POP3Session._refresh_mailbox (proxy_server.py:225) calls self.deleted.clear(), and handle_stat, handle_list and handle_uidl all invoke _refresh_mailbox() on every call.
A normal client sequence (DELE 1; STAT; QUIT) loses the pending deletion: STAT clears the deleted set, so handle_quit expunges nothing.
RFC 1939 also requires the maildrop to be locked and static for the duration of the session; re-listing mid-session shifts message numbers under the client.
Fix:
Snapshot the UID list once at authentication.
Do not clear the deleted set on STAT/LIST/UIDL.
Remove _refresh_mailbox and its mid-session calls.
Acceptance:
DELE followed by STAT/LIST/UIDL then QUIT still expunges the marked messages.
Message numbering is stable for the lifetime of the session.
POP3Session._refresh_mailbox (proxy_server.py:225) calls self.deleted.clear(), and handle_stat, handle_list and handle_uidl all invoke _refresh_mailbox() on every call.
A normal client sequence (DELE 1; STAT; QUIT) loses the pending deletion: STAT clears the deleted set, so handle_quit expunges nothing.
RFC 1939 also requires the maildrop to be locked and static for the duration of the session; re-listing mid-session shifts message numbers under the client.
Fix:
- Snapshot the UID list once at authentication.
- Do not clear the deleted set on STAT/LIST/UIDL.
- Remove _refresh_mailbox and its mid-session calls.
Acceptance:
- DELE followed by STAT/LIST/UIDL then QUIT still expunges the marked messages.
- Message numbering is stable for the lifetime of the session.
lyrathorpe
added the bug label 2026-06-17 17:12:04 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
POP3Session._refresh_mailbox (proxy_server.py:225) calls self.deleted.clear(), and handle_stat, handle_list and handle_uidl all invoke _refresh_mailbox() on every call.
A normal client sequence (DELE 1; STAT; QUIT) loses the pending deletion: STAT clears the deleted set, so handle_quit expunges nothing.
RFC 1939 also requires the maildrop to be locked and static for the duration of the session; re-listing mid-session shifts message numbers under the client.
Fix:
Acceptance: