Update net-imap

[binford2k]

Updates net-imap to the latest 0.2.x semver to mitigate CVE-2025-43857.

Fix backported in ruby/net-imap#442

[smortex]

The update is fine. There are newer releases available, but more importantly I am not sure about why the openvox server depend on a gem to communicate with a mail server?

[binford2k]

@smortex I honestly don't think it's actually used, based on the comment. It sounds like it's something to do with the default jruby install. 4ba80dd

My best guess is so they're available for module authors expecting to have the "standard" set of gems? I'm really struggling to think of a reason to have IMAP. I suppose someone could get really weird and write an IMAP classification terminus.

Although that might suggest that there's no need to keep API compatibility, or even to keep the gems. @nmburgan thoughts about this?

[nmburgan]

It’s part of the JRuby stdlib gems that it installs (or at least ones it bundles with JRuby).

4ba80dd

I don’t know what happens if we don’t ship it. Seems like JRuby probably expects it to be present.

See also jruby/jruby#8841

[nmburgan]

They also updated this in JRuby.

jruby/jruby#8825

I’m not super familiar with the build here, but I would guess we attempt to package up JRuby without the actual JRuby package, which is why we probably do this (like we package up all gems Bolt relies on).

We should also go through clj-parent and the other artifacts to see what needs bumping. JRuby itself might need a bump.