Bump zbateson/mail-mime-parser from 4.0.1 to 4.0.5

[dependabot]

Bumps zbateson/mail-mime-parser from 4.0.1 to 4.0.5.

Release notes

Sourced from zbateson/mail-mime-parser's releases.

4.0.5

Fixes #269 -- $streamPartEndPos in ZBateson\MailMimeParser\Parser\PartBuilder can be null when there is no body part in the mime message

Full Changelog: zbateson/mail-mime-parser@4.0.4...4.0.5

4.0.4

What's Changed

• Add a configurable limit on the total number of parts in a message, recording a parse error when reached (override via DI config) -- thanks @​iam-niranjan:
  • maxMessagePartCount (default 10000) — maximum parts per message, MIME and uu-encoded
• Parse header values in O(n) rather than O(n²)
• Add configurable limits to header parsing, each recording a parse error when reached (override via DI config):
  • maxCommentDepth (default 32) — maximum nesting depth of parenthesised header comments
  • maxHeaderTokenCount (default 20000) — maximum tokens parsed from a single header value; the remainder is kept as one unparsed token

Security

This release fixes a reported vulnerability:

• GHSA-pmx8-5pxm-f2r6 -- uncontrolled resource consumption (CPU/memory) when parsing untrusted messages, completing the fix for CVE-2026-61816.

Reported by @​iam-niranjan, who identified the unbounded part counts and proposed fixes that informed the patches; the header parsing issues were found during the resulting review. Upgrading is recommended.

4.0.3

What's Changed

• Allow Guzzle PSR-7 v3 by @​simPod in zbateson/mail-mime-parser#268

New Contributors

• @​simPod made their first contribution in zbateson/mail-mime-parser#268

Full Changelog: zbateson/mail-mime-parser@4.0.2...4.0.3

4.0.2

What's Changed

• Strip control characters (CR/LF) from attachment filenames and from decoded header parameter and MIME-encoded-word values -- thanks @​iliaal
• Add configurable limits to MIME parsing, each recording a parse error when reached (override via DI config) -- thanks @​iliaal:
  • maxMimePartDepth (default 256) — maximum multipart nesting depth
  • maxHeaderCount (default 1000) — maximum headers per part
  • maxHeaderSizeBytes (default 1048576) — maximum total header bytes per part
• Append child parts in O(n) rather than O(n²) -- thanks @​iliaal
• Generate MIME boundaries with random_bytes() -- thanks @​iliaal

Security

This release fixes two privately reported vulnerabilities:

• GHSA-36h5-qg4p-q2qf -- CRLF header injection via attachment filename.
• GHSA-f6v3-2qmr-vfjx -- uncontrolled resource consumption (CPU/memory) when parsing untrusted MIME.

Found and reported privately by @​iliaal, who also proposed fixes that informed the patches. Upgrading is recommended.

Commits

• 2239961 Fix parsing non-mime messages with no body
• 4cc63e4 Bump version
• ad2a871 Add a configurable header token count limit
• b6dcc59 Add a configurable header comment depth limit
• 1f273b5 Build header parts without repeated array copies
• c781520 Add a configurable message part count limit
• f0f7ea3 Bump version
• 4c8ba38 Merge pull request #268 from simPod/compat/psr7-v3-mail-mime-parser
• 6ce6d7d Allow Guzzle PSR-7 v3
• 0f268ce Bump version
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.