@mavogel/awscdk-rootmail 0.1.27 → 0.1.29

package/node_modules/mailparser/dist/esm/mail-parser.js

@@ -1,16 +1,14 @@
 import mailsplit from '@zone-eu/mailsplit';
 import FlowedDecoder from '@zone-eu/mailsplit/lib/flowed-decoder.js';
-import encodingJapanese from 'encoding-japanese';
 import he from 'he';
 import { htmlToText } from 'html-to-text';
-import iconv from 'iconv-lite';
 import libmime from 'libmime';
 import linkifyIt from 'linkify-it';
 import addressparser from 'nodemailer/lib/addressparser';
-import punycode from 'punycode.js';
 import { Transform } from 'node:stream';
 import tlds from './tlds.cjs';
 import StreamHash from './stream-hash.js';
+import { decodeAddresses, formatAddressesHTML, formatAddressesText } from './address-header.js';
 const { Splitter, ChunkedPassthrough } = mailsplit;
 // Bounds for link detection in text bodies. Message content is untrusted and
 // linkify-it backtracks heavily on crafted input: matching a host is quadratic
@@ -72,49 +70,6 @@ linkify.add('@', {
         match.url = 'https://twitter.com/' + match.url.replace(/^@/, '');
     }
 });
-// Lists the parameters a header value gives in RFC 2231 form (name*=, name*0= or
-// name*0*=). libmime decodes those while parsing the header, so the result must not go
-// through decodeWords as well: filename*=utf-8''a%3D%3Futf-8%3FQ%3F%3D2Eexe%3F%3D would
-// otherwise come out as "a.exe" while a parser that decodes once sees the encoded word.
-function rfc2231ParamNames(value) {
-    let names = new Set();
-    let quote = false;
-    let escaped = false;
-    let start = 0;
-    let addSegment = (end) => {
-        let segment = value.substring(start, end);
-        let eq = segment.indexOf('=');
-        if (eq < 0) {
-            return;
-        }
-        let match = segment
-            .substring(0, eq)
-            .trim()
-            .toLowerCase()
-            .match(/^(.+?)\*(\d+\*?)?$/);
-        if (match) {
-            names.add(match[1]);
-        }
-    };
-    for (let i = 0; i < value.length; i++) {
-        let chr = value.charAt(i);
-        if (escaped) {
-            escaped = false;
-        }
-        else if (chr === '\\') {
-            escaped = true;
-        }
-        else if (chr === '"') {
-            quote = !quote;
-        }
-        else if (chr === ';' && !quote) {
-            addSegment(i);
-            start = i + 1;
-        }
-    }
-    addSegment(value.length);
-    return names;
-}
 // Deepest element nesting html-to-text is asked to convert. htmlparser2 keeps its open
 // element stack at the front of an array, so parsing alone is quadratic in the nesting
 // depth (200k nested <b> took 9 s), and html-to-text's recursive walk overflows the call
@@ -184,6 +139,14 @@ function exceedsHtmlNestingDepth(html, maxDepth) {
     }
     return false;
 }
+// Charsets a body is never decoded from, matched the way iconv-lite and node-iconv compare names
+// (case and punctuation ignored). UTF-7 can carry markup past a filter that looks for "<" (a body
+// of +ADw-script+AD4- decodes to <script>), base64 and hex are transfer encodings. libmime's decode
+// stream refuses the same names, this check applies the refusal to the native Iconv option as well
+const REFUSED_CHARSET = /^(?:(?:cs)?unicode11)?utf7(?:imap)?$|^base64$|^hex$/;
+function isRefusedCharset(charset) {
+    return REFUSED_CHARSET.test((charset || '').toLowerCase().replace(/[^a-z0-9]/g, ''));
+}
 class IconvDecoder extends Transform {
     constructor(Iconv, charset) {
         super();
@@ -213,41 +176,6 @@ class IconvDecoder extends Transform {
         this.stream.end();
     }
 }
-class JPDecoder extends Transform {
-    constructor(charset) {
-        super();
-        this.charset = charset;
-        this.chunks = [];
-        this.chunklen = 0;
-    }
-    _transform(chunk, encoding, done) {
-        if (typeof chunk === 'string') {
-            chunk = Buffer.from(chunk, encoding);
-        }
-        this.chunks.push(chunk);
-        this.chunklen += chunk.length;
-        done();
-    }
-    _flush(done) {
-        let input = Buffer.concat(this.chunks, this.chunklen);
-        try {
-            let output = encodingJapanese.convert(input, {
-                to: 'UNICODE', // to_encoding
-                from: this.charset, // from_encoding
-                type: 'string'
-            });
-            if (typeof output === 'string') {
-                output = Buffer.from(output);
-            }
-            this.push(output);
-        }
-        catch {
-            // keep as is on errors
