Bump zbateson/mail-mime-parser from 1.3.3 to 3.0.6

[dependabot]

Bumps zbateson/mail-mime-parser from 1.3.3 to 3.0.6.

Release notes

Sourced from zbateson/mail-mime-parser's releases.

3.0.6

What's Changed

• Strip control characters (CR/LF) from attachment filenames and from decoded header parameter and MIME-encoded-word values -- thanks @​Iliaal
• Add configurable limits to MIME parsing, each recording a parse error when reached (override via DI config) -- thanks @​Iliaal:
  • maxMimePartDepth (default 256) — maximum multipart nesting depth
  • maxHeaderCount (default 1000) — maximum headers per part
  • maxHeaderSizeBytes (default 1048576) — maximum total header bytes per part
• Append child parts in O(n) rather than O(n²) -- thanks @​Iliaal.
• Generate MIME boundaries with random_bytes() -- thanks @​Iliaal.

Security

This release fixes two privately reported vulnerabilities:

• GHSA-36h5-qg4p-q2qf -- CRLF header injection via attachment filename.
• GHSA-f6v3-2qmr-vfjx -- uncontrolled resource consumption (CPU/memory) when parsing untrusted MIME.

Found and reported privately by @​iliaal, who also proposed fixes that informed the patches. Upgrading is recommended.

3.0.5

What's Changed

• Php 8.5 support by @​phpfui in zbateson/mail-mime-parser#260

Full Changelog: zbateson/mail-mime-parser@3.0.4...3.0.5

3.0.4

What's Changed

• Fix getAttachmentPart typo in IMessage.php docs by @​seanmckenzie428 in zbateson/mail-mime-parser#245

New Contributors

• @​seanmckenzie428 made their first contribution in zbateson/mail-mime-parser#245

Full Changelog: zbateson/mail-mime-parser@3.0.3...3.0.4

3.0.3

• Fix to allow empty address groups #241
• Ignore ws between rfc2047 parts in q-part #240
• Fix PartBuilder parent parameter type

Full Changelog: zbateson/mail-mime-parser@3.0.2...3.0.3

3.0.2

What's Changed

• Replace global DI library functions with corresponding objects for PRS-4 compliance by @​phpfui in zbateson/mail-mime-parser#238

Full Changelog: zbateson/mail-mime-parser@3.0.1...3.0.2

3.0.1

Fixes version constraints for php-di, guzzlehttp/psr7 and phpunit.

... (truncated)

Commits

• 395c406 Bump version
• 4aed399 Use random_bytes() for generated MIME boundaries
• fa44823 Add configurable limits to MIME parsing
• d2970b5 Remove CR/LF from attachment headers and values
• ff054c8 Merge pull request #260 from phpfui/PHP85
• 476ad26 Add PHP 8.5 for testing
• 4a117ca Fix 8.5 depreciation
• 153b8f2 Merge pull request #253 from ThomasLandauer/patch-1
• f0ccec9 Increment docs version
• d7160e5 Allow line breaks in date headers #258
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.