tdiary 5.5.0 → 5.6.0

data/vendor/bundle/ruby/3.4.0/gems/{net-imap-0.5.15 → net-imap-0.6.6}/lib/net/imap.rb

@@ -326,6 +326,11 @@ module Net
   #
   #   <em>In general, #capable? should be used rather than explicitly sending a
   #   +CAPABILITY+ command to the server.</em>
+  # - #enable: Enables backwards incompatible server extensions.
+  #   <em>Requires the +ENABLE+ or +IMAP4rev2+ capability.</em>
+  # - #enabled: Returns a set of enabled server extensions.
+  # - #enabled?: Returns whether a server extension has been enabled.
+  # - #utf8_enabled?: Returns whether UTF-8 string encoding has been enabled.
   #
   # === Handling server responses
   #
@@ -359,8 +364,8 @@ module Net
   #
   # - #capability: Returns the server's capabilities as an array of strings.
   #
-  #   <em>In general, #capable? should be used rather than explicitly sending a
-  #   +CAPABILITY+ command to the server.</em>
+  #   <em>In general,</em> #capable? <em>should be used rather than explicitly
+  #   sending a +CAPABILITY+ command to the server.</em>
   # - #noop: Allows the server to send unsolicited untagged #responses.
   # - #logout: Tells the server to end the session. Enters the +logout+ state.
   #
@@ -450,8 +455,8 @@ module Net
   #
   # Although IMAP4rev2[https://www.rfc-editor.org/rfc/rfc9051] is not supported
   # yet, Net::IMAP supports several extensions that have been folded into it:
-  # +ENABLE+, +IDLE+, +MOVE+, +NAMESPACE+, +SASL-IR+, +UIDPLUS+, +UNSELECT+,
-  # <tt>STATUS=SIZE</tt>, and the fetch side of +BINARY+.
+  # +ENABLE+, +IDLE+, +LITERAL-+, +MOVE+, +NAMESPACE+, +SASL-IR+, +UIDPLUS+,
+  # +UNSELECT+, <tt>STATUS=SIZE</tt>, and the fetch side of +BINARY+.
   # Commands for these extensions are listed with the {Core IMAP
   # commands}[rdoc-ref:Net::IMAP@Core+IMAP+commands], above.
   #
@@ -459,7 +464,7 @@ module Net
   #   <em>The following are folded into +IMAP4rev2+ but are currently
   #   unsupported or incompletely supported by</em> Net::IMAP<em>: RFC4466
   #   extensions, +SEARCHRES+, +LIST-EXTENDED+, +LIST-STATUS+,
-  #   +LITERAL-+, and +SPECIAL-USE+.</em>
+  #   and +SPECIAL-USE+.</em>
   #
   # ==== RFC2087: +QUOTA+
   # +NOTE:+ Only the +STORAGE+ quota resource type is currently supported.
@@ -489,9 +494,7 @@ module Net
   # IMAP4rev2[https://www.rfc-editor.org/rfc/rfc9051].
   # - Updates #fetch and #uid_fetch with the +BINARY+, +BINARY.PEEK+, and
   #   +BINARY.SIZE+ items.  See FetchData#binary and FetchData#binary_size.
-  #
-  # >>>
-  #   *NOTE:* The binary extension the #append command is _not_ supported yet.
+  # - Updates #append to allow binary messages containing +NULL+ bytes.
   #
   # ==== RFC3691: +UNSELECT+
   # Folded into IMAP4rev2[https://www.rfc-editor.org/rfc/rfc9051] and also included
@@ -554,6 +557,7 @@ module Net
   # ==== RFC6855: <tt>UTF8=ACCEPT</tt>, <tt>UTF8=ONLY</tt>
   #
   # - See #enable for information about support for UTF-8 string encoding.
+  # - #utf8_enabled?: Returns whether UTF-8 string encoding has been enabled.
   #
   # ==== RFC7162: +CONDSTORE+
   #
@@ -571,6 +575,15 @@ module Net
   # - Updates #store and #uid_store with the +unchangedsince+ modifier and adds
   #   the +MODIFIED+ ResponseCode to the tagged response.
   #
+  # ==== RFC7888: <tt>LITERAL+</tt>
+  # - Literal strings smaller than Config#max_non_synchronizing_literal bytes
+  #   are sent without waiting for the server's continuation request.
+  #
+  # ==== RFC7888: +LITERAL-+
+  # - Literal strings smaller than 4096 bytes or
+  #   Config#max_non_synchronizing_literal (whichever is smaller)
+  #   are sent without waiting for the server's continuation request.
+  #
   # ==== RFC8438: <tt>STATUS=SIZE</tt>
   # - Updates #status with the +SIZE+ status attribute.
   #
@@ -644,9 +657,9 @@ module Net
   #   RFC 5322, DOI 10.17487/RFC5322, October 2008,
   #   <https://www.rfc-editor.org/info/rfc5322>.
   #
-  #   <em>Note: obsoletes</em>
-  #   RFC-2822[https://www.rfc-editor.org/rfc/rfc2822]<em> (April 2001) and</em>
-  #   RFC-822[https://www.rfc-editor.org/rfc/rfc822]<em> (August 1982).</em>
+  #   *NOTE*: obsoletes
+  #   RFC-2822[https://www.rfc-editor.org/rfc/rfc2822] (April 2001) and
+  #   RFC-822[https://www.rfc-editor.org/rfc/rfc822] (August 1982).
   #
   # [CHARSET[https://www.rfc-editor.org/rfc/rfc2978]]::
   #   Freed, N. and J. Postel, "IANA Charset Registration Procedures", BCP 19,
@@ -753,8 +766,8 @@ module Net
   #   Gulbrandsen, A. and N. Freed, Ed., "Internet Message Access Protocol
   #   (\IMAP) - MOVE Extension", RFC 6851, DOI 10.17487/RFC6851, January 2013,
   #   <https://www.rfc-editor.org/info/rfc6851>.
-  # [UTF8=ACCEPT[https://www.rfc-editor.org/rfc/rfc6855]]::
-  # [UTF8=ONLY[https://www.rfc-editor.org/rfc/rfc6855]]::
+  # [{UTF8=ACCEPT}[https://www.rfc-editor.org/rfc/rfc6855]]::
+  # [{UTF8=ONLY}[https://www.rfc-editor.org/rfc/rfc6855]]::
   #   Resnick, P., Ed., Newman, C., Ed., and S. Shen, Ed.,
   #   "IMAP Support for UTF-8", RFC 6855, DOI 10.17487/RFC6855, March 2013,
   #   <https://www.rfc-editor.org/info/rfc6855>.
@@ -806,7 +819,7 @@ module Net
   # * {IMAP URLAUTH Authorization Mechanism Registry}[https://www.iana.org/assignments/urlauth-authorization-mechanism-registry/urlauth-authorization-mechanism-registry.xhtml]
   #
   class IMAP < Protocol
-    VERSION = "0.5.15"
+    VERSION = "0.6.6"
 
