@mavogel/awscdk-rootmail 0.1.4 → 0.1.6

package/node_modules/nodemailer/dist/cjs/stream-transport/index.d.ts

@@ -8,11 +8,11 @@ import type { default as Mail, SentMessageInfo, SendMailOptions, TransportOption
  */
 export interface StreamTransportOptions extends TransportOptions {
     /** Selects this transport in createTransport */
-    streamTransport?: boolean;
+    streamTransport?: boolean | undefined;
     /** If true, the message is returned as a Buffer object instead of a stream */
-    buffer?: boolean;
+    buffer?: boolean | undefined;
     /** Either 'windows' or 'unix', the line ending of the generated message */
-    newline?: string;
+    newline?: string | undefined;
 }
 /**
  * The value the Stream transport hands to the send callback

package/node_modules/nodemailer/dist/cjs/well-known/index.d.ts

@@ -3,23 +3,23 @@
  */
 export interface WellKnownServiceDefinition {
     /** Human readable description of the service */
-    description?: string;
+    description?: string | undefined;
     /** Domains of e-mail addresses hosted by the service */
-    domains?: string[];
+    domains?: string[] | undefined;
     /** Alternative names the service can be looked up by */
-    aliases?: string[];
+    aliases?: string[] | undefined;
     /** SMTP hostname */
-    host?: string;
+    host?: string | undefined;
     /** SMTP port (a numeric string in a few entries) */
-    port?: number | string;
+    port?: number | string | undefined;
     /** true for implicit TLS (usually port 465) */
-    secure?: boolean;
+    secure?: boolean | undefined;
     /** Preferred authentication method */
-    authMethod?: string;
+    authMethod?: string | undefined;
     /** Set to true to require STARTTLS on a plaintext connection */
-    requireTLS?: boolean;
+    requireTLS?: boolean | undefined;
     /** Set to true to skip STARTTLS */
-    ignoreTLS?: boolean;
+    ignoreTLS?: boolean | undefined;
 }
 /**
  * SMTP settings of a well-known service, without the lookup keys

package/node_modules/nodemailer/dist/cjs/well-known/services.js

@@ -119,6 +119,7 @@ exports.services = {
     "FastMail": {
         "description": "FastMail",
         "domains": [
+            "fastmail.com",
             "fastmail.fm"
         ],
         "host": "smtp.fastmail.com",
@@ -232,6 +233,7 @@ exports.services = {
             "Mac"
         ],
         "domains": [
+            "icloud.com",
             "me.com",
             "mac.com"
         ],

