mailparser 3.9.1 → 3.9.3

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "3.9.1"
+    ".": "3.9.3"
 }

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [3.9.3](https://github.com/nodemailer/mailparser/compare/v3.9.2...v3.9.3) (2026-01-28)
+
+
+### Bug Fixes
+
+* escape URLs and link text in textToHtml to prevent XSS ([921a67d](https://github.com/nodemailer/mailparser/commit/921a67df4cfb38f0b411037d7b26fbd4d5411b08)), closes [#412](https://github.com/nodemailer/mailparser/issues/412)
+
+## [3.9.2](https://github.com/nodemailer/mailparser/compare/v3.9.1...v3.9.2) (2026-01-28)
+
+
+### Bug Fixes
+
+* Bumpe deps ([508bcf7](https://github.com/nodemailer/mailparser/commit/508bcf75eb36cfd45600d73eacd7ad1e50fc7466))
+
 ## [3.9.1](https://github.com/nodemailer/mailparser/compare/v3.9.0...v3.9.1) (2025-12-11)
 
 

package/README.md

@@ -2,11 +2,10 @@
 
 ![Nodemailer](https://raw.githubusercontent.com/nodemailer/nodemailer/master/assets/nm_logo_200x136.png)
 
-Advanced email parser for Node.js. Everything is handled as a stream which should make it able to parse even very large messages (100MB+) with relatively low overhead.
-
-## Looking for a front-end solution?
+> [!IMPORTANT]
+> This module is in maintenance mode. It will continue to receive security updates and critical bug fixes, but no new features or feature changes will be added. For new projects, please consider using [PostalMime](https://github.com/postalsys/postal-mime), which works in both Node.js and browser environments.
 
-_mailparser_ is Node.js only library, so you can't use it reliably in the front-end or bundle with WebPack. If you do need a solution to parse emails in the front-end then use [PostalMime](https://www.npmjs.com/package/postal-mime).
+Advanced email parser for Node.js. Everything is handled as a stream which should make it able to parse even very large messages (100MB+) with relatively low overhead.
 
 ## Installation
 

package/lib/mail-parser.js

@@ -1129,7 +1129,11 @@ class MailParser extends Transform {
                             result.push(textPart);
                         }
 
-                        result.push(`<a href="${link.url}">${link.text}</a>`);
+                        // Escape quotes in URL to prevent XSS
+                        let safeUrl = link.url.replace(/"/g, '&quot;');
+                        // Escape HTML entities in link text
+                        let safeText = he.encode(link.text, { useNamedReferences: true });
+                        result.push(`<a href="${safeUrl}">${safeText}</a>`);
 
                         last = link.lastIndex;
                     });

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailparser",
-    "version": "3.9.1",
+    "version": "3.9.3",
     "description": "Parse e-mails",
     "main": "index.js",
     "scripts": {
@@ -21,19 +21,19 @@
         "encoding-japanese": "2.2.0",
         "he": "1.2.0",
         "html-to-text": "9.0.5",
-        "iconv-lite": "0.7.0",
+        "iconv-lite": "0.7.2",
         "libmime": "5.3.7",
         "linkify-it": "5.0.0",
         "@zone-eu/mailsplit": "5.4.8",
-        "nodemailer": "7.0.11",
+        "nodemailer": "7.0.13",
         "punycode.js": "2.3.1",
         "tlds": "1.261.0"
     },
     "devDependencies": {
         "@eslint/eslintrc": "3.3.3",
-        "@eslint/js": "9.39.1",
+        "@eslint/js": "9.39.2",
         "ajv": "8.17.1",
-        "eslint": "9.39.1",
+        "eslint": "9.39.2",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "10.1.8",
         "grunt": "1.6.1",
@@ -41,7 +41,7 @@
         "grunt-contrib-nodeunit": "5.0.0",
         "grunt-eslint": "26.0.0",
         "iconv": "3.0.1",
-        "prettier": "3.7.4",
+        "prettier": "3.8.1",
         "random-message": "1.1.0"
     },
     "repository": {