[dependabot]

Bumps nodemailer from 10.4.0 to 10.5.0.

Release notes

Sourced from nodemailer's releases.

v10.5.0

10.5.0 (2026-11-10)

Summary

Adds per-message cancellation to sendMail() with an AbortSignal, plus two encoding fixes: DKIM signatures for internationalized domains, and header text that looks like a broken encoded-word.

Who should upgrade

• Anyone who signs with DKIM for a domain written with upper case or mapped non-ASCII characters (an upper case IDN label, or one holding a soft hyphen). The d= tag named a different domain than From:, so verification and DMARC alignment failed.
• Anyone who wants to cancel or time-limit a single send without closing the transport or pool.

Highlights

• AbortSignal per send: sendMail({ ..., signal }) on SMTP and pooled SMTP. An abort removes a queued message from the pool, or closes only the connection delivering it, and the send fails with an AbortError (code EABORT). Other transports honor a signal that is already aborted and otherwise ignore it. Note that an abort late in DATA does not prove the server did not accept the message, so do not treat EABORT as safe to retry blindly.
• DKIM: the d= domain is encoded with UTS-46 mapping, the same way as the address headers.
• Header encoding: plain text that a receiver would decode as an encoded-word without it being a valid one (such as =?utf-8?Q?a b?= across a space) is now encoded. A valid encoded-word is still passed through, so subjects that are already encoded are not encoded twice.
• SMTP connection: a supplied socket no longer connects, and TLS no longer starts, after the connection was closed.

Features

• smtp: support AbortSignal for individual sends (#1911) (66387ed), closes #1910

Bug Fixes

• dkim: encode the d= domain the same way as the address headers (#1908) (4ebf03f)
• mime-funcs: encode header text that would be decoded as an invalid encoded word (#1912) (7a7b942)

v10.4.1

10.4.1 (2026-11-10)

Summary

A security patch release. Two cases where the recipient domain Nodemailer delivered to could differ from the domain an application had validated are fixed. SpacePost is added to the well-known services.

Who should upgrade

• Everyone who passes user-supplied recipient addresses to Nodemailer, especially applications that restrict recipients by domain. Both fixes close a gap between the domain a validator reads and the domain in the SMTP envelope.

Highlights

• Recipient domains with internationalized characters are mapped the same way url.domainToASCII and other UTS-46 validators map them. Previously a few characters could encode to a different domain than the validator approved. Affected since 9.1.0.

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.5.0 (2026-11-10)

Features

• smtp: support AbortSignal for individual sends (#1911) (66387ed), closes #1910

Bug Fixes

• dkim: encode the d= domain the same way as the address headers (#1908) (4ebf03f)
• mime-funcs: encode header text that would be decoded as an invalid encoded word (#1912) (7a7b942)

10.4.1 (2026-11-10)

Bug Fixes

• addressparser: read whitespace and comments around a dot of the domain as CFWS (c2b9c41)
• mime-node: hand a domain to the UTS-46 mapper without lowercasing it first (093e4dd)

Commits

• f4bacd5 chore(master): release 10.5.0 (#1914)
• 66387ed feat(smtp): support AbortSignal for individual sends (#1911)
• 7a7b942 fix(mime-funcs): encode header text that would be decoded as an invalid encod...
• 4ebf03f fix(dkim): encode the d= domain the same way as the address headers (#1908)
• 434b93c chore(master): release 10.4.1 (#1913)
• 13cb791 chore(deps): update development dependencies
• e87e211 chore(services): require STARTTLS for SpacePost
• c2b9c41 fix(addressparser): read whitespace and comments around a dot of the domain a...
• 093e4dd fix(mime-node): hand a domain to the UTS-46 mapper without lowercasing it first
• 40e09ce chore(services): add SpacePost (#1907)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: QUIET
• Plan: Advanced
• Run ID: 40eb9e42-9113-4232-8af7-fddaf40c0025

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

Warning

.coderabbit.yaml has a parsing error

The CodeRabbit configuration file in this repository has a parsing error and default settings were used instead. Please fix the error(s) in the configuration file. You can initialize chat with CodeRabbit to get help with the configuration file.

Parsing errors: 2

Validation error: Invalid input: expected string, received undefined at "reviews.path_instructions[3].path"; Invalid input: expected string, received undefined at "reviews.path_instructions[3].instructions"

Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[codescene-delta-analysis]

No application code in the PR — skipped Code Health checks.

See analysis details in CodeScene

Quality Gate Profile: The Bare Minimum
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.