[CVE-2026-42257] Bump net-imap to 0.5.15

Dockerfile

@@ -31,8 +31,8 @@ RUN rm -rf /usr/local/bundle/gems/ruby-maven-* \
 
 # Drop the vulnerable Bouncy Castle 1.79 jars from JRuby's default jruby-openssl
 # 0.15.3 (CVE-2026-5588); the pinned 0.16.0 gem provides 1.84 at runtime.
-# Also drop JRuby's vulnerable net-imap copies (CVE-2026-42246): the default
-# gem 0.2.3 and the older stdlib 0.1.1 (net/imap.rb). The pinned 0.3.10 gem
+# Also drop JRuby's vulnerable net-imap copies (CVE-2026-42246 and later): the default
+# gem 0.2.3 and the older stdlib 0.1.1 (net/imap.rb). The pinned 0.5.15 gem
 # from the Gemfile provides the fixed version at runtime.
 # Needs root as /opt/jruby is root-owned.
 USER root

Dockerfile.wolfi

@@ -64,8 +64,8 @@ RUN rm -rf /usr/local/bundle/gems/ruby-maven-* \
 
 # Drop the vulnerable Bouncy Castle 1.79 jars from JRuby's default jruby-openssl
 # 0.15.3 (CVE-2026-5588); the pinned 0.16.0 gem provides 1.84 at runtime.
-# Also drop JRuby's vulnerable net-imap copies (CVE-2026-42246): the default
-# gem 0.2.3 and the older stdlib 0.1.1 (net/imap.rb). The pinned 0.3.10 gem
+# Also drop JRuby's vulnerable net-imap copies (CVE-2026-42246 and later): the default
+# gem 0.2.3 and the older stdlib 0.1.1 (net/imap.rb). The pinned 0.5.15 gem
 # from the Gemfile provides the fixed version at runtime.
 # Done in the builder stage, before /opt/jruby is copied into the runtime image.
 RUN rm -rf /opt/jruby/lib/ruby/stdlib/org/bouncycastle \

Gemfile

@@ -40,9 +40,10 @@ group :default do
   # JRuby 9.4.12.0's default jruby-openssl 0.15.3 ships the vulnerable 1.79.
   gem 'jruby-openssl', '0.16.0', platform: :jruby
 
-  # JRuby 9.4.12.0 ships net-imap 0.2.3 as a default gem (CVE-2026-42246 STARTTLS
-  # stripping). Pin the lowest fixed release so Bundler installs over the default.
-  gem 'net-imap', '0.3.10'
+  # JRuby 9.4.12.0 ships net-imap 0.2.3 as a default gem. Pin above the fixed
+  # lines for CVE-2026-42246 / CVE-2026-42257 / CVE-2026-42245 / CVE-2026-42258
+  # / CVE-2026-47240 / CVE-2026-47242 / CVE-2026-47241 (0.5.15 clears all).
+  gem 'net-imap', '0.5.15'
 
   # Gems that need jruby as the platform
   gem 'bson', '~> 4.15.0', platform: :jruby

Gemfile.lock

@@ -68,7 +68,7 @@ GEM
     method_source (1.1.0)
     minitest (5.22.3)
     multi_json (1.15.0)
-    net-imap (0.3.10)
+    net-imap (0.5.15)
       date
       net-protocol
     net-protocol (0.2.2)
@@ -184,7 +184,7 @@ DEPENDENCIES
   jruby-openssl (= 0.16.0)
   json (~> 2.7.2)
   json-schema (~> 4.3.0)
-  net-imap (= 0.3.10)
+  net-imap (= 0.5.15)
   nokogiri (~> 1.18.9)
   pry (~> 0.14.2)
   pry-nav

NOTICE.txt

@@ -1699,32 +1699,13 @@ OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 --------------------------------------------------------------------------------
-Library: net-imap 0.3.10
+Library: net-imap 0.5.15
 URL: https://github.com/ruby/net-imap
 License: Ruby OR BSD-2-Clause
 
-Copyright (C) 1993-2013 Yukihiro Matsumoto. All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-notice, this list of conditions and the following disclaimer in the
-documentation and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.
+All the files in this distribution are covered under either the Ruby license or
+the BSD-2-Clause license (see the file COPYING) except some documentation mentioned
+below.
 
 -------------------------------------------------------------------------