@mavogel/awscdk-rootmail 0.1.7 → 0.1.9

package/node_modules/libbase64/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.3.1](https://github.com/nodemailer/libbase64/compare/v1.3.0...v1.3.1) (2026-09-28)
+
+
+### Bug Fixes
+
+* **decoder:** decode every padded segment instead of stopping at the first padding ([d9ba154](https://github.com/nodemailer/libbase64/commit/d9ba154ba13e45338936a55acec417dfb6ae2e52))
+
 ## [1.3.0](https://github.com/nodemailer/libbase64/compare/v1.2.1...v1.3.0) (2024-02-23)
 
 

package/node_modules/libbase64/lib/libbase64.js

@@ -26,6 +26,22 @@ function encode(buffer) {
  */
 function decode(str) {
     str = str || '';
+
+    // Buffer.from() stops decoding at the first padding char, so input made of several
+    // padded segments (eg. every line padded on its own) is decoded segment by segment
+    if (typeof str === 'string') {
+        let padPos = str.indexOf('=');
+        if (padPos >= 0 && /[a-zA-Z0-9+/\-_]/.test(str.substr(padPos))) {
+            let parts = [];
+            for (let segment of str.split(/[=]+/)) {
+                if (segment) {
+                    parts.push(Buffer.from(segment, 'base64'));
+                }
+            }
+            return Buffer.concat(parts);
+        }
+    }
+
     return Buffer.from(str, 'base64');
 }
 
@@ -215,6 +231,15 @@ class Decoder extends Transform {
             b64 = b64.replace(/[^a-zA-Z0-9+/=]/g, '');
         }
 
+        // everything up to the last padding char ends in complete segments, quartets are
+        // only counted from there on as a padding run restarts the quartet alignment
+        let padded = '';
+        let lastPad = b64.lastIndexOf('=');
+        if (lastPad >= 0) {
+            padded = b64.substr(0, lastPad + 1);
+            b64 = b64.substr(lastPad + 1);
+        }
+
         if (b64.length < 4) {
             this._curLine = b64;
             b64 = '';
@@ -223,6 +248,8 @@ class Decoder extends Transform {
             b64 = b64.substr(0, b64.length - this._curLine.length);
         }
 
+        b64 = padded + b64;
+
         if (b64) {
             let buf = decode(b64);
             this.outputBytes += buf.length;

package/node_modules/libbase64/package.json

@@ -1,6 +1,6 @@
 {
     "name": "libbase64",
-    "version": "1.3.0",
+    "version": "1.3.1",
     "description": "Encode and decode base64 encoded strings",
     "main": "lib/libbase64.js",
     "scripts": {
@@ -24,9 +24,9 @@
     "devDependencies": {
         "chai": "4.4.1",
         "eslint-config-nodemailer": "1.2.0",
-        "eslint-config-prettier": "9.1.0",
-        "grunt": "1.6.1",
-        "grunt-cli": "1.4.3",
+        "eslint-config-prettier": "10.1.8",
+        "grunt": "1.6.3",
+        "grunt-cli": "1.5.0",
         "grunt-eslint": "24.3.0",
         "grunt-mocha-test": "0.13.3",
         "mocha": "10.3.0"

package/node_modules/libmime/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [5.4.6](https://github.com/nodemailer/libmime/compare/v5.4.5...v5.4.6) (2026-09-28)
+
+
+### Bug Fixes
+
+* decode B-encoded words through libbase64 ([362f5ff](https://github.com/nodemailer/libmime/commit/362f5ff9cab6afab4a7673763f57b66d54d0f3e3))
+
+## [5.4.5](https://github.com/nodemailer/libmime/compare/v5.4.4...v5.4.5) (2026-09-28)
+
+
+### Bug Fixes
+
+* linear-time flowed decoding and header unfolding ([4035752](https://github.com/nodemailer/libmime/commit/4035752083f9eee25dff595062f2f9b9bbabee2e))
+
 ## [5.4.4](https://github.com/nodemailer/libmime/compare/v5.4.3...v5.4.4) (2026-09-15)
 
 

package/node_modules/libmime/lib/libmime.js

@@ -82,35 +82,55 @@ class Libmime {
 
         let lines = str.split(/\r?\n/);
 
-        let result = [],
-            buffer = null;
+        let result = [];
+
+        // The current paragraph is kept as a list of non-empty pieces and joined once when it
+        // ends. Appending to one string and testing it with a regex on every line re-scans (and
+        // flattens) the whole paragraph each time, which is quadratic on long soft-wrapped bodies.
+        let parts = null,
+            partsLength = 0;
+
+        let pushPart = part => {
+            if (part) {
+                parts.push(part);
+                partsLength += part.length;
+            }
+        };
 
