@mavogel/awscdk-rootmail 0.1.24 → 0.1.26

package/node_modules/nodemailer/dist/esm/mailer/mail-message.js

@@ -145,7 +145,10 @@ export default class MailMessage {
         const values = [data.html, data.text, data.watchHtml, data.amp, data.raw, data.icalEvent];
         for (const key of ['attachments', 'alternatives']) {
             if (Array.isArray(data[key])) {
-                values.push(...data[key]);
+                // one at a time, spreading a long enough list into the arguments throws
+                for (const entry of data[key]) {
+                    values.push(entry);
+                }
             }
         }
         for (const value of values) {

package/node_modules/nodemailer/dist/esm/mime-funcs/index.js

@@ -21,6 +21,12 @@ export function isPlainText(value, isParam) {
     const re = isParam ? /[\x00-\x1f\x7f"\u0080-\uFFFF]/ : /[\x00-\x08\x0b\x0c\x0e-\x1f\u0080-\uFFFF]/;
     return typeof value === 'string' && !re.test(value);
 }
+// A parameter value goes out as is only when it is plain text that does not look like an encoded
+// word. Receivers decode encoded words found in parameter values (libmime does so for unencoded
+// continuations), so as plain text it would come back as something else
+function isPlainParamValue(value) {
+    return isPlainText(value, true) && !value.includes('=?');
+}
 /**
  * Wraps a value into a quoted-string. Inside one a quote would end the string early
  * and a backslash would escape whatever follows it, so both go out as quoted-pairs.
@@ -188,7 +194,7 @@ export function buildHeaderValue(structured) {
         const value = structured.params[key];
         // a parameter name is a token too and it is emitted without any quoting around it
         const param = key.replace(/[\x00-\x1f\x7f]/g, '');
-        if (!isPlainText(value, true) || value.length >= 75) {
+        if (!isPlainParamValue(value) || value.length >= 75) {
             buildHeaderParam(param, value, 50).forEach(encodedParam => {
                 if (!/[\s"\\;:/=(),<>@[\]?]|^[-']|'$/.test(encodedParam.value) || encodedParam.key.substr(-1) === '*') {
                     paramsArray.push(encodedParam.key + '=' + encodedParam.value);
@@ -237,7 +243,7 @@ export function buildHeaderParam(key, data, maxLength) {
     let i, len;
     maxLength = maxLength || 50;
     // process ascii only text
-    if (isPlainText(data, true)) {
+    if (isPlainParamValue(data)) {
         // check if conversion is even needed
         if (encodedStr.length <= maxLength) {
             return [