-            this.push(input);
-        }
-        done();
-    }
-}
 /**
  * A lower level, streaming e-mail parser. It is a Transform stream: write the raw message in and
  * read the parsed content out. It emits:
@@ -323,6 +251,10 @@ class MailParser extends Transform {
             // create wrapper
             return {
                 decodeStream(charset) {
+                    if (isRefusedCharset(charset)) {
+                        // the same refusal as without the Iconv option, see below
+                        return libmime.createDecodeStream(charset);
+                    }
                     // node-iconv resolves its own charset aliases and needs charset-specific
                     // fixups (see IconvDecoder, eg. ks_c_5601-1987), so pass the charset through as is
                     return new IconvDecoder(Iconv, charset);
@@ -332,13 +264,12 @@ class MailParser extends Transform {
         else {
             return {
                 decodeStream(charset) {
-                    // resolve charset aliases (eg. iso-8859-8-i -> ISO-8859-8) via libmime's canonical table
-                    charset = libmime.normalizeCharset((charset || 'ascii').toString());
-                    if (/^jis|^iso-?2022-?jp/i.test(charset)) {
-                        // special case not supported by iconv-lite
-                        return new JPDecoder(charset);
-                    }
-                    return iconv.decodeStream(charset);
+                    // libmime resolves charset aliases (eg. iso-8859-8-i -> ISO-8859-8), decodes the
+                    // Japanese charsets iconv-lite lacks and keeps a multibyte character split across
+                    // chunks intact. A charset it does not know or refuses (UTF-7, which would turn
+                    // +ADw-script+AD4- into <script>, and the base64 and hex transfer encodings) is
+                    // decoded as UTF-8 with invalid bytes replaced, the same as encoded words get
+                    return libmime.createDecodeStream(charset || 'ascii');
                 }
             };
         }
@@ -441,9 +372,18 @@ class MailParser extends Transform {
                 case 'content-type':
                 case 'content-disposition':
                 case 'dkim-signature': {
-                    // a parameter given in RFC 2231 form is decoded by parseHeaderValue already
-                    let rfc2231 = rfc2231ParamNames(value);
-                    value = this.libmime.parseHeaderValue(value);
+                    // The comments of a MIME header are not part of its value, so they are
+                    // dropped as mailsplit drops them for the structure: `boundary=b (comment)`
+                    // names the boundary `b`. A DKIM-Signature is a tag list without comment
+                    // syntax, so a parenthesis in a tag value is data
+                    value = this.libmime.parseHeaderValue(value, { stripComments: key !== 'dkim-signature' });
+                    // A parameter given in RFC 2231 form was decoded by parseHeaderValue already,
+                    // which names it in decodedParams, and must not go through decodeWords as
+                    // well: filename*=utf-8''a%3D%3Futf-8%3FQ%3F%3D2Eexe%3F%3D would otherwise come
+                    // out as a.exe while a parser that decodes once sees the encoded word. A
+                    // second scan of the raw header for the name used to decide this, and read
+                    // `(c)filename*=` as `(c)filename` once the comment was dropped from the real one
+                    let rfc2231 = new Set(value.decodedParams);
                     if (value.value) {
                         value.value = this.libmime.decodeWords(value.value);
                     }
@@ -676,52 +616,7 @@ class MailParser extends Transform {
     }
     /** @internal */
     decodeAddresses(addresses) {
-        for (let i = 0; i < addresses.length; i++) {
-            let address = addresses[i];
-            address.name = (address.name || '').toString().trim();
-            // An encoded word decodes into the display name and nothing else, whatever it
-            // decodes to. RFC 2047 section 5 keeps encoded words out of the addr-spec, so a
-            // name that decodes to "CEO" <ceo@bank.com> is still only a name: parsing it
-            // again would report an address the header never carried
-            if (address.name) {
-                try {
-                    address.name = this.libmime.decodeWords(address.name);
