@mavogel/awscdk-rootmail 0.1.2 → 0.1.4

package/node_modules/mailparser/lib/mail-parser.js

@@ -16,6 +16,24 @@ const linkify = require('linkify-it')();
 const tlds = require('tlds');
 const encodingJapanese = require('encoding-japanese');
 
+// Bounds for link detection in text bodies. Message content is untrusted and
+// linkify-it backtracks heavily on crafted input: matching a host is quadratic
+// in the length of a single whitespace-free run and exponential in the number
+// of dot separated labels it has to try (a label starting with "xn--" matches
+// two of the alternatives in linkify-it's domain pattern, so N such labels can
+// be grouped in 2^N ways). Text is therefore scanned one whitespace-delimited
+// segment at a time, segments long enough or with enough chained host labels to
+// get expensive are left as plain text, and a message may only spend so much
+// work in total. Scanning one segment costs roughly length * (length + 1024), so
+// the budget is counted in those units rather than in characters - neither a
+// few very long segments nor very many short ones can then add up to an
+// unbounded scan. Together these keep the worst case at about half a second.
+// Ordinary mail stays far below all three: across test/fixtures the longest
+// segment is 565 characters and 99.9% of them chain up at most 3 host labels.
+const MAX_LINKIFY_SEGMENT_LENGTH = 4096;
+const MAX_LINKIFY_HOST_LABELS = 6;
+const MAX_LINKIFY_WORK = 768 * 1024 * 1024; // shared by all text parts of a message
+
 linkify
     .tlds(tlds) // Reload with full tlds list
     .tlds('onion', true) // Add unofficial `.onion` domain
@@ -23,6 +41,13 @@ linkify
     .add('ftp:', null) // Disable `ftp:` ptotocol
     .set({ fuzzyIP: true, fuzzyLink: true, fuzzyEmail: true });
 
+// Characters linkify-it accepts inside a host name: letters, digits, a dash,
+// and anything non-ASCII (its label pattern takes any character that is not
+// punctuation, whitespace or a control character).
+function isHostChar(code) {
+    return (code >= 0x61 && code <= 0x7a) || (code >= 0x41 && code <= 0x5a) || (code >= 0x30 && code <= 0x39) || code === 0x2d || code >= 0x80;
+}
+
 // twitter linkifier from
 // https://github.com/markdown-it/linkify-it#example-2-add-twitter-mentions-handler
 linkify.add('@', {
@@ -35,7 +60,7 @@ linkify.add('@', {
         if (self.re.twitter.test(tail)) {
             // Linkifier allows punctuation chars before prefix,
             // but we additionally disable `@` ("@@mention" is invalid)
-            if (pos >= 2 && tail[pos - 2] === '@') {
+            if (pos >= 2 && text[pos - 2] === '@') {
                 return false;
             }
             return tail.match(self.re.twitter)[0].length;
@@ -156,6 +181,7 @@ class MailParser extends Transform {
         this.text = false;
         this.html = false;
         this.textAsHtml = false;
+        this.linkifyWork = 0;
 
         this.attachmentList = [];
 
@@ -277,9 +303,7 @@ class MailParser extends Transform {
             return this.cleanup(done);
         }
         this.waitingEnd = () => {
-            this.cleanup(() => {
-                done();
-            });
+            this.cleanup(done);
         };
     }
 
@@ -289,7 +313,8 @@ class MailParser extends Transform {
                 let t = this.getTextContent();
                 this.push(t);
             } catch (err) {
-                return this.emit('error', err);
+                // report through the stream instead of leaving _flush hanging
+                return done(err);
             }
 
             done();
@@ -351,7 +376,10 @@ class MailParser extends Transform {
                     } catch (E) {
                         // ignore
                     }
-                    value = value.split(/\s+/).map(this.ensureMessageIDFormat).filter(val => val);
+                    value = value
+                        .split(/\s+/)
+                        .map(this.ensureMessageIDFormat)
+                        .filter(val => val);
                     break;
                 case 'message-id':
                 case 'in-reply-to':
@@ -1133,6 +1161,73 @@ class MailParser extends Transform {
         setImmediate(processNext);
     }
 
