge a working URLAUTH token by computing HMAC-SHA1 with a
    predictable key, allowing them read access to the mailbox.
    + CVE-2026-47083 ESEARCH cross-user content oracle
    Using the ESEARCH command, an authenticated IMAP user could
    enumerate folder names under any account they could name.
    Search would return UIDs of messages matching search, creating
    a content oracle without allowing arbitrary reads of the target's
    content.
    + CVE-2026-47088 Heap exposure in nested MIME comment parsing
    An authenticated IMAP user could specially craft an email
    containing an RFC 822 comment ending with a backslash. When
    parsing the message, the server would read past the message
    end in memory and read into the heap, returning the read content
    to the user.
    + CVE-2026-47082 Vacation "fcc" skips destination-mailbox ACL
    A user whose vacation Sieve script used :fcc (to save a copy
    of the sent message) could deliver vacation auto-reply copies
    into any mailbox the script could name, regardless of whether
    the script owner had insert permissions on the destination
    mailbox.
  * Build changes
    + Fixed: cunit+valgrind libtool invocation
    + Fixed: fix cunit stuff to properly integrate with autotools
    + Fixed: update cunit valgrind suppressions
    + Fixed: unused parameter warning in cyrdbbench
    + Fixed: consolidate cassandane 'other' configuration sections
    + Fixed: add --with-zoneinfo-dir configure option to set zoneinfo_dir at compile time
    + Fixed: add min/max other version cassandane magic
    + Fixed: update cassandane valgrind suppressions
  * Bug fixes
    + Fixed: fix leaks in imap SELECT and SETQUOTA
    (gh#cyrusimap/cyrus-imapd#5436)
    + Fixed: don't leak cached TLS sessions
    (gh#cyrusimap/cyrus-imapd#5437)
    + Fixed: fix proxy of LIST (SUBSCRIBED) to backends
    (gh#cyrusimap/cyrus-imapd#5602)
    + Fixed: squat crash attempting to search
    (gh#cyrusimap/cyrus-imapd#3562)
    + Fixed: VANISHED not working with cyrus proxy
    (gh#cyrusimap/cyrus-imapd#4787)
    + Fixed: auditlog rename of UUID mailboxes
    (gh#cyrusimap/cyrus-imapd#5908)
    + Fixed: various memory leaks (gh#cyrusimap/cyrus-imapd#6022)
- spec file changes
  * update cyrus-imapd-3.10.2-rename.patch to cyrus-imapd-3.10.3-rename.patch
  * remove never used old cassandane parts</changelog>
</package>
<package pkgid="5650ec2f5a352bdee9eb7df005fbecc8685d0f417b8e81872dcbf7a605c498145582ba7a23410ac4946cbdad0d57f2bba51729ca299ff65a4f7744fd2d832994" name="cyrus-imapd-utils" arch="i586">
  <version epoch="0" ver="3.10.1" rel="1.14"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
</package>
<package pkgid="82f33d0f2ded8d98bfcd378baf5d39739cf7d8b79cee7393fdb28f1274a9fe7e43bbd8e2e8511744f6f156a37a6be4e0c762db48304250aac69220d7a4935f93" name="cyrus-imapd-utils" arch="x86_64">
  <version epoch="0" ver="3.10.3" rel="1.2"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1751025600">- update to version 3.10.2
  * STARTTLS changes
    The industry is deprecating STARTTLS (aka opportunistic TLS) in
    favor of implicit TLS over a dedicated port. STARTTLS is now
    disabled by default.
    Installations that need to service clients that use opportunistic
    TLS should enable the allowstarttls imapd.conf(5) option for the
    services that need it. For example, for a service configured
    with the name imap in cyrus.conf(5), set imap_allowstarttls: on
    to enable STARTTLS.
  * Security changes
    + master: tighten up pidfile/etc handling
  * Build changes
  * Fixed: fix zoneinfo_db code for GCC 15 (gh#cyrusimap/cyrus-imapd#5450)
  * Bug fixes
    + Fixed: deadlock on shutdown (gh#cyrusimap/cyrus-imapd#5309)
    + Fixed: recognise service-specific SASL options in
    cyr_info conf-lint (gh#cyrusimap/cyrus-imapd#5424)
    + Fixed: charset.c needs stdbool.h (gh#cyrusimap/cyrus-imapd#5423)
    + Fixed: fix double-free in http_admin (gh#cyrusimap/cyrus-imapd#5420)
    + Fixed: pop3d: add basic prometheus support
    (gh#cyrusimap/cyrus-imapd#5460)
    + Fixed: imapd: typo in SASL-IR capability
    (gh#cyrusimap/cyrus-imapd#5481)
    + Fixed: httpd fails to parse OpenSSL version for status string
    (gh#cyrusimap/cyrus-imapd#5454)
- update patches
  * cyrus-imapd-3.10.1-rename.patch to cyrus-imapd-3.10.2-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1781697600">- fix systemd script for openSUSE Leap 16 or newer
  * remove var-run.mount from the requirements
- set correct license tag BSD-Attribution-HPND-disclaimer</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.3" date="1784116800">- update to version 3.10.3
  * Security Fixes
    + CVE-2026-47084 LOCALDELETE bypassed ACL checks
    An authenticated but non-admin user could invoke the admin-only
    LOCALDELETE IMAP command and delete mailboxes for which they
    had no permissions.
    + CVE-2026-47086 GENURLAUTH issued tokens bypassing ACLs
    Any authenticated user could mint a URLAUTH token (via the
    GENURLAUTH command) for any mailbox they could name, even
    without read access on it. This would allow reading mail from
    mailboxes despite having no granted permissions.
    + CVE-2026-47087 URLAUTH does not honor revoked authorizer access
    A URLAUTH URL minted while the authorizer had access continued
    to work after that access was revoked.
    + CVE-2026-47081 XAPPLEPUSHSERVICE folder existence oracle and push hijack
    An authenticated IMAP user could probe for the existence of
    arbitrary mailboxes on other users' accounts via the
    XAPPLEPUSHSERVICE command and then create Apple Push Notification
    Service notifications for new mail in those mailboxes to their
    own APNS device. This did not leak any data about the content
    of mailboxes. Instead, a "mailbox has changed" notice would be
    pushed when the mailbox modseq changed.
    + CVE-2026-47089 LISTRIGHTS not limited to users with admin access
    An authenticated user could call IMAP LISTRIGHTS against any
    mailbox they could name and learn what principals had what
    access to it. (This action should have been restricted to users
    with admin access on the target mailbox.)
    + CVE-2026-47085 URLAUTH token forgery via missing mboxkey
    If an attacker knew a folder name on the victim's account
    for which the victim had never issued an auth URL, they could
    forge a working URLAUTH token by computing HMAC-SHA1 with a
    predictable key, allowing them read access to the mailbox.
    + CVE-2026-47083 ESEARCH cross-user content oracle
    Using the ESEARCH command, an authenticated IMAP user could
    enumerate folder names under any account they could name.
    Search would return UIDs of messages matching search, creating
    a content oracle without allowing arbitrary reads of the target's
    content.
    + CVE-2026-47088 Heap exposure in nested MIME comment parsing
    An authenticated IMAP user could specially craft an email
    containing an RFC 822 comment ending with a backslash. When
    parsing the message, the server would read past the message
    end in memory and read into the heap, returning the read content
    to the user.
    + CVE-2026-47082 Vacation "fcc" skips destination-mailbox ACL
    A user whose vacation Sieve script used :fcc (to save a copy
    of the sent message) could deliver vacation auto-reply copies
    into any mailbox the script could name, regardless of whether
    the script owner had insert permissions on the destination
    mailbox.
