mailparser 3.9.8 → 3.9.10

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "3.9.8"
+    ".": "3.9.10"
 }

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [3.9.10](https://github.com/nodemailer/mailparser/compare/v3.9.9...v3.9.10) (2026-06-15)
+
+
+### Bug Fixes
+
+* bump dependencies (nodemailer 9, eslint 10.5, prettier 3.8.4) ([262ecff](https://github.com/nodemailer/mailparser/commit/262ecffcd649a6b0d4164271cc7a2662f9789f64))
+
+## [3.9.9](https://github.com/nodemailer/mailparser/compare/v3.9.8...v3.9.9) (2026-05-29)
+
+
+### Bug Fixes
+
+* bumped deps ([7a83b91](https://github.com/nodemailer/mailparser/commit/7a83b9184509c15faa580e91ac7a7b1e8f3b1090))
+
 ## [3.9.8](https://github.com/nodemailer/mailparser/compare/v3.9.7...v3.9.8) (2026-04-08)
 
 

package/SECURITY.md

@@ -0,0 +1,89 @@
+# Security Policy
+
+mailparser is an email parsing library for Node.js. It is routinely pointed at
+untrusted, adversarial, and malformed messages, so parser robustness is a
+security concern: a crafted message should never be able to crash the host
+process, exhaust memory or CPU, pollute prototypes, or leak data across parses.
+We take security reports seriously and aim to respond quickly.
+
+## Supported Versions
+
+Security fixes are released only against the latest version. We do not backport
+patches to older releases - upgrading to the current 3.x release line is the
+supported way to receive security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 3.x     | :white_check_mark: |
+| < 3.0   | :x:                |
+
+If you are on an older version, please upgrade. See the release notes at
+<https://github.com/nodemailer/mailparser/releases> before updating.
+
+> [!NOTE]
+> mailparser is in maintenance mode - it receives security updates and critical
+> bug fixes only. For new projects, consider
+> [PostalMime](https://github.com/postalsys/postal-mime), which works in both
+> Node.js and browser environments.
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues,
+pull requests, or discussions.**
+
+Report privately through one of the following channels:
+
+1. **GitHub Security Advisories (preferred).** Open a private report at
+   <https://github.com/nodemailer/mailparser/security/advisories/new>. This keeps
+   the discussion private until a fix is published and lets us credit you.
+2. **Email.** Send details to **andris@postalsys.com**. Encrypt sensitive
+   details if possible.
+
+When reporting, please include as much of the following as you can:
+
+- The affected version(s) and environment (mailparser version, Node.js version,
+  OS).
+- A clear description of the issue and its impact (e.g. denial of service via
+  CPU or memory exhaustion, ReDoS, prototype pollution, unhandled exception that
+  crashes the process, information disclosure between parses).
+- A minimal proof of concept - ideally the raw `.eml` sample or a short script
+  that reproduces the issue.
+- Any suggested remediation, if you have one.
+
+We are a small team, so there is no guaranteed response time - sometimes reports
+are handled within hours, sometimes they take longer. Accepted issues are fixed
+in a new release and coordinated through a GitHub Security Advisory, and
+reporters who wish to be named are credited.
+
+## CVEs
+
+We track and disclose vulnerabilities through GitHub Security Advisories. We do
+not request or manage CVE identifiers ourselves. If you need a CVE assigned for a
+reported issue, please request one yourself - for example, through GitHub's own
+CVE request flow on the published advisory, or another CNA.
+
+## Scope
+
+In scope: the mailparser library source in this repository - the streaming MIME
+parser (`MailParser`), the convenience parser (`simpleParser`), header and
+address decoding, charset/transfer-encoding handling, and attachment and HTML/
+text extraction. Of particular interest are inputs that cause unbounded resource
+consumption, catastrophic regular-expression backtracking, prototype pollution,
+or process crashes.
+
+Out of scope:
+
+- Vulnerabilities in your own application code that consumes mailparser output.
+  Parsed email content is attacker-controlled data; you must sanitize and escape
+  it before rendering, storing, or executing it. In particular, the `html` field
+  is not sanitized for safe display in a browser.
+- Vulnerabilities in third-party dependencies that are already tracked and fixed
+  upstream - report those to the respective project (we will still bump the
+  dependency once a fix is available).
+- Issues that require an already-compromised host or a malicious local
+  environment.
+- Resource consumption that is proportional to a legitimately large input (for
+  example, parsing a genuine 100MB message uses memory) rather than amplified by
+  a crafted small input.
+
+Thank you for helping keep mailparser and its users safe.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailparser",
-    "version": "3.9.8",
+    "version": "3.9.10",
     "description": "Parse e-mails",
     "main": "index.js",
     "scripts": {
@@ -20,28 +20,28 @@
     "dependencies": {
         "encoding-japanese": "2.2.0",
         "he": "1.2.0",
-        "html-to-text": "9.0.5",
+        "html-to-text": "10.0.0",
         "iconv-lite": "0.7.2",
         "libmime": "5.3.8",
-        "linkify-it": "5.0.0",
-        "@zone-eu/mailsplit": "5.4.8",
-        "nodemailer": "8.0.5",
+        "linkify-it": "5.0.1",
+        "@zone-eu/mailsplit": "5.4.12",
+        "nodemailer": "9.0.0",
         "punycode.js": "2.3.1",
         "tlds": "1.261.0"
     },
     "devDependencies": {
         "@eslint/eslintrc": "3.3.5",
         "@eslint/js": "10.0.1",
-        "ajv": "8.18.0",
-        "eslint": "10.2.0",
+        "ajv": "8.20.0",
+        "eslint": "10.5.0",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "10.1.8",
-        "grunt": "1.6.1",
+        "grunt": "1.6.2",
         "grunt-cli": "1.5.0",
         "grunt-contrib-nodeunit": "5.0.0",
         "grunt-eslint": "26.0.0",
         "iconv": "3.0.1",
-        "prettier": "3.8.1",
+        "prettier": "3.8.4",
         "random-message": "1.1.0"
     },
     "repository": {

