@postalsys/email-text-tools 2.6.4 → 3.0.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [3.0.0](https://github.com/postalsys/email-text-tools/compare/v2.6.4...v3.0.0) (2026-11-15)
+
+
+### ⚠ BREAKING CHANGES
+
+* Node.js 22.22.2, 24.15.0 or newer is required (engines.node ^22.22.2 || ^24.15.0 || >=26.0.0). On Node 20 the jsdom bundle throws when mimeHtml is first loaded.
+
+### Bug Fixes
+
+* stop retaining every rendered message, move to jsdom 31 and juice 12 ([dc6028d](https://github.com/postalsys/email-text-tools/commit/dc6028df0fa342c6504a54267a4d7ac1d7734729))
+
 ## [2.6.4](https://github.com/postalsys/email-text-tools/compare/v2.6.3...v2.6.4) (2026-11-10)
 
 

package/README.md

@@ -2,7 +2,7 @@
 
 Email text tools
 
-Ships ES module and CommonJS builds with type declarations, Node.js 20 or newer:
+Ships ES module and CommonJS builds with type declarations, Node.js 22.22.2, 24.15.0 or newer:
 
 ```js
 import { mimeHtml, textToHtml } from '@postalsys/email-text-tools';

package/dist/cjs/lib/jsdom.cjs

@@ -1,5 +1,5 @@
 "use strict";
-// jsdom, loaded from the CommonJS bundle scripts/bundle-jsdom.js builds into dist/vendor/jsdom.cjs.
+// jsdom, loaded from the CommonJS bundle scripts/bundle-vendor.js builds into dist/vendor/jsdom.cjs.
 // jsdom pulls in ES module only packages (parse5 among them), which the CommonJS build must not
 // require(), so the package itself is a devDependency and only its bundle ships. This file compiles
 // to jsdom.cjs in dist/cjs/lib and dist/esm/lib alike, both two levels below dist/vendor.

package/dist/cjs/lib/juice-worker.js

@@ -4,13 +4,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const node_worker_threads_1 = __importDefault(require("node:worker_threads"));
-// Pinned to juice 11.x: juice 12+ is pure ESM (requires Node >=22.12) and breaks pkg builds.
-const juice_1 = __importDefault(require("juice"));
+// juice comes from the CommonJS bundle in dist/vendor, see juice.cts
+const juice_cjs_1 = require("./juice.cjs");
 // Runs as a worker thread (see worker-pool.ts), the parent port is always there
 const parentPort = node_worker_threads_1.default.parentPort;
 parentPort.on('message', (html) => {
     try {
-        const result = (0, juice_1.default)(html);
+        const result = (0, juice_cjs_1.juice)(html);
         parentPort.postMessage({ success: true, result });
     }
     catch (error) {

package/dist/cjs/lib/juice.cjs

@@ -0,0 +1,15 @@
+"use strict";
+// juice, loaded from the CommonJS bundle scripts/bundle-vendor.js builds into dist/vendor/juice.cjs.
+// juice 12 is an ES module only package, which the CommonJS build must not require(), so the
+// package itself is a devDependency and only its bundle ships. This file compiles to juice.cjs in
+// dist/cjs/lib and dist/esm/lib alike, both two levels below dist/vendor.
+//
+// Not part of commonjs.cts on purpose: that module is loaded eagerly, and juice must only load
+// when mimeHtml or the juice worker is first used.
+//
+// The literal require() path is what @yao-pkg/pkg follows to put the bundle into a binary.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.juice = void 0;
+// A named export, like jsdom.cts: the ES module build reads it through the CommonJS export names
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+exports.juice = require('../../vendor/juice.cjs');

package/dist/cjs/lib/juice.d.cts

@@ -0,0 +1,2 @@
+import type JuiceModule from 'juice';
+export declare const juice: typeof JuiceModule;

package/dist/cjs/lib/mime-html.js

@@ -4,8 +4,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const dompurify_1 = __importDefault(require("dompurify"));
-// Pinned to juice 11.x: juice 12+ is pure ESM (requires Node >=22.12) and breaks pkg builds.
-const juice_1 = __importDefault(require("juice"));
+// juice comes from the CommonJS bundle in dist/vendor, see juice.cts
+const juice_cjs_1 = require("./juice.cjs");
 const he_1 = __importDefault(require("he"));
 const node_worker_threads_1 = require("node:worker_threads");
 const worker_pool_js_1 = __importDefault(require("./worker-pool.js"));
@@ -43,8 +43,8 @@ const FORBID_TAGS = [
 ];
 // form submission targets and popovers, which let sender markup act on or overlay the viewer
 const FORBID_ATTR = ['action', 'formaction', 'popover', 'popovertarget'];
+// `all` is forbidden too, but whole attributes at a time, see ALL_RULE
 const FORBID_STYLES = [
-    'all',
     'position',
     'clip',
     'animation',
@@ -70,10 +70,17 @@ const FORBID_STYLES = [
     'scrollbar-width',
     'zoom'
 ];
+// A CSS comment, written so that a run of them can only be split one way (no backtracking blowup)
+const CSS_COMMENT = '/\\*[^*]*\\*+(?:[^/*][^*]*\\*+)*/';
 function styleRule(properties, hint) {
-    return { properties, hint, declaration: new RegExp('(?:^|[^a-z0-9-])(?:' + properties.join('|') + ')\\s*:', 'i') };