  * Build changes
    + Fixed: cunit+valgrind libtool invocation
    + Fixed: fix cunit stuff to properly integrate with autotools
    + Fixed: update cunit valgrind suppressions
    + Fixed: unused parameter warning in cyrdbbench
    + Fixed: consolidate cassandane 'other' configuration sections
    + Fixed: add --with-zoneinfo-dir configure option to set zoneinfo_dir at compile time
    + Fixed: add min/max other version cassandane magic
    + Fixed: update cassandane valgrind suppressions
  * Bug fixes
    + Fixed: fix leaks in imap SELECT and SETQUOTA
    (gh#cyrusimap/cyrus-imapd#5436)
    + Fixed: don't leak cached TLS sessions
    (gh#cyrusimap/cyrus-imapd#5437)
    + Fixed: fix proxy of LIST (SUBSCRIBED) to backends
    (gh#cyrusimap/cyrus-imapd#5602)
    + Fixed: squat crash attempting to search
    (gh#cyrusimap/cyrus-imapd#3562)
    + Fixed: VANISHED not working with cyrus proxy
    (gh#cyrusimap/cyrus-imapd#4787)
    + Fixed: auditlog rename of UUID mailboxes
    (gh#cyrusimap/cyrus-imapd#5908)
    + Fixed: various memory leaks (gh#cyrusimap/cyrus-imapd#6022)
- spec file changes
  * update cyrus-imapd-3.10.2-rename.patch to cyrus-imapd-3.10.3-rename.patch
  * remove never used old cassandane parts</changelog>
</package>
<package pkgid="84efc0127e96a97d09c9d29bfb6852f93eb3a7abb2fac9d541fc4529d708382b9248ed223b5ac191f59cec5191a3fee329fe3c7903a01e67d7d524c464da4265" name="cyrus-timezones" arch="i586">
  <version epoch="0" ver="2026a" rel="1.67"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1596024000">- initial package version 2020a</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1612440000">- update to version 2020f
  * no changelog available
  * extracted from commit 14d08670ec823cd748f0234bcaff0e4cf9d4825d</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2023f" date="1701777600">- update to version 2023f
  * update tzdata to 2023f
  * add library for guessing IANA timezone ids from VTIMEZONE
  * remove vendored vzic (now a separate package)
- spec file changes
  * add subpackage libguesstz0
- fix compiling with libical prior to version 3.1.0
  * add 0001-fix-compiling-pre-libical-3.1.0.patch
- fix format truncation in snprintf function
  * add 0002-fix-format-truncation.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1709121600">- update to version 2023d
  * update tzdate to 2023d</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2024a" date="1710072000">- update to version 2024a
  * update tzdata to 2024a,
    see https://mm.icann.org/pipermail/tz-announce/2024-February/000081.html</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2025b" date="1759838400">- update to version 2025b
  * update tzdata to 2025b
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/6JVHNHLB6I2WAYTQ75L6KEPEQHFXAJK3/
- previous changes since version 2024a
  * guesstz: update with libical recur-by-ref changes
  * update tzdata to 2024b
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/IZ7AO6WRE3W3TWBL5IR6PMQUL433BQIE/</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2026a" date="1776081600">- update to version 2026a
  * update tzdata to 2026a
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/ASPLBE3A4BAEXIOQ3KZ6EJSJWBU6L53G/
- changes from version 2025c
  * update tzdata to 2025c
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/TAGXKYLMAQRZRFTERQ33CEKOW7KRJVAK/</changelog>
</package>
<package pkgid="5aa7b96099c4430fea80bab0d3683b9681ae1afcfc0a0d2d67df6c9a7dc07c63a6c40c895f339a0a279ad2bb115417caaf3667411cf27ff26780c2181ca9ff41" name="cyrus-timezones" arch="src">
  <version epoch="0" ver="2026a" rel="1.67"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1596024000">- initial package version 2020a</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1612440000">- update to version 2020f
  * no changelog available
  * extracted from commit 14d08670ec823cd748f0234bcaff0e4cf9d4825d</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2023f" date="1701777600">- update to version 2023f
  * update tzdata to 2023f
  * add library for guessing IANA timezone ids from VTIMEZONE
  * remove vendored vzic (now a separate package)
- spec file changes
  * add subpackage libguesstz0
- fix compiling with libical prior to version 3.1.0
  * add 0001-fix-compiling-pre-libical-3.1.0.patch
- fix format truncation in snprintf function
  * add 0002-fix-format-truncation.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1709121600">- update to version 2023d
  * update tzdate to 2023d</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2024a" date="1710072000">- update to version 2024a
  * update tzdata to 2024a,
    see https://mm.icann.org/pipermail/tz-announce/2024-February/000081.html</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2025b" date="1759838400">- update to version 2025b
  * update tzdata to 2025b
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/6JVHNHLB6I2WAYTQ75L6KEPEQHFXAJK3/
- previous changes since version 2024a
  * guesstz: update with libical recur-by-ref changes
  * update tzdata to 2024b
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/IZ7AO6WRE3W3TWBL5IR6PMQUL433BQIE/</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2026a" date="1776081600">- update to version 2026a
  * update tzdata to 2026a
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/ASPLBE3A4BAEXIOQ3KZ6EJSJWBU6L53G/
- changes from version 2025c
  * update tzdata to 2025c
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/TAGXKYLMAQRZRFTERQ33CEKOW7KRJVAK/</changelog>
</package>
<package pkgid="bf75f37ba33784a394e71463fde4f0e7315a9c699d1c3bc5052def02d6659d5c01fdf79a384c8f61ab257462f475baaa951adccc4723a838945a9681d5d7ceed" name="cyrus-timezones" arch="x86_64">
  <version epoch="0" ver="2026a" rel="1.67"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1596024000">- initial package version 2020a</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1612440000">- update to version 2020f
  * no changelog available
  * extracted from commit 14d08670ec823cd748f0234bcaff0e4cf9d4825d</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2023f" date="1701777600">- update to version 2023f
  * update tzdata to 2023f
  * add library for guessing IANA timezone ids from VTIMEZONE
  * remove vendored vzic (now a separate package)
- spec file changes
  * add subpackage libguesstz0
- fix compiling with libical prior to version 3.1.0
  * add 0001-fix-compiling-pre-libical-3.1.0.patch
- fix format truncation in snprintf function
  * add 0002-fix-format-truncation.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1709121600">- update to version 2023d
  * update tzdate to 2023d</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2024a" date="1710072000">- update to version 2024a
  * update tzdata to 2024a,
    see https://mm.icann.org/pipermail/tz-announce/2024-February/000081.html</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2025b" date="1759838400">- update to version 2025b
  * update tzdata to 2025b
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/6JVHNHLB6I2WAYTQ75L6KEPEQHFXAJK3/
- previous changes since version 2024a
  * guesstz: update with libical recur-by-ref changes
  * update tzdata to 2024b
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/IZ7AO6WRE3W3TWBL5IR6PMQUL433BQIE/</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2026a" date="1776081600">- update to version 2026a
  * update tzdata to 2026a
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/ASPLBE3A4BAEXIOQ3KZ6EJSJWBU6L53G/
- changes from version 2025c
  * update tzdata to 2025c
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/TAGXKYLMAQRZRFTERQ33CEKOW7KRJVAK/</changelog>
</package>
<package pkgid="bf478620ca8af2b44090455015286b92030947e427dc529552a8e22073a0d09ae0aa244fc62e0472093eaffe0c73ee003b227d9abfe65e0e5b065260c361ea79" name="cyrus-timezones-devel" arch="i586">
  <version epoch="0" ver="2026a" rel="1.67"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1596024000">- initial package version 2020a</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1612440000">- update to version 2020f
  * no changelog available
  * extracted from commit 14d08670ec823cd748f0234bcaff0e4cf9d4825d</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2023f" date="1701777600">- update to version 2023f
  * update tzdata to 2023f
  * add library for guessing IANA timezone ids from VTIMEZONE
  * remove vendored vzic (now a separate package)
- spec file changes
  * add subpackage libguesstz0
- fix compiling with libical prior to version 3.1.0