package/node_modules/nodemailer/dist/cjs/xoauth2/index.d.ts

@@ -25,50 +25,50 @@ export type XOAuth2PrivateKey = crypto.KeyLike | crypto.SignKeyObjectInput | cry
  */
 export interface XOAuth2Options {
     /** User e-mail address */
-    user?: string;
+    user?: string | undefined;
     /** Client ID value */
-    clientId?: string;
+    clientId?: string | undefined;
     /** Client secret value */
-    clientSecret?: string;
+    clientSecret?: string | undefined;
     /** Refresh token for an user */
-    refreshToken?: string;
+    refreshToken?: string | undefined;
     /** Endpoint for token generation, defaults to 'https://accounts.google.com/o/oauth2/token' */
-    accessUrl?: string;
+    accessUrl?: string | undefined;
     /** An existing valid accessToken */
-    accessToken?: string;
+    accessToken?: string | undefined;
     /** Private key for JSW */
-    privateKey?: XOAuth2PrivateKey;
+    privateKey?: XOAuth2PrivateKey | undefined;
     /** Optional Access Token expire time in ms */
-    expires?: number;
+    expires?: number | undefined;
     /** Optional TTL for Access Token in seconds */
-    timeout?: number;
+    timeout?: number | undefined;
     /** Function to run when a new access token is required */
-    provisionCallback?: XOAuth2ProvisionCallback;
+    provisionCallback?: XOAuth2ProvisionCallback | undefined;
     /** Optional TLS options forwarded to the HTTPS token request. Defaults to strict cert validation; supply { rejectUnauthorized: false } only for self-hosted OAuth providers on private CAs. */
     tls?: {
         [key: string]: any;
-    };
+    } | undefined;
     /** Service account client id (the JWT issuer), switches to the JWT bearer flow */
-    serviceClient?: string;
+    serviceClient?: string | undefined;
     /** Lifetime of the service account JWT in seconds, defaults to 5 minutes, capped at an hour */
-    serviceRequestTimeout?: number;
+    serviceRequestTimeout?: number | undefined;
     /** OAuth2 scope for the service account flow, defaults to 'https://mail.google.com/' */
-    scope?: string;
+    scope?: string | undefined;
     /** Logger component name, defaults to 'OAuth2' */
-    component?: string;
+    component?: string | undefined;
     /** Extra headers for the token request */
-    customHeaders?: OutgoingHttpHeaders;
+    customHeaders?: OutgoingHttpHeaders | undefined;
     /** Extra form fields for the token request */
     customParams?: {
         [key: string]: any;
-    };
+    } | undefined;
 }
 /**
  * The object emitted with the 'token' event once a new access token has been generated
  */
 export interface XOAuth2Token {
     /** User e-mail address */
-    user?: string;
+    user?: string | undefined;
     /** The new access token */
     accessToken: string;
     /** Expire time as a timestamp in milliseconds, 0 when unknown */

package/node_modules/nodemailer/dist/esm/addressparser/index.d.ts

@@ -3,9 +3,7 @@
  */
 export interface AddressParserOptions {
     /** Flatten groups into a single list of mailboxes */
-    flatten?: boolean;
-    /** Internal recursion depth counter (do not set manually) */
-    _depth?: number;
+    flatten?: boolean | undefined;
 }
 /**
  * A single mailbox. Either value may be an empty string when the input did not carry it