package/.github/FUNDING.yml

@@ -1,4 +0,0 @@
-# These are supported funding model platforms
-
-github: [andris9] # enable once enrolled
-custom: ['https://www.paypal.me/nodemailer']

package/.github/workflows/release.yaml

@@ -1,36 +0,0 @@
-on:
-    push:
-        branches:
-            - master
-
-permissions:
-    contents: write
-    pull-requests: write
-    issues: write
-    id-token: write
-
-name: release
-jobs:
-    release-please:
-        runs-on: ubuntu-latest
-        outputs:
-            release_created: ${{ steps.release.outputs.release_created }}
-        steps:
-            - uses: googleapis/release-please-action@v4
-              id: release
-
-    publish:
-        needs: release-please
-        if: ${{ needs.release-please.outputs.release_created }}
-        runs-on: ubuntu-latest
-        permissions:
-            contents: read
-            id-token: write
-        steps:
-            - uses: actions/checkout@v4
-            - uses: actions/setup-node@v4
-              with:
-                  node-version: 24
-                  registry-url: 'https://registry.npmjs.org'
-            - run: npm ci
-            - run: npm publish --provenance --access public

package/.github/workflows/stale.yml

@@ -1,24 +0,0 @@
-name: 'Close stale issues and PRs'
-on:
-    schedule:
-        - cron: '30 1 * * *'
-
-jobs:
-    stale:
-        runs-on: ubuntu-latest
-        steps:
-            - uses: actions/stale@v8
-              with:
-                  stale-issue-message: 'This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
-                  stale-pr-message: 'This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.'
-                  close-issue-message: 'This issue was closed because it has been stalled for 15 days with no activity.'
-                  close-pr-message: 'This PR was closed because it has been stalled for 20 days with no activity.'
-                  days-before-issue-stale: 30
-                  days-before-pr-stale: 45
-                  days-before-issue-close: 15
-                  days-before-pr-close: 20
-                  stale-issue-label: 'no-issue-activity'
-                  exempt-issue-labels: 'pending,work-in-progress'
-                  stale-pr-label: 'no-pr-activity'
-                  exempt-pr-labels: 'awaiting-approval,work-in-progress'
-                  repo-token: ${{ secrets.GITHUB_TOKEN }}

package/.github/workflows/test.yml

@@ -1,21 +0,0 @@
-name: Run tests
-
-on:
-    push:
-    pull_request:
-
-jobs:
-    test:
-        strategy:
-            matrix:
-                node: [22.x, 24.x]
-                os: [ubuntu-latest]
-        runs-on: ${{ matrix.os }}
-        steps:
-            - uses: actions/checkout@v4
-            - name: Use Node.js ${{ matrix.node }}
-              uses: actions/setup-node@v4
-              with:
-                  node-version: ${{ matrix.node }}
-            - run: npm install
-            - run: npm test

package/.ncurc.js

@@ -1,6 +0,0 @@
-'use strict';
-
-module.exports = {
-    upgrade: true,
-    reject: []
-};