         // remove soft linebreaks
         // soft linebreaks are added after space symbols
         for (let i = 0; i < lines.length; i++) {
             let line = lines[i];
 
-            let isSoftBreak = buffer !== null && / $/.test(buffer) && !/(^|\n)-- $/.test(buffer);
+            // the last piece is never empty, so it holds the last character of the paragraph
+            let last = parts !== null && parts.length ? parts[parts.length - 1] : '';
+
+            // Lines never contain a line break, so a signature separator can only be the whole
+            // paragraph being exactly "-- "
+            let isSoftBreak = last.endsWith(' ') && !(partsLength === 3 && parts.join('') === '-- ');
 
             if (isSoftBreak) {
                 if (delSp) {
                     // delsp adds space to text to be able to fold it
                     // these spaces can be removed once the text is unfolded
-                    buffer = buffer.slice(0, -1) + line;
-                } else {
-                    buffer += line;
+                    parts.pop();
+                    partsLength -= last.length;
+                    pushPart(last.slice(0, -1));
                 }
+                pushPart(line);
             } else {
-                if (buffer !== null) {
-                    result.push(buffer);
+                if (parts !== null) {
+                    result.push(parts.join(''));
                 }
 
-                buffer = line;
+                parts = [];
+                partsLength = 0;
+                pushPart(line);
             }
         }
 
-        if (buffer) {
-            result.push(buffer);
+        if (parts !== null && partsLength) {
+            result.push(parts.join(''));
         }
 
         // remove whitespace stuffing
@@ -279,12 +299,8 @@ class Libmime {
             }
             str = Buffer.from(bytes);
         } else if (encoding === 'B') {
-            str = Buffer.concat(
-                str
-                    .split('=')
-                    .filter(s => s !== '') // filter empty string
-                    .map(str => Buffer.from(str, 'base64'))
-            );
+            // libbase64 decodes input made of several padded segments segment by segment
+            str = libbase64.decode(str);
         } else {
             // keep as is, convert Buffer to unicode string, assume utf8
             str = Buffer.from(str);
@@ -433,12 +449,16 @@ class Libmime {
         lines = lines.slice(headersPos, bodyPos >= 0 ? bodyPos : lines.length);
 
         // unfold folded lines, a continuation line always starts with a space or a tab
-        for (i = lines.length - 1; i > 0; i--) {
-            if (/^[ \t]/.test(lines[i])) {
-                lines[i - 1] += '\r\n' + lines[i];
-                lines.splice(i, 1);
+        // Built in one forward pass, removing continuation lines with splice() is quadratic
+        let unfolded = [];
+        for (i = 0, len = lines.length; i < len; i++) {
+            if (unfolded.length && /^[ \t]/.test(lines[i])) {
+                unfolded[unfolded.length - 1] += '\r\n' + lines[i];
+            } else {
+                unfolded.push(lines[i]);
             }
         }
+        lines = unfolded;
 
         for (i = 0, len = lines.length; i < len; i++) {
             header = this.decodeHeader(lines[i]);

package/node_modules/libmime/package.json

@@ -1,7 +1,7 @@
 {
     "name": "libmime",
     "description": "Encode and decode quoted printable and base64 strings",
-    "version": "5.4.4",
+    "version": "5.4.6",
     "main": "lib/libmime.js",
     "files": [
         "lib",
@@ -26,8 +26,8 @@
     "dependencies": {
         "encoding-japanese": "2.4.0",
         "iconv-lite": "0.7.3",
-        "libbase64": "1.3.0",
-        "libqp": "2.1.1"
+        "libbase64": "1.3.1",
+        "libqp": "2.1.2"
     },
     "devDependencies": {
         "chai": "4.4.1",

package/node_modules/libqp/.github/workflows/release.yaml

@@ -2,6 +2,9 @@ on:
     push:
         branches:
             - master
+    # Manual run: publish the version currently on master (used when a release was cut
+    # but the publish step failed)
+    workflow_dispatch:
 