package/node_modules/nodemailer/dist/esm/addressparser/index.js

@@ -47,6 +47,134 @@ const ADDR_SPEC = /^[^@\s]+@[^@\s]+$/;
  * further '@' that a domain should not have but malformed headers carry anyway.
  */
 const LOOSE_ADDR_SPEC = /^[^@\s]+@\S+$/;
+/**
+ * An addr-spec sitting inside free text, together with the whitespace around it. Sticky
+ * on purpose: it is run at the one offset _looseAddressStart picks rather than being let
+ * loose to search, see there.
+ */
+const LOOSE_TEXT_ADDR = /\s*\b[^@\s]+@[^\s]+\b\s*/y;
+/**
+ * The characters JS `\s` matches, which the scan below has to agree with to land on the
+ * same match the pattern would.
+ */
+function _isSpaceCode(code) {
+    return (code === 0x20 ||
+        (code >= 0x09 && code <= 0x0d) ||
+        code === 0xa0 ||
+        code === 0x1680 ||
+        (code >= 0x2000 && code <= 0x200a) ||
+        code === 0x2028 ||
+        code === 0x2029 ||
+        code === 0x202f ||
+        code === 0x205f ||
+        code === 0x3000 ||
+        code === 0xfeff);
+}
+/**
+ * The characters JS `\w` matches without the unicode flag, the set the `\b` in
+ * LOOSE_TEXT_ADDR is read against. charCodeAt off either end of the string gives NaN,
+ * which compares false throughout, so out of range reads as the non-word the pattern
+ * treats them as.
+ */
+function _isWordCode(code) {
+    return (code >= 0x30 && code <= 0x39) || (code >= 0x41 && code <= 0x5a) || (code >= 0x61 && code <= 0x7a) || code === 0x5f;
+}
+/**
+ * Whether `\b` holds at an offset
+ */
+function _isBoundary(text, at) {
+    return _isWordCode(text.charCodeAt(at - 1)) !== _isWordCode(text.charCodeAt(at));
+}
+/**
+ * Offset of the first '@' in `text` between `from` and `to`, or -1 when the range holds none.
+ *
+ * indexOf would scan on to the end of the value, and the value here is a whole header. The
+ * walk below steps one whitespace delimited run at a time and only ever uses a '@' that sits
+ * inside the run it is on, so an unbounded probe rescans everything behind that run once per
+ * run and grows with the square of the header: 400KB of free text carrying no '@' took a
+ * quarter of a second. GHSA-v53p-9fqp-m79j took the pattern search out of this walk and left
+ * the probe unbounded behind it.
+ *
+ * @param text Text to look in
+ * @param from Offset to start at
+ * @param to Offset to stop before
+ * @return Offset of the '@', or -1
+ */
+function _indexOfAt(text, from, to) {
+    for (let i = from; i < to; i++) {
+        if (text.charCodeAt(i) === 0x40) {
+            return i;
+        }
+    }
+    return -1;
+}
+/**
+ * Finds the offset LOOSE_TEXT_ADDR matches at, or -1 when it does not match at all.
+ *
+ * Letting the pattern search for itself is quadratic: '[^@\s]+' is retried from every
+ * offset and rescans the run to the next '@' each time, so 140KB of header holding no
+ * usable '@' blocks the event loop for about ten seconds (GHSA-v53p-9fqp-m79j). The search is also unnecessary.
+ * '[^@\s]+' crosses neither whitespace nor a '@', so a match can only begin at the head of
+ * a whitespace delimited run or just past a '@' inside one, and '[^\s]+\b' gives characters
+ * back until it lands on a boundary, so the only end it can take in that run is the last
+ * boundary in it. Both are found in one pass, and the pattern is then run at that single
+ * offset.
+ *
+ * @param text Free text to look in
+ * @return Offset to match at, or -1
+ */
+function _looseAddressStart(text) {
+    const len = text.length;
+    let pos = 0;
+    while (pos < len) {
+        while (pos < len && _isSpaceCode(text.charCodeAt(pos))) {
+            pos++;
+        }
+        if (pos >= len) {
+            break;
+        }
+        const runStart = pos;
+        let runEnd = pos;
+        while (runEnd < len && !_isSpaceCode(text.charCodeAt(runEnd))) {
+            runEnd++;
+        }
+        let at = _indexOfAt(text, runStart, runEnd);
+        if (at >= 0) {
+            let lastBoundary = -1;
+            for (let k = runEnd; k > runStart; k--) {
+                if (_isBoundary(text, k)) {
+                    lastBoundary = k;
+                    break;
+                }
+            }
+            let atomStart = runStart;
+            while (lastBoundary >= 0 && at >= 0) {
+                // '[^@\s]+' has to cover a character before the '@' and '[^\s]+' one after it,
+                // and the boundary that ends the match has to sit past both
+                if (at > atomStart && runEnd > at + 1 && lastBoundary > at + 1) {
+                    for (let start = atomStart; start < at; start++) {
+                        if (_isBoundary(text, start)) {
+                            if (start > runStart) {
+                                return start;
+                            }
+                            // the leading '\s*' is greedy, so a match that begins at the run
+                            // takes the whitespace in front of it along
+                            let padded = runStart;
+                            while (padded > 0 && _isSpaceCode(text.charCodeAt(padded - 1))) {
+                                padded--;
+                            }
+                            return padded;
+                        }
+                    }
+                }
+                atomStart = at + 1;
+                at = _indexOfAt(text, atomStart, runEnd);
+            }
+        }
+        pos = runEnd;
+    }
+    return -1;
+}
 /**
  * Recovers the addr-spec from an angle-addr that came back holding unquoted whitespace.
  *
@@ -131,6 +259,12 @@ function _handleAddress(tokens, depth) {
         textWasQuoted: []
     };
     let insideQuotes = false;
+    // Last character of the run each state is currently accumulating. Reading it back off
+    // the accumulator with slice(-1) makes the engine flatten the whole growing string on
+    // every token, which is quadratic over an address built from many comment-joined atoms