  * add 0001-fix-compiling-pre-libical-3.1.0.patch
- fix format truncation in snprintf function
  * add 0002-fix-format-truncation.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1709121600">- update to version 2023d
  * update tzdate to 2023d</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2024a" date="1710072000">- update to version 2024a
  * update tzdata to 2024a,
    see https://mm.icann.org/pipermail/tz-announce/2024-February/000081.html</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2025b" date="1759838400">- update to version 2025b
  * update tzdata to 2025b
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/6JVHNHLB6I2WAYTQ75L6KEPEQHFXAJK3/
- previous changes since version 2024a
  * guesstz: update with libical recur-by-ref changes
  * update tzdata to 2024b
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/IZ7AO6WRE3W3TWBL5IR6PMQUL433BQIE/</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2026a" date="1776081600">- update to version 2026a
  * update tzdata to 2026a
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/ASPLBE3A4BAEXIOQ3KZ6EJSJWBU6L53G/
- changes from version 2025c
  * update tzdata to 2025c
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/TAGXKYLMAQRZRFTERQ33CEKOW7KRJVAK/</changelog>
</package>
<package pkgid="8fa59b5e4c572bb057ebe86fb9ee19b6dd6dd9139cf84f5dbfbfc0e8d0d88a7af46ad217fea84c6f91a5fd74ab4222cd20d7aa9001b03c78b12d3c3293a8eb55" name="cyrus-timezones-devel" arch="x86_64">
  <version epoch="0" ver="2026a" rel="1.67"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1596024000">- initial package version 2020a</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1612440000">- update to version 2020f
  * no changelog available
  * extracted from commit 14d08670ec823cd748f0234bcaff0e4cf9d4825d</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2023f" date="1701777600">- update to version 2023f
  * update tzdata to 2023f
  * add library for guessing IANA timezone ids from VTIMEZONE
  * remove vendored vzic (now a separate package)
- spec file changes
  * add subpackage libguesstz0
- fix compiling with libical prior to version 3.1.0
  * add 0001-fix-compiling-pre-libical-3.1.0.patch
- fix format truncation in snprintf function
  * add 0002-fix-format-truncation.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1709121600">- update to version 2023d
  * update tzdate to 2023d</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2024a" date="1710072000">- update to version 2024a
  * update tzdata to 2024a,
    see https://mm.icann.org/pipermail/tz-announce/2024-February/000081.html</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2025b" date="1759838400">- update to version 2025b
  * update tzdata to 2025b
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/6JVHNHLB6I2WAYTQ75L6KEPEQHFXAJK3/
- previous changes since version 2024a
  * guesstz: update with libical recur-by-ref changes
  * update tzdata to 2024b
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/IZ7AO6WRE3W3TWBL5IR6PMQUL433BQIE/</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2026a" date="1776081600">- update to version 2026a
  * update tzdata to 2026a
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/ASPLBE3A4BAEXIOQ3KZ6EJSJWBU6L53G/
- changes from version 2025c
  * update tzdata to 2025c
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/TAGXKYLMAQRZRFTERQ33CEKOW7KRJVAK/</changelog>
</package>
<package pkgid="db8918cc61f4a7f26734ca47e25f6e892069a9ed05e7ae9939bbdd48e2341f20f7bfffde77a32ea0f459486a9ffbd546524bc30fe468ddd3d0127ed908428745" name="libcyrus0" arch="i586">
  <version epoch="0" ver="3.10.1" rel="1.14"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
</package>
<package pkgid="b1a64ad541f5291f40dddd57e8477a19f6166d2273b0153807e299cb37b2426266fc095139f56f18d44f087e0bf6025cd985ec8673e0c21e6a98ba064a841fdb" name="libcyrus0" arch="x86_64">
  <version epoch="0" ver="3.10.3" rel="1.2"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1751025600">- update to version 3.10.2
  * STARTTLS changes
    The industry is deprecating STARTTLS (aka opportunistic TLS) in
    favor of implicit TLS over a dedicated port. STARTTLS is now
    disabled by default.
    Installations that need to service clients that use opportunistic
    TLS should enable the allowstarttls imapd.conf(5) option for the
    services that need it. For example, for a service configured
    with the name imap in cyrus.conf(5), set imap_allowstarttls: on
    to enable STARTTLS.
  * Security changes
    + master: tighten up pidfile/etc handling
  * Build changes
  * Fixed: fix zoneinfo_db code for GCC 15 (gh#cyrusimap/cyrus-imapd#5450)
  * Bug fixes
    + Fixed: deadlock on shutdown (gh#cyrusimap/cyrus-imapd#5309)
    + Fixed: recognise service-specific SASL options in
    cyr_info conf-lint (gh#cyrusimap/cyrus-imapd#5424)
    + Fixed: charset.c needs stdbool.h (gh#cyrusimap/cyrus-imapd#5423)
    + Fixed: fix double-free in http_admin (gh#cyrusimap/cyrus-imapd#5420)
    + Fixed: pop3d: add basic prometheus support
    (gh#cyrusimap/cyrus-imapd#5460)
    + Fixed: imapd: typo in SASL-IR capability
    (gh#cyrusimap/cyrus-imapd#5481)
    + Fixed: httpd fails to parse OpenSSL version for status string
    (gh#cyrusimap/cyrus-imapd#5454)
- update patches
  * cyrus-imapd-3.10.1-rename.patch to cyrus-imapd-3.10.2-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1781697600">- fix systemd script for openSUSE Leap 16 or newer
  * remove var-run.mount from the requirements
- set correct license tag BSD-Attribution-HPND-disclaimer</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.3" date="1784116800">- update to version 3.10.3
  * Security Fixes
    + CVE-2026-47084 LOCALDELETE bypassed ACL checks
    An authenticated but non-admin user could invoke the admin-only
    LOCALDELETE IMAP command and delete mailboxes for which they
    had no permissions.
    + CVE-2026-47086 GENURLAUTH issued tokens bypassing ACLs
    Any authenticated user could mint a URLAUTH token (via the
    GENURLAUTH command) for any mailbox they could name, even
    without read access on it. This would allow reading mail from
    mailboxes despite having no granted permissions.
    + CVE-2026-47087 URLAUTH does not honor revoked authorizer access
    A URLAUTH URL minted while the authorizer had access continued
    to work after that access was revoked.
    + CVE-2026-47081 XAPPLEPUSHSERVICE folder existence oracle and push hijack
    An authenticated IMAP user could probe for the existence of
    arbitrary mailboxes on other users' accounts via the
    XAPPLEPUSHSERVICE command and then create Apple Push Notification
    Service notifications for new mail in those mailboxes to their
    own APNS device. This did not leak any data about the content
    of mailboxes. Instead, a "mailbox has changed" notice would be
    pushed when the mailbox modseq changed.
    + CVE-2026-47089 LISTRIGHTS not limited to users with admin access
    An authenticated user could call IMAP LISTRIGHTS against any
    mailbox they could name and learn what principals had what
    access to it. (This action should have been restricted to users
    with admin access on the target mailbox.)
    + CVE-2026-47085 URLAUTH token forgery via missing mboxkey
    If an attacker knew a folder name on the victim's account
    for which the victim had never issued an auth URL, they could
    forge a working URLAUTH token by computing HMAC-SHA1 with a
    predictable key, allowing them read access to the mailbox.
    + CVE-2026-47083 ESEARCH cross-user content oracle
    Using the ESEARCH command, an authenticated IMAP user could
    enumerate folder names under any account they could name.
    Search would return UIDs of messages matching search, creating
    a content oracle without allowing arbitrary reads of the target's
    content.
    + CVE-2026-47088 Heap exposure in nested MIME comment parsing
    An authenticated IMAP user could specially craft an email
    containing an RFC 822 comment ending with a backslash. When
    parsing the message, the server would read past the message
    end in memory and read into the heap, returning the read content
    to the user.
    + CVE-2026-47082 Vacation "fcc" skips destination-mailbox ACL
    A user whose vacation Sieve script used :fcc (to save a copy
    of the sent message) could deliver vacation auto-reply copies
    into any mailbox the script could name, regardless of whether
    the script owner had insert permissions on the destination
    mailbox.