-                }
-                catch {
-                    //ignore, keep as is
-                }
-            }
-            // Security fix: detect RFC 2047 encoded-words in the address field.
-            // Per RFC 2047 Section 5, encoded-words MUST NOT appear in addr-spec.
-            // If found, decode and validate; reject if result is not a simple local@domain.
-            if (address.address && /[=]\?[^?]+\?[BbQq]\?[^?]*\?[=]/.test(address.address)) {
-                try {
-                    let decodedAddr = this.libmime.decodeWords(address.address);
-                    if (/^[^\s@]+@[^\s@]+$/.test(decodedAddr) && !/[=]\?/.test(decodedAddr)) {
-                        address.address = decodedAddr;
-                    }
-                    else {
-                        address.address = '';
-                    }
-                }
-                catch {
-                    address.address = '';
-                }
-            }
-            if (address.address && /@xn--/.test(address.address)) {
-                try {
-                    address.address =
-                        address.address.slice(0, address.address.lastIndexOf('@') + 1) +
-                            punycode.toUnicode(address.address.slice(address.address.lastIndexOf('@') + 1));
-                }
-                catch {
-                    // Not a valid punycode string; keep as is
-                }
-            }
-            if (address.group) {
-                this.decodeAddresses(address.group);
-            }
-        }
+        decodeAddresses(addresses, this.libmime);
     }
     /** @internal */
     createNode(node) {
@@ -1003,7 +898,8 @@ class MailParser extends Transform {
                             this.waitUntilAttachmentEnd = false;
                         }
                     };
-                    let algo = this.options.checksumAlgo || 'md5';
+                    // false skips hashing, checksum is then left unset
+                    let algo = this.options.checksumAlgo === false ? false : this.options.checksumAlgo || 'md5';
                     let hasher;
                     try {
                         hasher = new StreamHash(attachment, algo);
@@ -1156,56 +1052,13 @@ class MailParser extends Transform {
      * Formats parsed addresses for an HTML context, every value HTML-escaped.
      */
     getAddressesHTML(value) {
-        let formatSingleLevel = (addresses) => addresses
-            .map(address => {
-            let str = '<span class="mp_address_group">';
-            if (address.name) {
-                str += '<span class="mp_address_name">' + he.encode(address.name) + (address.group ? ': ' : '') + '</span>';
-            }
-            if (address.address) {
-                let link = '<a href="mailto:' + he.encode(address.address) + '" class="mp_address_email">' + he.encode(address.address) + '</a>';
-                if (address.name) {
-                    str += ' &lt;' + link + '&gt;';
-                }
-                else {
-                    str += link;
-                }
-            }
-            if (address.group) {
-                str += formatSingleLevel(address.group) + ';';
-            }
-            return str + '</span>';
-        })
-            .join(', ');
-        return formatSingleLevel([].concat(value || []));
+        return formatAddressesHTML(value);
     }
     /**
      * Formats parsed addresses as plain text, display names quoted.
      */
     getAddressesText(value) {
-        let formatSingleLevel = (addresses) => addresses
-            .map(address => {
-            let str = '';
-            if (address.name) {
-                // a quoted-string, so a quote or backslash inside the name is escaped
-                str += `"${address.name.replace(/["\\]/g, '\\$&')}"` + (address.group ? ': ' : '');
-            }
-            if (address.address) {
-                let link = address.address;
-                if (address.name) {
-                    str += ' <' + link + '>';
-                }
-                else {
-                    str += link;
-                }
-            }
-            if (address.group) {
-                str += formatSingleLevel(address.group) + ';';
-            }
-            return str;
-        })
-            .join(', ');
-        return formatSingleLevel([].concat(value || []));
+        return formatAddressesText(value);
     }
     /**
      * Replaces `cid:` links to image attachments in the HTML content. Call it once the parser has

