chore(deps): update dependency nodemailer to v10

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
nodemailer (source)	^6.9.16 -> ^10.0.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

nodemailer/nodemailer (nodemailer)

v10.0.10

Compare Source

Bug Fixes

• derive the attachment filename from the basename of a Windows path (c7cc7ce)
• dkim: unfold folded header lines in linear time (28a5909)
• smtp-connection: reassemble multiline replies in linear time (f2d82fa)

v10.0.9

Compare Source

Bug Fixes

• addressparser: bound the '@​' probe to the run being scanned (1465c3f)
• addressparser: keep the text after a comment out of a quoted local part address (2f36eb1)

v10.0.8

Compare Source

Bug Fixes

• mime-node: clean the boundary where it is written, not only where it is built (e14278d)
• mime-node: drop every control character from multipart boundary material (a82a355)

v10.0.7

Compare Source

Bug Fixes

• mime-funcs: do not double encode Buffer input when chunking base64 mime words (#​1865) (4327a59)
• mime-node: keep a boundary that is only line breaks from stripping to empty (ec46800)
• mime-node: strip line breaks from multipart boundary material (#​1867) (03c1a5c)
• smtp-pool: release rate-limited connections on close (#​1866) (7f5c7a4)

v10.0.6

Compare Source

Bug Fixes

• addressparser: scan free text for an address in linear time (437d7fc)

v10.0.5

Compare Source

Bug Fixes

• addressparser: parse comment-joined addresses in linear time (c07f175)

v10.0.4

Compare Source

Bug Fixes

• fetch: scope a cookie without a Path to the RFC 6265 default path (2f907cb)
• fetch: send cookies set with Path back to the exact path (#​1861) (d557113)
• mail-composer: keep httpHeaders and tls for href alternatives and icalEvent (#​1862) (7f502be)
• resolve well-known services by their primary domains (#​1859) (085f525)
• ses-transport: throw a configuration error when the SES client is missing (#​1863) (4d9c4c9)

v10.0.3

Compare Source

Bug Fixes

• fetch: honor the cookie Domain attribute without accepting public suffixes (1608391), closes #​1856

v10.0.2

Compare Source

Bug Fixes

• mime-node: flatten nested recipient arrays without recursion (ebe0849)
• shared: keep the TLS server name out of the DNS cache (a6512db)

v10.0.1

Compare Source

Bug Fixes

• types: accept an explicit undefined for optional properties (209719d), closes #​1853
• types: drop the internal members from the published declarations (81e64ea)

v10.0.0

Compare Source

⚠ BREAKING CHANGES

• Node.js 20 or newer is required. The Node.js 6 syntax compatibility check and the .npmignore file are gone.

Features

• keep the @​types/nodemailer type layout working (1cc5356)
• migrate to TypeScript with ES module and CommonJS builds (f7cbf83)

Bug Fixes

• apply the other keys of a configuration object next to its url (29610f9)
• dkim: canonicalize raw messages the way verifiers do (2c84b11)
• keep a transporter assignable to the plain Transporter type (8bf55fb)
• shared: keep a colon in the user name of a connection or proxy url (6acf4b6)
• shared: refuse URL hosts the legacy parser would truncate (17a5068)
• shared: resolve hostnames when the runtime has no interface table (8b03240)
• smtp-connection: clear the timers of a connection dropped before the greeting (01dcaa0)
• smtp-connection: keep an incomplete server reply out of lastServerResponse (1a6e427)
• smtp-pool: free the pool slot when the proxy socket can not be opened (204a344)
• well-known: keep nodemailer/lib/well-known/services.json available (367730c)

v9.1.1

Compare Source

Bug Fixes

• mailer: apply the message access policy in resolveContent (dc48ed3)
• mailer: keep message data from reopening the access sandbox (ab7ef34)
• mime-node: inherit the access policy from the tree a node hangs in (262d550)

v9.1.0

Compare Source

Features

• mailer: cap recipients per message with maxRecipients (7279ac8)