  * Build changes
    + Fixed: cunit+valgrind libtool invocation
    + Fixed: fix cunit stuff to properly integrate with autotools
    + Fixed: update cunit valgrind suppressions
    + Fixed: unused parameter warning in cyrdbbench
    + Fixed: consolidate cassandane 'other' configuration sections
    + Fixed: add --with-zoneinfo-dir configure option to set zoneinfo_dir at compile time
    + Fixed: add min/max other version cassandane magic
    + Fixed: update cassandane valgrind suppressions
  * Bug fixes
    + Fixed: fix leaks in imap SELECT and SETQUOTA
    (gh#cyrusimap/cyrus-imapd#5436)
    + Fixed: don't leak cached TLS sessions
    (gh#cyrusimap/cyrus-imapd#5437)
    + Fixed: fix proxy of LIST (SUBSCRIBED) to backends
    (gh#cyrusimap/cyrus-imapd#5602)
    + Fixed: squat crash attempting to search
    (gh#cyrusimap/cyrus-imapd#3562)
    + Fixed: VANISHED not working with cyrus proxy
    (gh#cyrusimap/cyrus-imapd#4787)
    + Fixed: auditlog rename of UUID mailboxes
    (gh#cyrusimap/cyrus-imapd#5908)
    + Fixed: various memory leaks (gh#cyrusimap/cyrus-imapd#6022)
- spec file changes
  * update cyrus-imapd-3.10.2-rename.patch to cyrus-imapd-3.10.3-rename.patch
  * remove never used old cassandane parts</changelog>
</package>
<package pkgid="cec56beec9ac00142f3402fafba793d839a053ba6639882bcf44c82a7907fcc2559d1cc00eceafa163b58777238938f8ad182454cb5a65e37f300bb54d84dc53" name="libguesstz0" arch="i586">
  <version epoch="0" ver="2026a" rel="1.67"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1596024000">- initial package version 2020a</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1612440000">- update to version 2020f
  * no changelog available
  * extracted from commit 14d08670ec823cd748f0234bcaff0e4cf9d4825d</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2023f" date="1701777600">- update to version 2023f
  * update tzdata to 2023f
  * add library for guessing IANA timezone ids from VTIMEZONE
  * remove vendored vzic (now a separate package)
- spec file changes
  * add subpackage libguesstz0
- fix compiling with libical prior to version 3.1.0
  * add 0001-fix-compiling-pre-libical-3.1.0.patch
- fix format truncation in snprintf function
  * add 0002-fix-format-truncation.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1709121600">- update to version 2023d
  * update tzdate to 2023d</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2024a" date="1710072000">- update to version 2024a
  * update tzdata to 2024a,
    see https://mm.icann.org/pipermail/tz-announce/2024-February/000081.html</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2025b" date="1759838400">- update to version 2025b
  * update tzdata to 2025b
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/6JVHNHLB6I2WAYTQ75L6KEPEQHFXAJK3/
- previous changes since version 2024a
  * guesstz: update with libical recur-by-ref changes
  * update tzdata to 2024b
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/IZ7AO6WRE3W3TWBL5IR6PMQUL433BQIE/</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2026a" date="1776081600">- update to version 2026a
  * update tzdata to 2026a
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/ASPLBE3A4BAEXIOQ3KZ6EJSJWBU6L53G/
- changes from version 2025c
  * update tzdata to 2025c
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/TAGXKYLMAQRZRFTERQ33CEKOW7KRJVAK/</changelog>
</package>
<package pkgid="7c9ff6f1d6307ca2f6360586515016837a2ea5a99f74aa81313f0f53b47448b178271158041dc30a470ebe06331ca7eed65f97d0797e3f6852732abe5f311de1" name="libguesstz0" arch="x86_64">
  <version epoch="0" ver="2026a" rel="1.67"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1596024000">- initial package version 2020a</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1612440000">- update to version 2020f
  * no changelog available
  * extracted from commit 14d08670ec823cd748f0234bcaff0e4cf9d4825d</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2023f" date="1701777600">- update to version 2023f
  * update tzdata to 2023f
  * add library for guessing IANA timezone ids from VTIMEZONE
  * remove vendored vzic (now a separate package)
- spec file changes
  * add subpackage libguesstz0
- fix compiling with libical prior to version 3.1.0
  * add 0001-fix-compiling-pre-libical-3.1.0.patch
- fix format truncation in snprintf function
  * add 0002-fix-format-truncation.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1709121600">- update to version 2023d
  * update tzdate to 2023d</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2024a" date="1710072000">- update to version 2024a
  * update tzdata to 2024a,
    see https://mm.icann.org/pipermail/tz-announce/2024-February/000081.html</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2025b" date="1759838400">- update to version 2025b
  * update tzdata to 2025b
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/6JVHNHLB6I2WAYTQ75L6KEPEQHFXAJK3/
- previous changes since version 2024a
  * guesstz: update with libical recur-by-ref changes
  * update tzdata to 2024b
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/IZ7AO6WRE3W3TWBL5IR6PMQUL433BQIE/</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 2026a" date="1776081600">- update to version 2026a
  * update tzdata to 2026a
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/ASPLBE3A4BAEXIOQ3KZ6EJSJWBU6L53G/
- changes from version 2025c
  * update tzdata to 2025c
    see https://lists.iana.org/hyperkitty/list/tz-announce@iana.org/thread/TAGXKYLMAQRZRFTERQ33CEKOW7KRJVAK/</changelog>
</package>
<package pkgid="8014bce6635f074271da81f1d842600b6e4e082cbbff83c216c2e798df7b5e0aafc01ee4370278e8289fb16b4e85f2a54deb8f43dfc538134ec625bb1e29c49a" name="libsrs2-0" arch="i586">
  <version epoch="0" ver="1.0.18" rel="3.33"/>
  <changelog author="Michal Hrusecky &lt;michal.hrusecky@opensuse.org&gt;" date="1537876800">- Initial package version 1.0.18</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1612440000">- Add 0001-fix-memory-leaks.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 1.0.18" date="1710417600">- spec file changes
  * add more license files
  * update License tag to include BSD-3-Clause or GPL-2.0-only
  * change URL tag to https://github.com/shevek/libsrs2 as libsrs2.org
    is down
  * add 0002-improve-makefile.patch from upstream</changelog>
</package>
<package pkgid="3397133d3f39f9cd219449f699c845071adb2426f6e828aaef2052720bac81e6735196902f7d4e7bf0c3925d45f7d2c66e01c29f480fa3fae1ececa0390138f2" name="libsrs2-0" arch="x86_64">
  <version epoch="0" ver="1.0.18" rel="3.33"/>
  <changelog author="Michal Hrusecky &lt;michal.hrusecky@opensuse.org&gt;" date="1537876800">- Initial package version 1.0.18</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1612440000">- Add 0001-fix-memory-leaks.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 1.0.18" date="1710417600">- spec file changes
  * add more license files
  * update License tag to include BSD-3-Clause or GPL-2.0-only
  * change URL tag to https://github.com/shevek/libsrs2 as libsrs2.org
    is down
  * add 0002-improve-makefile.patch from upstream</changelog>
</package>
<package pkgid="4b50529fe46f6d1fde86ed1498b73cdc4000525ebf2ce14df55049d78faa07f62fbbe2f6881ab5fd602d8689adffc9c49925eef3e4b3da09c108989f7935dfc0" name="libsrs2" arch="src">
  <version epoch="0" ver="1.0.18" rel="3.33"/>
