[dependabot]

Bumps nodemailer from 9.0.1 to 10.1.4.

Release notes

Sourced from nodemailer's releases.

v10.1.4

10.1.4 (2026-10-18)

Bug Fixes

• addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)
• addressparser: bound group nesting at ten levels (ce63303)
• addressparser: drop the obsolete route from an angle-addr (3dbc730)
• addressparser: end a comment only at the ")" that closes the outermost one (0a87617)
• addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)
• addressparser: never read a mailbox out of a comment (a1538ea)
• addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)
• addressparser: read the first addr-spec of the display text (038940a)
• split a domain literal off at the "@" in front of it (d5983b0)

v10.1.3

10.1.3 (2026-10-18)

Bug Fixes

• format References and strip URLs in linear time, release any number of streams (2f18641)

v10.1.2

10.1.2 (2026-10-16)

Bug Fixes

• bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint (e347fa2)

v10.1.1

10.1.1 (2026-10-14)

Bug Fixes

• fetch: strip credentials on any cross-origin redirect (a15360c)

v10.1.0

10.1.0 (2026-10-10)

Behaviour changes

• Pooled connections are closed after 4 minutes without a message (new idleTimeout pool option, set it to 0 to keep them open). A message whose recipients are rejected no longer closes the pooled connection, it is reset with RSET and reused, and a message is requeued when the server dropped a reused connection before any of it was sent.
• connectionTimeout covers setting the session up as a whole: the DNS lookup, a proxy handshake, the TCP connection, TLS, the greeting and a STARTTLS upgrade. greetingTimeout still bounds the greeting and the STARTTLS handshake within it.
• Any 421 reply ends the SMTP session. When the server closes an idle connection, SMTPConnection emits only end, not an ECONNECTION error.
• A content stream that was already read or destroyed fails the message with ESTREAM instead of producing an empty attachment. Content streams of a message that fails are destroyed.
• With opportunisticTLS, authentication is skipped on the unencrypted connection after a failed STARTTLS, unless forceAuth is set.

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.1.4 (2026-10-18)

Bug Fixes

• addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)
• addressparser: bound group nesting at ten levels (ce63303)
• addressparser: drop the obsolete route from an angle-addr (3dbc730)
• addressparser: end a comment only at the ")" that closes the outermost one (0a87617)
• addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)
• addressparser: never read a mailbox out of a comment (a1538ea)
• addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)
• addressparser: read the first addr-spec of the display text (038940a)
• split a domain literal off at the "@" in front of it (d5983b0)

10.1.3 (2026-10-18)

Bug Fixes

• format References and strip URLs in linear time, release any number of streams (2f18641)

10.1.2 (2026-10-16)

Bug Fixes

• bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint (e347fa2)

10.1.1 (2026-10-14)

Bug Fixes

• fetch: strip credentials on any cross-origin redirect (a15360c)

10.1.0 (2026-10-10)

Features

• harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

• do not read the environment or the interface table on import (094179d)
• end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)
• keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)
• let the proxy handshake and the SMTP connection share one deadline (91ed683)

... (truncated)

Commits

• 2a7e952 chore(master): release 10.1.4 (#1897)
• 038940a fix(addressparser): read the first addr-spec of the display text
• ce63303 fix(addressparser): bound group nesting at ten levels
• a1538ea fix(addressparser): never read a mailbox out of a comment
• 3dbc730 fix(addressparser): drop the obsolete route from an angle-addr
• ba3c095 fix(addressparser): read CFWS beside the "@" of an addr-spec as nothing
• d5983b0 fix: split a domain literal off at the "@" in front of it
• ee35f57 fix(addressparser): apply the unexpected "<" rule outside quotes and comments
• 0a87617 fix(addressparser): end a comment only at the ")" that closes the outermost one
• 1cd57d2 fix(addressparser): honour quoted strings and comments inside an angle-addr a...
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nodemailer@​9.0.1 ⏵ 10.1.4	+3	+46	+1

View full report