 permissions:
     contents: write
@@ -15,23 +18,22 @@ jobs:
         steps:
             - uses: google-github-actions/release-please-action@v3
               id: release
+              if: ${{ github.event_name == 'push' }}
               with:
                   release-type: node
                   package-name: ${{vars.NPM_MODULE_NAME}}
                   pull-request-title-pattern: 'chore${scope}: release ${version} [skip-ci]'
-            # The logic below handles the npm publication:
+            # The logic below handles the npm publication through npm trusted publishing
+            # (OIDC, no token secret): it runs when a new release is created, or on a
+            # manual dispatch.
             - uses: actions/checkout@v4
-              # these if statements ensure that a publication only occurs when
-              # a new release is created:
-              if: ${{ steps.release.outputs.release_created }}
+              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}
             - uses: actions/setup-node@v4
               with:
-                  node-version: 20
+                  node-version: 24
                   registry-url: 'https://registry.npmjs.org'
-              if: ${{ steps.release.outputs.release_created }}
+              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}
             - run: npm ci
-              if: ${{ steps.release.outputs.release_created }}
+              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}
             - run: npm publish --provenance --access public
-              env:
-                  NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
-              if: ${{ steps.release.outputs.release_created }}
+              if: ${{ steps.release.outputs.release_created || github.event_name == 'workflow_dispatch' }}

package/node_modules/libqp/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [2.1.2](https://github.com/nodemailer/libqp/compare/v2.1.1...v2.1.2) (2026-09-28)
+
+
+### Bug Fixes
+
+* **decoder:** keep raw 8-bit bytes intact when decoding ([7bbdcbe](https://github.com/nodemailer/libqp/commit/7bbdcbeac4475e5e16b7f24a578ed6209de133a8))
+
 ## [2.1.1](https://github.com/nodemailer/libqp/compare/v2.1.0...v2.1.1) (2024-11-29)
 
 

package/node_modules/libqp/lib/libqp.js

@@ -45,12 +45,14 @@ function encode(buffer) {
 /**
  * Decodes a Quoted-Printable encoded string to a Buffer object
  *
- * @param {String} str Quoted-Printable encoded string
+ * @param {String|Buffer} str Quoted-Printable encoded string. A Buffer is read byte for byte,
+ *        so raw 8-bit bytes in the input are copied to the output unchanged
  * @returns {Buffer} Decoded value
  */
 function decode(str) {
-    str = (str || '')
-        .toString()
+    // 'binary' maps every byte to one char code 0-255. A UTF-8 read would collapse raw
+    // multi-byte chars into one byte below and turn raw latin1 bytes into U+FFFD
+    str = (Buffer.isBuffer(str) ? str.toString('binary') : (str || '').toString())
         // remove invalid whitespace from the end of lines
         .replace(/[\t ]+$/gm, '')
         // remove soft line breaks
@@ -292,7 +294,7 @@ class Decoder extends Transform {
 
     _flush(done) {
         if (this.inputBytes) {
-            let buf = decode(Buffer.concat(this.qpChunks, this.inputBytes).toString());
+            let buf = decode(Buffer.concat(this.qpChunks, this.inputBytes));
             this.outputBytes += buf.length;
             this.push(buf);
         }

package/node_modules/libqp/package.json

@@ -1,6 +1,6 @@
 {
     "name": "libqp",
-    "version": "2.1.1",
+    "version": "2.1.2",
     "description": "Encode and decode quoted-printable strings according to rfc2045",
     "main": "lib/libqp.js",
     "scripts": {
@@ -23,6 +23,6 @@
     "homepage": "https://github.com/nodemailer/libqp",
     "devDependencies": {
         "eslint-config-nodemailer": "1.2.0",
-        "eslint-config-prettier": "9.1.0"
+        "eslint-config-prettier": "10.1.8"
     }
 }

package/node_modules/libqp/test/libqp-test.js

@@ -42,12 +42,8 @@ test('Encoding tests', async t => {
 
 test('Decoding tests', async t => {
     // Example taken from RFC2045 section 6.7
-    const encoded =
-        "Now's the time =\r\n" +
-        "for all folk to come=\r\n" +
-        " to the aid of their country."
-    const expectedDecoded =
-        "Now's the time for all folk to come to the aid of their country."
+    const encoded = "Now's the time =\r\n" + 'for all folk to come=\r\n' + ' to the aid of their country.';
+    const expectedDecoded = "Now's the time for all folk to come to the aid of their country.";
 
     await t.test('simple string', async () => {
         const decoded = libqp.decode(encoded).toString();
@@ -81,8 +77,8 @@ test('Decoding tests', async t => {
 
     await t.test('stream, multiple chunks', async () => {
         const encodedChunk1Length = 3;
-        const encodedChunk1 = encoded.substring(0, encodedChunk1Length)
-        const encodedChunk2 = encoded.substring(encodedChunk1Length)
+        const encodedChunk1 = encoded.substring(0, encodedChunk1Length);
+        const encodedChunk2 = encoded.substring(encodedChunk1Length);
 
         const decoder = new libqp.Decoder();
 