  <changelog author="Michal Hrusecky &lt;michal.hrusecky@opensuse.org&gt;" date="1537876800">- Initial package version 1.0.18</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1612440000">- Add 0001-fix-memory-leaks.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 1.0.18" date="1710417600">- spec file changes
  * add more license files
  * update License tag to include BSD-3-Clause or GPL-2.0-only
  * change URL tag to https://github.com/shevek/libsrs2 as libsrs2.org
    is down
  * add 0002-improve-makefile.patch from upstream</changelog>
</package>
<package pkgid="7ead60e5442acffb06c2896a1ec1d84c62112604268e501ee8ff7a929b0046ac98fad804effd39baaf29ba30a6a93a1fe7ca4f36dd02a4f296af07fd6e9071d5" name="libsrs2-devel" arch="i586">
  <version epoch="0" ver="1.0.18" rel="3.33"/>
  <changelog author="Michal Hrusecky &lt;michal.hrusecky@opensuse.org&gt;" date="1537876800">- Initial package version 1.0.18</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1612440000">- Add 0001-fix-memory-leaks.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 1.0.18" date="1710417600">- spec file changes
  * add more license files
  * update License tag to include BSD-3-Clause or GPL-2.0-only
  * change URL tag to https://github.com/shevek/libsrs2 as libsrs2.org
    is down
  * add 0002-improve-makefile.patch from upstream</changelog>
</package>
<package pkgid="166e2e5b596126a75016e1319879fec2eee1647d965c42e2030ed0b1edfe5a298fcd60e7d993f721c4a60b08bf4bfe157df6a40761cb1606ec7e0e15fff79990" name="libsrs2-devel" arch="x86_64">
  <version epoch="0" ver="1.0.18" rel="3.33"/>
  <changelog author="Michal Hrusecky &lt;michal.hrusecky@opensuse.org&gt;" date="1537876800">- Initial package version 1.0.18</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1612440000">- Add 0001-fix-memory-leaks.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 1.0.18" date="1710417600">- spec file changes
  * add more license files
  * update License tag to include BSD-3-Clause or GPL-2.0-only
  * change URL tag to https://github.com/shevek/libsrs2 as libsrs2.org
    is down
  * add 0002-improve-makefile.patch from upstream</changelog>
</package>
<package pkgid="342c42c0c1b131ff5f34ff86c95224e9bf65b79b92bf894c6e0ebb0a941aa31d6aa871d548ce797ea1da5d6d0a6e70a9a5a1c9f013c03de7a4dfa8bc696f67ca" name="perl-Cyrus-Annotator" arch="i586">
  <version epoch="0" ver="3.10.1" rel="1.14"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
</package>
<package pkgid="05c54922419be74155bff7b18352566f72d8cbe030410d0e16980afcca78ff4a2fab41939cbf66fc2f8a49242f3462245e28f75aabd23d1d6c282d5213d9f39c" name="perl-Cyrus-Annotator" arch="x86_64">
  <version epoch="0" ver="3.10.3" rel="1.2"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1751025600">- update to version 3.10.2
  * STARTTLS changes
    The industry is deprecating STARTTLS (aka opportunistic TLS) in
    favor of implicit TLS over a dedicated port. STARTTLS is now
    disabled by default.
    Installations that need to service clients that use opportunistic
    TLS should enable the allowstarttls imapd.conf(5) option for the
    services that need it. For example, for a service configured
    with the name imap in cyrus.conf(5), set imap_allowstarttls: on
    to enable STARTTLS.
  * Security changes
    + master: tighten up pidfile/etc handling
  * Build changes
  * Fixed: fix zoneinfo_db code for GCC 15 (gh#cyrusimap/cyrus-imapd#5450)
  * Bug fixes
    + Fixed: deadlock on shutdown (gh#cyrusimap/cyrus-imapd#5309)
    + Fixed: recognise service-specific SASL options in
    cyr_info conf-lint (gh#cyrusimap/cyrus-imapd#5424)
    + Fixed: charset.c needs stdbool.h (gh#cyrusimap/cyrus-imapd#5423)
    + Fixed: fix double-free in http_admin (gh#cyrusimap/cyrus-imapd#5420)
    + Fixed: pop3d: add basic prometheus support
    (gh#cyrusimap/cyrus-imapd#5460)
    + Fixed: imapd: typo in SASL-IR capability
    (gh#cyrusimap/cyrus-imapd#5481)
    + Fixed: httpd fails to parse OpenSSL version for status string
    (gh#cyrusimap/cyrus-imapd#5454)
- update patches
  * cyrus-imapd-3.10.1-rename.patch to cyrus-imapd-3.10.2-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1781697600">- fix systemd script for openSUSE Leap 16 or newer
  * remove var-run.mount from the requirements
- set correct license tag BSD-Attribution-HPND-disclaimer</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.3" date="1784116800">- update to version 3.10.3
  * Security Fixes
    + CVE-2026-47084 LOCALDELETE bypassed ACL checks
    An authenticated but non-admin user could invoke the admin-only
    LOCALDELETE IMAP command and delete mailboxes for which they
    had no permissions.
    + CVE-2026-47086 GENURLAUTH issued tokens bypassing ACLs
    Any authenticated user could mint a URLAUTH token (via the
    GENURLAUTH command) for any mailbox they could name, even
    without read access on it. This would allow reading mail from
    mailboxes despite having no granted permissions.
    + CVE-2026-47087 URLAUTH does not honor revoked authorizer access
    A URLAUTH URL minted while the authorizer had access continued
    to work after that access was revoked.
    + CVE-2026-47081 XAPPLEPUSHSERVICE folder existence oracle and push hijack
    An authenticated IMAP user could probe for the existence of
    arbitrary mailboxes on other users' accounts via the
    XAPPLEPUSHSERVICE command and then create Apple Push Notification
    Service notifications for new mail in those mailboxes to their
    own APNS device. This did not leak any data about the content
    of mailboxes. Instead, a "mailbox has changed" notice would be
    pushed when the mailbox modseq changed.
    + CVE-2026-47089 LISTRIGHTS not limited to users with admin access
    An authenticated user could call IMAP LISTRIGHTS against any
    mailbox they could name and learn what principals had what
    access to it. (This action should have been restricted to users
    with admin access on the target mailbox.)
    + CVE-2026-47085 URLAUTH token forgery via missing mboxkey
    If an attacker knew a folder name on the victim's account
    for which the victim had never issued an auth URL, they could
    forge a working URLAUTH token by computing HMAC-SHA1 with a
    predictable key, allowing them read access to the mailbox.
    + CVE-2026-47083 ESEARCH cross-user content oracle
    Using the ESEARCH command, an authenticated IMAP user could
    enumerate folder names under any account they could name.
    Search would return UIDs of messages matching search, creating
    a content oracle without allowing arbitrary reads of the target's
    content.
    + CVE-2026-47088 Heap exposure in nested MIME comment parsing
    An authenticated IMAP user could specially craft an email
    containing an RFC 822 comment ending with a backslash. When
    parsing the message, the server would read past the message
    end in memory and read into the heap, returning the read content
    to the user.
    + CVE-2026-47082 Vacation "fcc" skips destination-mailbox ACL
    A user whose vacation Sieve script used :fcc (to save a copy
    of the sent message) could deliver vacation auto-reply copies
    into any mailbox the script could name, regardless of whether
    the script owner had insert permissions on the destination
    mailbox.