package/node_modules/mailparser/dist/esm/stream-hash.d.ts

@@ -10,14 +10,15 @@ export interface HashTarget {
 }
 /**
  * A pass-through stream that records the checksum and byte size of what flows through it on the
- * given object once the stream ends. Throws when the hash algorithm is not available.
+ * given object once the stream ends. Throws when the hash algorithm is not available. With `algo`
+ * set to `false` nothing is hashed and only the size is recorded.
  */
 declare class StreamHash extends Transform {
     attachment: HashTarget;
-    algo: string;
-    hash: crypto.Hash;
+    algo: string | false;
+    hash: crypto.Hash | null;
     byteCount: number;
-    constructor(attachment: HashTarget, algo?: string);
+    constructor(attachment: HashTarget, algo?: string | false);
     _transform(chunk: Buffer, encoding: BufferEncoding, done: TransformCallback): void;
     _flush(done: TransformCallback): void;
 }

package/node_modules/mailparser/dist/esm/stream-hash.js

@@ -2,23 +2,26 @@ import crypto from 'node:crypto';
 import { Transform } from 'node:stream';
 /**
  * A pass-through stream that records the checksum and byte size of what flows through it on the
- * given object once the stream ends. Throws when the hash algorithm is not available.
+ * given object once the stream ends. Throws when the hash algorithm is not available. With `algo`
+ * set to `false` nothing is hashed and only the size is recorded.
  */
 class StreamHash extends Transform {
     constructor(attachment, algo) {
         super();
         this.attachment = attachment;
-        this.algo = (algo || 'md5').toLowerCase();
-        this.hash = crypto.createHash(this.algo);
+        this.algo = algo === false ? false : (algo || 'md5').toLowerCase();
+        this.hash = this.algo === false ? null : crypto.createHash(this.algo);
         this.byteCount = 0;
     }
     _transform(chunk, encoding, done) {
-        this.hash.update(chunk);
+        this.hash?.update(chunk);
         this.byteCount += chunk.length;
         done(null, chunk);
     }
     _flush(done) {
-        this.attachment.checksum = this.hash.digest('hex');
+        if (this.hash) {
+            this.attachment.checksum = this.hash.digest('hex');
+        }
         this.attachment.size = this.byteCount;
         done();
     }

