[dependabot]

Bumps nodemailer from 8.0.11 to 10.1.2.

Release notes

Sourced from nodemailer's releases.

v10.1.2

10.1.2 (2026-10-16)

Bug Fixes

• bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint (e347fa2)

v10.1.1

10.1.1 (2026-10-14)

Bug Fixes

• fetch: strip credentials on any cross-origin redirect (a15360c)

v10.1.0

10.1.0 (2026-10-10)

Behaviour changes

• Pooled connections are closed after 4 minutes without a message (new idleTimeout pool option, set it to 0 to keep them open). A message whose recipients are rejected no longer closes the pooled connection, it is reset with RSET and reused, and a message is requeued when the server dropped a reused connection before any of it was sent.
• connectionTimeout covers setting the session up as a whole: the DNS lookup, a proxy handshake, the TCP connection, TLS, the greeting and a STARTTLS upgrade. greetingTimeout still bounds the greeting and the STARTTLS handshake within it.
• Any 421 reply ends the SMTP session. When the server closes an idle connection, SMTPConnection emits only end, not an ECONNECTION error.
• A content stream that was already read or destroyed fails the message with ESTREAM instead of producing an empty attachment. Content streams of a message that fails are destroyed.
• With opportunisticTLS, authentication is skipped on the unencrypted connection after a failed STARTTLS, unless forceAuth is set.
• The envelope is pipelined (MAIL FROM, RCPT TO and DATA in one batch) when the server announces PIPELINING.
• Errors carry originalCode (the system error code Nodemailer replaced, such as ECONNREFUSED) and, for ETIMEDOUT, timeoutType.

Features

• harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

• do not read the environment or the interface table on import (094179d)
• end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)
• keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)
• let the proxy handshake and the SMTP connection share one deadline (91ed683)
• mime-node: decode an SMTPUTF8 domain from its A-label form (e436f4d)
• mime-node: finish an encoded part only after its output was read (ec97d8f)
• qp: encode a lone CR or LF in binary quoted-printable parts (42b91d9)
• smtp-connection: count the wait for the greeting against connectionTimeout (bdcd046)
• smtp-connection: drop the connection when DATA is taken after a refused sender (f90fb04)
• smtp-connection: refuse a second connect() call (24ba2e0)
• turn Nagle off for SMTP sockets and report an early sendmail exit as such (fa9b8d3)

Performance Improvements

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.1.2 (2026-10-16)

Bug Fixes

• bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint (e347fa2)

10.1.1 (2026-10-14)

Bug Fixes

• fetch: strip credentials on any cross-origin redirect (a15360c)

10.1.0 (2026-10-10)

Features

• harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

• do not read the environment or the interface table on import (094179d)
• end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)
• keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)
• let the proxy handshake and the SMTP connection share one deadline (91ed683)
• mime-node: decode an SMTPUTF8 domain from its A-label form (e436f4d)
• mime-node: finish an encoded part only after its output was read (ec97d8f)
• qp: encode a lone CR or LF in binary quoted-printable parts (42b91d9)
• smtp-connection: count the wait for the greeting against connectionTimeout (bdcd046)
• smtp-connection: drop the connection when DATA is taken after a refused sender (f90fb04)
• smtp-connection: refuse a second connect() call (24ba2e0)
• turn Nagle off for SMTP sockets and report an early sendmail exit as such (fa9b8d3)

Performance Improvements

• encode base64 and quoted-printable without per-chunk delays (fd377bb)

10.0.16 (2026-10-07)

Bug Fixes

• addressparser: keep an escaped parenthesis inside a comment (c4ae20d)
• fetch: keep the case of cookie names (#1888) (9f16eed)
• fetch: read the cookie name-value pair by position (645e97c)

... (truncated)

Commits

• 8454a24 Merge pull request #1894 from nodemailer/release-please--branches--master--co...
• 667cea6 chore(master): release 10.1.2
• e347fa2 fix: bound the work a message can make the mailer do and keep per-message aut...
• e58217c chore: add Oveyon SMTP service (#1892)
• 9396cca chore(master): release 10.1.1 (#1893)
• 65d7498 chore(deps): bump dev dependencies
• 647ee44 test(smtp-connection): pin connectionTimeout across all resolved addresses
• a15360c fix(fetch): strip credentials on any cross-origin redirect
• c8671c4 Updated SECURITY.md formatting
• be6fe72 testing VUlnerability firm
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.