  * Build changes
    + Fixed: cunit+valgrind libtool invocation
    + Fixed: fix cunit stuff to properly integrate with autotools
    + Fixed: update cunit valgrind suppressions
    + Fixed: unused parameter warning in cyrdbbench
    + Fixed: consolidate cassandane 'other' configuration sections
    + Fixed: add --with-zoneinfo-dir configure option to set zoneinfo_dir at compile time
    + Fixed: add min/max other version cassandane magic
    + Fixed: update cassandane valgrind suppressions
  * Bug fixes
    + Fixed: fix leaks in imap SELECT and SETQUOTA
    (gh#cyrusimap/cyrus-imapd#5436)
    + Fixed: don't leak cached TLS sessions
    (gh#cyrusimap/cyrus-imapd#5437)
    + Fixed: fix proxy of LIST (SUBSCRIBED) to backends
    (gh#cyrusimap/cyrus-imapd#5602)
    + Fixed: squat crash attempting to search
    (gh#cyrusimap/cyrus-imapd#3562)
    + Fixed: VANISHED not working with cyrus proxy
    (gh#cyrusimap/cyrus-imapd#4787)
    + Fixed: auditlog rename of UUID mailboxes
    (gh#cyrusimap/cyrus-imapd#5908)
    + Fixed: various memory leaks (gh#cyrusimap/cyrus-imapd#6022)
- spec file changes
  * update cyrus-imapd-3.10.2-rename.patch to cyrus-imapd-3.10.3-rename.patch
  * remove never used old cassandane parts</changelog>
</package>
<package pkgid="fcefdf5bb270bd961c540c4f6f874db69211a4bc3f662d6cf9559bc1bfcfaeb22ece7f02ad5e98bb1252354ca0c20d555a80d552a486e1fb15f21b9944dc9b28" name="perl-Cyrus-IMAP" arch="i586">
  <version epoch="0" ver="3.10.1" rel="1.14"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
</package>
<package pkgid="9fa17aa90345a08100ea8e19210ca447999e19258485a58e6c8e9cc5d4f3ff076e2cba4f02977fe8a9cb6c19a7c187f01db2ee4f74e2b9a441afe0ac2d66c5b6" name="perl-Cyrus-IMAP" arch="x86_64">
  <version epoch="0" ver="3.10.3" rel="1.2"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1751025600">- update to version 3.10.2
  * STARTTLS changes
    The industry is deprecating STARTTLS (aka opportunistic TLS) in
    favor of implicit TLS over a dedicated port. STARTTLS is now
    disabled by default.
    Installations that need to service clients that use opportunistic
    TLS should enable the allowstarttls imapd.conf(5) option for the
    services that need it. For example, for a service configured
    with the name imap in cyrus.conf(5), set imap_allowstarttls: on
    to enable STARTTLS.
  * Security changes
    + master: tighten up pidfile/etc handling
  * Build changes
  * Fixed: fix zoneinfo_db code for GCC 15 (gh#cyrusimap/cyrus-imapd#5450)
  * Bug fixes
    + Fixed: deadlock on shutdown (gh#cyrusimap/cyrus-imapd#5309)
    + Fixed: recognise service-specific SASL options in
    cyr_info conf-lint (gh#cyrusimap/cyrus-imapd#5424)
    + Fixed: charset.c needs stdbool.h (gh#cyrusimap/cyrus-imapd#5423)
    + Fixed: fix double-free in http_admin (gh#cyrusimap/cyrus-imapd#5420)
    + Fixed: pop3d: add basic prometheus support
    (gh#cyrusimap/cyrus-imapd#5460)
    + Fixed: imapd: typo in SASL-IR capability
    (gh#cyrusimap/cyrus-imapd#5481)
    + Fixed: httpd fails to parse OpenSSL version for status string
    (gh#cyrusimap/cyrus-imapd#5454)
- update patches
  * cyrus-imapd-3.10.1-rename.patch to cyrus-imapd-3.10.2-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1781697600">- fix systemd script for openSUSE Leap 16 or newer
  * remove var-run.mount from the requirements
- set correct license tag BSD-Attribution-HPND-disclaimer</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.3" date="1784116800">- update to version 3.10.3
  * Security Fixes
    + CVE-2026-47084 LOCALDELETE bypassed ACL checks
    An authenticated but non-admin user could invoke the admin-only
    LOCALDELETE IMAP command and delete mailboxes for which they
    had no permissions.
    + CVE-2026-47086 GENURLAUTH issued tokens bypassing ACLs
    Any authenticated user could mint a URLAUTH token (via the
    GENURLAUTH command) for any mailbox they could name, even
    without read access on it. This would allow reading mail from
    mailboxes despite having no granted permissions.
    + CVE-2026-47087 URLAUTH does not honor revoked authorizer access
    A URLAUTH URL minted while the authorizer had access continued
    to work after that access was revoked.
    + CVE-2026-47081 XAPPLEPUSHSERVICE folder existence oracle and push hijack
    An authenticated IMAP user could probe for the existence of
    arbitrary mailboxes on other users' accounts via the
    XAPPLEPUSHSERVICE command and then create Apple Push Notification
    Service notifications for new mail in those mailboxes to their
    own APNS device. This did not leak any data about the content
    of mailboxes. Instead, a "mailbox has changed" notice would be
    pushed when the mailbox modseq changed.
    + CVE-2026-47089 LISTRIGHTS not limited to users with admin access
    An authenticated user could call IMAP LISTRIGHTS against any
    mailbox they could name and learn what principals had what
    access to it. (This action should have been restricted to users
    with admin access on the target mailbox.)
    + CVE-2026-47085 URLAUTH token forgery via missing mboxkey
    If an attacker knew a folder name on the victim's account
    for which the victim had never issued an auth URL, they could
    forge a working URLAUTH token by computing HMAC-SHA1 with a
    predictable key, allowing them read access to the mailbox.
    + CVE-2026-47083 ESEARCH cross-user content oracle
    Using the ESEARCH command, an authenticated IMAP user could
    enumerate folder names under any account they could name.
    Search would return UIDs of messages matching search, creating
    a content oracle without allowing arbitrary reads of the target's
    content.
    + CVE-2026-47088 Heap exposure in nested MIME comment parsing
    An authenticated IMAP user could specially craft an email
    containing an RFC 822 comment ending with a backslash. When
    parsing the message, the server would read past the message
    end in memory and read into the heap, returning the read content
    to the user.
    + CVE-2026-47082 Vacation "fcc" skips destination-mailbox ACL
    A user whose vacation Sieve script used :fcc (to save a copy
    of the sent message) could deliver vacation auto-reply copies
    into any mailbox the script could name, regardless of whether
    the script owner had insert permissions on the destination
    mailbox.
  * Build changes
    + Fixed: cunit+valgrind libtool invocation
    + Fixed: fix cunit stuff to properly integrate with autotools
    + Fixed: update cunit valgrind suppressions
    + Fixed: unused parameter warning in cyrdbbench
    + Fixed: consolidate cassandane 'other' configuration sections
    + Fixed: add --with-zoneinfo-dir configure option to set zoneinfo_dir at compile time
    + Fixed: add min/max other version cassandane magic
    + Fixed: update cassandane valgrind suppressions
  * Bug fixes
    + Fixed: fix leaks in imap SELECT and SETQUOTA
    (gh#cyrusimap/cyrus-imapd#5436)
    + Fixed: don't leak cached TLS sessions
    (gh#cyrusimap/cyrus-imapd#5437)
    + Fixed: fix proxy of LIST (SUBSCRIBED) to backends
    (gh#cyrusimap/cyrus-imapd#5602)
    + Fixed: squat crash attempting to search
    (gh#cyrusimap/cyrus-imapd#3562)
    + Fixed: VANISHED not working with cyrus proxy
    (gh#cyrusimap/cyrus-imapd#4787)
    + Fixed: auditlog rename of UUID mailboxes
    (gh#cyrusimap/cyrus-imapd#5908)
    + Fixed: various memory leaks (gh#cyrusimap/cyrus-imapd#6022)
- spec file changes
  * update cyrus-imapd-3.10.2-rename.patch to cyrus-imapd-3.10.3-rename.patch
  * remove never used old cassandane parts</changelog>
</package>
<package pkgid="691b3cdf172ae086ad58a5857fdab7a762c35327d9c8dbc73ee198dcfeb4aef98f5ecdd31648b41d8fa17182fbf32fd6985f0f085e1448ec5ee2257f31e40538" name="perl-Cyrus-SIEVE-managesieve" arch="i586">
  <version epoch="0" ver="3.10.1" rel="1.14"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
</package>
<package pkgid="e68ba4d6e6162114d9afe5a991c6d24778f5304de3496e122429892c8b20794dbee595e3e66ee84e76385d0081557eda05ff6dbcc5ea09eca757815b09df8380" name="perl-Cyrus-SIEVE-managesieve" arch="x86_64">
  <version epoch="0" ver="3.10.3" rel="1.2"/>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.0" date="1724587200">- initial package version 3.10.0
- changes since the 3.8 series
  * Major changes
    + URLs found in HTML &lt;a&gt;, &lt;area&gt; and &lt;img&gt; tags, as well as "alt"
    text in &lt;img&gt; tags, are now indexed for search and snippets
    + cyr_expire(8) now supports non-day durations in the
    archive/delete/expire annotations
    + cyr_expire(8) no longer supports fractional durations in command
    line arguments. Installations that passed fractional durations
    such as "1.5d" to any of the -E, -X, -D, or -A arguments must
    adapt these to only use integer durations such as "1d12h"
    + cyr_expire(8) now supports the 'noexpire_until' annotation to
    disable cyr_expire per user
    + JMAP calendar default alarms are now stored in a non-DAV mailbox
    annotation. See Default alarms for upgrading instructions if you
    are already using the experimental JMAP Calendars API
    + Removes support for parsing and generating bytecode for the
    deprecated denotify action and notify actions using the legacy
    (pre-RFC 5435) syntax. Existing bytecode containing these actions
    will still be executed. Scripts that contain the deprecated
    denotify action should be rewritten to remove them. Scripts that
    contain notify actions using the legacy syntax should be
    rewritten to use the syntax in RFC 5435
    + Adds support for the "exp" and "nbf" JSON Web Token claims
    + Adds support for IMAP Version 4rev2 (RFC 9051)
    + Adds support for IMAP NOTIFY (RFC 5465). Only available if idled
    is running
    + Refresh interval for APNS subscriptions to DAV resources is now
    configurable. See the aps_expiry imapd.conf(5) option
    + Upgrade IMAP Quota support to RFC 9208. Sites running a Murder
    will be unable to set ANNOTATION-STORAGE or MAILBOX quotas
    (formerly known as X-ANNOTATION-STORAGE and X-NUM_FOLDERS) in a
    mixed-version environment until frontends are upgraded. Upgraded
    frontends know how to negotiate with older backends.