     # Aliases for supported capabilities, to be used with the #enable command.
     ENABLE_ALIASES = {
@@ -814,6 +827,11 @@ module Net
       "UTF8=ONLY" => "UTF8=ACCEPT",
     }.freeze
 
+    # Aliases for supported capabilities, to be used with #enabled?.
+    ENABLED_ALIASES = {
+      utf8: Set.new(%w[UTF8=ACCEPT IMAP4REV2]).freeze,
+    }.freeze
+
     dir = File.expand_path("imap", __dir__)
     autoload :ConnectionState,        "#{dir}/connection_state"
     autoload :ResponseReader,         "#{dir}/response_reader"
@@ -823,10 +841,6 @@ module Net
     autoload :StringPrep,             "#{dir}/stringprep"
 
     include MonitorMixin
-    if defined?(OpenSSL::SSL)
-      include OpenSSL
-      include SSL
-    end
 
     # :call-seq:
     #   Net::IMAP::SequenceSet(set = nil) -> SequenceSet
@@ -1107,11 +1121,11 @@ module Net
       @ssl_ctx_params, @ssl_ctx = build_ssl_ctx(ssl)
 
       # Basic Client State
-      @utf8_strings = false
       @debug_output_bol = true
       @exception = nil
       @greeting = nil
       @capabilities = nil
+      @enabled = Set.new
       @tls_verified = false
       @connection_state = ConnectionState::NotAuthenticated.new
 
