imapflow 1.6.0 → 1.6.2

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "1.6.0"
+    ".": "1.6.2"
 }

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.6.2](https://github.com/postalsys/imapflow/compare/v1.6.1...v1.6.2) (2026-07-28)
+
+
+### Bug Fixes
+
+* never fall back to LSUB on an IMAP4rev2 session ([329f588](https://github.com/postalsys/imapflow/commit/329f58829592a3c9a9f69fa74387596a3e55eac3))
+
+## [1.6.1](https://github.com/postalsys/imapflow/compare/v1.6.0...v1.6.1) (2026-07-27)
+
+
+### Bug Fixes
+
+* keep the authentication result on a verifyOnly connection ([8665c64](https://github.com/postalsys/imapflow/commit/8665c642f16988c630a779fa796c5801532ffd4a))
+
 ## [1.6.0](https://github.com/postalsys/imapflow/compare/v1.5.0...v1.6.0) (2026-07-27)
 
 

package/lib/commands/list.js

@@ -478,20 +478,21 @@ module.exports = async (connection, reference, mailbox, options) => {
             response.next();
         };
 
-        // Skipped when RETURN (SUBSCRIBED) already provided subscription state or when
-        // this connection's server already rejected LSUB once. Safety net: if the
-        // extended LIST was accepted but not a single mailbox came back subscribed on a
-        // non-rev2 session, assume the server silently ignored RETURN (SUBSCRIBED) and
-        // fall back to LSUB anyway (a rev2 session has no LSUB to fall back to, and an
-        // account without any subscriptions legitimately looks the same).
-        let needsLsub = !successStage.subscribed || (!isRev2Active(connection) && !entries.some(entry => entry.subscribed));
+        // Never sent on a rev2 session - LSUB is not part of that protocol version, and
+        // some servers break the rest of the session over the rejection, so this is
+        // decided up front rather than left to the skipLsub latch below. On rev1 it is
+        // skipped when RETURN (SUBSCRIBED) already answered. Safety net: if the extended
+        // LIST was accepted but not a single mailbox came back subscribed, assume the
+        // server silently ignored the option and fall back to LSUB anyway (an account
+        // with no subscriptions legitimately looks the same).
+        let needsLsub = !isRev2Active(connection) && (!successStage.subscribed || !entries.some(entry => entry.subscribed));
         if (needsLsub && !connection.skipLsub) {
             try {
                 await runLsub();
             } catch (err) {
                 if (isRejectedCommand(err)) {
-                    // Tagged BAD: the server does not recognize the command (IMAP4rev2
-                    // removed LSUB) - skip LSUB for the rest of this connection
+                    // Tagged BAD: the server does not implement LSUB despite advertising
+                    // rev1 - skip it for the rest of this connection
                     connection.skipLsub = true;
                 } else if (err.responseStatus !== 'NO' || err.code === 'ETHROTTLE') {
                     // Transport failures and throttling: rethrow, every follow-up

package/lib/imap-flow.js

@@ -2292,12 +2292,20 @@ class ImapFlow extends EventEmitter {
             // live server state. Cleared during the first close only, so repeated close() calls
             // stay idempotent and cannot emit an event twice.
             // `byeReason` is deliberately kept: it explains why the session ended.
+            //
+            // `authenticated` is kept for a verifyOnly connection, where it is the result rather
+            // than live state. That mode authenticates, optionally lists, and logs out before
+            // connect() resolves, so clearing it here left every caller reading `false` off a
+            // connection that had just authenticated successfully - there is no later moment at
+            // which the answer could be read, and such a client is never reconnected.
             let closedMailbox = false;
             if (!this.isClosed) {
                 closedMailbox = this.mailbox;
                 this.mailbox = false;
                 this.currentSelectCommand = false;
-                this.authenticated = false;
+                if (!this.options.verifyOnly) {
+                    this.authenticated = false;
+                }
                 this.preCheck = false;
             }
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "1.6.0",
+    "version": "1.6.2",
     "description": "IMAP Client for Node",
     "main": "lib/imap-flow.js",
     "types": "lib/imap-flow.d.ts",
@@ -30,9 +30,9 @@
     "homepage": "https://imapflow.com/",
     "devDependencies": {
         "@eslint/js": "10.0.1",
-        "@types/node": "26.1.1",
+        "@types/node": "26.1.2",
         "c8": "12.0.0",
-        "eslint": "10.7.0",
+        "eslint": "10.8.0",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "10.1.8",
         "grunt": "1.6.2",

