1.1.2

Security

• imap_mail() rejects line breaks in $to, $subject, $cc, $bcc and $return_path, other than header folding. Before, they let the caller add headers such as a hidden Bcc: (GHSA-7j2h-8378-qm32, #18).

Fixes

• imap_mail() returns false with a warning when the sendmail program is missing, fails or is killed, like mail(). Exit code 75 (the message was queued) still counts as success (#17).

Install

• configure finds Kerberos through krb5-multidev, so apt-get install libc-client-dev is enough on Debian and Ubuntu (#15, #16).
• Each release now includes a package for pecl, also as imap.tgz under the fixed link releases/latest/download/imap.tgz (#14, #19).

pie install sirlouen/imap

or with pecl:

curl -LO https://github.com/SirLouen/pecl-mail-imap/releases/download/1.1.2/imap-1.1.2.tgz
pecl install imap-1.1.2.tgz

Upgrading

Both imap_mail() changes return false with a warning where 1.1.1 returned true. If your application turns warnings into exceptions, these calls now throw.

1.1.1

• Fix a crash in imap_close() with CL_EXPUNGE on a connection opened with OP_PROTOTYPE (#12).
• Report the correct extension version. 1.1.0 was tagged before PHP_IMAP_VERSION was updated, so phpversion('imap') and php --ri imap showed 1.0.3 (#13).

pie install sirlouen/imap

For the changes since PECL imap 1.0.3, see the 1.1.0 release notes.

1.1.0

This release reports its version as 1.0.3 in phpversion('imap') and php --ri imap, because it was tagged before the version number was updated. 1.1.1 reports the correct version and also fixes a crash in imap_close().

First release of this fork of php/pecl-mail-imap, based on PECL imap 1.0.3. The extension name, functions and license do not change.

Install

pie install sirlouen/imap

c-client must be installed first. See the README for the distribution packages.

Changes since 1.0.3

• Builds and runs on PHP 8.6 and php-src master, which removed XtOffsetOf() and INI_STR() (#1, #2).
• Can be installed with PIE as sirlouen/imap (#9).
• A plain ./configure, which is what PIE runs, enables Kerberos and SSL support by itself when c-client needs them (#6).
• Without c-client, ./configure now stops with "Cannot find rfc822.h" instead of an unrelated error (#8).
• The test suite passes on PHP 8.5 and later (#3).
• CI runs the whole test suite against Dovecot on PHP 8.3 to 8.6, NTS and ZTS, including the GSSAPI test that used to be skipped. It also builds on Alpine, installs with PIE, and builds on Windows (#4 to #9).

Known limitations

• Not safe with several threads in one process, as in FrankenPHP. ZTS builds that run one thread per process, like the CLI and PHP-FPM, work.
• No Windows support through PIE yet, and PHP 8.6 on Windows is not supported.
• c-client has to come from the system. Debian 13, Ubuntu 26.10, Fedora and Homebrew no longer package it.