@@ -111,8 +107,8 @@ test('Decoding tests', async t => {
 
     await t.test('stream, space at end of chunk', async () => {
         const encodedChunk1Length = encoded.indexOf(' ') + 1;
-        const encodedChunk1 = encoded.substring(0, encodedChunk1Length)
-        const encodedChunk2 = encoded.substring(encodedChunk1Length)
+        const encodedChunk1 = encoded.substring(0, encodedChunk1Length);
+        const encodedChunk2 = encoded.substring(encodedChunk1Length);
 
         const decoder = new libqp.Decoder();
 
@@ -141,8 +137,8 @@ test('Decoding tests', async t => {
 
     await t.test('stream, soft line break equals sign at end of chunk', async () => {
         const encodedChunk1Length = encoded.indexOf('=') + 1;
-        const encodedChunk1 = encoded.substring(0, encodedChunk1Length)
-        const encodedChunk2 = encoded.substring(encodedChunk1Length)
+        const encodedChunk1 = encoded.substring(0, encodedChunk1Length);
+        const encodedChunk2 = encoded.substring(encodedChunk1Length);
 
         const decoder = new libqp.Decoder();
 
@@ -171,8 +167,8 @@ test('Decoding tests', async t => {
 
     await t.test('stream, CR at end of chunk', async () => {
         const encodedChunk1Length = encoded.indexOf('\r') + 1;
-        const encodedChunk1 = encoded.substring(0, encodedChunk1Length)
-        const encodedChunk2 = encoded.substring(encodedChunk1Length)
+        const encodedChunk1 = encoded.substring(0, encodedChunk1Length);
+        const encodedChunk2 = encoded.substring(encodedChunk1Length);
 
         const decoder = new libqp.Decoder();
 
@@ -199,3 +195,64 @@ test('Decoding tests', async t => {
         assert.strictEqual(decoded, expectedDecoded);
     });
 });
+
+test('Raw 8-bit bytes in Quoted-Printable input', async t => {
+    const decodeStream = async chunks =>
+        await new Promise((resolve, reject) => {
+            const decoder = new libqp.Decoder();
+            const output = [];
+            decoder.on('data', chunk => output.push(chunk));
+            decoder.on('end', () => resolve(Buffer.concat(output)));
+            decoder.on('error', reject);
+            for (const chunk of chunks) {
+                decoder.write(chunk);
+            }
+            decoder.end();
+        });
+
+    // "caf\xC3\xA9 \xE2\x82\xAC =C3=A9", raw UTF-8 bytes mixed with an escape
+    const utf8Input = Buffer.concat([Buffer.from('caf'), Buffer.from([0xc3, 0xa9, 0x20, 0xe2, 0x82, 0xac]), Buffer.from(' =C3=A9')]);
+    const utf8Expected = Buffer.from('café € é');
+
+    // "caf\xE9 =E9", a raw latin1 byte next to the same byte escaped
+    const latin1Input = Buffer.concat([Buffer.from('caf'), Buffer.from([0xe9]), Buffer.from(' =E9')]);
+    const latin1Expected = Buffer.from([0x63, 0x61, 0x66, 0xe9, 0x20, 0xe9]);
+
+    await t.test('decode() keeps raw UTF-8 bytes from a Buffer', async () => {
+        assert.deepStrictEqual(libqp.decode(utf8Input), utf8Expected);
+    });
+
+    await t.test('decode() keeps raw latin1 bytes from a Buffer', async () => {
+        assert.deepStrictEqual(libqp.decode(latin1Input), latin1Expected);
+    });
+
+    await t.test('decode() of a binary string still maps char codes to bytes', async () => {
+        assert.deepStrictEqual(libqp.decode(latin1Input.toString('binary')), latin1Expected);
+    });
+
+    await t.test('Decoder keeps raw UTF-8 bytes', async () => {
+        assert.deepStrictEqual(await decodeStream([utf8Input]), utf8Expected);
+    });
+
+    await t.test('Decoder keeps raw latin1 bytes', async () => {
+        assert.deepStrictEqual(await decodeStream([latin1Input]), latin1Expected);
+    });
+
+    await t.test('Decoder keeps raw bytes and escapes split byte by byte', async () => {
+        const chunks = [];
+        for (let i = 0; i < utf8Input.length; i++) {
+            chunks.push(utf8Input.subarray(i, i + 1));
+        }
+        assert.deepStrictEqual(await decodeStream(chunks), utf8Expected);
+    });
+
+    await t.test('Decoder handles an escape split across chunks', async () => {
+        // split inside "=C3", once after "=" and once after "=C"
+        const input = Buffer.from('ab=C3=A9=\r\ncd');
+        const expected = Buffer.from('abécd');
+        assert.deepStrictEqual(await decodeStream([input.subarray(0, 3), input.subarray(3)]), expected);
+        assert.deepStrictEqual(await decodeStream([input.subarray(0, 4), input.subarray(4)]), expected);
+        // soft line break split between "=" and CRLF
+        assert.deepStrictEqual(await decodeStream([input.subarray(0, 9), input.subarray(9)]), expected);
+    });
+});