package/test/commands-integration-test.js

@@ -4168,7 +4168,7 @@ module.exports['Commands: list survives LSUB rejection'] = async test => {
         exec: async (cmd, attrs, opts) => {
             if (cmd === 'LSUB') {
                 lsubCalls++;
-                // e.g. Exchange in IMAP4rev2 mode responds "BAD Command Argument Error"
+                // e.g. Exchange responds "BAD Command Argument Error"
                 throw commandError('Command failed', 'BAD');
             }
             if (cmd === 'LIST' && opts && opts.untagged && opts.untagged.LIST) {
@@ -4304,6 +4304,40 @@ module.exports['Commands: list retries with plain LIST when RETURN is rejected']
     test.done();
 };
 
+module.exports['Commands: list never falls back to LSUB on a rev2 session'] = async test => {
+    let lsubCalled = false;
+    // An Exchange-alike that advertises both revisions and negotiates rev2 via ENABLE,
+    // having already proved it rejects RETURN (SUBSCRIBED). The listing therefore
+    // carries no subscription state - and the LSUB that rev1 would fall back to is not
+    // part of rev2, so asking anyway only risks upsetting the session.
+    const connection = createMockConnection({
+        state: 3,
+        capabilities: new Map([
+            ['IMAP4rev2', true],
+            ['IMAP4rev1', true]
+        ]),
+        enabled: new Set(['IMAP4REV2']),
+        skipListSubscribedArg: true,
+        exec: async (cmd, attrs, opts) => {
+            if (cmd === 'LSUB') {
+                lsubCalled = true;
+            }
+            if (cmd === 'LIST' && opts && opts.untagged && opts.untagged.LIST) {
+                await opts.untagged.LIST({
+                    attributes: [[{ value: '\\HasNoChildren' }], { value: '/' }, { value: 'Folder1' }]
+                });
+            }
+            return { next: () => {} };
+        }
+    });
+
+    const result = await listCommand(connection, '', '*');
+    test.equal(lsubCalled, false);
+    // No subscription source was available, so nothing claims the folder is subscribed
+    test.ok(!result.find(entry => entry.path === 'Folder1').subscribed);
+    test.done();
+};
+
 module.exports['Commands: list does not retry extended LIST on transport errors'] = async test => {
     let listCalls = 0;
     const connection = createMockConnection({

package/test/imap-flow-server-test.js

@@ -615,6 +615,43 @@ module.exports['Server: verifyOnly connect lists mailboxes and logs out'] = asyn
     test.done();
 };
 
+module.exports['Server: verifyOnly keeps the authentication result after logging out'] = async test => {
+    // The whole point of verifyOnly is to report whether the credentials work. The mode logs out
+    // before connect() resolves, so if close() cleared `authenticated` the caller would read false
+    // off a connection that had just authenticated, with no later moment to read the real answer.
+    let server = createServer();
+    let port = await listen(server);
+    let client = makeClient(port, { verifyOnly: true, includeMailboxes: true });
+    client.on('error', () => {});
+
+    await client.connect();
+    test.ok(client.authenticated, 'authentication result survives the verifyOnly logout');
+
+    client.close();
+    test.ok(client.authenticated, 'and survives an explicit close as well');
+
+    server.close();
+    test.done();
+};
+
+module.exports['Server: an ordinary session clears the authentication state on close'] = async test => {
+    // The counterpart: for a session that is not verifyOnly, `authenticated` describes live state
+    // and must not survive the connection, or reconnect logic reads it as still signed in.
+    let server = createServer();
+    let port = await listen(server);
+    let client = makeClient(port);
+    client.on('error', () => {});
+
+    await client.connect();
+    test.ok(client.authenticated, 'authenticated while the session is up');
+
+    client.close();
+    test.equal(client.authenticated, false, 'cleared once the session ends');
+
+    server.close();
+    test.done();
+};
+
 module.exports['Server: ID is re-requested after login when first response is sparse'] = async test => {
     let idCalls = 0;
     let server = createServer({