@@ -1142,6 +1156,44 @@ module Net
       start_imap_connection
     end
 
+    # Returns a string representation of +self+, showing basic client state
+    # information.
+    #
+    #   imap = Net::IMAP.new(hostname, ssl: true)
+    #   imap.inspect #=> "#<Net::IMAP imap.example.net:993 TLS not_authenticated>"
+    #
+    #   imap.authenticate(:oauthbearer, "user", token)
+    #   imap.inspect #=> "#<Net::IMAP imap.example.net:993 TLS authenticated>"
+    #
+    #   imap.select("INBOX")
+    #   imap.inspect #=> "#<Net::IMAP imap.example.net:993 TLS selected>"
+    #
+    #   imap.logout
+    #   imap.inspect #=> "#<Net::IMAP imap.example.net:993 TLS logout>"
+    #
+    #   imap = Net::IMAP.new(hostname, ssl: false)
+    #   imap.inspect #=> "#<Net::IMAP imap.example.net:143 PLAINTEXT not_authenticated>"
+    #
+    #   imap.starttls verify_mode: OpenSSL::SSL::VERIFY_NONE
+    #   imap.inspect #=> "#<Net::IMAP imap.example.net:993 TLS (NOT VERIFIED) not_authenticated>"
+    #
+    def inspect
+      conn_state = disconnected? ? "disconnected" : connection_state.to_sym
+      "#<%s:0x%08x %s:%s %s %s>" % [
+        self.class.name, __id__, host, port, inspect_tls_state, conn_state
+      ]
+    end
+
+    private def inspect_tls_state
+      if tls_verified?
+        "TLS"
+      elsif ssl_ctx && @sock.kind_of?(OpenSSL::SSL::SSLSocket)
+        "TLS (#{@sock.session ? "NOT VERIFIED" : "NOT ESTABLISHED"})"
+      else
+        "PLAINTEXT#{" (TLS NOT STARTED)" if ssl_ctx}"
+      end
+    end
+
     # Returns true after the TLS negotiation has completed and the remote
     # hostname has been verified.  Returns false when TLS has been established
     # but peer verification was disabled.
@@ -1152,9 +1204,10 @@ module Net
     # Waits for receiver thread to close before returning, except when called
     # from inside the connection mutex such as from a response handler.  Slow or
     # stuck response handlers can cause #disconnect to hang until they complete.
+    # Use +timeout+ to limit how long to wait for the receiver thread to exit.
     #
     # Related: #logout, #logout!
-    def disconnect
+    def disconnect(timeout: nil)
       in_logout_state = try_state_logout?
       return if disconnected?
       in_receiver_thread = Thread.current == @receiver_thread
@@ -1166,7 +1219,7 @@ module Net
         @receiver_thread.raise(e) unless in_receiver_thread
       end
       @sock.close
-      @receiver_thread.join unless mon_owned? || in_receiver_thread
+      @receiver_thread.join(timeout) unless mon_owned? || in_receiver_thread
       raise e if e
     ensure
       # Try again after shutting down the receiver thread.  With no reciever
@@ -1428,7 +1481,7 @@ module Net
       end
       if error
         disconnect
-        raise error
+        reraise error
       end
       unless handled
         disconnect
@@ -1551,6 +1604,7 @@ module Net
     # completes.  If the TaggedResponse to #authenticate includes updated
     # capabilities, they will be cached.
     def authenticate(*args, sasl_ir: config.sasl_ir, **props, &callback)
+      sasl_ir = may_depend_on_capabilities_cached?(sasl_ir)
       sasl_adapter.authenticate(*args, sasl_ir: sasl_ir, **props, &callback)
         .tap do state_authenticated! _1 end
     end
@@ -1602,7 +1656,7 @@ module Net
     # When the +condstore+ keyword argument is true, the server is told to
     # enable the extension.  If +mailbox+ supports persistence of mod-sequences,
     # the +HIGHESTMODSEQ+ ResponseCode will be sent as an untagged response to
-    # #select and all `FETCH` responses will include FetchData#modseq.
+    # #select and all +FETCH+ responses will include FetchData#modseq.
     # Otherwise, the +NOMODSEQ+ ResponseCode will be sent.
     #
     # A Net::IMAP::NoResponseError is raised if the mailbox does not
@@ -1930,7 +1984,7 @@ module Net
       if storage_limit.nil?
         list = []
       else
-        list = ["STORAGE", Integer(storage_limit)]
+        list = ["STORAGE", NumValidator.coerce_number64(storage_limit)]
       end
       send_command("SETQUOTA", quota_root, list)
     end
@@ -2078,9 +2132,14 @@ module Net
     #
     # ==== Capabilities
     #
+    # If +BINARY+ [RFC3516[https://www.rfc-editor.org/rfc/rfc3516.html]] is
+    # supported by the server, +message+ may contain +NULL+ characters and
+    # be sent as a binary literal.  Otherwise, binary message parts must be
+    # encoded appropriately (for example, +base64+).
+    #
     # If +UIDPLUS+ [RFC4315[https://www.rfc-editor.org/rfc/rfc4315.html]] is
     # supported and the destination supports persistent UIDs, the server's
-    # response should include an +APPENDUID+ response code with UIDPlusData.
+    # response should include an +APPENDUID+ response code with AppendUIDData.
     # This will report the UIDVALIDITY of the destination mailbox and the
     # assigned UID of the appended message.
     #
@@ -2088,12 +2147,11 @@ module Net
     # TODO: add MULTIAPPEND support
     #++
     def append(mailbox, message, flags = nil, date_time = nil)
+      message = StringFormatter.literal_or_literal8(message, name: "message")
       args = []
-      if flags
-        args.push(flags)
-      end
+      args.push(flags)     if flags
       args.push(date_time) if date_time
-      args.push(Literal.new(message))
+      args.push(message)
       send_command("APPEND", mailbox, *args)
     end
 
