imapflow 1.3.2 → 1.3.4

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "1.3.2"
+    ".": "1.3.4"
 }

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [1.3.4](https://github.com/postalsys/imapflow/compare/v1.3.3...v1.3.4) (2026-05-29)
+
+
+### Bug Fixes
+
+* bumped deps ([593b805](https://github.com/postalsys/imapflow/commit/593b805ed88d62bf7200a1a2ef081ce49f9162c0))
+* handle THREADID NIL in FETCH response ([#353](https://github.com/postalsys/imapflow/issues/353)) ([40318d6](https://github.com/postalsys/imapflow/commit/40318d69b866989d6e84f1d0652d118920a3162e))
+
+## [1.3.3](https://github.com/postalsys/imapflow/compare/v1.3.2...v1.3.3) (2026-04-29)
+
+
+### Bug Fixes
+
+* handle NIL delimiter in NAMESPACE response (RFC 2342) ([#351](https://github.com/postalsys/imapflow/issues/351)) ([10bda2a](https://github.com/postalsys/imapflow/commit/10bda2a1d398dc7bc6ea0ede50b1ae48e4b28cf7))
+
 ## [1.3.2](https://github.com/postalsys/imapflow/compare/v1.3.1...v1.3.2) (2026-04-17)
 
 

package/lib/commands/namespace.js

@@ -4,7 +4,7 @@
  * Requests NAMESPACE info from the server.
  *
  * @param {Object} connection - IMAP connection instance
- * @returns {Promise<{prefix: string, delimiter: string}|{error: boolean, status: string, text: string}>} The primary personal namespace, or an error object on failure
+ * @returns {Promise<{prefix: string, delimiter: string|null}|{error: boolean, status: string, text: string}>} The primary personal namespace, or an error object on failure
  */
 module.exports = async connection => {
     if (![connection.states.AUTHENTICATED, connection.states.SELECTED].includes(connection.state)) {
@@ -114,7 +114,7 @@ async function getListPrefix(connection) {
  * Parses namespace information from an IMAP NAMESPACE response attribute.
  *
  * @param {Array} attribute - Namespace attribute array from the server response
- * @returns {Array<{prefix: string, delimiter: string}>|boolean} Array of namespace entries, or false if empty
+ * @returns {Array<{prefix: string, delimiter: string|null}>|boolean} Array of namespace entries, or false if empty
  */
 function getNamsepaceInfo(attribute) {
     if (!attribute || !attribute.length) {
@@ -122,10 +122,15 @@ function getNamsepaceInfo(attribute) {
     }
 
     return attribute
-        .filter(entry => entry.length >= 2 && typeof entry[0].value === 'string' && typeof entry[1].value === 'string')
+        .filter(
+            entry =>
+                // RFC 2342 §5 allows the delimiter to be NIL when the namespace has
+                // no hierarchy. The token parser emits a literal `null` for NIL.
+                entry.length >= 2 && entry[0] && typeof entry[0].value === 'string' && (entry[1] === null || (entry[1] && typeof entry[1].value === 'string'))
+        )
         .map(entry => {
             let prefix = entry[0].value;
-            let delimiter = entry[1].value;
+            let delimiter = entry[1] === null ? null : entry[1].value;
 
             // Append the delimiter to the prefix if it doesn't already end with one,
             // so callers can construct full paths by simply concatenating prefix + name.

package/lib/tools.js

@@ -383,6 +383,10 @@ const tools = {
                 if (Array.isArray(attribute)) {
                     return attribute.map(entry => (entry && typeof entry.value === 'string' ? entry.value : false)).filter(entry => entry);
                 }
+                // NIL (parsed as null) and other non-array values yield an empty array,
+                // so callers can safely index into the result. RFC 8474 allows e.g.
+                // `THREADID NIL` when the server has no thread relation to report.
+                return [];
             };
 
             switch (key) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "1.3.2",
+    "version": "1.3.4",
     "description": "IMAP Client for Node",
     "main": "lib/imap-flow.js",
     "types": "lib/imap-flow.d.ts",
@@ -28,9 +28,9 @@
     "homepage": "https://imapflow.com/",
     "devDependencies": {
         "@eslint/js": "10.0.1",
-        "@types/node": "25.6.0",
+        "@types/node": "25.9.1",
         "c8": "11.0.0",
-        "eslint": "10.2.0",
+        "eslint": "10.4.0",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "10.1.8",
         "grunt": "1.6.2",
@@ -42,14 +42,14 @@
         "typescript": "6.0.3"
     },
     "dependencies": {
-        "@zone-eu/mailsplit": "5.4.9",
+        "@zone-eu/mailsplit": "5.4.12",
         "encoding-japanese": "2.2.0",
         "iconv-lite": "0.7.2",
         "libbase64": "1.3.0",
         "libmime": "5.3.8",
         "libqp": "2.1.1",
-        "nodemailer": "8.0.5",
+        "nodemailer": "8.0.10",
         "pino": "10.3.1",
-        "socks": "2.8.7"
+        "socks": "2.8.9"
     }
 }

package/test/commands-integration-test.js

@@ -6457,6 +6457,185 @@ module.exports['Commands: namespace handles NIL namespaces'] = async test => {
     test.done();
 };
 
