build(deps): bump nodemailer from 9.0.6 to 10.0.0 - #2360

Sourced from nodemailer's releases.

v10.0.0

10.0.0 (2026-09-03)

⚠ BREAKING CHANGES

• Node.js 20 or newer is required. The Node.js 6 syntax compatibility check and the .npmignore file are gone.

Features

• keep the @​types/nodemailer type layout working (1cc5356)
• migrate to TypeScript with ES module and CommonJS builds (f7cbf83)

Bug Fixes

• apply the other keys of a configuration object next to its url (29610f9)
• dkim: canonicalize raw messages the way verifiers do (2c84b11)
• keep a transporter assignable to the plain Transporter type (8bf55fb)
• shared: keep a colon in the user name of a connection or proxy url (6acf4b6)
• shared: refuse URL hosts the legacy parser would truncate (17a5068)
• shared: resolve hostnames when the runtime has no interface table (8b03240)
• smtp-connection: clear the timers of a connection dropped before the greeting (01dcaa0)
• smtp-connection: keep an incomplete server reply out of lastServerResponse (1a6e427)
• smtp-pool: free the pool slot when the proxy socket can not be opened (204a344)
• well-known: keep nodemailer/lib/well-known/services.json available (367730c)

v9.1.1

9.1.1 (2026-09-01)

Bug Fixes

• mailer: apply the message access policy in resolveContent (dc48ed3)
• mailer: keep message data from reopening the access sandbox (ab7ef34)
• mime-node: inherit the access policy from the tree a node hangs in (262d550)

v9.1.0

9.1.0 (2026-08-31)

Features

• mailer: cap recipients per message with maxRecipients (7279ac8)

Bug Fixes

• addressparser: handle address lists in linear time (9116da9)
• addressparser: terminate the domain at an RFC 5322 comment (902b63e)

... (truncated)

Sourced from nodemailer's changelog.

10.0.0 (2026-09-03)

⚠ BREAKING CHANGES

• Node.js 20 or newer is required. The Node.js 6 syntax compatibility check and the .npmignore file are gone.

Features

• keep the @​types/nodemailer type layout working (1cc5356)
• migrate to TypeScript with ES module and CommonJS builds (f7cbf83)

Bug Fixes

• apply the other keys of a configuration object next to its url (29610f9)
• dkim: canonicalize raw messages the way verifiers do (2c84b11)
• keep a transporter assignable to the plain Transporter type (8bf55fb)
• shared: keep a colon in the user name of a connection or proxy url (6acf4b6)
• shared: refuse URL hosts the legacy parser would truncate (17a5068)
• shared: resolve hostnames when the runtime has no interface table (8b03240)
• smtp-connection: clear the timers of a connection dropped before the greeting (01dcaa0)
• smtp-connection: keep an incomplete server reply out of lastServerResponse (1a6e427)
• smtp-pool: free the pool slot when the proxy socket can not be opened (204a344)
• well-known: keep nodemailer/lib/well-known/services.json available (367730c)

9.1.1 (2026-09-01)

Bug Fixes

• mailer: apply the message access policy in resolveContent (dc48ed3)
• mailer: keep message data from reopening the access sandbox (ab7ef34)
• mime-node: inherit the access policy from the tree a node hangs in (262d550)

9.1.0 (2026-08-31)

Features

• mailer: cap recipients per message with maxRecipients (7279ac8)

Bug Fixes

• addressparser: handle address lists in linear time (9116da9)
• addressparser: terminate the domain at an RFC 5322 comment (902b63e)
• mime-node: apply UTS-46 mapping when encoding a domain (259c32d)
• mime-node: dedupe envelope recipients in linear time (7cc38af)
• mime-node: flatten parsed addresses without concat.apply (83b8c48)

... (truncated)

• 2ee030c chore(master): release 10.0.0 (#1852)
• 8bf55fb fix: keep a transporter assignable to the plain Transporter type
• 62202a8 docs: mark 10.x as the supported security line
• d9316d1 refactor(punycode): write the RFC 3490 separators as escape sequences
• d1d3fb5 test(dkim): cover the signing failure path
• 1a6e427 fix(smtp-connection): keep an incomplete server reply out of lastServerResponse
• 70b2197 test(dkim): skip the mailauth verification where mailauth does not load
• 7c1ca6d test: cover the mailer, the transports and the utility modules
• 29610f9 fix: apply the other keys of a configuration object next to its url
• 6acf4b6 fix(shared): keep a colon in the user name of a connection or proxy url
• Additional commits viewable in compare view

This version adds prepare script that runs during installation. Review the package contents before updating.