@@ -2847,7 +2905,7 @@ module Net
     #
     # If +UIDPLUS+ [RFC4315[https://www.rfc-editor.org/rfc/rfc4315.html]] is
     # supported, the server's response should include a +COPYUID+ response code
-    # with UIDPlusData.  This will report the UIDVALIDITY of the destination
+    # with CopyUIDData.  This will report the UIDVALIDITY of the destination
     # mailbox, the UID set of the source messages, and the assigned UID set of
     # the moved messages.
     #
@@ -2888,7 +2946,7 @@ module Net
     #
     # If +UIDPLUS+ [RFC4315[https://www.rfc-editor.org/rfc/rfc4315.html]] is
     # supported, the server's response should include a +COPYUID+ response code
-    # with UIDPlusData.  This will report the UIDVALIDITY of the destination
+    # with CopyUIDData.  This will report the UIDVALIDITY of the destination
     # mailbox, the UID set of the source messages, and the assigned UID set of
     # the moved messages.
     #
@@ -3114,12 +3172,48 @@ module Net
       synchronize do
         send_command("ENABLE", *capabilities)
         result = clear_responses("ENABLED").last || []
-        @utf8_strings ||= result.include? "UTF8=ACCEPT"
-        @utf8_strings ||= result.include? "IMAP4REV2"
+        @enabled.merge(result.map(&:upcase))
         result
       end
     end
 
+    # Returns whether UTF-8 string encoding has been enabled for the connection.
+    #
+    # This is currently identical to calling #enabled? with +:utf8+.
+    #
+    # See #enable and #enabled?.
+    def utf8_enabled?; enabled?(:utf8) end
+
+    # Returns whether +capability+ is in the set of #enabled capabilities,
+    # matched case-insensitively.
+    #
+    # When +capability+ is +:utf8+, it matches if _either_
+    # <tt>"UTF8=ACCEPT"</tt> or <tt>"IMAP4REV2"</tt> is enabled.
+    #
+    # See #enable and #utf8_enabled?.
+    def enabled?(capability)
+      case capability
+      in String
+        capability = capability.upcase
+        synchronize { @enabled.include?(capability) }
+      in Symbol
+        capabilities = ENABLED_ALIASES[capability] or
+          raise ArgumentError, "unknown capability alias: #{capability}"
+        synchronize { @enabled.intersect?(capabilities) }
+      else
+        raise TypeError, "expected capability to be String or Symbol, " \
+                         "got %s" % [capability.class]
+      end
+    end
+
+    # Returns a set of enabled capabilities for the connection, as upper-cased
+    # strings.
+    #
+    # See #enable and #enabled?.
+    def enabled
+      synchronize { @enabled.dup }
+    end
+
     # Sends an {IDLE command [RFC2177 §3]}[https://www.rfc-editor.org/rfc/rfc6851#section-3]
     # {[IMAP4rev2 §6.3.13]}[https://www.rfc-editor.org/rfc/rfc9051#section-6.3.13]
     # that waits for notifications of new or expunged messages.  Yields
@@ -3156,8 +3250,9 @@ module Net
 