+    // Tells whether a text segment is worth handing to linkify-it, see
+    // MAX_LINKIFY_* above. Note that linkify.pretest() can not be used for this
+    // - it is a quick deny that also denies links its own matcher finds, eg. a
+    // host followed by a fullwidth vertical bar.
+    canScanSegment(segment) {
+        // every link linkify-it can find contains at least one of these
+        if (segment.length > MAX_LINKIFY_SEGMENT_LENGTH || !/[.:@/]/.test(segment)) {
+            return false;
+        }
+
+        // Dots only chain up into one host candidate while the characters
+        // around them could be part of a host, so a slash, comma or colon ends
+        // the chain and dots in a path or query do not add to it.
+        let labels = 0;
+        for (let i = 0, len = segment.length; i < len; i++) {
+            let code = segment.charCodeAt(i);
+            if (code === 0x2e) {
+                if (++labels > MAX_LINKIFY_HOST_LABELS) {
+                    return false;
+                }
+            } else if (!isHostChar(code)) {
+                labels = 0;
+            }
+        }
+
+        return true;
+    }
+
+    findLinks(str) {
+        let links = [];
+
+        if (this.linkifyWork >= MAX_LINKIFY_WORK || !linkify.pretest(str)) {
+            return links;
+        }
+
+        // Whitespace can not be part of a link and linkify-it treats the end of
+        // a segment exactly like whitespace, so scanning segment by segment
+        // finds the same links as scanning the entire string would. U+FEFF is
+        // whitespace for Javascript but an ordinary link character for
+        // linkify-it, so it must not end a segment.
+        let segmentRegex = /[\S\uFEFF]+/g;
+        let segmentMatch;
+
+        while ((segmentMatch = segmentRegex.exec(str)) !== null) {
+            let segment = segmentMatch[0];
+
+            if (!this.canScanSegment(segment)) {
+                // too expensive to scan or can not match at all, keep as plain text
+                continue;
+            }
+
+            let matches = linkify.match(segment);
+            for (let i = 0; matches && i < matches.length; i++) {
+                matches[i].index += segmentMatch.index;
+                matches[i].lastIndex += segmentMatch.index;
+                links.push(matches[i]);
+            }
+
+            this.linkifyWork += segment.length * (segment.length + 1024);
+            if (this.linkifyWork >= MAX_LINKIFY_WORK) {
+                break;
+            }
+        }
+
+        return links;
+    }
+
     textToHtml(str) {
         if (this.options.skipTextToHtml) {
             return '';
@@ -1140,12 +1235,10 @@ class MailParser extends Transform {
         str = (str || '').toString();
         let encoded;
 
-        let linkified = false;
         if (!this.options.skipTextLinks) {
             try {
-                if (linkify.pretest(str)) {
-                    linkified = true;
-                    let links = linkify.match(str) || [];
+                let links = this.findLinks(str);
+                if (links.length) {
                     let result = [];
                     let last = 0;
 
@@ -1182,7 +1275,8 @@ class MailParser extends Transform {
             }
         }
 
-        if (!linkified) {
+        // nothing linkified, or linkifying threw halfway through
+        if (!encoded) {
             encoded = he
                 // encode special chars
                 .encode(str, {
@@ -1195,7 +1289,12 @@ class MailParser extends Transform {
             encoded
                 .replace(/\r?\n/g, '\n')
                 .trim() // normalize line endings
-                .replace(/[ \t]+$/gm, '')
+                // Trims trailing spaces and tabs off every line. The leading
+                // group keeps this linear, plain /[ \t]+$/gm rescans the whole
+                // run from every position inside it, which is quadratic. The
+                // lookahead lists the line terminators that multiline $ matches
+                // before, the group covers the line starts.
+                .replace(/(^|[^ \t])[ \t]+(?=[\n\r\u2028\u2029]|$)/g, '$1')
                 .trim() // trim empty line endings
                 .replace(/\n\n+/g, '</p><p>')
                 .trim() // insert <p> to multiple linebreaks