+    // (GHSA-prgh-xp8r-p3m5). A run only ever grows by the token appended below, so the
+    // character is carried along instead of re-read.
+    const lastChars = { address: '', comment: '', group: '', text: '' };
     // Filter out <addresses>, (comments) and regular text
     for (let i = 0, len = tokens.length; i < len; i++) {
         const token = tokens[i];
@@ -161,6 +295,19 @@ function _handleAddress(tokens, depth) {
             }
         }
         else if (token.value) {
+            // An empty quoted string is dropped by the tokenizer, leaving no text token of its
+            // own for textWasQuoted to be recorded on, so the pair of quote operators right in
+            // front of this token is all that is left of it and the run it opens carries the
+            // quoting instead. Without this '""@example.com' reads as the bare '@example.com',
+            // the quotes never go back on, and the value is no longer an addr-spec a trailing
+            // comment can be peeled off of. It only ever opens a run: a run that already holds
+            // material collected outside the quotes is not a quoted string, whatever follows it
+            const prevPrevToken = i > 1 ? tokens[i - 2] : null;
+            const opensAfterEmptyQuotedString = prevToken?.type === 'operator' &&
+                prevToken.value === '"' &&
+                !!prevToken.noBreak &&
+                prevPrevToken?.type === 'operator' &&
+                prevPrevToken.value === '"';
             if (state === 'address') {
                 // Handle unquoted name that includes a "<".
                 // Apple Mail truncates everything between an unexpected < and an address.
@@ -174,17 +321,21 @@ function _handleAddress(tokens, depth) {
             const joins = prevToken &&
                 prevToken.noBreak &&
                 parts.length &&
-                (prevToken.value !== ')' || parts[parts.length - 1].slice(-1) === '@' || token.value.charAt(0) === '@');
+                (prevToken.value !== ')' || lastChars[state] === '@' || token.value.charAt(0) === '@');
             if (joins) {
                 data[state][data[state].length - 1] += token.value;
+                if (token.value) {
+                    lastChars[state] = token.value.charAt(token.value.length - 1);
+                }
                 if (state === 'text' && insideQuotes) {
                     data.textWasQuoted[data.textWasQuoted.length - 1] = true;
                 }
             }
             else {
                 data[state].push(token.value);
+                lastChars[state] = token.value.charAt(token.value.length - 1);
                 if (state === 'text') {
-                    data.textWasQuoted.push(insideQuotes);
+                    data.textWasQuoted.push(insideQuotes || opensAfterEmptyQuotedString);
                 }
             }
         }
@@ -234,16 +385,19 @@ function _handleAddress(tokens, depth) {
                 for (let i = data.text.length - 1; i >= 0; i--) {
                     // Security: Do not extract email addresses from quoted strings
                     if (!data.textWasQuoted[i]) {
-                        data.text[i] = data.text[i]
-                            .replace(/\s*\b[^@\s]+@[^\s]+\b\s*/, (match) => {
-                            if (!extracted) {
-                                data.address = [match.trim()];
+                        const part = data.text[i];
+                        let remainder = part;
+                        const at = _looseAddressStart(part);
+                        if (at >= 0) {
+                            LOOSE_TEXT_ADDR.lastIndex = at;
+                            const match = LOOSE_TEXT_ADDR.exec(part);
+                            if (match) {
+                                data.address = [match[0].trim()];
                                 extracted = true;
-                                return ' ';
+                                remainder = part.slice(0, at) + ' ' + part.slice(at + match[0].length);
                             }
-                            return match;
-                        })
-                            .trim();
+                        }
+                        data.text[i] = remainder.trim();
                         if (extracted) {
                             break;
                         }
@@ -266,6 +420,18 @@ function _handleAddress(tokens, depth) {
         // Join values with spaces
         data.text = data.text.join(' ');
         data.address = data.address.join(' ');
+        if (addressFromQuotedText && data.text) {
+            // The mailbox is still sitting in the text, so it moves over here and is quoted
+            // before the recovery below rather than after it. Anything else the text holds
+            // came along with it: a comment ends the domain but leaves the atoms behind it in
+            // the same text, and '"user"@example.com(x)evil.com' was handed on as the address
+            // 'user@example.com evil.com', a second domain riding into the envelope recipient
+            // on a value that is no addr-spec at all (GHSA-g57g-f23g-4646). Putting the quotes
+            // back first is what lets the recovery tell the whitespace an addr-spec may carry
+            // from the wreckage trailing one, as only a quoted local part may hold whitespace
+            data.address = _quoteLocalPart(data.text);
+            data.text = '';
+        }
         _recoverAddrSpec(data);
         const address = {
             address: data.address || data.text || '',
@@ -279,9 +445,6 @@ function _handleAddress(tokens, depth) {
                 address.address = '';
             }
         }
-        if (addressFromQuotedText && address.address) {
-            address.address = _quoteLocalPart(address.address);
-        }
         addresses.push(address);
     }
     return addresses;