package/node_modules/nodemailer/dist/esm/mime-node/index.js

@@ -26,6 +26,35 @@ const QUOTED_STRING = /^"(?:[^"\\]|\\[\s\S])*"$/;
 // else goes into angle brackets so that the header can not be read as more addresses than
 // the envelope carries
 const PLAIN_ADDRESS = /^[^\s"(),:;<>@[\\\]]+@[^\s"(),:;<>@[\\\]]+$/;
+/**
+ * A domain literal that ends an address, see _normalizeAddress
+ */
+const DOMAIN_LITERAL_TAIL = /@(\[[^[\]\\]*\])$/;
+/**
+ * Removes the whitespace inside every <...> of a References value. A "<" with no ">" after
+ * it is left as it is. An index scan, the regex /<[^>]*>/g rescans the rest of the value
+ * from every such "<"
+ *
+ * @param value References header value
+ * @returns The value with the msg-ids closed up
+ */
+function stripWhitespaceInAngleBrackets(value) {
+    let result = '';
+    let pos = 0;
+    for (;;) {
+        const open = value.indexOf('<', pos);
+        if (open < 0) {
+            break;
+        }
+        const close = value.indexOf('>', open + 1);
+        if (close < 0) {
+            break;
+        }
+        result += value.slice(pos, open) + value.slice(open, close + 1).replace(/\s/g, '');
+        pos = close + 1;
+    }
+    return result + value.slice(pos);
+}
 // domainToASCII and domainToUnicode are WHATWG host parsers rather than plain IDNA
 // mappers, so they do more than map: they cut the host at '/', '\\', '?' and '#', drop C0
 // controls, and percent-decode. Handing them 'evil.example/mail.corp.example' returns the
@@ -1319,26 +1348,26 @@ class MimeNode {
                 }
                 return value;
             // space separated list of values enclosed in <>
-            case 'References':
-                value = [].concat
-                    .apply([], [].concat(value || '').map(elm => {
-                    elm = (elm || '')
+            case 'References': {
+                const ids = [];
+                for (const entry of [].concat(value || '')) {
+                    const elm = (entry || '')
                         .toString()
                         .replace(/\r?\n|\r/g, ' ')
                         .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '')
                         .trim();
-                    return elm.replace(/<[^>]*>/g, str => str.replace(/\s/g, '')).split(/\s+/);
-                }))
-                    .map(elm => {
-                    if (elm.charAt(0) !== '<') {
-                        elm = '<' + elm;
-                    }
-                    if (elm.charAt(elm.length - 1) !== '>') {
-                        elm = elm + '>';
+                    for (let id of stripWhitespaceInAngleBrackets(elm).split(/\s+/)) {
+                        if (id.charAt(0) !== '<') {
+                            id = '<' + id;
+                        }
+                        if (id.charAt(id.length - 1) !== '>') {
+                            id = id + '>';
+                        }
+                        ids.push(id);
                     }
-                    return elm;
-                });
-                return value.join(' ').trim();
+                }
+                return ids.join(' ').trim();
+            }
             case 'Date':
                 if (Object.prototype.toString.call(value) === '[object Date]') {
                     return value.toUTCString().replace(/GMT/, '+0000');
@@ -1417,7 +1446,10 @@ class MimeNode {
             // callers use an empty value to detect a missing address
             return address;
         }
-        const lastAt = address.lastIndexOf('@');
+        // dtext includes '@', so a domain literal is split off at the '@' in front of it and
+        // not at the last one, which delivered 'a@[x@evil.com]' to evil.com
+        const literal = address.charAt(address.length - 1) === ']' ? DOMAIN_LITERAL_TAIL.exec(address) : null;
+        const lastAt = literal ? address.length - literal[1].length - 1 : address.lastIndexOf('@');
         if (lastAt < 0) {
             // Bare username, there is no domain to split off
             return this._normalizeLocalPart(address);

package/node_modules/nodemailer/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.1.2";
+export declare const version = "10.1.7";
 export declare const homepage = "https://nodemailer.com/";

package/node_modules/nodemailer/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.1.2';
+export const version = '10.1.7';
 export const homepage = 'https://nodemailer.com/';

package/node_modules/nodemailer/dist/esm/shared/url.js

@@ -19,10 +19,27 @@ import * as punycode from '../punycode/index.js';
 // Matches a "scheme:" not followed by "//" (and with something after it), used
 // to re-insert the authority separator the legacy parser did not require.
 const SLASHLESS_AUTHORITY = /^([a-zA-Z][a-zA-Z0-9+.-]*:)(?!\/\/)([\s\S]+)$/;
-// Leading and trailing C0 controls and spaces, which the WHATWG parser strips before it
-// looks at the input. Stripped up front so that the slash-less form is recognized in a
-// value read from a file with a trailing newline as well.
-const SURROUNDING_WHITESPACE = /^[\x00-\x20]+|[\x00-\x20]+$/g;
+/**
+ * Drops the leading and trailing C0 controls and spaces, which the WHATWG parser strips
+ * before it looks at the input. Stripped up front so that the slash-less form is recognized
+ * in a value read from a file with a trailing newline as well. An index scan, the regex
+ * /^[\x00-\x20]+|[\x00-\x20]+$/g retried a run of spaces inside the value from every
+ * position in it
+ *
+ * @param input URL string
+ * @returns The string without the surrounding controls and spaces
+ */
+function stripSurroundingWhitespace(input) {
+    let start = 0;
+    let end = input.length;
+    while (start < end && input.charCodeAt(start) <= 0x20) {
+        start++;
+    }
+    while (end > start && input.charCodeAt(end - 1) <= 0x20) {
+        end--;
+    }
+    return input.slice(start, end);
+}
 // Leading characters legacy url.parse() skips before it reads the scheme
 const LEGACY_TRIM = /^[\x00-\x20\u00a0\ufeff]+/;
 // The authority of a "scheme://authority/..." or a scheme-relative "//authority/..."
@@ -117,7 +134,7 @@ function normalizeHostname(raw, href) {
     return mapped;
 }
 export const parse = (input, parseQueryString) => {
-    input = (input || '').replace(SURROUNDING_WHITESPACE, '');
+    input = stripSurroundingWhitespace(input || '');
     // Legacy url.parse() parses a "user:pass@host:port" authority that follows
     // the scheme even without the "//" separator, for schemes outside its
     // built-in slashed-protocol list (smtp:/smtps:/socks:/...). The WHATWG