       synchronize do
         tag = Thread.current[:net_imap_tag] = generate_tag
-        guard_against_tagged_response_skipping_handler!(tag, "IDLE")
+        command = Command[tag:, name: "IDLE"]
         put_string("#{tag} IDLE#{CRLF}")
+        finish_sending_command(command)
 
         begin
           add_response_handler(&response_handler)
@@ -3165,7 +3260,7 @@ module Net
           @idle_done_cond.wait(timeout)
           @idle_done_cond = nil
           if @receiver_thread_terminating
-            raise @exception || Net::IMAP::Error.new("connection closed")
+            reraise @exception || Net::IMAP::Error.new("connection closed")
           end
         ensure
           remove_response_handler(response_handler)
@@ -3174,6 +3269,9 @@ module Net
             response = get_tagged_response(tag, "IDLE", idle_response_timeout)
           end
         end
+      rescue InvalidResponseError
+        disconnect
+        raise
       end
 
       return response
@@ -3465,67 +3563,28 @@ module Net
     end
 
     def receive_responses
-      connection_closed = false
-      until connection_closed
-        synchronize do
-          @exception = nil
-        end
-        begin
-          resp = get_response
-        rescue Exception => e
-          synchronize do
-            state_logout!
-            @sock.close
-            @exception = e
-          end
-          break
-        end
-        unless resp
-          synchronize do
-            @exception = EOFError.new("end of file reached")
-          end
-          break
-        end
-        begin
-          synchronize do
-            case resp
-            when TaggedResponse
-              @tagged_responses[resp.tag] = resp
-              @tagged_response_arrival.broadcast
-              case resp.tag
-              when @logout_command_tag
-                state_logout!
-                return
-              when @continued_command_tag
-                @continuation_request_exception =
-                  RESPONSE_ERRORS[resp.name].new(resp)
-                @continuation_request_arrival.signal
-              end
-            when UntaggedResponse
-              record_untagged_response(resp)
-              if resp.name == "BYE" && @logout_command_tag.nil?
-                state_logout!
-                @sock.close
-                @exception = ByeResponseError.new(resp)
-                connection_closed = true
-              end
-            when ContinuationRequest
-              @continuation_request_arrival.signal
-            end
-            state_unselected! if resp in {data: {code: {name: "CLOSED"}}}
-            @response_handlers.each do |handler|
-              handler.call(resp)
-            end
-          end
-        rescue Exception => e
-          @exception = e
-          synchronize do
-            @tagged_response_arrival.broadcast
-            @continuation_request_arrival.broadcast
-          end
-        end
+      exception = nil
+      loop do
+        resp = get_response or raise EOFError, "end of file reached"
+        handle_response(resp) or return
       end
+    rescue Exception => exception
+      # NOTE: this rescue clause is only capturing the exception for the ensure
+      # clause.  Using `$!` in the ensure clause seems to trigger a weird
+      # TruffleRuby bug: https://github.com/truffleruby/truffleruby/issues/4308
+      #
+      # We don't assign @exception directly here, because we want that to be
+      # atomically synchronized with all of the other changes in `ensure`.
+      raise
+    ensure
       synchronize do
+        if exception
+          # Handling exceptions here, not in a rescue clause, so the lock isn't
+          # released and reacquired between rescue and ensure clauses.
+          @exception ||= exception
+          @sock.close
+        end
+        state_logout!
         @receiver_thread_terminating = true
         @tagged_response_arrival.broadcast
         @continuation_request_arrival.broadcast
@@ -3533,36 +3592,6 @@ module Net
           @idle_done_cond.signal
         end
       end
-    ensure
-      state_logout!
-    end
-
-    def get_tagged_response(tag, cmd, timeout = nil)
-      if timeout
-        deadline = Time.now + timeout
-      end
-      until @tagged_responses.key?(tag)
-        raise @exception if @exception
-        if timeout
-          timeout = deadline - Time.now
-          if timeout <= 0
-            return nil
-          end
-        end
-        @tagged_response_arrival.wait(timeout)
-      end
-      resp = @tagged_responses.delete(tag)
-      case resp.name
-      when /\A(?:OK)\z/ni
-        return resp
-      when /\A(?:NO)\z/ni
-        raise NoResponseError, resp
-      when /\A(?:BAD)\z/ni
-        raise BadResponseError, resp
-      else
-        disconnect
-        raise InvalidResponseError, "invalid tagged resp: %p" % [resp.raw.chomp]
-      end
     end
 
