imapflow 2.0.2 → 2.0.4

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## [2.0.4](https://github.com/postalsys/imapflow/compare/v2.0.3...v2.0.4) (2026-09-15)
+
+
+### Bug Fixes
+
+* **deps:** update libmime to 5.4.4 and encoding-japanese to 2.4.0 ([ffa0f93](https://github.com/postalsys/imapflow/commit/ffa0f93a60e7b17f8bd6f6920c158ee308b95cee))
+
+## [2.0.3](https://github.com/postalsys/imapflow/compare/v2.0.2...v2.0.3) (2026-09-14)
+
+
+### Bug Fixes
+
+* bound the chunked download loop by the reported message size ([fc9b4eb](https://github.com/postalsys/imapflow/commit/fc9b4ebdcc15fbc952fb2a18d98a723511e384ab))
+* stop chunked download when the server ignores the partial spec ([#396](https://github.com/postalsys/imapflow/issues/396)) ([e216fde](https://github.com/postalsys/imapflow/commit/e216fdeaad4724bdeead6f346e207cd3d75a20fd))
+
 ## [2.0.2](https://github.com/postalsys/imapflow/compare/v2.0.1...v2.0.2) (2026-09-10)
 
 

package/dist/cjs/imap-flow.js

@@ -3029,7 +3029,22 @@ class ImapFlow extends node_events_1.EventEmitter {
                 return {};
             }
             processed += chunk.length;
-            hasMore = chunk.length >= chunkSize;
+            // A compliant server returns at most `chunkSize` bytes for a partial
+            // request. Some servers (Tencent Exmail among them) ignore the partial
+            // spec and answer every request with the complete part. That chunk is
+            // then larger than requested, so treating it as "full, keep going"
+            // would advance the offset past the end forever and never see a short
+            // chunk. An oversized answer already contains the whole part - stop.
+            hasMore = chunk.length === chunkSize;
+            if (chunk.length > chunkSize) {
+                this.log.warn({
+                    msg: 'Server returned more than the requested window, treating the part as complete',
+                    chunkSize,
+                    received: chunk.length,
+                    processed,
+                    cid: this.id
+                });
+            }
             let result = { chunk };
             if (query.size) {
                 result.response = response;
@@ -3198,11 +3213,30 @@ class ImapFlow extends node_events_1.EventEmitter {
             }
             return stream.write(chunk);
         };
+        // Ceiling on how many bytes one download may pull off the wire, as the backstop for the
+        // partial-ignoring servers above: a part whose size happens to equal chunkSize exactly
+        // comes back looking like a full window every time, so no test over chunk lengths can end
+        // that loop. RFC822.SIZE bounds any part of the message; doubled for servers that count
+        // line endings differently than they deliver, plus one window so a download sitting right
+        // at the bound still gets its terminating chunk. Infinity when the server reported no
+        // size, which leaves the loop bounded by maxBytes alone.
+        let maxTotalBytes = (0, limited_passthrough_js_1.normalizeByteLimit)(meta.expectedSize ? meta.expectedSize * 2 + chunkSize : 0);
         // Fetch remaining chunks in a loop, writing each to the decoder stream.
-        // Stops when the server returns a short chunk (< chunkSize), the byte
-        // limiter is satisfied, or the consumer destroys the output stream.
+        // Stops when the server returns a short chunk (< chunkSize), answers with more than the
+        // requested window, the byte limiter is satisfied, or the consumer destroys the output
+        // stream. Throws when the ceiling above is crossed.
         let fetchAllParts = async () => {
             while (hasMore && !isLimited() && !fetchAborted) {
+                if (processed >= maxTotalBytes) {
+                    // Loud on purpose. Everything written downstream by this point holds
+                    // duplicated content, and a quiet stop is indistinguishable from a clean EOF,
+                    // so the consumer would store a corrupt body believing it intact.
+                    let err = new Error('Download exceeded the expected message size');
+                    err.code = 'DownloadOverflow';
+                    err.maxSize = maxTotalBytes;
+                    err.cid = this.id;
+                    throw err;
+                }
                 let { chunk } = await getNextPart();
                 if (!chunk || fetchAborted) {
                     break;

