Bump net-imap from 0.5.8 to 0.5.15 in /rails_app

[dependabot]

Bumps net-imap from 0.5.8 to 0.5.15.

Release notes

Sourced from net-imap's releases.

v0.5.15

What's Changed

🔒 Security

This release fixes several more security vulnerabilities which are related to the fixes in v0.5.14. Please see the linked security advisories for more information.

• (moderate) Command Injection via non-synchronizing literal in "raw" argument (CVE-2026-47240, GHSA-8p34-64r3-mwg8) This vulnerability depends how the server interprets non-synchronizing literals. The connection is not vulnerable if the server supports non-synchronizing literals.
  • 🥅 Validate non-synchronizing literals support by @​nevans in ruby/net-imap#703 (backports ruby/net-imap#701)
• (moderate) Command Injection via unvalidated ID and ENABLE arguments (CVE-2026-47242, GHSA-46q3-7gv7-qmgg)
  • 🥅 Validate ID values contain only valid bytes by @​nevans in ruby/net-imap#703 (backports ruby/net-imap#698)
  • 🥅 Validate #enable arguments are all atoms by @​nevans in ruby/net-imap#703 (backport ruby/net-imap#699) NOTE: #enable should never be called with untrusted input.
• (low) Denial of Service via incomplete "raw" argument validation (CVE-2026-47241, GHSA-c4fp-cxrr-mj66) This results in the affected command hanging until the connection is closed. If another thread attempts to send a concurrent pipelined command, the first thread will return with a syntax error and the second thread will hang until the connection closes.
  • Reported by @​fg0x0
  • 🐛 Prevent trailing {0} in RawData validation by @​nevans in ruby/net-imap#703 (backports ruby/net-imap#700)

Fixed

• 🥅 Validate that Atom and Flag are not empty by @​nevans in ruby/net-imap#685 (backports ruby/net-imap#684)
• 🧵 Fix deadlock in #disconnect by @​nevans in ruby/net-imap#697 (backports ruby/net-imap#686)

Documentation

• ⚠️ Boost visibility of raw data argument documentation warnings by @​nevans in ruby/net-imap#696 (backports ruby/net-imap#677)

Other Changes

• 🏷️ Allow 64-bit Integer arguments in ruby/net-imap#696 (backports ruby/net-imap#675)
• 🥅 Ensure send_number_data input is an Integer in ruby/net-imap#696 (backports ruby/net-imap#676)
• ♻️ Improve RawData.new, Add RawData.split by @​nevans in ruby/net-imap#696 (backports ruby/net-imap#679)
• 🥅 Validate response literal byte size format by @​nevans in ruby/net-imap#696 (backports ruby/net-imap#681)

Miscellaneous

• ✅ Improvements to tests' FakeServer in ruby/net-imap#696 (backports ruby/net-imap#678)

Full Changelog: ruby/net-imap@v0.5.14...v0.5.15

v0.5.14

What's Changed

🔒 Security

This release contains fixes for multiple vulnerabilities concerning STARTTLS stripping, argument validation, and denial of service attacks.

[!WARNING] ruby/net-imap#665 fixes a STARTTLS stripping vulnerability (GHSA-vcgp-9326-pqcp). Without this fix, a man-in-the-middle attacker can cause Net::IMAP#starttls to return "successfully", without starting TLS.

[!IMPORTANT] Argument validation is significantly improved. Several command injection vulnerabilities have been fixed: ruby/net-imap#662 fixes CRLF/command/argument injection via Symbol arguments (GHSA-75xq-5h9v-w6px). ruby/net-imap#662 fixes CRLF/command/argument injection via the attr argument to #store/#uid_store (GHSA-hm49-wcqc-g2xg)

... (truncated)

Commits

• ce20fc8 🔖 Bump version to 0.5.15
• 0b7b83c 🔀 Merge pull request #703 from ruby/backport/v0.5/security-patches
• f22fd6c 🍒 pick 0ea9eba3 (#701): ✅ Fix flaky tests for MacOS, TruffleRuby
• 1246074 🍒 pick ae9f83b5 (#701): ♻️ Extract str.bytesize lvar in send_literal
• a2f61af 🍒 pick 62a0da6d (#701): 🥅 Validate non-synchronizing literals support
• e33348c 🍒 pick d6ddd294 (#700): 🐛 Prevent trailing {0} in RawData validation
• 4f81b69 🍒 pick 1f97168b (#699): 🥅 Validate #enable arguments are all atoms
• 69da4a4 🍒 pick 8d9397ab (#698): 🥅 Validate QuotedString contains only valid bytes
• 7aab580 🍒 pick e3c50fad (#698): ♻️ Refactor RawText, add improve test coverage
• fac1733 🍒 pick aab64f92 (#686): 🧵 Fix deadlock in #disconnect
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[chris-olszewski]

@dependabot rebase