package/node_modules/nodemailer/dist/esm/base64/index.d.ts

@@ -1,4 +1,4 @@
-import { Transform, type TransformCallback } from 'node:stream';
+import { Transform } from 'node:stream';
 /**
  * Encodes a Buffer into a base64 encoded string
  *
@@ -19,7 +19,7 @@ export declare function wrap(str: string, lineLength?: number | false): string;
  */
 export interface EncoderOptions {
     /** Maximum length for lines, set to false to disable wrapping */
-    lineLength?: number | false;
+    lineLength?: number | false | undefined;
 }
 /**
  * Creates a transform stream for encoding data to base64 encoding
@@ -32,9 +32,5 @@ export declare class Encoder extends Transform {
     options: EncoderOptions;
     inputBytes: number;
     outputBytes: number;
-    _curLine: string;
-    _remainingBytes: Buffer | false;
     constructor(options?: EncoderOptions);
-    _transform(chunk: Buffer | string, encoding: BufferEncoding | 'buffer', done: TransformCallback): void;
-    _flush(done: TransformCallback): void;
 }

package/node_modules/nodemailer/dist/esm/base64/index.js

@@ -54,6 +54,7 @@ export class Encoder extends Transform {
         this.inputBytes = 0;
         this.outputBytes = 0;
     }
+    /** @internal */
     _transform(chunk, encoding, done) {
         let buf = encoding !== 'buffer' ? Buffer.from(chunk, encoding) : chunk;
         if (!buf || !buf.length) {
@@ -95,6 +96,7 @@ export class Encoder extends Transform {
         }
         setImmediate(done);
     }
+    /** @internal */
     _flush(done) {
         if (this._remainingBytes && this._remainingBytes.length) {
             this._curLine += encode(this._remainingBytes);

package/node_modules/nodemailer/dist/esm/dkim/index.d.ts

@@ -9,13 +9,13 @@ export type { DKIMKey, DKIMPrivateKey, DKIMSignOptions };
  */
 export interface DKIMOptions extends DKIMSignOptions {
     /** One or more signing keys, used instead of the domainName, keySelector and privateKey options */
-    keys?: DKIMKey | DKIMKey[];
+    keys?: DKIMKey | DKIMKey[] | undefined;
     /** Directory for buffering large message bodies to disk, no buffering when not set */
-    cacheDir?: string | false;
+    cacheDir?: string | false | undefined;
     /** Body size in bytes from which the body is buffered to cacheDir, defaults to 10 MB */
-    cacheTreshold?: number;
+    cacheTreshold?: number | undefined;
     /** Hash algorithm for the body hash and the signature, defaults to sha256 */
-    hashAlgo?: string;
+    hashAlgo?: string | undefined;
 }
 /**
  * The signed message as returned by DKIM#sign

package/node_modules/nodemailer/dist/esm/dkim/message-parser.d.ts

@@ -1,4 +1,4 @@
-import { Transform, type TransformCallback, type TransformOptions } from 'node:stream';
+import { Transform, type TransformOptions } from 'node:stream';
 /**
  * A header line as emitted with the 'headers' event
  */
@@ -35,7 +35,5 @@ export default class MessageParser extends Transform {
      * @return Returns true if headers are already found or false otherwise
      */
     checkHeaders(data: Buffer): boolean;
-    _transform(chunk: Buffer | string, encoding: BufferEncoding, callback: TransformCallback): void;
-    _flush(callback: TransformCallback): void;
     parseHeaders(): MessageParserHeaderLine[];
 }