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.0.2";
+export declare const version = "2.0.4";
 export declare const homepage = "https://imapflow.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'imapflow';
-exports.version = '2.0.2';
+exports.version = '2.0.4';
 exports.homepage = 'https://imapflow.com/';

package/dist/esm/imap-flow.js

@@ -2989,7 +2989,22 @@ export class ImapFlow extends EventEmitter {
                 return {};
             }
             processed += chunk.length;
-            hasMore = chunk.length >= chunkSize;
+            // A compliant server returns at most `chunkSize` bytes for a partial
+            // request. Some servers (Tencent Exmail among them) ignore the partial
+            // spec and answer every request with the complete part. That chunk is
+            // then larger than requested, so treating it as "full, keep going"
+            // would advance the offset past the end forever and never see a short
+            // chunk. An oversized answer already contains the whole part - stop.
+            hasMore = chunk.length === chunkSize;
+            if (chunk.length > chunkSize) {
+                this.log.warn({
+                    msg: 'Server returned more than the requested window, treating the part as complete',
+                    chunkSize,
+                    received: chunk.length,
+                    processed,
+                    cid: this.id
+                });
+            }
             let result = { chunk };
             if (query.size) {
                 result.response = response;
@@ -3158,11 +3173,30 @@ export class ImapFlow extends EventEmitter {
             }
             return stream.write(chunk);
         };
+        // Ceiling on how many bytes one download may pull off the wire, as the backstop for the
+        // partial-ignoring servers above: a part whose size happens to equal chunkSize exactly
+        // comes back looking like a full window every time, so no test over chunk lengths can end
+        // that loop. RFC822.SIZE bounds any part of the message; doubled for servers that count
+        // line endings differently than they deliver, plus one window so a download sitting right
+        // at the bound still gets its terminating chunk. Infinity when the server reported no
+        // size, which leaves the loop bounded by maxBytes alone.
+        let maxTotalBytes = normalizeByteLimit(meta.expectedSize ? meta.expectedSize * 2 + chunkSize : 0);
         // Fetch remaining chunks in a loop, writing each to the decoder stream.
-        // Stops when the server returns a short chunk (< chunkSize), the byte
-        // limiter is satisfied, or the consumer destroys the output stream.
+        // Stops when the server returns a short chunk (< chunkSize), answers with more than the
+        // requested window, the byte limiter is satisfied, or the consumer destroys the output
+        // stream. Throws when the ceiling above is crossed.
         let fetchAllParts = async () => {
             while (hasMore && !isLimited() && !fetchAborted) {
+                if (processed >= maxTotalBytes) {
+                    // Loud on purpose. Everything written downstream by this point holds
+                    // duplicated content, and a quiet stop is indistinguishable from a clean EOF,
+                    // so the consumer would store a corrupt body believing it intact.
+                    let err = new Error('Download exceeded the expected message size');
+                    err.code = 'DownloadOverflow';
+                    err.maxSize = maxTotalBytes;
+                    err.cid = this.id;
+                    throw err;
+                }
                 let { chunk } = await getNextPart();
                 if (!chunk || fetchAborted) {
                     break;

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.0.2";
+export declare const version = "2.0.4";
 export declare const homepage = "https://imapflow.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'imapflow';
-export const version = '2.0.2';
+export const version = '2.0.4';
 export const homepage = 'https://imapflow.com/';

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "2.0.2",
+    "version": "2.0.4",
     "description": "IMAP Client for Node",
     "type": "module",
     "main": "./dist/cjs/imap-flow.js",
@@ -77,15 +77,15 @@
         "tsx": "4.23.13",
         "types-node-legacy": "npm:@types/node@20.0.0",
         "typescript": "6.0.3",
-        "typescript-eslint": "8.69.0",
-        "wrangler": "4.129.0"
+        "typescript-eslint": "8.70.0",
+        "wrangler": "4.131.2"
     },
     "dependencies": {
         "@zone-eu/mailsplit": "5.4.16",
-        "encoding-japanese": "2.3.0",
+        "encoding-japanese": "2.4.0",
         "iconv-lite": "0.7.3",
         "libbase64": "1.3.0",
-        "libmime": "5.4.3",
+        "libmime": "5.4.4",
         "libqp": "2.1.1",
         "pino": "10.3.1",
         "socks": "2.8.10"