Bug Fixes

• addressparser: handle address lists in linear time (9116da9)
• addressparser: terminate the domain at an RFC 5322 comment (902b63e)
• mime-node: apply UTS-46 mapping when encoding a domain (259c32d)
• mime-node: dedupe envelope recipients in linear time (7cc38af)
• mime-node: flatten parsed addresses without concat.apply (83b8c48)
• mime-node: keep the recipient dedupe linear across address headers (34da642)
• mime-node: keep URL delimiters away from the domain mapper (b212ac4)

v9.0.6

Compare Source

Bug Fixes

• addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
• harden copies of user supplied keys and URL fetching (2f667f4)

v9.0.5

Compare Source

Bug Fixes

• ci: retrigger the workflows dropped during the Actions outage (85d16c1)
• mailer: escape specials in List-* header comments (#​1842) (75913bb)
• mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
• mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
• mime: encode DEL in header parameters and List-* comments (cf69430)
• mime: keep control chars out of the remaining header positions (5ed9d26)
• mime: normalize an address parsed out of a string as well (63685f7)
• mime: normalize an address so header and envelope agree (a9343b4)
• mime: stop a header key callback and the dkim tags from injecting (b7d772e)

v9.0.4

Compare Source

Bug Fixes

• mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
• mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#​1838) (5bd3a65)
• mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
• mime-node: escape backslash and quote in the Content-Type name parameter (#​1837) (adcfc4f)
• mime: encode HT/CR/LF in header parameter values instead of quoting them (#​1840) (5bc9cab)

v9.0.3

Compare Source

Bug Fixes

• smtp-connection: harden STARTTLS upgrade and secure socket handling (#​1835) (07d8253)

v9.0.2

Compare Source

Bug Fixes

• addressparser: keep operator chars inside an address-literal as text (#​1829) (9ba1064)
• harden smtp-connection low-severity issues (22ddcea)
• harden smtp-connection response parsing and socket lifecycle (68860b9)
• prevent SES transport callback double-invocation and hang on sync errors (#​1831) (9517bc5)
• reject CRLF in HTTP proxy CONNECT destination to prevent request injection (6347b47)

v9.0.1

Compare Source

Bug Fixes

• enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

Compare Source

⚠ BREAKING CHANGES

• HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

• replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)
• validate TLS certificates by default when fetching remote content (6a947ac)

v8.0.11

Compare Source

Bug Fixes

• apply the transport-level newline option in stream and sendmail transports (cb4f904)
• include icalEvent path/href content in the application/ics attachment (b801c48)
• parse Ethereal response props without polynomial regex backtracking (067aebe)
• resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)
• return the promise from every resolveContent branch (07ffe8c)
• strip the url scheme from List-ID header values (77e5885)
• tag AWS SES transport errors with the ESES code (efa647a)

v8.0.10

Compare Source

Bug Fixes

• fall back to lower-severity handler when custom logger lacks a level method (6d849df)

v8.0.9

Compare Source

Bug Fixes

• two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#​1820) (5f69497)

v8.0.8

Compare Source

Bug Fixes

• enforce strict TLS for OAuth2 and Ethereal credential requests (#​1818) (833d6e5)
• four listener/stream leaks in SMTP transport, connection, pool (#​1817) (850bb91)

v8.0.7

Compare Source

Bug Fixes

• keep domain as UTF-8 when local part is non-ASCII (#​1814) (66d4ecb)

v8.0.6

Compare Source

Bug Fixes

• restore base64 wrap() trim behavior to prevent trailing CRLF (#​1810) (#​1811) (b1ae6c1)

v8.0.5

Compare Source

Bug Fixes

• decode SMTP server responses as UTF-8 at line boundary (95876b1)
• sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g) (0a43876)

v8.0.4

Compare Source

Bug Fixes

• sanitize envelope size to prevent SMTP command injection (2d7b971)