     def get_response
@@ -3575,6 +3604,47 @@ module Net
     #############################
     # built-in response handlers
 
+    def handle_response(resp)
+      connection_closed = false
+      synchronize do
+        case resp
+        when TaggedResponse
+          @tagged_responses[resp.tag] = resp
+          @tagged_response_arrival.broadcast
+          case resp.tag
+          when @logout_command_tag
+            state_logout!
+            return
+          when @continued_command_tag
+            @continuation_request_exception =
+              RESPONSE_ERRORS[resp.name].new(resp)
+            @continuation_request_arrival.signal
+          end
+        when UntaggedResponse
+          record_untagged_response(resp)
+          if resp.name == "BYE" && @logout_command_tag.nil?
+            state_logout!
+            @sock.close
+            @exception = ByeResponseError.new(resp)
+            connection_closed = true
+          end
+        when ContinuationRequest
+          @continuation_request_arrival.signal
+        end
+        state_unselected! if resp in {data: {code: {name: "CLOSED"}}}
+        @response_handlers.each do |handler|
+          handler.call(resp)
+        end
+      rescue Exception => e
+        @exception = e
+        @tagged_response_arrival.broadcast
+        @continuation_request_arrival.broadcast
+      ensure
+        @exception = nil unless connection_closed
+      end
+      !connection_closed
+    end
+
     # store name => [..., data]
     def record_untagged_response(resp)
       @responses[resp.name] << resp.data
@@ -3611,45 +3681,96 @@ module Net
     end
 
     def send_command(cmd, *args, &block)
+      args.each do validate_data _1 end
       synchronize do
-        args.each do |i|
-          validate_data(i)
-        end
         tag = generate_tag
+        command = Command[tag:, name: cmd]
         put_string(tag + " " + cmd)
         args.each do |i|
           put_string(" ")
           send_data(i, tag)
         end
-        guard_against_tagged_response_skipping_handler!(tag, cmd)
-        put_string(CRLF)
-        if cmd == "LOGOUT"
-          @logout_command_tag = tag
-        end
-        if block
-          add_response_handler(&block)
-        end
+        @logout_command_tag = tag if cmd == "LOGOUT"
+        finish_sending_command(command)
+        add_response_handler(&block) if block
         begin
-          return get_tagged_response(tag, cmd)
+          put_string(CRLF)
+          get_tagged_response(tag, cmd)
         ensure
-          if block
-            remove_response_handler(block)
+          remove_response_handler(block) if block
+        end
+      rescue InvalidResponseError
+        disconnect
+        raise
+      end
+    end
+
+    # NOTE: This must be synchronized with sending the command's final CRLF and
+    # adding any command-related response handlers.
+    def finish_sending_command(command)
+      if (response = @tagged_responses[command.tag])&.name&.casecmp?("OK")
+        raise InvalidTaggedResponseError.new(:incomplete, command:, response:)
+      end
+    end
+
+    def get_tagged_response(tag, cmd, timeout = nil)
+      if timeout
+        deadline = Time.now + timeout
+      end
+      until @tagged_responses.key?(tag)
+        reraise @exception
+        if timeout
+          timeout = deadline - Time.now
+          if timeout <= 0
+            return nil
           end
         end
+        @tagged_response_arrival.wait(timeout)
+      end
+      resp = @tagged_responses.delete(tag)
+      case resp.name
+      when /\A(?:OK)\z/ni
+        return resp
+      when /\A(?:NO)\z/ni
+        raise NoResponseError, resp
+      when /\A(?:BAD)\z/ni
+        raise BadResponseError, resp
+      else
+        disconnect
+        raise InvalidResponseError, "invalid tagged resp: %p" % [resp.raw_data.chomp]
       end
-    rescue InvalidResponseError
-      disconnect
-      raise
     end
 