+    return { properties, hint, declaration: new RegExp(`(?:^|[^a-z0-9-])(?:${properties.join('|')})\\s*(?:${CSS_COMMENT}\\s*)*:`, 'i') };
 }
-const FORBID_STYLES_RULE = styleRule(FORBID_STYLES, /position|float|clip|zoom|anim|offset|scrollbar|paint|clear|\ball\b/i);
+const FORBID_STYLES_RULE = styleRule(FORBID_STYLES, /position|float|clip|zoom|anim|offset|scrollbar|paint|clear/i);
+// The `all` property resets every other one. jsdom 30+ reads it as the shorthand of every longhand
+// (over five hundred of them), so a declared one would serialize as all of them the moment the
+// attribute is written back from the CSSOM: a few bytes of input per element would become kilobytes
+// of output. An element that declares it loses its style attribute instead, see finishHtml()
+const ALL_RULE = styleRule(['all'], /\ball\b/i);
 // Resolves CSS escape sequences (\6F, \o) the way a browser does before it matches a property
 // name, so that a forbidden property cannot hide behind an escaped character
 function decodeCssEscapes(value) {
@@ -341,7 +348,11 @@ function removeStyleProperties(node, rule) {
         return;
     }
     for (const property of rule.properties) {
-        node.style.removeProperty(property);
+        // Only what the element holds: removing a shorthand removes its longhands too, and with a
+        // shorthand like `all` (see ALL_RULE) that would be the whole declaration block
+        if (node.style.getPropertyValue(property)) {
+            node.style.removeProperty(property);
+        }
     }
     // removeProperty() rewrites the attribute from the CSSOM, which only holds the declarations
     // cssstyle managed to parse. A forbidden property still named in the attribute after that was
@@ -387,12 +398,19 @@ function finishHtml(html, inliningSkipped) {
         if (!node.style) {
             continue;
         }
-        const styleText = node.getAttribute('style') || '';
+        let styleText = node.getAttribute('style') || '';
         if (styleText.indexOf('\\') >= 0) {
             // A browser resolves CSS escapes in property names (p\osition is position) but jsdom's
             // CSSOM does not, so the checks below would miss them. Decode first and write the
             // decoded text back so the CSSOM sees the same properties the browser will
-            node.setAttribute('style', decodeCssEscapes(styleText));
+            styleText = decodeCssEscapes(styleText);
+            node.setAttribute('style', styleText);
+        }
+        if (ALL_RULE.hint.test(styleText) && ALL_RULE.declaration.test(styleText)) {
+            // A browser would still apply the declarations that follow an `all`, so they are lost
+            // too: the price of never writing the expanded block back, see ALL_RULE
+            node.removeAttribute('style');
+            continue;
         }
         removeStyleProperties(node, FORBID_STYLES_RULE);
     }
@@ -434,7 +452,7 @@ function mimeHtmlSync(message) {
         if (hasStyle) {
             try {
                 // Run juice synchronously - risky but backwards compatible
-                html = (0, juice_1.default)(html);
+                html = (0, juice_cjs_1.juice)(html);
             }
             catch (_err) {
                 // not so important, so we'll ignore if style inlining fails

package/dist/esm/lib/jsdom.cjs

@@ -1,5 +1,5 @@
 "use strict";
-// jsdom, loaded from the CommonJS bundle scripts/bundle-jsdom.js builds into dist/vendor/jsdom.cjs.
+// jsdom, loaded from the CommonJS bundle scripts/bundle-vendor.js builds into dist/vendor/jsdom.cjs.
 // jsdom pulls in ES module only packages (parse5 among them), which the CommonJS build must not
 // require(), so the package itself is a devDependency and only its bundle ships. This file compiles
 // to jsdom.cjs in dist/cjs/lib and dist/esm/lib alike, both two levels below dist/vendor.

package/dist/esm/lib/juice-worker.js

@@ -1,6 +1,6 @@
 import workerThreads from 'node:worker_threads';
-// Pinned to juice 11.x: juice 12+ is pure ESM (requires Node >=22.12) and breaks pkg builds.
-import juice from 'juice';
+// juice comes from the CommonJS bundle in dist/vendor, see juice.cts
+import { juice } from './juice.cjs';
 // Runs as a worker thread (see worker-pool.ts), the parent port is always there
 const parentPort = workerThreads.parentPort;
 parentPort.on('message', (html) => {

package/dist/esm/lib/juice.cjs

@@ -0,0 +1,15 @@
+"use strict";
+// juice, loaded from the CommonJS bundle scripts/bundle-vendor.js builds into dist/vendor/juice.cjs.
+// juice 12 is an ES module only package, which the CommonJS build must not require(), so the
+// package itself is a devDependency and only its bundle ships. This file compiles to juice.cjs in
+// dist/cjs/lib and dist/esm/lib alike, both two levels below dist/vendor.
