[Enhancement] Remove/upgrade unused Ruby net-imap 0.1.1 from orfs Docker image (flagged by CVE scanners)

Description

Filing as an enhancement (not a bug/security report): the OpenROAD flow works fine — this is a Docker-image dependency-hygiene request. Per the project security policy, the underlying net-imap CVEs are ReDoS/DoS-class in an unused bundled gem, so they're out of scope for security@ and I'm reporting here instead.

Summary

The openroad/orfs:latest image bundles Ruby 3.0's default gem net-imap 0.1.1, which is flagged by vulnerability scanners (our institution's UT Nessus scan flagged three CVEs against it). net-imap ships as a default gem in the Ubuntu 22.04 base and is not used anywhere in the OpenROAD flow — it's purely incidental.

Note this is very likely a version-string false positive: Ubuntu commonly backports security fixes into the libruby* package without bumping the version number, so the code may already be patched even though the gemspec still reads 0.1.1. Nessus keys off that version string and flags it regardless. Either way, the stale file trips downstream scanners, so it's worth cleaning up at the image level.

Where it lives in the image

/usr/lib/ruby/gems/3.0.0/specifications/default/net-imap-0.1.1.gemspec
/usr/lib/ruby/gems/3.0.0/gems/net-imap-0.1.1

Steps to reproduce

docker pull openroad/orfs:latest
docker run --rm openroad/orfs:latest \
  ls /usr/lib/ruby/gems/3.0.0/specifications/default/ | grep net-imap
# -> net-imap-0.1.1.gemspec

Impact

I think there is no functional impact on the flow as OpenROAD never calls net-imap. The problem is purely that downstream users who pull the image get flagged by CVE scanners and, in institutional environments, are required to remediate it (which currently means manually stripping the gem from the image layer). Removing it at the source would spare every downstream user that work.

Suggested Solution

Since the gem is unused, the cleanest fix is to remove the stale default-gem files at image build time:

RUN rm -rf /usr/lib/ruby/gems/3.0.0/gems/net-imap-0.1.1 \ /usr/lib/ruby/gems/3.0.0map-0.1.1.gemspec
Note that gem install net-imap -v '>= 0.5.15' is not a reliable fix here: on Ubuntu these are default gems packaged inside libruby* (outsll won't necessarily override thepackaged file the scanner sees. Removing the stale files (as above) or rebasing on a newer base image
where the packaged version is higheThis is a no-op for the flow sincenet-imap is never invoked.

Additional Context

Environment

• Image: openroad/orfs:latest (pulled ~2026-07-16)
• Ruby: 3.0.0 (Ubuntu 22.04 base default gems, packaged in libruby*)
• Affected gem: net-imap 0.1.1 → fin the 0.6.x line)

Flagged CVEs

• CVE-2025-43857 (ResponseReader DoS)
• CVE-2026-42258 (CRLF / command injection via Symbol args)
• CVE-2026-47242 (CRLF injection in #id)

Fixed in net-imap ≥ 0.5.15 / ≥ 0.6.4.

Start with the Docker image build definition and reproduce the issue using the provided docker run command, checking /usr/lib/ruby/gems/3.0.0/specifications/default/ and the corresponding gems directory for net-imap-0.1.1. Remove or upgrade the stale default gem during the image build, then verify the OpenROAD flow still works and the reported files no longer trigger the scanner.