-    def guard_against_tagged_response_skipping_handler!(tag, cmd)
-      return unless (resp = @tagged_responses[tag])&.name&.upcase == "OK"
-      raise InvalidResponseError, format(
-        "Received tagged 'OK' to incomplete %s command (tag=%s).  " \
-        "This could indicate a malicious server, a man-in-the-middle, or " \
-        "client-side command injection.  Disconnecting.",
-        cmd, tag
-      )
+    # Raises a copy of +exception+ with an updated +backtrace+ and +cause+, or
+    # returns +nil+ when +exception+ is falsey.
+    #
+    # +backtrace+ is set to reflect the current caller.
+    #
+    # +cause+ is set to the original exception, _if_ the original has its own
+    # backtrace or cause.  Otherwise, the original was never raised and the
+    # default cause is used.
+    #
+    # This is meant for exceptions that may have been created by another thread.
+    # Raising them directly gives a misleading backtrace, making it hard to
+    # discover where the errors originate.  Although it is sometimes more
+    # appropriate to raise a wrapping exception, that changes the API and forces
+    # updates to users' `rescue` pattern matching.
+    def reraise(exception)
+      return unless exception
+      copy = exception.dup
+      # NOTE: set_backtrace(caller_locations) doesn't work for CRuby <= 3.3.
+      #   and set_backtrace(nil) doesn't work for TruffleRuby 34.0.0:
+      #   https://github.com/truffleruby/truffleruby/issues/4296
+      if RUBY_ENGINE == "truffleruby"
+        copy.set_backtrace caller_locations
+      else
+        copy.set_backtrace nil
+      end
+      if exception.cause || exception.backtrace
+        raise copy, cause: exception
+      else
+        raise copy
+      end
     end
 
     def generate_tag
@@ -3673,11 +3794,11 @@ module Net
     end
 
     def enforce_logindisabled?
-      if config.enforce_logindisabled == :when_capabilities_cached
-        capabilities_cached?
-      else
-        config.enforce_logindisabled
-      end
+      may_depend_on_capabilities_cached?(config.enforce_logindisabled)
+    end
+
+    def may_depend_on_capabilities_cached?(value)
+      value == :when_capabilities_cached ? capabilities_cached? : value
     end
 
     def expunge_internal(...)
@@ -3873,12 +3994,9 @@ module Net
     def build_ssl_ctx(ssl)
       if ssl
         params = (Hash.try_convert(ssl) || {}).freeze
-        context = SSLContext.new
+        context = OpenSSL::SSL::SSLContext.new
         context.set_params(params)
-        if defined?(VerifyCallbackProc)
-          context.verify_callback = VerifyCallbackProc
-        end
-        context.freeze
+        context.setup
         [params, context]
       else
         false
@@ -3889,12 +4007,12 @@ module Net
       raise "SSL extension not installed" unless defined?(OpenSSL::SSL)
       raise "already using SSL" if @sock.kind_of?(OpenSSL::SSL::SSLSocket)
       raise "cannot start TLS without SSLContext" unless ssl_ctx
-      @sock = SSLSocket.new(@sock, ssl_ctx)
+      @sock = OpenSSL::SSL::SSLSocket.new(@sock, ssl_ctx)
       @reader = ResponseReader.new(self, @sock)
       @sock.sync_close = true
       @sock.hostname = @host if @sock.respond_to? :hostname=
       ssl_socket_connect(@sock, open_timeout)
-      if ssl_ctx.verify_mode != VERIFY_NONE
+      if ssl_ctx.verify_mode != OpenSSL::SSL::VERIFY_NONE
         @sock.post_connection_check(@host)
         @tls_verified = true
       end
@@ -3958,7 +4076,6 @@ require_relative "imap/errors"
 require_relative "imap/config"
 require_relative "imap/command_data"
 require_relative "imap/data_encoding"
-require_relative "imap/data_lite"
 require_relative "imap/flags"
 require_relative "imap/response_data"
 require_relative "imap/response_parser"