package/node_modules/nodemailer/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.1.2",
+    "version": "10.1.7",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",

package/package.json

@@ -69,7 +69,7 @@
     "jsii-pacmak": "^1.141.0",
     "jsii-rosetta": "~5.9.0",
     "jsonfile": "^6.2.1",
-    "projen": "^0.104.5",
+    "projen": "^0.104.8",
     "ts-jest": "^29.4.15",
     "ts-node": "^10.9.2",
     "typescript": "^6.0.2"
@@ -79,15 +79,15 @@
     "constructs": "^10.5.1"
   },
   "dependencies": {
-    "@aws-sdk/client-cloudwatch-logs": "^3.1152.0",
-    "@aws-sdk/client-route-53": "^3.1152.0",
-    "@aws-sdk/client-s3": "^3.1152.0",
-    "@aws-sdk/client-ses": "^3.1152.0",
-    "@aws-sdk/client-ssm": "^3.1152.0",
-    "@mavogel/mvc-projen": "^0.0.61",
+    "@aws-sdk/client-cloudwatch-logs": "^3.1153.0",
+    "@aws-sdk/client-route-53": "^3.1153.0",
+    "@aws-sdk/client-s3": "^3.1153.0",
+    "@aws-sdk/client-ses": "^3.1153.0",
+    "@aws-sdk/client-ssm": "^3.1153.0",
+    "@mavogel/mvc-projen": "^0.0.62",
     "cdk-nag": "^3.0.1",
     "constructs": "^10.5.1",
-    "mailparser": "^3.9.40",
+    "mailparser": "^3.10.0",
     "uuid": "^14.0.3"
   },
   "bundledDependencies": [
@@ -122,7 +122,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.1.24",
+  "version": "0.1.26",
   "jest": {
     "coverageProvider": "v8",
     "transformIgnorePatterns": [

package/node_modules/@aws-sdk/core/dist-types/submodules/protocols/json/codec-v1/JsonSettings.d.ts

@@ -1,7 +0,0 @@
-import type { CodecSettings } from "@smithy/types";
-/**
- * @public
- */
-export type JsonSettings = CodecSettings & {
-    jsonName: boolean;
-};

package/node_modules/@aws-sdk/core/dist-types/ts3.4/submodules/protocols/json/codec-v1/JsonSettings.d.ts

@@ -1,4 +0,0 @@
-import { CodecSettings } from "@smithy/types";
-export type JsonSettings = CodecSettings & {
-  jsonName: boolean;
-};

package/node_modules/@aws-sdk/core/dist-types/ts3.4/submodules/protocols/json/codec-v1/JsonShapeDeserializer.d.ts

@@ -1,13 +0,0 @@
-import { DocumentType, Schema, ShapeDeserializer } from "@smithy/types";
-import { SerdeContextConfig } from "../../ConfigurableSerdeContext";
-import { JsonSettings } from "./JsonSettings";
-export declare class JsonShapeDeserializer
-  extends SerdeContextConfig
-  implements ShapeDeserializer<string>
-{
-  readonly settings: JsonSettings;
-  constructor(settings: JsonSettings);
-  read(schema: Schema, data: string | Uint8Array | unknown): Promise<any>;
-  readObject(schema: Schema, data: DocumentType): any;
-  protected _read(schema: Schema, value: unknown): any;
-}

package/node_modules/@aws-sdk/core/dist-types/ts3.4/submodules/protocols/json/codec-v1/JsonShapeSerializer.d.ts

