Bump nodemailer from 9.1.1 to 10.0.1

[dependabot]

Bumps nodemailer from 9.1.1 to 10.0.1.

Release notes

Sourced from nodemailer's releases.

v10.0.1

10.0.1 (2026-09-07)

Bug Fixes

• types: accept an explicit undefined for optional properties (209719d), closes #1853
• types: drop the internal members from the published declarations (81e64ea)

v10.0.0

10.0.0 (2026-09-03)

⚠ BREAKING CHANGES

• Node.js 20 or newer is required. The Node.js 6 syntax compatibility check and the .npmignore file are gone.

Features

• keep the @​types/nodemailer type layout working (1cc5356)
• migrate to TypeScript with ES module and CommonJS builds (f7cbf83)

Bug Fixes

• apply the other keys of a configuration object next to its url (29610f9)
• dkim: canonicalize raw messages the way verifiers do (2c84b11)
• keep a transporter assignable to the plain Transporter type (8bf55fb)
• shared: keep a colon in the user name of a connection or proxy url (6acf4b6)
• shared: refuse URL hosts the legacy parser would truncate (17a5068)
• shared: resolve hostnames when the runtime has no interface table (8b03240)
• smtp-connection: clear the timers of a connection dropped before the greeting (01dcaa0)
• smtp-connection: keep an incomplete server reply out of lastServerResponse (1a6e427)
• smtp-pool: free the pool slot when the proxy socket can not be opened (204a344)
• well-known: keep nodemailer/lib/well-known/services.json available (367730c)

Changelog

Sourced from nodemailer's changelog.

10.0.1 (2026-09-07)

Bug Fixes

• types: accept an explicit undefined for optional properties (209719d), closes #1853
• types: drop the internal members from the published declarations (81e64ea)

10.0.0 (2026-09-03)

⚠ BREAKING CHANGES

• Node.js 20 or newer is required. The Node.js 6 syntax compatibility check and the .npmignore file are gone.

Features

• keep the @​types/nodemailer type layout working (1cc5356)
• migrate to TypeScript with ES module and CommonJS builds (f7cbf83)

Bug Fixes

• apply the other keys of a configuration object next to its url (29610f9)
• dkim: canonicalize raw messages the way verifiers do (2c84b11)
• keep a transporter assignable to the plain Transporter type (8bf55fb)
• shared: keep a colon in the user name of a connection or proxy url (6acf4b6)
• shared: refuse URL hosts the legacy parser would truncate (17a5068)
• shared: resolve hostnames when the runtime has no interface table (8b03240)
• smtp-connection: clear the timers of a connection dropped before the greeting (01dcaa0)
• smtp-connection: keep an incomplete server reply out of lastServerResponse (1a6e427)
• smtp-pool: free the pool slot when the proxy socket can not be opened (204a344)
• well-known: keep nodemailer/lib/well-known/services.json available (367730c)

Commits

• 40d5221 chore(master): release 10.0.1 (#1854)
• 81e64ea fix(types): drop the internal members from the published declarations
• c5dba6e chore: turn on exactOptionalPropertyTypes for the type-check
• 209719d fix(types): accept an explicit undefined for optional properties
• 2ee030c chore(master): release 10.0.0 (#1852)
• 8bf55fb fix: keep a transporter assignable to the plain Transporter type
• 62202a8 docs: mark 10.x as the supported security line
• d9316d1 refactor(punycode): write the RFC 3490 separators as escape sequences
• d1d3fb5 test(dkim): cover the signing failure path
• 1a6e427 fix(smtp-connection): keep an incomplete server reply out of lastServerResponse
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/nodemailer	10.0.1	🟢 5.5	Details Check Score Reason Code-Review ⚠️ 1 Found 2/14 approved changesets -- score normalized to 1 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Packaging 🟢 10 packaging workflow detected

Scanned Files

• package-lock.json

[dependabot]

Superseded by #600.