package/node_modules/mailparser/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "3.9.28"
+    ".": "3.9.34"
 }

package/node_modules/mailparser/CHANGELOG.md

@@ -1,5 +1,47 @@
 # Changelog
 
+## [3.9.34](https://github.com/nodemailer/mailparser/compare/v3.9.33...v3.9.34) (2026-10-03)
+
+
+### Bug Fixes
+
+* **deps:** update nodemailer to 10.0.14 ([f79334d](https://github.com/nodemailer/mailparser/commit/f79334d4f2b1cd296a7b4770710ee5095a78c43a))
+
+## [3.9.33](https://github.com/nodemailer/mailparser/compare/v3.9.32...v3.9.33) (2026-10-01)
+
+
+### Bug Fixes
+
+* report an unavailable checksum algorithm as a parser error ([dc24878](https://github.com/nodemailer/mailparser/commit/dc248783a735c379627c0afd76ee3d7ff5400ce0))
+
+## [3.9.32](https://github.com/nodemailer/mailparser/compare/v3.9.31...v3.9.32) (2026-09-30)
+
+
+### Bug Fixes
+
+* **deps:** update nodemailer to 10.0.13 ([c0dfdf8](https://github.com/nodemailer/mailparser/commit/c0dfdf87cdee539ae40a46a09d6a3f5f1b47cd3c))
+
+## [3.9.31](https://github.com/nodemailer/mailparser/compare/v3.9.30...v3.9.31) (2026-09-28)
+
+
+### Bug Fixes
+
+* **deps:** update libmime to 5.4.6 and mailsplit to 5.4.19 ([bdaf7c3](https://github.com/nodemailer/mailparser/commit/bdaf7c3945d1c3dc0bebb0300c5dd9cd243e2746))
+
+## [3.9.30](https://github.com/nodemailer/mailparser/compare/v3.9.29...v3.9.30) (2026-09-28)
+
+
+### Bug Fixes
+
+* cap inlined cid images, report late splitter errors, settle once, honour attachment backpressure, derive partId from the part number ([af3fe56](https://github.com/nodemailer/mailparser/commit/af3fe56719ae6bf5d867f22faf3bf81942659bdd))
+
+## [3.9.29](https://github.com/nodemailer/mailparser/compare/v3.9.28...v3.9.29) (2026-09-27)
+
+
+### Bug Fixes
+
+* **deps:** update nodemailer to 10.0.11 ([bd1407a](https://github.com/nodemailer/mailparser/commit/bd1407a1f653e4fdb95df406e779184164ddee38))
+
 ## [3.9.28](https://github.com/nodemailer/mailparser/compare/v3.9.27...v3.9.28) (2026-09-15)
 
 

package/node_modules/mailparser/README.md

@@ -25,6 +25,11 @@ const mailparser = require('mailparser');
 
 See [mailparser homepage](https://nodemailer.com/extras/mailparser/) for documentation and terms.
 
+### Limits
+
+- `simpleParser` replaces `cid:` image references in the HTML with `data:` URLs. The total length of the URLs written into the HTML is capped by the `maxInlinedImagesSize` option (default 20 MB, counted in characters of the inserted URLs). References past the cap stay as `cid:` links. The same cap applies to URLs returned from a custom `updateImageLinks()` callback.
+- `simpleParser` calls its callback, or settles its promise, exactly once. When `MailParser` reports a non-fatal error (for example HTML longer than `maxHtmlLengthToParse`), that error is what the caller receives. `MailParser` itself still emits the `'error'` event and then finishes parsing.
+
 ### License
 
 Licensed under MIT