    + Adds support for IMAP REPLACE (RFC 8508)
    + Adds support for IMAP UIDONLY extension (draft-ietf-extra-imap-uidonly)
    + Adds experimental support for JMAP Contacts per upcoming IETF
    standards. Requires the not-yet-released libicalvcard
    + squatter(8) now supports the "wait=y" cyrus.conf(5) option when
    started in rolling mode from the DAEMON section
    + master(8) now touches a ready file to indicate it is
    "ready for work". See master.pid and master.ready files
    + master(8) now gets its pidfile name from the master_pid_file
    imapd.conf(5) option. See master.pid and master.ready files
    + Adds pcre2 support. Prefers pcre2 over pcre if both are available
    + The proc cyr_info(8) subcommand now also reports DAEMON and EVENTS
    processes
    + JMAP CalendarEventNotification objects are now automatically pruned.
    The jmap_max_calendareventnotifs imapd.conf(5) option can be used
    to tune this behaviour
    + Cyrus now requires libical &gt;= 3.0.10 for HTTP support
    + Sieve [current]date :zone parameter now accepts either a UTC offset
    or an IANA time zone ID
    + Adds an implicit_keep_target Sieve action to change the target
    mailbox for an implicit keep
    + squatter(8) no longer holds a mailbox lock while extracting text
    from attachments
    + IMAP RENAME command no longer emits non-standard per-folder updates.
    Use the new XRENAME command if you need this behaviour
    + Outgoing SMTP connections now EHLO as client_bind_name or servername
    rather than localhost
    + Deprecates the experimental Cyrus Backups feature
  * Storage changes
    + None in 3.10. But if your upgrade is skipping over 3.6 and 3.8,
    please do not miss 3.6.0 Storage changes and 3.8.0 Storage changes
  * Updates to default configuration
    The cyr_info(8) conf, conf-all and conf-default subcommands accept an
  - s &lt;version&gt; argument to highlight imapd.conf(5) options that are new
    or whose behaviour has changed since the specified version. We recommend
    using this when evaluating a new Cyrus version to check which
    configuration options you will need to examine and maybe set or change
    during the process.
    + The master pidfile name is now read from imapd.conf, and defaults to
    {configdirectory}/master.pid. If you have something that looks for
    this file, you should either update it to look in the new default
    location, or set master_pid_file in imapd.conf(5) to override the
    default. The -p option to master(8) can still be used to override it
  * Security fixes
    + Fixed CVE-2024-34055: Cyrus-IMAP through 3.8.2 and 3.10.0-beta2 allow
    authenticated attackers to cause unbounded memory allocation by
    sending many LITERALs in a single command.
    The IMAP protocol allows for command arguments to be LITERALs of
    negotiated length, and for these the server allocates memory to
    receive the content before instructing the client to proceed. The
    allocated memory is released when the whole command has been received
    and processed.
    The IMAP protocol has a number commands that specify an unlimited number
    of arguments, for example SEARCH. Each of these arguments can be a
    LITERAL, for which memory will be allocated and not released until the
    entire command has been received and processed. This can run a server
    out of memory, with varying consequences depending on the server's OOM
    policy.
    Two limits, with corresponding imapd.conf(5) options, have been added
    to address this:
  - maxargssize (default: unlimited): limits the overall length of a single
    IMAP command. Deployments should configure this to a size that suits
    their system resources and client usage patterns
  - maxliteral (default: 128K): limits the length of individual IMAP LITERALs
    Connections sending commands that would exceed these limits will see the
    command fail, or the connection closed, depending on the specific context.
    The error message will contain the [TOOBIG] response code.
    These limits may be set small without affecting message uploads, as the
    APPEND command's message literal is limited by maxmessagesize, not by
    these new options.
  * Significant bugfixes
    + Fixed: squat db reindexes are no longer always incremental
    + Fixed: squat db corruption from unintentional indexing of fields
    intended to be skipped
    + Fixed: squat db out of bounds access in incremental reindex docID map
    + Fixed: squat db searches now handle unindexed messages correctly again
    (gh#cyrusimap/cyrus-imapd#4692)
    + Restored functionality of the sync_client -o/--connect-once option
    + Fixed: copying/moving messages from split conversations is now correct
    (gh#cyrusimap/cyrus-imapd#4654)
    + Fixed: fix renaming mailbox between users (gh#cyrusimap/cyrus-imapd#4758)
    + Fixed: mailbox_maxmessages limits now applied correctly
    (gh#cyrusimap/cyrus-imapd#4804)
    + Fixed: LITERAL+ broken in mupdate (gh#cyrusimap/cyrus-imapd#4932)</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.1" date="1737547200">- update to version 3.10.1
  * Build changes
    + Fixed: check for unexpected extra tiny-tests directories
    (gh#cyrusimap/cyrus-imapd#5029)
    + Fixed: added --enable-release-checks configure option for use
    when building releases (gh#cyrusimap/cyrus-imapd#5148)
  * Bug fixes
    + Fixed: calendar-color "changes" namespace
    (gh#cyrusimap/cyrus-imapd#4489)
    + Fixed: various portability warnings and nits
    (gh#cyrusimap/cyrus-imapd#5009)
    + Fixed: inverse sign when guessing Etc/GMT+X timezone
    (gh#cyrusimap/cyrus-imapd#5027)
    + Fixed: iTIP line endings (gh#cyrusimap/cyrus-imapd#5050)
    + Fixed: iMIP line endings (gh#cyrusimap/cyrus-imapd#5052)
    + Fixed: http_cgi use after free (gh#cyrusimap/cyrus-imapd#5072)
    + Fixed: httpd crash when PROPFIND url is /dav/calendars
    (gh#cyrusimap/cyrus-imapd#5094)
    + Fixed: broken language checks for "zr-hant" and "sr-me"
    (gh#cyrusimap/cyrus-imapd#5118)
    + Fixed: proxying UID SEARCH (gh#cyrusimap/cyrus-imapd#5047)
- update patches
  * cyrus-imapd-3.10.0-rename.patch to cyrus-imapd-3.10.1-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1751025600">- update to version 3.10.2
  * STARTTLS changes
    The industry is deprecating STARTTLS (aka opportunistic TLS) in
    favor of implicit TLS over a dedicated port. STARTTLS is now
    disabled by default.
