[dependabot]

Bumps nodemailer from 10.0.14 to 10.1.0.

Release notes

Sourced from nodemailer's releases.

v10.1.0

10.1.0 (2026-10-10)

Behaviour changes

• Pooled connections are closed after 4 minutes without a message (new idleTimeout pool option, set it to 0 to keep them open). A message whose recipients are rejected no longer closes the pooled connection, it is reset with RSET and reused, and a message is requeued when the server dropped a reused connection before any of it was sent.
• connectionTimeout covers setting the session up as a whole: the DNS lookup, a proxy handshake, the TCP connection, TLS, the greeting and a STARTTLS upgrade. greetingTimeout still bounds the greeting and the STARTTLS handshake within it.
• Any 421 reply ends the SMTP session. When the server closes an idle connection, SMTPConnection emits only end, not an ECONNECTION error.
• A content stream that was already read or destroyed fails the message with ESTREAM instead of producing an empty attachment. Content streams of a message that fails are destroyed.
• With opportunisticTLS, authentication is skipped on the unencrypted connection after a failed STARTTLS, unless forceAuth is set.
• The envelope is pipelined (MAIL FROM, RCPT TO and DATA in one batch) when the server announces PIPELINING.
• Errors carry originalCode (the system error code Nodemailer replaced, such as ECONNREFUSED) and, for ETIMEDOUT, timeoutType.

Features

• harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

• do not read the environment or the interface table on import (094179d)
• end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)
• keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)
• let the proxy handshake and the SMTP connection share one deadline (91ed683)
• mime-node: decode an SMTPUTF8 domain from its A-label form (e436f4d)
• mime-node: finish an encoded part only after its output was read (ec97d8f)
• qp: encode a lone CR or LF in binary quoted-printable parts (42b91d9)
• smtp-connection: count the wait for the greeting against connectionTimeout (bdcd046)
• smtp-connection: drop the connection when DATA is taken after a refused sender (f90fb04)
• smtp-connection: refuse a second connect() call (24ba2e0)
• turn Nagle off for SMTP sockets and report an early sendmail exit as such (fa9b8d3)

Performance Improvements

• encode base64 and quoted-printable without per-chunk delays (fd377bb)

v10.0.16

10.0.16 (2026-10-07)

Bug Fixes

• addressparser: keep an escaped parenthesis inside a comment (c4ae20d)
• fetch: keep the case of cookie names (#1888) (9f16eed)
• fetch: read the cookie name-value pair by position (645e97c)

v10.0.15

10.0.15 (2026-10-05)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.1.0 (2026-10-10)

Features

• harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

• do not read the environment or the interface table on import (094179d)
• end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)
• keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)
• let the proxy handshake and the SMTP connection share one deadline (91ed683)
• mime-node: decode an SMTPUTF8 domain from its A-label form (e436f4d)
• mime-node: finish an encoded part only after its output was read (ec97d8f)
• qp: encode a lone CR or LF in binary quoted-printable parts (42b91d9)
• smtp-connection: count the wait for the greeting against connectionTimeout (bdcd046)
• smtp-connection: drop the connection when DATA is taken after a refused sender (f90fb04)
• smtp-connection: refuse a second connect() call (24ba2e0)
• turn Nagle off for SMTP sockets and report an early sendmail exit as such (fa9b8d3)

Performance Improvements

• encode base64 and quoted-printable without per-chunk delays (fd377bb)

10.0.16 (2026-10-07)

Bug Fixes

• addressparser: keep an escaped parenthesis inside a comment (c4ae20d)
• fetch: keep the case of cookie names (#1888) (9f16eed)
• fetch: read the cookie name-value pair by position (645e97c)

10.0.15 (2026-10-05)

Bug Fixes

• errors: inherit NodemailerError code from ErrnoException (e99db61), closes #1884
• errors: keep NodemailerError compatible with @​types/node 26 ErrnoException (#1885) (b660328)

Commits

• 0780032 chore(master): release 10.1.0 (#1890)
• 42b91d9 fix(qp): encode a lone CR or LF in binary quoted-printable parts
• b9b8c84 test(smtp-pool): fail the clear event test with the pool state instead of han...
• 4f1a34a test(smtp-connection): keep the scripted server silent after a stalled STARTTLS
• f90fb04 fix(smtp-connection): drop the connection when DATA is taken after a refused ...
• bdcd046 fix(smtp-connection): count the wait for the greeting against connectionTimeout
• 751330a test(smtp-pool): measure the rate limit against a window wider than connecting
• ec97d8f fix(mime-node): finish an encoded part only after its output was read
• 24ba2e0 fix(smtp-connection): refuse a second connect() call
• 91ed683 fix: let the proxy handshake and the SMTP connection share one deadline
• Additional commits viewable in compare view

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[felixrichardt]

@dependabot rebase