package/node_modules/mailparser/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailparser",
-    "version": "3.9.14",
+    "version": "3.9.22",
     "description": "Parse e-mails",
     "main": "index.js",
     "scripts": {
@@ -18,30 +18,30 @@
     ],
     "license": "MIT",
     "dependencies": {
-        "encoding-japanese": "2.2.0",
+        "encoding-japanese": "2.3.0",
         "he": "1.2.0",
-        "html-to-text": "10.0.0",
+        "html-to-text": "10.0.1",
         "iconv-lite": "0.7.3",
-        "libmime": "5.4.1",
+        "libmime": "5.4.3",
         "linkify-it": "5.0.2",
-        "@zone-eu/mailsplit": "5.4.14",
-        "nodemailer": "9.0.3",
+        "@zone-eu/mailsplit": "5.4.16",
+        "nodemailer": "10.0.0",
         "punycode.js": "2.3.1",
         "tlds": "1.261.0"
     },
     "devDependencies": {
-        "@eslint/eslintrc": "3.3.5",
+        "@eslint/eslintrc": "3.3.7",
         "@eslint/js": "10.0.1",
         "ajv": "8.20.0",
-        "eslint": "10.6.0",
+        "eslint": "10.10.0",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "10.1.8",
-        "grunt": "1.6.2",
+        "grunt": "1.6.3",
         "grunt-cli": "1.5.0",
         "grunt-contrib-nodeunit": "5.0.0",
-        "grunt-eslint": "26.0.0",
+        "grunt-eslint": "27.0.0",
         "iconv": "3.0.1",
-        "prettier": "3.9.4",
+        "prettier": "3.9.6",
         "random-message": "1.1.0"
     },
     "repository": {
@@ -50,5 +50,8 @@
     },
     "bugs": {
         "url": "https://github.com/nodemailer/mailparser/issues"
+    },
+    "engines": {
+        "node": ">=20.0.0"
     }
 }