    Installations that need to service clients that use opportunistic
    TLS should enable the allowstarttls imapd.conf(5) option for the
    services that need it. For example, for a service configured
    with the name imap in cyrus.conf(5), set imap_allowstarttls: on
    to enable STARTTLS.
  * Security changes
    + master: tighten up pidfile/etc handling
  * Build changes
  * Fixed: fix zoneinfo_db code for GCC 15 (gh#cyrusimap/cyrus-imapd#5450)
  * Bug fixes
    + Fixed: deadlock on shutdown (gh#cyrusimap/cyrus-imapd#5309)
    + Fixed: recognise service-specific SASL options in
    cyr_info conf-lint (gh#cyrusimap/cyrus-imapd#5424)
    + Fixed: charset.c needs stdbool.h (gh#cyrusimap/cyrus-imapd#5423)
    + Fixed: fix double-free in http_admin (gh#cyrusimap/cyrus-imapd#5420)
    + Fixed: pop3d: add basic prometheus support
    (gh#cyrusimap/cyrus-imapd#5460)
    + Fixed: imapd: typo in SASL-IR capability
    (gh#cyrusimap/cyrus-imapd#5481)
    + Fixed: httpd fails to parse OpenSSL version for status string
    (gh#cyrusimap/cyrus-imapd#5454)
- update patches
  * cyrus-imapd-3.10.1-rename.patch to cyrus-imapd-3.10.2-rename.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.2" date="1781697600">- fix systemd script for openSUSE Leap 16 or newer
  * remove var-run.mount from the requirements
- set correct license tag BSD-Attribution-HPND-disclaimer</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 3.10.3" date="1784116800">- update to version 3.10.3
  * Security Fixes
    + CVE-2026-47084 LOCALDELETE bypassed ACL checks
    An authenticated but non-admin user could invoke the admin-only
    LOCALDELETE IMAP command and delete mailboxes for which they
    had no permissions.
    + CVE-2026-47086 GENURLAUTH issued tokens bypassing ACLs
    Any authenticated user could mint a URLAUTH token (via the
    GENURLAUTH command) for any mailbox they could name, even
    without read access on it. This would allow reading mail from
    mailboxes despite having no granted permissions.
    + CVE-2026-47087 URLAUTH does not honor revoked authorizer access
    A URLAUTH URL minted while the authorizer had access continued
    to work after that access was revoked.
    + CVE-2026-47081 XAPPLEPUSHSERVICE folder existence oracle and push hijack
    An authenticated IMAP user could probe for the existence of
    arbitrary mailboxes on other users' accounts via the
    XAPPLEPUSHSERVICE command and then create Apple Push Notification
    Service notifications for new mail in those mailboxes to their
    own APNS device. This did not leak any data about the content
    of mailboxes. Instead, a "mailbox has changed" notice would be
    pushed when the mailbox modseq changed.
    + CVE-2026-47089 LISTRIGHTS not limited to users with admin access
    An authenticated user could call IMAP LISTRIGHTS against any
    mailbox they could name and learn what principals had what
    access to it. (This action should have been restricted to users
    with admin access on the target mailbox.)
    + CVE-2026-47085 URLAUTH token forgery via missing mboxkey
    If an attacker knew a folder name on the victim's account
    for which the victim had never issued an auth URL, they could
    forge a working URLAUTH token by computing HMAC-SHA1 with a
    predictable key, allowing them read access to the mailbox.
    + CVE-2026-47083 ESEARCH cross-user content oracle
    Using the ESEARCH command, an authenticated IMAP user could
    enumerate folder names under any account they could name.
    Search would return UIDs of messages matching search, creating
    a content oracle without allowing arbitrary reads of the target's
    content.
    + CVE-2026-47088 Heap exposure in nested MIME comment parsing
    An authenticated IMAP user could specially craft an email
    containing an RFC 822 comment ending with a backslash. When
    parsing the message, the server would read past the message
    end in memory and read into the heap, returning the read content
    to the user.
    + CVE-2026-47082 Vacation "fcc" skips destination-mailbox ACL
    A user whose vacation Sieve script used :fcc (to save a copy
    of the sent message) could deliver vacation auto-reply copies
    into any mailbox the script could name, regardless of whether
    the script owner had insert permissions on the destination
    mailbox.
  * Build changes
    + Fixed: cunit+valgrind libtool invocation
    + Fixed: fix cunit stuff to properly integrate with autotools
    + Fixed: update cunit valgrind suppressions
    + Fixed: unused parameter warning in cyrdbbench
    + Fixed: consolidate cassandane 'other' configuration sections
    + Fixed: add --with-zoneinfo-dir configure option to set zoneinfo_dir at compile time
    + Fixed: add min/max other version cassandane magic
    + Fixed: update cassandane valgrind suppressions
  * Bug fixes
    + Fixed: fix leaks in imap SELECT and SETQUOTA
    (gh#cyrusimap/cyrus-imapd#5436)
    + Fixed: don't leak cached TLS sessions
    (gh#cyrusimap/cyrus-imapd#5437)
    + Fixed: fix proxy of LIST (SUBSCRIBED) to backends
    (gh#cyrusimap/cyrus-imapd#5602)
    + Fixed: squat crash attempting to search
    (gh#cyrusimap/cyrus-imapd#3562)
    + Fixed: VANISHED not working with cyrus proxy
    (gh#cyrusimap/cyrus-imapd#4787)
    + Fixed: auditlog rename of UUID mailboxes
    (gh#cyrusimap/cyrus-imapd#5908)
    + Fixed: various memory leaks (gh#cyrusimap/cyrus-imapd#6022)
- spec file changes
  * update cyrus-imapd-3.10.2-rename.patch to cyrus-imapd-3.10.3-rename.patch
  * remove never used old cassandane parts</changelog>
</package>
<package pkgid="ce2037e52107c10fd41c3a942050516dc8910395ddf0195b3e434c8f9f4ea1b0433fed96ab805ec552307983dc6851b740b2b3d23bd5f51b95548029fff6a134" name="srs2-tools" arch="i586">
  <version epoch="0" ver="1.0.18" rel="3.33"/>
  <changelog author="Michal Hrusecky &lt;michal.hrusecky@opensuse.org&gt;" date="1537876800">- Initial package version 1.0.18</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1612440000">- Add 0001-fix-memory-leaks.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 1.0.18" date="1710417600">- spec file changes
  * add more license files
  * update License tag to include BSD-3-Clause or GPL-2.0-only
  * change URL tag to https://github.com/shevek/libsrs2 as libsrs2.org
    is down
  * add 0002-improve-makefile.patch from upstream</changelog>
</package>
<package pkgid="d6fdaa7a041fafbd22aaa1c6010ce30118015bc4d5c239cfa7c358c7d63b8e0275594a633312f7b3c37fa7106ddb81d7794e78d684bd62fe5872ccd73de82223" name="srs2-tools" arch="x86_64">
  <version epoch="0" ver="1.0.18" rel="3.33"/>
  <changelog author="Michal Hrusecky &lt;michal.hrusecky@opensuse.org&gt;" date="1537876800">- Initial package version 1.0.18</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt;" date="1612440000">- Add 0001-fix-memory-leaks.patch</changelog>
  <changelog author="Matthias Fehring &lt;buschmann23@opensuse.org&gt; - 1.0.18" date="1710417600">- spec file changes
  * add more license files
  * update License tag to include BSD-3-Clause or GPL-2.0-only
  * change URL tag to https://github.com/shevek/libsrs2 as libsrs2.org
    is down
  * add 0002-improve-makefile.patch from upstream</changelog>
</package>
</otherdata>