+module.exports['Commands: namespace handles NIL delimiter (RFC 2342)'] = async test => {
+    // RFC 2342 §5: NIL delimiter means the namespace has no hierarchy.
+    // The token parser emits a literal `null` for NIL.
+
+    const connection = createMockConnection({
+        state: 2,
+        capabilities: new Map([['NAMESPACE', true]]),
+        exec: async (cmd, args, opts) => {
+            if (opts && opts.untagged && opts.untagged.NAMESPACE) {
+                await opts.untagged.NAMESPACE({
+                    attributes: [
+                        [
+                            [{ value: '' }, { value: '/' }],
+                            [{ value: '#hidden' }, null]
+                        ],
+                        null,
+                        null
+                    ]
+                });
+            }
+            return { next: () => {} };
+        }
+    });
+
+    const result = await namespaceCommand(connection);
+
+    // Guard against handler crash so a regression surfaces as a failed
+    // assertion rather than fatal-halting the whole nodeunit suite.
+    if (result && result.error) {
+        test.ok(false, 'namespace command returned error sentinel — likely crashed on NIL delimiter');
+        test.done();
+        return;
+    }
+    if (!Array.isArray(connection.namespaces && connection.namespaces.personal)) {
+        test.ok(false, 'connection.namespaces.personal is not an array (handler crashed mid-untagged-callback)');
+        test.done();
+        return;
+    }
+
+    test.equal(connection.namespaces.personal.length, 2, 'both personal entries should be parsed');
+
+    test.equal(connection.namespaces.personal[0].prefix, '');
+    test.equal(connection.namespaces.personal[0].delimiter, '/');
+
+    // NIL-delimiter entry preserved with delimiter:null rather than dropped silently.
+    test.equal(connection.namespaces.personal[1].prefix, '#hidden');
+    test.equal(connection.namespaces.personal[1].delimiter, null);
+
+    // Default namespace pointer resolves to the first valid personal entry.
+    test.equal(connection.namespace.prefix, '');
+    test.equal(connection.namespace.delimiter, '/');
+
+    test.done();
+};
+
+module.exports['Commands: namespace handles NIL delimiter as only personal entry'] = async test => {
+    // Edge case: only a NIL-delimiter entry in the personal section.
+    // connection.namespace must still be set and usable downstream.
+
+    const connection = createMockConnection({
+        state: 2,
+        capabilities: new Map([['NAMESPACE', true]]),
+        exec: async (cmd, args, opts) => {
+            if (opts && opts.untagged && opts.untagged.NAMESPACE) {
+                await opts.untagged.NAMESPACE({
+                    attributes: [[[{ value: '#hidden' }, null]], null, null]
+                });
+            }
+            return { next: () => {} };
+        }
+    });
+
+    const result = await namespaceCommand(connection);
+
+    if (result && result.error) {
+        test.ok(false, 'namespace command returned error sentinel — likely crashed on NIL delimiter');
+        test.done();
+        return;
+    }
+    if (!Array.isArray(connection.namespaces && connection.namespaces.personal)) {
+        test.ok(false, 'connection.namespaces.personal is not an array (handler crashed mid-untagged-callback)');
+        test.done();
+        return;
+    }
+
+    test.equal(connection.namespaces.personal.length, 1);
+    test.equal(connection.namespaces.personal[0].prefix, '#hidden');
+    test.equal(connection.namespaces.personal[0].delimiter, null);
+
+    test.ok(connection.namespace);
+    test.equal(connection.namespace.prefix, '#hidden');
+    test.equal(connection.namespace.delimiter, null);
+
+    test.done();
+};
+
+module.exports['Commands: namespace handles NIL delimiter in other and shared sections'] = async test => {
+    // NIL delimiter is also valid in the `other` and `shared` sections,
+    // not just `personal`.
+
+    const connection = createMockConnection({
+        state: 2,
+        capabilities: new Map([['NAMESPACE', true]]),
+        exec: async (cmd, args, opts) => {
+            if (opts && opts.untagged && opts.untagged.NAMESPACE) {
+                await opts.untagged.NAMESPACE({
+                    attributes: [[[{ value: '' }, { value: '/' }]], [[{ value: 'Other Users/' }, null]], [[{ value: 'Public/' }, null]]]
+                });
+            }
+            return { next: () => {} };
+        }
+    });
+
+    const result = await namespaceCommand(connection);
+
+    if (result && result.error) {
+        test.ok(false, 'namespace command returned error sentinel — likely crashed on NIL delimiter');
+        test.done();
+        return;
+    }
+
+    test.ok(Array.isArray(connection.namespaces.other), 'other should be an array');
+    test.equal(connection.namespaces.other.length, 1);
+    test.equal(connection.namespaces.other[0].prefix, 'Other Users/');
+    test.equal(connection.namespaces.other[0].delimiter, null);
+
+    test.ok(Array.isArray(connection.namespaces.shared), 'shared should be an array');
+    test.equal(connection.namespaces.shared.length, 1);
+    test.equal(connection.namespaces.shared[0].prefix, 'Public/');
+    test.equal(connection.namespaces.shared[0].delimiter, null);
+
+    test.done();
+};
+
+module.exports['Commands: namespace skips malformed entries without crashing'] = async test => {
+    // The filter must reject entries that don't match either the
+    // (string-prefix, string-delimiter) or (string-prefix, NIL) shape,
+    // so a single broken entry from a buggy server doesn't poison
+    // the whole namespace list or crash the handler.
+
+    const connection = createMockConnection({
+        state: 2,
+        capabilities: new Map([['NAMESPACE', true]]),
+        exec: async (cmd, args, opts) => {
+            if (opts && opts.untagged && opts.untagged.NAMESPACE) {
+                await opts.untagged.NAMESPACE({
+                    attributes: [
+                        [
+                            [{ value: '' }, { value: '/' }], // valid
+                            [{ value: '#hidden' }, null], // valid (NIL delimiter)
+                            [{ value: 'broken' }], // too short — rejected
+                            [null, { value: '/' }], // null prefix — rejected
+                            [{ value: 123 }, { value: '/' }] // non-string prefix — rejected
+                        ],
+                        null,
+                        null
+                    ]
+                });
+            }
+            return { next: () => {} };
+        }
+    });
+
+    const result = await namespaceCommand(connection);
+
+    if (result && result.error) {
+        test.ok(false, 'namespace command returned error sentinel — likely crashed on malformed entry');
+        test.done();
+        return;
+    }
+
+    test.equal(connection.namespaces.personal.length, 2, 'only the two well-formed entries should be kept');
+    test.equal(connection.namespaces.personal[0].prefix, '');
+    test.equal(connection.namespaces.personal[1].prefix, '#hidden');
+    test.equal(connection.namespaces.personal[1].delimiter, null);
+
+    test.done();
+};
+
 module.exports['Commands: namespace handles multiple personal namespaces'] = async test => {
     const connection = createMockConnection({
         state: 2,