package/node_modules/mailparser/dist/esm/types.d.ts

@@ -37,6 +37,24 @@ export interface AddressObject {
     /** The addresses formatted as plain text, display names quoted. */
     text: string;
 }
+/**
+ * Options for `parseAddressHeader`.
+ */
+export interface ParseAddressHeaderOptions {
+    /**
+     * Replace every group with its members, so the result lists mailboxes only and the group names
+     * are dropped.
+     * @default false
+     */
+    flatten?: boolean;
+    /**
+     * Decode an internationalized (punycode) domain to Unicode. Set to false to keep the domain as
+     * it appears in the header, for an address that is going to be used to send mail, such as an
+     * SMTP envelope, where the ASCII form is the one every server accepts.
+     * @default true
+     */
+    decodePunycode?: boolean;
+}
 /**
  * One entry of the combined `list` header, built from a `List-*` header such as `List-Unsubscribe`.
  */
@@ -122,7 +140,10 @@ export interface AttachmentStream extends AttachmentCommon {
      * message. Must be called for every attachment. Set to `null` once called.
      */
     release: (() => void) | null;
-    /** The hex encoded checksum of the content (md5 unless `checksumAlgo` says otherwise). Set once `content` has ended. */
+    /**
+     * The hex encoded checksum of the content (md5 unless `checksumAlgo` says otherwise). Set once
+     * `content` has ended, never when `checksumAlgo` is `false`.
+     */
     checksum?: string;
     /** The size of the decoded content in bytes. Set once `content` has ended. */
     size?: number;
@@ -135,7 +156,11 @@ export interface Attachment extends AttachmentCommon {
     content: Buffer;
     /** Always `null`, `simpleParser` has released the attachment already. */
     release: null;
-    /** The hex encoded checksum of the content (md5 unless `checksumAlgo` says otherwise). */
+    /**
+     * The hex encoded checksum of the content (md5 unless `checksumAlgo` says otherwise). Not set when
+     * `checksumAlgo` is `false`: the type keeps it a string so code written for the default does not
+     * have to check it, so a caller that turns hashing off must not read it.
+     */
     checksum: string;
     /** The size of the decoded content in bytes. */
     size: number;
@@ -211,16 +236,18 @@ export interface MailParserOptions {
      */
     keepDeliveryStatus?: boolean;
     /**
-     * Decode character sets with the native `iconv` module instead of `iconv-lite`. Pass the
-     * `Iconv` class: `{ Iconv: require('iconv').Iconv }`.
+     * Decode the character sets of text bodies with the native `iconv` module instead of libmime's
+     * decoder (`iconv-lite`). Pass the `Iconv` class: `{ Iconv: require('iconv').Iconv }`. Bodies
+     * declared as UTF-7 are never decoded from it either way, see the note on charsets in the README.
      */
     Iconv?: IconvConstructor;
     /**
      * The hash algorithm for attachment checksums, any name `crypto.createHash()` accepts. An algorithm
-     * that is not available makes the parser emit an error.
+     * that is not available makes the parser emit an error. `false` skips hashing attachments
+     * altogether, and their `checksum` is then not set (`size` still is).
      * @default 'md5'
      */
-    checksumAlgo?: string;
+    checksumAlgo?: string | false;
     /**
      * The longest the URLs `updateImageLinks()` writes into the HTML may be in total, in characters.
      * References past the limit are left as `cid:` links.

package/node_modules/mailparser/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailparser",
-    "version": "3.10.0",
+    "version": "3.12.4",
     "description": "Parse e-mails",
     "type": "module",
     "main": "./dist/cjs/index.js",
@@ -92,14 +92,12 @@
     ],
     "license": "MIT",
     "dependencies": {
-        "@zone-eu/mailsplit": "5.4.27",
-        "encoding-japanese": "2.4.0",
+        "@zone-eu/mailsplit": "5.4.29",
         "he": "1.2.0",
         "html-to-text": "10.0.1",
-        "iconv-lite": "0.7.3",
-        "libmime": "5.5.2",
+        "libmime": "5.6.3",
         "linkify-it": "5.0.2",
-        "nodemailer": "10.1.7",
+        "nodemailer": "10.2.1",
         "punycode.js": "2.3.1",
         "tlds": "1.261.0"
     },
@@ -110,10 +108,11 @@
         "eslint-config-prettier": "10.1.8",
         "globals": "17.13.0",
         "iconv": "3.0.1",
+        "iconv-lite": "0.7.3",
         "prettier": "3.9.10",
         "tsx": "4.23.15",
         "typescript": "6.0.3",
-        "typescript-eslint": "8.71.2"
+        "typescript-eslint": "8.72.0"
     },
     "repository": {
         "type": "git",