@@ -1,18 +0,0 @@
-import { NormalizedSchema } from "@smithy/core/schema";
-import { Schema, ShapeSerializer } from "@smithy/types";
-import { SerdeContextConfig } from "../../ConfigurableSerdeContext";
-import { JsonSettings } from "./JsonSettings";
-export declare class JsonShapeSerializer
-  extends SerdeContextConfig
-  implements ShapeSerializer<string>
-{
-  readonly settings: JsonSettings;
-  protected buffer: any;
-  protected useReplacer: boolean;
-  protected rootSchema: NormalizedSchema | undefined;
-  constructor(settings: JsonSettings);
-  write(schema: Schema, value: unknown): void;
-  flush(): string;
-  writeDiscriminatedDocument(schema: Schema, value: unknown): void;
-  protected _write(schema: Schema, value: unknown, container?: NormalizedSchema): any;
-}

package/node_modules/@aws-sdk/core/dist-types/ts3.4/submodules/protocols/json/codec-v2/JsonBytesStringAdapter.d.ts

@@ -1,27 +0,0 @@
-export declare class JsonBytesStringAdapter extends Uint8Array {
-  private string;
-  static allocUnsafe(bytes: number): JsonBytesStringAdapter;
-  toString(): string;
-  valueOf(): any;
-  includes(searchString: string | number, position?: number): boolean;
-  indexOf(searchString: string | number, position?: number): number;
-  lastIndexOf(searchString: string | number, position?: number): number;
-  startsWith(searchString: string, position?: number): boolean;
-  endsWith(searchString: string, endPosition?: number): boolean;
-  match(regexp: string | RegExp): RegExpMatchArray | null;
-  replace(searchValue: string | RegExp, replaceValue: string): string;
-  search(regexp: string | RegExp): number;
-  split(separator: string | RegExp, limit?: number): string[];
-  substring(start: number, end?: number): string;
-  trim(): string;
-  trimStart(): string;
-  trimEnd(): string;
-  charAt(pos: number): string;
-  charCodeAt(index: number): number;
-  padStart(maxLength: number, fillString?: string): string;
-  padEnd(maxLength: number, fillString?: string): string;
-  repeat(count: number): string;
-  toUpperCase(): string;
-  toLowerCase(): string;
-  private s;
-}

package/node_modules/@aws-sdk/core/dist-types/ts3.4/submodules/protocols/json/codec-v2/JsonShapeDeserializer2.d.ts

@@ -1,15 +0,0 @@
-import { DocumentType, Schema, ShapeDeserializer } from "@smithy/types";
-import { SerdeContextConfig } from "../../ConfigurableSerdeContext";
-import { JsonSettings } from "../JsonSettings";
-export declare class JsonShapeDeserializer2
-  extends SerdeContextConfig
-  implements ShapeDeserializer<string>
-{
-  readonly settings: JsonSettings;
-  constructor(settings: JsonSettings);
-  read(schema: Schema, data: string | Uint8Array | unknown): Promise<any>;
-  readObject(schema: Schema, data: DocumentType): any;
-  protected _read(schema: Schema, value: unknown): any;
-  private _readStruct;
-  private needsTransform;
-}

package/node_modules/@aws-sdk/core/dist-types/ts3.4/submodules/protocols/json/codec-v2/JsonShapeSerializer2.d.ts