package/node_modules/nodemailer/dist/esm/dkim/message-parser.js

@@ -88,6 +88,7 @@ export default class MessageParser extends Transform {
         this.updateLastBytes(data);
         return false;
     }
+    /** @internal */
     _transform(chunk, encoding, callback) {
         if (!chunk || !chunk.length) {
             return callback();
@@ -108,6 +109,7 @@ export default class MessageParser extends Transform {
         }
         setImmediate(callback);
     }
+    /** @internal */
     _flush(callback) {
         if (this.headerChunks) {
             // no empty line was seen, so the message consists of headers only
@@ -122,11 +124,18 @@ export default class MessageParser extends Transform {
         // signature covers exactly the bytes the receiving side canonicalizes
         // Only SP and HTAB fold a line, and only they are trimmed from the field name, the
         // same whitespace the relaxed canonicalization in sign.ts works with
-        const lines = (this.rawHeaders || Buffer.alloc(0)).toString('binary').split(/\r?\n/);
-        for (let i = lines.length - 1; i > 0; i--) {
-            if (/^[ \t]/.test(lines[i])) {
-                lines[i - 1] += '\n' + lines[i];
-                lines.splice(i, 1);
+        const rawLines = (this.rawHeaders || Buffer.alloc(0)).toString('binary').split(/\r?\n/);
+        // Unfold in a single forward pass and only ever test a freshly split line for the
+        // continuation prefix. Testing an already merged line instead would rescan a string
+        // that grows with every continuation line, so a header folded into many continuation
+        // lines (a large recipient list, for example) would take quadratic time to unfold
+        const lines = [];
+        for (const rawLine of rawLines) {
+            if (lines.length && /^[ \t]/.test(rawLine)) {
+                lines[lines.length - 1] += '\n' + rawLine;
+            }
+            else {
+                lines.push(rawLine);
             }
         }
         return lines

package/node_modules/nodemailer/dist/esm/dkim/relaxed-body.d.ts

@@ -1,13 +1,13 @@
-import { Transform, type TransformCallback } from 'node:stream';
+import { Transform } from 'node:stream';
 import crypto from 'node:crypto';
 /**
  * Options for the relaxed body hash stream
  */
 export interface RelaxedBodyOptions {
     /** Hash algorithm for the body hash, defaults to sha256 */
-    hashAlgo?: string;
+    hashAlgo?: string | undefined;
     /** Collect the canonicalized body and emit it with the 'hash' event */
-    debug?: boolean;
+    debug?: boolean | undefined;
 }
 /**
  * Passes the message body through unchanged and hashes its relaxed
@@ -22,25 +22,6 @@ export default class RelaxedBody extends Transform {
     /** Bytes of the original body seen so far */
     byteLength: number;
     debug: boolean | undefined;
-    _debugBody: Buffer[] | false;
-    /** The current line has bytes that survive canonicalization */
-    _lineHasContent: boolean;
-    /** Whitespace that ends up as a single space if more content follows on the line */
-    _pendingWsp: boolean;
-    /** A CR that is part of the line ending if LF follows, otherwise content */
-    _pendingCr: boolean;
-    /** Empty lines that are hashed only once a non-empty line follows them */
-    _pendingEmptyLines: number;
     constructor(options?: RelaxedBodyOptions);
-    _hashCanonical(data: Buffer): void;
-    _hashEmptyLines(): void;
-    /**
-     * Writes a content byte, with the space a pending run of whitespace collapses to,
-     * into the output buffer and returns the new write position. Kept a method rather
-     * than a closure so the write position stays a plain local in the byte loop
-     */
-    _emitContent(out: Buffer, outPos: number, c: number): number;
     updateHash(chunk: Buffer, final?: boolean): void;
-    _transform(chunk: Buffer | string, encoding: BufferEncoding, callback: TransformCallback): void;
-    _flush(callback: TransformCallback): void;
 }