package/node_modules/nodemailer/CHANGELOG.md

@@ -1,5 +1,92 @@
 # CHANGELOG
 
+## [10.0.0](https://github.com/nodemailer/nodemailer/compare/v9.1.1...v10.0.0) (2026-09-03)
+
+
+### ⚠ BREAKING CHANGES
+
+* Node.js 20 or newer is required. The Node.js 6 syntax compatibility check and the .npmignore file are gone.
+
+### Features
+
+* keep the @types/nodemailer type layout working ([1cc5356](https://github.com/nodemailer/nodemailer/commit/1cc535627e1bb672214b09fa4cc503567275fd7f))
+* migrate to TypeScript with ES module and CommonJS builds ([f7cbf83](https://github.com/nodemailer/nodemailer/commit/f7cbf8384e0ea6055efcc514afb8bc070ac3a2b1))
+
+
+### Bug Fixes
+
+* apply the other keys of a configuration object next to its url ([29610f9](https://github.com/nodemailer/nodemailer/commit/29610f9fe04dbd8af04c4a3362f3b68d293592da))
+* **dkim:** canonicalize raw messages the way verifiers do ([2c84b11](https://github.com/nodemailer/nodemailer/commit/2c84b117d4d138751e9ffa8607f3796771bb5e66))
+* keep a transporter assignable to the plain Transporter type ([8bf55fb](https://github.com/nodemailer/nodemailer/commit/8bf55fb177cf155b24d6bb86a7cd86670146d551))
+* **shared:** keep a colon in the user name of a connection or proxy url ([6acf4b6](https://github.com/nodemailer/nodemailer/commit/6acf4b67d919971f516f58940113c9b8598b2254))
+* **shared:** refuse URL hosts the legacy parser would truncate ([17a5068](https://github.com/nodemailer/nodemailer/commit/17a5068f06e62fc04e1d5545ed70d4248bef258e))
+* **shared:** resolve hostnames when the runtime has no interface table ([8b03240](https://github.com/nodemailer/nodemailer/commit/8b032407135ea05ae377e623a7021705a4a139d0))
+* **smtp-connection:** clear the timers of a connection dropped before the greeting ([01dcaa0](https://github.com/nodemailer/nodemailer/commit/01dcaa05b212aafc33747041027fb8c66497e0eb))
+* **smtp-connection:** keep an incomplete server reply out of lastServerResponse ([1a6e427](https://github.com/nodemailer/nodemailer/commit/1a6e4271adb808509adf11832ad1adfdfc05c31b))
+* **smtp-pool:** free the pool slot when the proxy socket can not be opened ([204a344](https://github.com/nodemailer/nodemailer/commit/204a344f7e4068ff41385195ee394a223ebadd84))
+* **well-known:** keep nodemailer/lib/well-known/services.json available ([367730c](https://github.com/nodemailer/nodemailer/commit/367730cce85bc78c7804405c2cc7d89d93aafdd1))
+
+## [9.1.1](https://github.com/nodemailer/nodemailer/compare/v9.1.0...v9.1.1) (2026-09-01)
+
+
+### Bug Fixes
+
+* **mailer:** apply the message access policy in resolveContent ([dc48ed3](https://github.com/nodemailer/nodemailer/commit/dc48ed395c4d6c79ee5c95eb6eff17bafe391474))
+* **mailer:** keep message data from reopening the access sandbox ([ab7ef34](https://github.com/nodemailer/nodemailer/commit/ab7ef348b9a97b1fd70e7bfbeb56d4ea4a07946b))
+* **mime-node:** inherit the access policy from the tree a node hangs in ([262d550](https://github.com/nodemailer/nodemailer/commit/262d550b1e121e3ff4ef6675d6771a5b2b4ddcec))
+
+## [9.1.0](https://github.com/nodemailer/nodemailer/compare/v9.0.6...v9.1.0) (2026-08-31)
+
+
+### Features
+
+* **mailer:** cap recipients per message with maxRecipients ([7279ac8](https://github.com/nodemailer/nodemailer/commit/7279ac8dee4f66c032981e6e51e3e7210ad0dcbf))
+
+
+### Bug Fixes
+
+* **addressparser:** handle address lists in linear time ([9116da9](https://github.com/nodemailer/nodemailer/commit/9116da9528c6524cefaed75185602a7e85d20434))
+* **addressparser:** terminate the domain at an RFC 5322 comment ([902b63e](https://github.com/nodemailer/nodemailer/commit/902b63e935435c30f4025901c0902dce64cd8880))
+* **mime-node:** apply UTS-46 mapping when encoding a domain ([259c32d](https://github.com/nodemailer/nodemailer/commit/259c32d7d266301e3377a212776c3fff993c0148))
+* **mime-node:** dedupe envelope recipients in linear time ([7cc38af](https://github.com/nodemailer/nodemailer/commit/7cc38af418ffa6fc7e86085195ca5ca681694b3e))