package/node_modules/nodemailer/CHANGELOG.md

@@ -1,5 +1,28 @@
 # CHANGELOG
 
+## [10.2.1](https://github.com/nodemailer/nodemailer/compare/v10.2.0...v10.2.1) (2026-10-22)
+
+
+### Bug Fixes
+
+* drop the comments of a Content-Type or Content-Disposition value with the stripComments option ([b3052b7](https://github.com/nodemailer/nodemailer/commit/b3052b7fe2e49b51dd66d6c7814a072e885f1ac8))
+
+## [10.2.0](https://github.com/nodemailer/nodemailer/compare/v10.1.7...v10.2.0) (2026-10-21)
+
+
+### Features
+
+* add info.serverMessageId from the final 250 reply ([108dddd](https://github.com/nodemailer/nodemailer/commit/108dddd88d9d71f708630b7aba7fa2a7d2f14076))
+* add pendingCount() to the SMTP pool ([6cffb70](https://github.com/nodemailer/nodemailer/commit/6cffb7037269a6012d992c263a8927fcaf0563f2))
+* make header value encoding public with MimeNode encodeHeaderValue() ([3b048c7](https://github.com/nodemailer/nodemailer/commit/3b048c7a0fb60f946985b09b3143b0680194e47b))
+* mark SMTP errors as permanent or transient with err.permanent ([6a20e2a](https://github.com/nodemailer/nodemailer/commit/6a20e2ae109eeb5662235d72d1e5a2d38515997a))
+
+
+### Bug Fixes
+
+* label an ASCII message/rfc822 attachment 7bit instead of 8bit ([ad66fa1](https://github.com/nodemailer/nodemailer/commit/ad66fa1a048135867a629bcb7b6dc308ee06a945))
+* report the recipients an LMTP server refuses after DATA in rejectedErrors ([dd64eb3](https://github.com/nodemailer/nodemailer/commit/dd64eb3171e3ab5629828084d3944a7859790968))
+
 ## [10.1.7](https://github.com/nodemailer/nodemailer/compare/v10.1.6...v10.1.7) (2026-10-18)
 
 

package/node_modules/nodemailer/dist/cjs/addressparser/index.js

@@ -693,9 +693,7 @@ function _handleAddress(tokens, from, to) {
             // A run that is a quoted local part with its '@' and domain is an addr-spec of
             // its own, with the quoting put back on, and takes its turn like any other
             const local = data.quotedLocalAt[i];
-            const quotedLocal = data.textWasQuoted[i] && local >= 0 && QUOTED_LOCAL_DOMAIN.test(data.text[i].slice(local))
-                ? _quoteLocalPart(data.text[i])
-                : '';
+            const quotedLocal = data.textWasQuoted[i] && local >= 0 && QUOTED_LOCAL_DOMAIN.test(data.text[i].slice(local)) ? _quoteLocalPart(data.text[i]) : '';
             if (quotedLocal || (!data.textWasQuoted[i] && _isAddrSpec(candidates[i]))) {
                 data.address = [quotedLocal || candidates[i]];
                 data.text.splice(i, 1);
@@ -1020,8 +1018,7 @@ class Tokenizer {
             return;
         }
         if (this.node < 0) {
-            this.node = this.list.push((this.operatorExpecting === '"' || this.operatorExpecting === ')' ? TOKEN_ESCAPES : 0) |
-                (this.escaped ? TOKEN_STARTS_ESCAPED : 0), i, i);
+            this.node = this.list.push((this.operatorExpecting === '"' || this.operatorExpecting === ')' ? TOKEN_ESCAPES : 0) | (this.escaped ? TOKEN_STARTS_ESCAPED : 0), i, i);
         }
         if (chr === '\n') {
             // Convert newlines to spaces. Carriage return is ignored as \r and \n usually

