Bump nodemailer from 9.0.6 to 10.1.0

[dependabot]

Bumps nodemailer from 9.0.6 to 10.1.0.

Release notes

Sourced from nodemailer's releases.

v10.1.0

10.1.0 (2026-10-10)

Behaviour changes

• Pooled connections are closed after 4 minutes without a message (new idleTimeout pool option, set it to 0 to keep them open). A message whose recipients are rejected no longer closes the pooled connection, it is reset with RSET and reused, and a message is requeued when the server dropped a reused connection before any of it was sent.
• connectionTimeout covers setting the session up as a whole: the DNS lookup, a proxy handshake, the TCP connection, TLS, the greeting and a STARTTLS upgrade. greetingTimeout still bounds the greeting and the STARTTLS handshake within it.
• Any 421 reply ends the SMTP session. When the server closes an idle connection, SMTPConnection emits only end, not an ECONNECTION error.
• A content stream that was already read or destroyed fails the message with ESTREAM instead of producing an empty attachment. Content streams of a message that fails are destroyed.
• With opportunisticTLS, authentication is skipped on the unencrypted connection after a failed STARTTLS, unless forceAuth is set.
• The envelope is pipelined (MAIL FROM, RCPT TO and DATA in one batch) when the server announces PIPELINING.
• Errors carry originalCode (the system error code Nodemailer replaced, such as ECONNREFUSED) and, for ETIMEDOUT, timeoutType.

Features

• harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

• do not read the environment or the interface table on import (094179d)
• end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)
• keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)
• let the proxy handshake and the SMTP connection share one deadline (91ed683)
• mime-node: decode an SMTPUTF8 domain from its A-label form (e436f4d)
• mime-node: finish an encoded part only after its output was read (ec97d8f)
• qp: encode a lone CR or LF in binary quoted-printable parts (42b91d9)
• smtp-connection: count the wait for the greeting against connectionTimeout (bdcd046)
• smtp-connection: drop the connection when DATA is taken after a refused sender (f90fb04)
• smtp-connection: refuse a second connect() call (24ba2e0)
• turn Nagle off for SMTP sockets and report an early sendmail exit as such (fa9b8d3)

Performance Improvements

• encode base64 and quoted-printable without per-chunk delays (fd377bb)

v10.0.16

10.0.16 (2026-10-07)

Bug Fixes

• addressparser: keep an escaped parenthesis inside a comment (c4ae20d)
• fetch: keep the case of cookie names (#1888) (9f16eed)
• fetch: read the cookie name-value pair by position (645e97c)

v10.0.15

10.0.15 (2026-10-05)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.1.0 (2026-10-10)

Features

• harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

• do not read the environment or the interface table on import (094179d)
• end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)
• keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)
• let the proxy handshake and the SMTP connection share one deadline (91ed683)
• mime-node: decode an SMTPUTF8 domain from its A-label form (e436f4d)
• mime-node: finish an encoded part only after its output was read (ec97d8f)
• qp: encode a lone CR or LF in binary quoted-printable parts (42b91d9)
• smtp-connection: count the wait for the greeting against connectionTimeout (bdcd046)
• smtp-connection: drop the connection when DATA is taken after a refused sender (f90fb04)
• smtp-connection: refuse a second connect() call (24ba2e0)
• turn Nagle off for SMTP sockets and report an early sendmail exit as such (fa9b8d3)

Performance Improvements

• encode base64 and quoted-printable without per-chunk delays (fd377bb)

10.0.16 (2026-10-07)

Bug Fixes

• addressparser: keep an escaped parenthesis inside a comment (c4ae20d)
• fetch: keep the case of cookie names (#1888) (9f16eed)
• fetch: read the cookie name-value pair by position (645e97c)

10.0.15 (2026-10-05)

Bug Fixes

• errors: inherit NodemailerError code from ErrnoException (e99db61), closes #1884
• errors: keep NodemailerError compatible with @​types/node 26 ErrnoException (#1885) (b660328)

10.0.14 (2026-10-03)

Bug Fixes

• addressparser: keep a quoted display name that holds no "@" out of the address (3570d26)

... (truncated)

Commits

• 0780032 chore(master): release 10.1.0 (#1890)
• 42b91d9 fix(qp): encode a lone CR or LF in binary quoted-printable parts
• b9b8c84 test(smtp-pool): fail the clear event test with the pool state instead of han...
• 4f1a34a test(smtp-connection): keep the scripted server silent after a stalled STARTTLS
• f90fb04 fix(smtp-connection): drop the connection when DATA is taken after a refused ...
• bdcd046 fix(smtp-connection): count the wait for the greeting against connectionTimeout
• 751330a test(smtp-pool): measure the rate limit against a window wider than connecting
• ec97d8f fix(mime-node): finish an encoded part only after its output was read
• 24ba2e0 fix(smtp-connection): refuse a second connect() call
• 91ed683 fix: let the proxy handshake and the SMTP connection share one deadline
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)