+* **mime-node:** flatten parsed addresses without concat.apply ([83b8c48](https://github.com/nodemailer/nodemailer/commit/83b8c48cbdb8b3116f2e1ba84af755b2c5661c0f))
+* **mime-node:** keep the recipient dedupe linear across address headers ([34da642](https://github.com/nodemailer/nodemailer/commit/34da64282dcdc9b0581c721a27ab2fa226673150))
+* **mime-node:** keep URL delimiters away from the domain mapper ([b212ac4](https://github.com/nodemailer/nodemailer/commit/b212ac4e27bce8182478044fcb8d1642ccdad46e))
+
+## [9.0.6](https://github.com/nodemailer/nodemailer/compare/v9.0.5...v9.0.6) (2026-08-27)
+
+
+### Bug Fixes
+
+* **addressparser:** recover the addr-spec from an angle-addr holding whitespace ([e989a22](https://github.com/nodemailer/nodemailer/commit/e989a22ca4f5161929bf37be8fb07de635016fa7))
+* harden copies of user supplied keys and URL fetching ([2f667f4](https://github.com/nodemailer/nodemailer/commit/2f667f4272cb2d7cb479b2e3903ab10600fc0eae))
+
+## [9.0.5](https://github.com/nodemailer/nodemailer/compare/v9.0.4...v9.0.5) (2026-08-07)
+
+
+### Bug Fixes
+
+* **ci:** retrigger the workflows dropped during the Actions outage ([85d16c1](https://github.com/nodemailer/nodemailer/commit/85d16c103ec69e237c7e55c0e3103f439c135ce3))
+* **mailer:** escape specials in List-* header comments ([#1842](https://github.com/nodemailer/nodemailer/issues/1842)) ([75913bb](https://github.com/nodemailer/nodemailer/commit/75913bba032623046dd7fa037b8b880e388d8357))
+* **mime-funcs:** star the continuation key of a restarted parameter line ([36bcf1a](https://github.com/nodemailer/nodemailer/commit/36bcf1a21a92b5a283c780e35aacd3080292d98d))
+* **mime-node:** keep control chars out of header values and msg-id headers ([15cf6d1](https://github.com/nodemailer/nodemailer/commit/15cf6d1c15cdf60f551618fd54fb727ea7aac94c))
+* **mime:** encode DEL in header parameters and List-* comments ([cf69430](https://github.com/nodemailer/nodemailer/commit/cf69430ffac1d246bfbab564daf321f31ed9e1dd))
+* **mime:** keep control chars out of the remaining header positions ([5ed9d26](https://github.com/nodemailer/nodemailer/commit/5ed9d26f85eecb48f4b3ae74ad33ed2abf002040))
+* **mime:** normalize an address parsed out of a string as well ([63685f7](https://github.com/nodemailer/nodemailer/commit/63685f7dd4aefa75cc72a36f983f32f61cd6733e))
+* **mime:** normalize an address so header and envelope agree ([a9343b4](https://github.com/nodemailer/nodemailer/commit/a9343b47e42b9ccb27911ad8e73d4119c6170c85))
+* **mime:** stop a header key callback and the dkim tags from injecting ([b7d772e](https://github.com/nodemailer/nodemailer/commit/b7d772ea4ec12ee82e65a9b919af882bf0f125d9))
+
+## [9.0.4](https://github.com/nodemailer/nodemailer/compare/v9.0.3...v9.0.4) (2026-08-04)
+
+
+### Bug Fixes
+
+* **mime-funcs:** do not let an unpaired surrogate consume the next character ([9797f7f](https://github.com/nodemailer/nodemailer/commit/9797f7f57d47b1e27d8ae050550ba93600dbf9f4))
+* **mime-funcs:** keep any surrogate pair intact when chunking base64 mime words ([#1838](https://github.com/nodemailer/nodemailer/issues/1838)) ([5bd3a65](https://github.com/nodemailer/nodemailer/commit/5bd3a657be2d12df1ac2838a1673cb4885e99016))
+* **mime-funcs:** percent encode unpaired surrogates in header parameter values ([78f4aa2](https://github.com/nodemailer/nodemailer/commit/78f4aa253d0ebb9c5ba91301adacef5fb6cf5493))
+* **mime-node:** escape backslash and quote in the Content-Type name parameter ([#1837](https://github.com/nodemailer/nodemailer/issues/1837)) ([adcfc4f](https://github.com/nodemailer/nodemailer/commit/adcfc4f46445edc8a14136b2bf3f775943425c13))
+* **mime:** encode HT/CR/LF in header parameter values instead of quoting them ([#1840](https://github.com/nodemailer/nodemailer/issues/1840)) ([5bc9cab](https://github.com/nodemailer/nodemailer/commit/5bc9cabddcb8d18d16244701ae9facc8fba942a3))
+
 ## [9.0.3](https://github.com/nodemailer/nodemailer/compare/v9.0.2...v9.0.3) (2026-06-30)
 