package/test/tools-test.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const tools = require('../lib/tools');
+const { parser } = require('../lib/handler/imap-handler');
 
 // Mock connection for testing
 let createMockConnection = (options = {}) => ({
@@ -1137,3 +1138,29 @@ module.exports['Tools: getColorFlags with null returns result not null'] = test
     test.ok(result.remove.includes('\\Flagged'));
     test.done();
 };
+
+// ============================================
+// formatMessageResponse: OBJECTID NIL handling (RFC 8474)
+// ============================================
+
+module.exports['Tools: formatMessageResponse handles THREADID NIL'] = async test => {
+    // RFC 8474 allows `THREADID NIL` when the server has no thread relation to
+    // report (e.g. Strato). The NIL token is parsed as null and must not crash.
+    let untagged = await parser('* 1 FETCH (UID 1 EMAILID (E1) THREADID NIL FLAGS (\\Seen) MODSEQ (4312))');
+    let result = await tools.formatMessageResponse(untagged, {});
+    test.equal(result.seq, 1);
+    test.equal(result.uid, 1);
+    test.equal(result.emailId, 'E1');
+    test.equal(result.threadId, undefined);
+    test.ok(result.flags.has('\\Seen'));
+    test.equal(result.modseq, 4312n);
+    test.done();
+};
+
+module.exports['Tools: formatMessageResponse handles normal THREADID'] = async test => {
+    let untagged = await parser('* 2 FETCH (THREADID (T9999) EMAILID (E2))');
+    let result = await tools.formatMessageResponse(untagged, {});
+    test.equal(result.threadId, 'T9999');
+    test.equal(result.emailId, 'E2');
+    test.done();
+};