v8.0.3

Compare Source

Bug Fixes

• clean up addressparser and fix group name fallback producing undefined (9d55877)
• fix cookie bugs, remove dead code, and improve hot-path efficiency (e8c8b92)
• refactor smtp-connection for clarity and add Node.js 6 syntax compat test (c5b48ea)
• remove familySupportCache that broke DNS resolution tests (c803d90)

v8.0.2

Compare Source

Bug Fixes

• merge fragmented display names with unquoted commas in addressparser (fe27f7f)

v8.0.1

Compare Source

Bug Fixes

• apply the transport-level newline option in stream and sendmail transports (cb4f904)
• include icalEvent path/href content in the application/ics attachment (b801c48)
• parse Ethereal response props without polynomial regex backtracking (067aebe)
• resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)
• return the promise from every resolveContent branch (07ffe8c)
• strip the url scheme from List-ID header values (77e5885)
• tag AWS SES transport errors with the ESES code (efa647a)

v8.0.0

Compare Source

⚠ BREAKING CHANGES

• Error code 'NoAuth' renamed to 'ENOAUTH'

Bug Fixes

• add connection fallback to alternative DNS addresses (e726d6f)
• centralize and standardize error codes (45062ce)
• harden DNS fallback against race conditions and cleanup issues (4fa3c63)
• improve socket cleanup to prevent potential memory leaks (6069fdc)

v7.0.13

Compare Source

Bug Fixes

• downgrade transient connection error logs to warn level (4c041db)

v7.0.12

Compare Source

Bug Fixes

• added support for REQUIRETLS (#​1793) (053ce6a)
• use 8bit encoding for message/rfc822 attachments (adf8611)

v7.0.11

Compare Source

Bug Fixes

• prevent stack overflow DoS in addressparser with deeply nested groups (b61b9c0)

v7.0.10

Compare Source

Bug Fixes

• Increase data URI size limit from 100KB to 50MB and preserve content type (28dbf3f)

v7.0.9

Compare Source

Bug Fixes

• release: Trying to fix release proecess by upgrading Node version in runner (579fce4)

v7.0.7

Compare Source

Bug Fixes

• addressparser: Fixed addressparser handling of quoted nested email addresses (1150d99)
• dns: add memory leak prevention for DNS cache (0240d67)
• linter: Updated eslint and created prettier formatting task (df13b74)
• refresh expired DNS cache on error (#​1759) (ea0fc5a)
• resolve linter errors in DNS cache tests (3b8982c)

v7.0.6

Compare Source

Bug Fixes

• encoder: avoid silent data loss by properly flushing trailing base64 (#​1747) (01ae76f)
• handle multiple XOAUTH2 token requests correctly (#​1754) (dbe0028)
• ReDoS vulnerability in parseDataURI and _processDataUrl (#​1755) (90b3e24)

v7.0.5

Compare Source

Bug Fixes

• updated well known delivery service list (fa2724b)

v7.0.4

Compare Source

Bug Fixes

• pools: Emit 'clear' once transporter is idle and all connections are closed (839e286)
• smtp-connection: jsdoc public annotation for socket (#​1741) (c45c84f)
• well-known-services: Added AliyunQiye (bb9e6da)

v7.0.3

Compare Source

Bug Fixes

• attachments: Set the default transfer encoding for message/rfc822 attachments as '7bit' (007d5f3)

v7.0.2

Compare Source

Bug Fixes

• ses: Fixed structured from header (faa9a5e)

v7.0.1

Compare Source

Bug Fixes

• downgrade transient connection error logs to warn level (4c041db)

v7.0.0

Compare Source

⚠ BREAKING CHANGES

• SESv2 SDK support, removed older SES SDK v2 and v3 , removed SES rate limiting and idling features

Features

• SESv2 SDK support, removed older SES SDK v2 and v3 , removed SES rate limiting and idling features (15db667)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign dillon-zheng for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

Hi @renovate[bot]. Thanks for your PR.

I'm waiting for a PingCAP-QE member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.