 

package/node_modules/nodemailer/README.md

@@ -8,10 +8,11 @@ Send emails from Node.js – easy as cake! 🍰✉️
 
 See [nodemailer.com](https://nodemailer.com/) for documentation and terms.
 
-> [!TIP]
-> Check out **[EmailEngine](https://emailengine.app/?utm_source=github-nodemailer&utm_campaign=nodemailer&utm_medium=readme-link)** – a self-hosted email gateway that allows making **REST requests against IMAP and SMTP servers**. EmailEngine also sends webhooks whenever something changes on the registered accounts.\
-> \
-> Using the email accounts registered with EmailEngine, you can receive and [send emails](https://emailengine.app/sending-emails?utm_source=github-nodemailer&utm_campaign=nodemailer&utm_medium=readme-link). EmailEngine supports OAuth2, delayed sends, opens and clicks tracking, bounce detection, etc. All on top of regular email accounts without an external MTA service.
+> Nodemailer is developed by the team behind **[EmailEngine](https://emailengine.app/?utm_source=nodemailer-readme&utm_medium=readme&utm_campaign=oss-docs)**, a self-hosted email API that turns any Gmail, Microsoft 365, or IMAP account into a REST endpoint, with managed OAuth2, webhooks for incoming mail, and built-in [sending](https://emailengine.app/sending-emails?utm_source=nodemailer-readme&utm_medium=readme&utm_campaign=oss-docs). If you would rather call an HTTP API than maintain IMAP and SMTP connections yourself, that is what it is for.
+
+## Supported runtimes
+
+Nodemailer targets Node.js 20 and later. The ES module build also runs on [Bun](https://bun.sh/) (tested against the latest release) and on [Cloudflare Workers](https://developers.cloudflare.com/workers/) with the `nodejs_compat` compatibility flag. On Workers only the SMTP based transports apply, `sendmail` needs a child process, and the runtime does not allow turning certificate validation off, so `tls.rejectUnauthorized: false` fails there with an error.
 
 ## Having an issue?
 
@@ -19,13 +20,13 @@ See [nodemailer.com](https://nodemailer.com/) for documentation and terms.
 
 Documentation for Nodemailer can be found at [nodemailer.com](https://nodemailer.com/about/).
 
-#### Nodemailer throws a SyntaxError for "..."
+#### Nodemailer fails to load or throws a SyntaxError
 
-You are using an older Node.js version than v6.0. Upgrade Node.js to get support for the spread operator. Nodemailer supports all Node.js versions starting from Node.js@v6.0.0.
+Nodemailer 10 and later require Node.js 20 or newer. The package ships both ES module and CommonJS builds, so `import nodemailer from 'nodemailer'` and `const nodemailer = require('nodemailer')` both work. If you need to run on an older Node.js version, stay on the 9.x line.
 
 #### I'm having issues with Gmail
 
-Gmail either works well, or it does not work at all. It is probably easier to switch to an alternative service instead of fixing issues with Gmail. If Gmail does not work for you, then don't use it. Read more about it [here](https://nodemailer.com/usage/using-gmail/).
+Gmail either works well, or it does not work at all. It is probably easier to switch to an alternative service instead of fixing issues with Gmail. If Gmail does not work for you, then don't use it. Read more about it [here](https://nodemailer.com/usage/using-gmail/). If the blocker is OAuth2 setup rather than Gmail itself, [EmailEngine](https://emailengine.app/?utm_source=nodemailer-readme&utm_medium=readme&utm_campaign=oss-docs&utm_content=faq-gmail) handles the OAuth2 flow and token refresh for you.
 