package/node_modules/nodemailer/dist/cjs/dkim/index.js

@@ -25,9 +25,7 @@ class DKIMSigner {
         this.chunks = [];
         this.chunklen = 0;
         this.readPos = 0;
-        this.cachePath = this.cacheDir
-            ? node_path_1.default.join(this.cacheDir, 'message.' + Date.now() + '-' + node_crypto_1.default.randomBytes(14).toString('hex'))
-            : false;
+        this.cachePath = this.cacheDir ? node_path_1.default.join(this.cacheDir, 'message.' + Date.now() + '-' + node_crypto_1.default.randomBytes(14).toString('hex')) : false;
         this.cache = false;
         this.headers = false;
         this.bodyHash = false;

package/node_modules/nodemailer/dist/cjs/errors.d.ts

@@ -68,6 +68,18 @@ export declare const isTransientError: (err: {
     code?: string | undefined;
     responseCode?: number | undefined;
 }) => boolean;
+/**
+ * Tells whether an SMTP reply code is a permanent rejection, one that retrying the same
+ * message would get again. RFC 5321 makes every 5yz reply a permanent negative completion
+ * and every 4yz reply a transient one. 503 (bad sequence of commands) is the exception: it
+ * says the session was in the wrong state for the command rather than that the message was
+ * refused, so the same message can go through on a new connection. 2yz and 3yz replies are
+ * only an error when the client expected something else, and are not permanent either.
+ *
+ * @param responseCode SMTP reply code
+ * @returns true for a permanent rejection
+ */
+export declare const isPermanentResponseCode: (responseCode: number) => boolean;
 /**
  * Code Node.js sets on an error when its permission model (`--permission`) denies an
  * operation. It is not replaced with the Nodemailer code of the failing step (`ESOCKET`,
@@ -89,6 +101,13 @@ export interface NodemailerError extends NodeJS.ErrnoException {
     response?: string | undefined;
     /** Numeric SMTP response code */
     responseCode?: number | undefined;
+    /**
+     * Set together with responseCode, from the reply class: true when the server rejected the
+     * message for good (5xx except 503), false when the same message may be accepted on a later
+     * attempt (4xx, 503, or an unexpected 2xx or 3xx). Not set on an error that carries no SMTP
+     * reply, such as a connection failure or missing credentials, see isPermanentResponseCode
+     */
+    permanent?: boolean | undefined;
     /** URL of the resource that could not be fetched */
     sourceUrl?: string | undefined;
     /** Recipient address the error applies to */

package/node_modules/nodemailer/dist/cjs/errors.js

@@ -10,7 +10,7 @@
  *   err.code = errors.ECONNECTION;
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ERR_ACCESS_DENIED = exports.isTransientError = exports.EFETCH = exports.EURLACCESS = exports.EFILEACCESS = exports.EPROXY = exports.ECONFIG = exports.ESES = exports.ESENDMAIL = exports.EMAXRECIPIENTS = exports.EMAXLIMIT = exports.EOAUTH2 = exports.ENOAUTH = exports.EAUTH = exports.ESTREAM = exports.EMESSAGE = exports.EENVELOPE = exports.EPROTOCOL = exports.EREQUIRETLS = exports.ETLS = exports.EDNS = exports.ESOCKET = exports.ETIMEDOUT = exports.ECONNECTION = exports.ERROR_CODES = void 0;
+exports.ERR_ACCESS_DENIED = exports.isPermanentResponseCode = exports.isTransientError = exports.EFETCH = exports.EURLACCESS = exports.EFILEACCESS = exports.EPROXY = exports.ECONFIG = exports.ESES = exports.ESENDMAIL = exports.EMAXRECIPIENTS = exports.EMAXLIMIT = exports.EOAUTH2 = exports.ENOAUTH = exports.EAUTH = exports.ESTREAM = exports.EMESSAGE = exports.EENVELOPE = exports.EPROTOCOL = exports.EREQUIRETLS = exports.ETLS = exports.EDNS = exports.ESOCKET = exports.ETIMEDOUT = exports.ECONNECTION = exports.ERROR_CODES = void 0;
 /**
  * Error code descriptions for documentation and debugging
  */
@@ -73,6 +73,19 @@ exports.EFETCH = 'EFETCH';
  */
 const isTransientError = (err) => err.responseCode === 421 || err.code === exports.ECONNECTION || err.code === exports.ESOCKET || err.code === exports.ETIMEDOUT;
 exports.isTransientError = isTransientError;
+/**
+ * Tells whether an SMTP reply code is a permanent rejection, one that retrying the same
+ * message would get again. RFC 5321 makes every 5yz reply a permanent negative completion
+ * and every 4yz reply a transient one. 503 (bad sequence of commands) is the exception: it
+ * says the session was in the wrong state for the command rather than that the message was
+ * refused, so the same message can go through on a new connection. 2yz and 3yz replies are
+ * only an error when the client expected something else, and are not permanent either.
+ *
+ * @param responseCode SMTP reply code
+ * @returns true for a permanent rejection
+ */
+const isPermanentResponseCode = (responseCode) => responseCode >= 500 && responseCode < 600 && responseCode !== 503;
+exports.isPermanentResponseCode = isPermanentResponseCode;
 /**
  * Code Node.js sets on an error when its permission model (`--permission`) denies an
  * operation. It is not replaced with the Nodemailer code of the failing step (`ESOCKET`,