package/node_modules/nodemailer/dist/esm/dkim/relaxed-body.js

@@ -29,6 +29,7 @@ export default class RelaxedBody extends Transform {
         this._pendingCr = false;
         this._pendingEmptyLines = 0;
     }
+    /** @internal */
     _hashCanonical(data) {
         if (!data.length) {
             return;
@@ -38,6 +39,7 @@ export default class RelaxedBody extends Transform {
             this._debugBody.push(Buffer.from(data));
         }
     }
+    /** @internal */
     _hashEmptyLines() {
         while (this._pendingEmptyLines > 0) {
             const count = Math.min(this._pendingEmptyLines, EMPTY_LINES.length / 2);
@@ -49,6 +51,7 @@ export default class RelaxedBody extends Transform {
      * Writes a content byte, with the space a pending run of whitespace collapses to,
      * into the output buffer and returns the new write position. Kept a method rather
      * than a closure so the write position stays a plain local in the byte loop
+     * @internal
      */
     _emitContent(out, outPos, c) {
         if (!this._lineHasContent) {
@@ -111,6 +114,7 @@ export default class RelaxedBody extends Transform {
         }
         this._hashCanonical(out.subarray(0, outPos));
     }
+    /** @internal */
     _transform(chunk, encoding, callback) {
         if (!chunk || !chunk.length) {
             return callback();
@@ -123,6 +127,7 @@ export default class RelaxedBody extends Transform {
         this.push(chunk);
         callback();
     }
+    /** @internal */
     _flush(callback) {
         this.updateHash(Buffer.alloc(0), true);
         if (this._lineHasContent) {

package/node_modules/nodemailer/dist/esm/dkim/sign.d.ts

@@ -10,17 +10,17 @@ export type DKIMPrivateKey = crypto.KeyLike | crypto.SignKeyObjectInput | crypto
  */
 export interface DKIMKey {
     /** Domain name to be signed for */
-    domainName?: string;
+    domainName?: string | undefined;
     /** DKIM key selector to use */
-    keySelector?: string;
+    keySelector?: string | undefined;
     /** DKIM private key to use */
-    privateKey?: DKIMPrivateKey;
+    privateKey?: DKIMPrivateKey | undefined;
 }
 export interface DKIMSignOptions extends DKIMKey {
     /** Colon separated list of header field names to sign, defaults to the RFC4871 list */
-    headerFieldNames?: string;
+    headerFieldNames?: string | undefined;
     /** Colon separated list of header field names to leave out of the signature */
-    skipFields?: string;
+    skipFields?: string | undefined;
 }
 /**
  * Canonicalized headers and the list of field names that went into them

package/node_modules/nodemailer/dist/esm/errors.d.ts

@@ -68,21 +68,21 @@ export declare const EFETCH = "EFETCH";
  */
 export interface NodemailerError extends Error {
     /** Nodemailer error code, see ERROR_CODES */
-    code?: string;
+    code?: string | undefined;
     /** SMTP command that was in flight when the server replied with an error */
-    command?: string;
+    command?: string | undefined;
     /** Raw SMTP server response */
-    response?: string;
+    response?: string | undefined;
     /** Numeric SMTP response code */
-    responseCode?: number;
+    responseCode?: number | undefined;
     /** URL of the resource that could not be fetched */
-    sourceUrl?: string;
+    sourceUrl?: string | undefined;
     /** Recipient address the error applies to */
-    recipient?: string;
+    recipient?: string | undefined;
     /** Recipient addresses rejected by the server */
-    rejected?: string[];
+    rejected?: string[] | undefined;
     /** Per-recipient errors for the rejected addresses */
-    rejectedErrors?: NodemailerError[];
+    rejectedErrors?: NodemailerError[] | undefined;
 }
 /**
  * Node style callback: called with an error, or with null and the result