@@ -1,39 +0,0 @@
-import { NormalizedSchema } from "@smithy/core/schema";
-import { Schema, ShapeSerializer } from "@smithy/types";
-import { SerdeContextConfig } from "../../ConfigurableSerdeContext";
-import { JsonSettings } from "../JsonSettings";
-export declare class JsonShapeSerializer2
-  extends SerdeContextConfig
-  implements ShapeSerializer<Uint8Array>
-{
-  readonly settings: JsonSettings;
-  private json;
-  private i;
-  private rootSchema;
-  private rawValue;
-  private passthrough;
-  constructor(settings: JsonSettings);
-  write(schema: Schema, value: unknown): void;
-  writeDiscriminatedDocument(schema: Schema, value: unknown): void;
-  flush(): Uint8Array;
-  protected ensure(byteCount: number): void;
-  protected writeAscii(s: string): void;
-  protected writeAsciiQuoted(s: string): void;
-  protected writeJsonString(s: string): void;
-  protected writeUnicodeEscape(code: number): void;
-  protected static readonly B64: Uint8Array;
-  protected writeBase64(data: Uint8Array): void;
-  protected writeValue(
-    schema: Schema,
-    value: unknown,
-    container: NormalizedSchema | undefined,
-  ): void;
-  protected writeStruct(ns: NormalizedSchema, value: Record<string, unknown>): void;
-  protected writeList(ns: NormalizedSchema, value: unknown[], isDocument?: boolean): void;
-  protected writeMap(
-    ns: NormalizedSchema,
-    value: Record<string, unknown>,
-    isDocument?: boolean,
-  ): void;
-  protected writeTimestamp(ns: NormalizedSchema, value: Date): void;
-}

package/node_modules/@aws-sdk/core/dist-types/ts3.4/submodules/protocols/json/jsonReplacer.d.ts

@@ -1,7 +0,0 @@
-export declare class JsonReplacer {
-  private readonly values;
-  private counter;
-  private stage;
-  createReplacer(): (key: string, value: unknown) => unknown;
-  replaceInJson(json: string): string;
-}

package/node_modules/@aws-sdk/core/dist-types/ts3.4/submodules/protocols/json/jsonReviver.d.ts

@@ -1,7 +0,0 @@
-export declare function jsonReviver(
-  key: string,
-  value: any,
-  context?: {
-    source?: string;
-  },
-): any;

package/node_modules/@aws-sdk/core/dist-types/ts3.4/submodules/protocols/json/needsReviver.d.ts

@@ -1,2 +0,0 @@
-import { Schema } from "@smithy/types";
-export declare function needsReviver(schema: Schema): boolean;

package/node_modules/@aws-sdk/core/dist-types/ts3.4/submodules/protocols/json/parseJsonBody.d.ts

@@ -1,14 +0,0 @@
-import { HttpResponse, Schema, SerdeFunctions } from "@smithy/types";
-export declare function parseJsonBody(streamBody: any, context: SerdeFunctions): Promise<any>;
-export declare function parseJsonBody(
-  streamBody: any,
-  context: SerdeFunctions,
-  schema: Schema,
-): Promise<any>;
-export declare const parseJsonErrorBody: (errorBody: any, context: SerdeFunctions) => Promise<any>;
-export declare const loadRestJsonErrorCode: (output: HttpResponse, data: any) => string | undefined;
-export declare const loadJsonRpcErrorCode: (
-  output: HttpResponse,
-  data: any,
-  queryCompat?: boolean,
-) => string | undefined;

package/node_modules/libbase64/.eslintrc

@@ -1,11 +0,0 @@
-{
-    "rules": {
-        "indent": 0,
-        "global-require": 0,
-        "no-await-in-loop": 0
-    },
-    "extends": ["nodemailer", "prettier"],
-    "parserOptions": {
-        "ecmaVersion": 2017
-    }
-}

package/node_modules/libbase64/.github/FUNDING.yml

@@ -1,4 +0,0 @@
-# These are supported funding model platforms
-
-github: [andris9] # enable once enrolled
-custom: ['https://www.paypal.me/nodemailer']