package/node_modules/nodemailer/dist/cjs/fetch/cookies.js

@@ -198,16 +198,14 @@ class Cookies {
         // check if hostname matches
         // .foo.com also matches subdomains, foo.com does not
         if (urlparts.hostname !== cookie.domain &&
-            (cookie.domain.charAt(0) !== '.' ||
-                ('.' + urlparts.hostname).substr(-cookie.domain.length) !== cookie.domain)) {
+            (cookie.domain.charAt(0) !== '.' || ('.' + urlparts.hostname).substr(-cookie.domain.length) !== cookie.domain)) {
             return false;
         }
         // check if the request path path-matches the cookie path (RFC 6265 section 5.1.4):
         // identical paths match, otherwise the cookie path must be a directory prefix
         const pathname = urlparts.pathname || '/';
         const cookiePath = cookie.path;
-        const pathMatches = pathname === cookiePath ||
-            (pathname.startsWith(cookiePath) && (cookiePath.endsWith('/') || pathname.charAt(cookiePath.length) === '/'));
+        const pathMatches = pathname === cookiePath || (pathname.startsWith(cookiePath) && (cookiePath.endsWith('/') || pathname.charAt(cookiePath.length) === '/'));
         if (!pathMatches) {
             return false;
         }

package/node_modules/nodemailer/dist/cjs/fetch/index.js

@@ -262,11 +262,7 @@ function nmfetch(url, options) {
             }
         });
     }
-    if (parsed.protocol === 'https:' &&
-        parsed.hostname &&
-        parsed.hostname !== reqOptions.host &&
-        !node_net_1.default.isIP(parsed.hostname) &&
-        !reqOptions.servername) {
+    if (parsed.protocol === 'https:' && parsed.hostname && parsed.hostname !== reqOptions.host && !node_net_1.default.isIP(parsed.hostname) && !reqOptions.servername) {
         reqOptions.servername = parsed.hostname;
     }
     try {
@@ -369,9 +365,7 @@ function nmfetch(url, options) {
             // downgrade would also put them on the wire in cleartext). Strip sensitive
             // request headers so an attacker who controls the redirect target cannot
             // harvest them.
-            const crossOrigin = redirectParsed.protocol !== parsed.protocol ||
-                redirectParsed.hostname !== parsed.hostname ||
-                fetchPort(redirectParsed) !== fetchPort(parsed);
+            const crossOrigin = redirectParsed.protocol !== parsed.protocol || redirectParsed.hostname !== parsed.hostname || fetchPort(redirectParsed) !== fetchPort(parsed);
             if (options.headers && crossOrigin) {
                 const sensitive = ['authorization', 'cookie', 'proxy-authorization'];
                 Object.keys(options.headers).forEach(key => {