chore(deps): bump zbateson/mail-mime-parser from 3.0.5 to 4.0.4

[dependabot]

Bumps zbateson/mail-mime-parser from 3.0.5 to 4.0.4.

Release notes

Sourced from zbateson/mail-mime-parser's releases.

4.0.4

What's Changed

• Add a configurable limit on the total number of parts in a message, recording a parse error when reached (override via DI config) -- thanks @​iam-niranjan:
  • maxMessagePartCount (default 10000) — maximum parts per message, MIME and uu-encoded
• Parse header values in O(n) rather than O(n²)
• Add configurable limits to header parsing, each recording a parse error when reached (override via DI config):
  • maxCommentDepth (default 32) — maximum nesting depth of parenthesised header comments
  • maxHeaderTokenCount (default 20000) — maximum tokens parsed from a single header value; the remainder is kept as one unparsed token

Security

This release fixes a reported vulnerability:

• GHSA-pmx8-5pxm-f2r6 -- uncontrolled resource consumption (CPU/memory) when parsing untrusted messages, completing the fix for CVE-2026-61816.

Reported by @​iam-niranjan, who identified the unbounded part counts and proposed fixes that informed the patches; the header parsing issues were found during the resulting review. Upgrading is recommended.

4.0.3

What's Changed

• Allow Guzzle PSR-7 v3 by @​simPod in zbateson/mail-mime-parser#268

New Contributors

• @​simPod made their first contribution in zbateson/mail-mime-parser#268

Full Changelog: zbateson/mail-mime-parser@4.0.2...4.0.3

4.0.2

What's Changed

• Strip control characters (CR/LF) from attachment filenames and from decoded header parameter and MIME-encoded-word values -- thanks @​iliaal
• Add configurable limits to MIME parsing, each recording a parse error when reached (override via DI config) -- thanks @​iliaal:
  • maxMimePartDepth (default 256) — maximum multipart nesting depth
  • maxHeaderCount (default 1000) — maximum headers per part
  • maxHeaderSizeBytes (default 1048576) — maximum total header bytes per part
• Append child parts in O(n) rather than O(n²) -- thanks @​iliaal
• Generate MIME boundaries with random_bytes() -- thanks @​iliaal

Security

This release fixes two privately reported vulnerabilities:

• GHSA-36h5-qg4p-q2qf -- CRLF header injection via attachment filename.
• GHSA-f6v3-2qmr-vfjx -- uncontrolled resource consumption (CPU/memory) when parsing untrusted MIME.

Found and reported privately by @​iliaal, who also proposed fixes that informed the patches. Upgrading is recommended.

4.0.1

Full Changelog: zbateson/mail-mime-parser@4.0.0...4.0.1

4.0.0

Full Changelog: zbateson/mail-mime-parser@3.0.5...4.0.0

... (truncated)

Commits

• 4cc63e4 Bump version
• ad2a871 Add a configurable header token count limit
• b6dcc59 Add a configurable header comment depth limit
• 1f273b5 Build header parts without repeated array copies
• c781520 Add a configurable message part count limit
• f0f7ea3 Bump version
• 4c8ba38 Merge pull request #268 from simPod/compat/psr7-v3-mail-mime-parser
• 6ce6d7d Allow Guzzle PSR-7 v3
• 0f268ce Bump version
• 3e2abe3 Use random_bytes() for generated MIME boundaries
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Quality Report — ConductionNL/openregister @ bbe9d58

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	❌
psalm	❌
phpstan	❌
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		❌
test-l10n-parity		✅
format		❌
check-schema-l10n		❌
check-l10n-js		✅
composer			✅	✅ 174/174
npm			✅	✅ 653/653
app:check-code	⏭️
info.xml	✅
REUSE	❌
lockfile sync		✅
PHPUnit					❌
Newman					❌
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it on any branch from the Actions tab, or locally with npx playwright test.
Hydra gates					❌

---

Quality workflow — 2026-09-15 21:53 UTC

Download the full PDF report from the workflow artifacts.