Just by the way, please note an amendment to PR description:

-xarf-login-attack-local[mailargs=%(mailargs)s,mailcmd=%(mailcmd)s,bcc=%(bcc)s,dontsend=%(dontsend)s]
+xarf-login-attack-local[mailargs=%(mailargs)s,mailcmd=%(mailcmd)s,bcc="%(bcc)s",dontsend="%(dontsend)s"]

without quotes it would supply wrong (truncated) arguments to the action.

I also removed a redundant IFS operation on $ADDRESSES.

Why it should be redundant (now)? I don't see any code piece that could solve #2372, which could occur again if you would remove this "redundant" operation.

@sebres thanks for your comment. I have tested extensively without the suggested double-quotes and have no experienced truncation of the arguments, verified by dumping the received arguments to a tempfile for debugging. Can you please point me in the direction what I'm failing to understand?

I also removed a redundant IFS operation on $ADDRESSES.

Why it should be redundant (now)? I don't see any code piece that could solve #2372, which could occur again if you would remove this "redundant" operation.

I was unaware of #2372. I will re-add that operation.

Can you please point me in the direction what I'm failing to understand?

$ python -c 'from fail2ban.helpers import extractOptions; an, ao = extractOptions("""some-action[a="x, y, z", b=x, y, z]"""); print(ao)'
{'a': 'x, y, z', 'b': 'x'}

as you can see a contains whole string as enclosed in quotes x, y, z, whereas b contains only x.
As an option value (without quote) only single "word" is allowed (and it cannot contains comma, space or [] characters).

As for "not experienced truncation", it is a matter of sequence, so how (or rather when exactly) %(dontsend)s gets substituted
and I'm pretty sure this gets interpolated before it is supplied as parameter to the action in the jail, so it becomes:

- [..., dontsend=%(dontsend)s]
+ [..., dontsend=( 'one@address.com' 'two@address.com' 'three@address.com')]

But... trying this:

$ python -c 'from fail2ban.helpers import extractOptions; an, ao = extractOptions("""some-action[a=(one@address.com two@address.com three@address.com)]"""); print(ao)'
{'a': '(one@address.com two@address.com three@address.com)'}

I see it is indeed correct, so space (alone) is not a separator anymore at least in last version (I changed this extractOptions several times).