+//
+// Not part of commonjs.cts on purpose: that module is loaded eagerly, and juice must only load
+// when mimeHtml or the juice worker is first used.
+//
+// The literal require() path is what @yao-pkg/pkg follows to put the bundle into a binary.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.juice = void 0;
+// A named export, like jsdom.cts: the ES module build reads it through the CommonJS export names
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+exports.juice = require('../../vendor/juice.cjs');

package/dist/esm/lib/juice.d.cts

@@ -0,0 +1,2 @@
+import type JuiceModule from 'juice';
+export declare const juice: typeof JuiceModule;

package/dist/esm/lib/mime-html.js

@@ -1,6 +1,6 @@
 import createDOMPurify from 'dompurify';
-// Pinned to juice 11.x: juice 12+ is pure ESM (requires Node >=22.12) and breaks pkg builds.
-import juice from 'juice';
+// juice comes from the CommonJS bundle in dist/vendor, see juice.cts
+import { juice } from './juice.cjs';
 import he from 'he';
 import { Worker } from 'node:worker_threads';
 import WorkerPool from './worker-pool.js';
@@ -38,8 +38,8 @@ const FORBID_TAGS = [
 ];
 // form submission targets and popovers, which let sender markup act on or overlay the viewer
 const FORBID_ATTR = ['action', 'formaction', 'popover', 'popovertarget'];
+// `all` is forbidden too, but whole attributes at a time, see ALL_RULE
 const FORBID_STYLES = [
-    'all',
     'position',
     'clip',
     'animation',
@@ -65,10 +65,17 @@ const FORBID_STYLES = [
     'scrollbar-width',
     'zoom'
 ];
+// A CSS comment, written so that a run of them can only be split one way (no backtracking blowup)
+const CSS_COMMENT = '/\\*[^*]*\\*+(?:[^/*][^*]*\\*+)*/';
 function styleRule(properties, hint) {
-    return { properties, hint, declaration: new RegExp('(?:^|[^a-z0-9-])(?:' + properties.join('|') + ')\\s*:', 'i') };
+    return { properties, hint, declaration: new RegExp(`(?:^|[^a-z0-9-])(?:${properties.join('|')})\\s*(?:${CSS_COMMENT}\\s*)*:`, 'i') };
 }
-const FORBID_STYLES_RULE = styleRule(FORBID_STYLES, /position|float|clip|zoom|anim|offset|scrollbar|paint|clear|\ball\b/i);
+const FORBID_STYLES_RULE = styleRule(FORBID_STYLES, /position|float|clip|zoom|anim|offset|scrollbar|paint|clear/i);
+// The `all` property resets every other one. jsdom 30+ reads it as the shorthand of every longhand
+// (over five hundred of them), so a declared one would serialize as all of them the moment the
+// attribute is written back from the CSSOM: a few bytes of input per element would become kilobytes
+// of output. An element that declares it loses its style attribute instead, see finishHtml()
+const ALL_RULE = styleRule(['all'], /\ball\b/i);
 // Resolves CSS escape sequences (\6F, \o) the way a browser does before it matches a property
 // name, so that a forbidden property cannot hide behind an escaped character
 function decodeCssEscapes(value) {
@@ -336,7 +343,11 @@ function removeStyleProperties(node, rule) {
         return;
     }
     for (const property of rule.properties) {
-        node.style.removeProperty(property);
+        // Only what the element holds: removing a shorthand removes its longhands too, and with a
+        // shorthand like `all` (see ALL_RULE) that would be the whole declaration block
+        if (node.style.getPropertyValue(property)) {
+            node.style.removeProperty(property);
+        }
     }
     // removeProperty() rewrites the attribute from the CSSOM, which only holds the declarations
     // cssstyle managed to parse. A forbidden property still named in the attribute after that was
@@ -382,12 +393,19 @@ function finishHtml(html, inliningSkipped) {
         if (!node.style) {
             continue;
         }
-        const styleText = node.getAttribute('style') || '';
+        let styleText = node.getAttribute('style') || '';
         if (styleText.indexOf('\\') >= 0) {
             // A browser resolves CSS escapes in property names (p\osition is position) but jsdom's
             // CSSOM does not, so the checks below would miss them. Decode first and write the
             // decoded text back so the CSSOM sees the same properties the browser will
-            node.setAttribute('style', decodeCssEscapes(styleText));
+            styleText = decodeCssEscapes(styleText);
+            node.setAttribute('style', styleText);
+        }
+        if (ALL_RULE.hint.test(styleText) && ALL_RULE.declaration.test(styleText)) {
+            // A browser would still apply the declarations that follow an `all`, so they are lost
+            // too: the price of never writing the expanded block back, see ALL_RULE
+            node.removeAttribute('style');
+            continue;
         }
         removeStyleProperties(node, FORBID_STYLES_RULE);
     }