 #### I get ETIMEDOUT errors
 
@@ -55,7 +56,7 @@ let configOptions = {
 
 #### I have issues with DNS / hosts file
 
-Node.js uses [c-ares](https://nodejs.org/en/docs/meta/topics/dependencies/#c-ares) to resolve domain names, not the DNS library provided by the system, so if you have some custom DNS routing set up, it might be ignored. Nodemailer runs [dns.resolve4()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnsresolve4hostname-options-callback) and [dns.resolve6()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnsresolve6hostname-options-callback) to resolve hostname into an IP address. If both calls fail, then Nodemailer will fall back to [dns.lookup()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnslookuphostname-options-callback). If this does not work for you, you can hard code the IP address into the configuration like shown below. In that case, Nodemailer would not perform any DNS lookups.
+Node.js uses [c-ares](https://github.com/c-ares/c-ares) to resolve domain names, not the DNS library provided by the system, so if you have some custom DNS routing set up, it might be ignored. Nodemailer runs [dns.resolve4()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnsresolve4hostname-options-callback) and [dns.resolve6()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnsresolve6hostname-options-callback) to resolve hostname into an IP address. If both calls fail, then Nodemailer will fall back to [dns.lookup()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnslookuphostname-options-callback). If this does not work for you, you can hard code the IP address into the configuration like shown below. In that case, Nodemailer would not perform any DNS lookups.
 
 ```js
 let configOptions = {
@@ -71,7 +72,7 @@ let configOptions = {
 
 #### I have an issue with TypeScript types
 
-Nodemailer has official support for Node.js only. For anything related to TypeScript, you need to directly contact the authors of the [type definitions](https://www.npmjs.com/package/@types/nodemailer).
+Nodemailer 10 and later are written in TypeScript and ship their own type definitions, so `@types/nodemailer` is no longer needed and should be removed from your project to avoid conflicting declarations. The type names follow the layout of the old definitions, so references such as `Mail.Options`, `SMTPTransport.Options` or `Transporter<SMTPTransport.SentMessageInfo>` keep compiling, and the most used types (`SendMailOptions`, `Transporter`, `SentMessageInfo`, `Attachment`, `Address`) are exported from the package root. For older Nodemailer versions, the community maintained [type definitions](https://www.npmjs.com/package/@types/nodemailer) still apply.
 
 #### I have a different problem
 

package/node_modules/nodemailer/SECURITY.md

@@ -6,13 +6,13 @@ reports seriously and aim to respond quickly.
 ## Supported Versions
 
 Security fixes are released only against the latest major version. We do not
-backport patches to older majors — upgrading to the current release line is the
-supported way to receive security updates.
+backport patches to older majors, so upgrading to the current release line is
+the supported way to receive security updates.
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 8.x     | :white_check_mark: |
-| < 8.0   | :x:                |
+| 10.x    | :white_check_mark: |
+| < 10.0  | :x:                |
 
 If you are on an older major, please upgrade. See the migration notes at
 <https://nodemailer.com/> before updating.
@@ -41,7 +41,7 @@ When reporting, please include as much of the following as you can:
 - Any suggested remediation, if you have one.
 
 Nodemailer is maintained by a single person, so there is no guaranteed response
-time — sometimes reports are handled within hours, sometimes they take longer.
+time: sometimes reports are handled within hours, sometimes they take longer.
 Accepted issues are fixed in a new release and coordinated through a GitHub
 Security Advisory, and reporters who wish to be named are credited.
 
@@ -49,12 +49,12 @@ Security Advisory, and reporters who wish to be named are credited.
 
 We track and disclose vulnerabilities through GitHub Security Advisories. We do
 not request or manage CVE identifiers ourselves. If you need a CVE assigned for a
-reported issue, please request one yourself — for example, through GitHub's own
+reported issue, please request one yourself, for example through GitHub's own
 CVE request flow on the published advisory, or another CNA.
 
 ## Scope
 
-In scope: the `nodemailer` package source in this repository — message and MIME
+In scope: the `nodemailer` package source in this repository: message and MIME
 generation, SMTP/LMTP client behaviour, address parsing, header handling, DKIM
 signing, and the bundled transports.
 

package/node_modules/nodemailer/dist/cjs/addressparser/index.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Options for addressparser
+ */
+export interface AddressParserOptions {
+    /** Flatten groups into a single list of mailboxes */
+    flatten?: boolean;
+    /** Internal recursion depth counter (do not set manually) */
+    _depth?: number;
+}
+/**
+ * A single mailbox. Either value may be an empty string when the input did not carry it
+ */
+export interface MailboxAddress {
+    name: string;
+    address: string;
+    group?: undefined;
+}
+/**
+ * An address group. RFC 5322 does not allow nested groups, so any nesting is flattened
+ * into `group`
+ */
+export interface GroupAddress {
+    name: string;
+    group: Address[];
+    address?: undefined;
+}
+/**
+ * A parsed address entry, either a mailbox or a group
+ */
+export type Address = MailboxAddress | GroupAddress;
+/**
+ * Parses structured e-mail addresses from an address field
+ *
+ * Example:
+ *
+ *    'Name <address@domain>'
+ *
+ * will be converted to
+ *
+ *     [{name: 'Name', address: 'address@domain'}]
+ *
+ * @param str Address field
+ * @param options Optional options object
+ * @param options._depth Internal recursion depth counter (do not set manually)
+ * @return An array of address objects
+ */
+export default function addressparser(str?: string | null, options?: AddressParserOptions): Address[];