package/node_modules/libbase64/.github/VULNERABILITY_REPORT.yml

@@ -1,75 +0,0 @@
-name: "libbase64 security vulnerability report"
-description: "Report an exploitable security vulnerability in libbase64"
-
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Before reporting, read our
-        [Security Policy](https://github.com/nodemailer/libbase64/security/policy).
-
-        Reports must demonstrate a credible security impact.
-        Technically valid bugs without a realistic attack
-        scenario belong in the regular issue tracker.
-
-  - type: textarea
-    id: summary
-    attributes:
-      label: Vulnerability summary
-      description: Describe the vulnerability and affected versions.
-    validations:
-      required: true
-
-  - type: textarea
-    id: attacker
-    attributes:
-      label: Attacker capabilities
-      description: |
-        What can an attacker control without already having
-        privileged access to the application or its configuration?
-    validations:
-      required: true
-      min_length: 100
-
-  - type: textarea
-    id: exploit
-    attributes:
-      label: Realistic exploitation scenario
-      description: |
-        Describe how this can be exploited in a real application.
-        Explain the prerequisites and security boundary crossed.
-    validations:
-      required: true
-      min_length: 150
-
-  - type: textarea
-    id: poc
-    attributes:
-      label: Proof of concept
-      description: Provide reproducible steps or working code.
-    validations:
-      required: true
-
-  - type: textarea
-    id: impact
-    attributes:
-      label: Security impact
-      description: |
-        What can the attacker achieve? Who is affected?
-        Explain why this is a security vulnerability rather
-        than an ordinary bug.
-    validations:
-      required: true
-      min_length: 100
-
-  - type: checkboxes
-    id: confirmation
-    attributes:
-      label: Reporting requirements
-      options:
-        - label: I have read the Security Policy.
-          required: true
-        - label: I have verified the finding against a supported version.
-          required: true
-        - label: I have described a credible attacker-controlled scenario.
-          required: true

package/node_modules/libbase64/.github/workflows/release.yaml

@@ -1,39 +0,0 @@
-on:
-    push:
-        branches:
-            - master
-    # Manual run: publish the version currently on master (used when a release was cut
-    # but the publish step failed)
-    workflow_dispatch:
-
-permissions:
-    contents: write
-    pull-requests: write
-    id-token: write
-
-name: release
-jobs:
-    release-please:
-        runs-on: ubuntu-latest
-        steps:
-            - uses: google-github-actions/release-please-action@v3
-              id: release
-              if: ${{ github.event_name == 'push' }}
-              with:
-                  release-type: node
-                  package-name: ${{vars.NPM_MODULE_NAME}}
-                  pull-request-title-pattern: 'chore${scope}: release ${version} [skip-ci]'
-            # The logic below handles the npm publication through npm trusted publishing
-            # (OIDC, no token secret): it runs when a new release is created, or on a
-            # manual dispatch.
-            - uses: actions/checkout@v4
-              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}
-            - uses: actions/setup-node@v4
-              with:
-                  node-version: 24
-                  registry-url: 'https://registry.npmjs.org'
-              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}
-            - run: npm ci
-              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}
-            - run: npm publish --provenance --access public
-              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}

package/node_modules/libbase64/.github/workflows/test.yml

@@ -1,21 +0,0 @@
-name: Run tests
-
-on:
-    push:
-    pull_request:
-
-jobs:
-    test:
-        strategy:
-            matrix:
-                node: [16.x, 18.x, 20.x, 21.x]
-                os: [ubuntu-latest]
-        runs-on: ${{ matrix.os }}
-        steps:
-            - uses: actions/checkout@v2
-            - name: Use Node.js ${{ matrix.node }}
-              uses: actions/setup-node@v4
-              with:
-                  node-version: ${{ matrix.node }}
-            - run: npm install
-            - run: npm test

package/node_modules/libbase64/.ncurc.js

@@ -1,13 +0,0 @@
-module.exports = {
-    upgrade: true,
-    reject: [
-        // 12 is esm only ("type": "module"), and grunt-mocha-test require()s it as a
-        // constructor - "Mocha is not a constructor". Node 24 hides this through
-        // require(esm); CI on Node 22 does not. Lift it when the runner drops grunt.
-        'mocha',
-        // 5x is esm only
-        'chai',
-        // api changes in newer eslint
-        'grunt-eslint'
-    ]
-};

package/node_modules/libbase64/.prettierrc.js

@@ -1,8 +0,0 @@
-module.exports = {
-    printWidth: 160,
-    tabWidth: 4,
-    singleQuote: true,
-    endOfLine: 'lf',
-    trailingComma: 'none',
-    arrowParens: 'avoid'
-};