nodemailer 10.0.11 → 10.0.13

package/dist/esm/smtp-pool/index.js

@@ -5,6 +5,10 @@ import wellKnown from '../well-known/index.js';
 import * as shared from '../shared/index.js';
 import * as errors from '../errors.js';
 import * as packageData from '../package-info.js';
+/** First delay before a requeued message is retried, doubled on every further requeue */
+const REQUEUE_BASE_DELAY = 50;
+/** Upper bound for the requeue delay */
+const REQUEUE_MAX_DELAY = 2000;
 /**
  * Creates a SMTP pool transport object for Nodemailer
  *
@@ -36,6 +40,8 @@ class SMTPPool extends EventEmitter {
         );
         this.options.maxConnections = this.options.maxConnections || 5;
         this.options.maxMessages = this.options.maxMessages || 100;
+        // a default bound, a server that closes every connection before the greeting would otherwise be retried forever
+        this.options.maxRequeues = typeof this.options.maxRequeues === 'number' ? this.options.maxRequeues : 5;
         this.logger = shared.getLogger(this.options, {
             component: this.options.component || 'smtp-pool'
         });
@@ -79,6 +85,10 @@ class SMTPPool extends EventEmitter {
      */
     send(mail, callback) {
         if (this._closed) {
+            // Mail.sendMail ignores the return value, so without a callback its promise would never settle
+            const err = new Error('Connection pool was closed');
+            err.code = errors.ECONNECTION;
+            setImmediate(() => callback(err));
             return false;
         }
         this._queue.push({
@@ -292,15 +302,22 @@ class SMTPPool extends EventEmitter {
                 // Note that we must wait a bit.. because the callback of the 'error' handler might be called
                 // in the next event loop
                 setTimeout(() => {
+                    let delay = 0;
                     if (connection.queueEntry) {
                         if (this._shouldRequeuOnConnectionClose(connection.queueEntry)) {
-                            this._requeueEntryOnConnectionClose(connection);
+                            delay = this._requeueEntryOnConnectionClose(connection);
                         }
                         else {
                             this._failDeliveryOnConnectionClose(connection);
                         }
                     }
-                    this._continueProcessing();
+                    if (delay) {
+                        // back off, a server that keeps dropping connections is not hammered
+                        setTimeout(() => this._continueProcessing(), delay);
+                    }
+                    else {
+                        this._continueProcessing();
+                    }
                 }, 50);
             }
             else {
@@ -315,7 +332,7 @@ class SMTPPool extends EventEmitter {
     }
     /** @internal */
     _shouldRequeuOnConnectionClose(queueEntry) {
-        if (this.options.maxRequeues === undefined || this.options.maxRequeues < 0) {
+        if (this.options.maxRequeues < 0) {
             return true;
         }
         return queueEntry.requeueAttempts < this.options.maxRequeues;
@@ -324,7 +341,9 @@ class SMTPPool extends EventEmitter {
     _failDeliveryOnConnectionClose(connection) {
         if (connection.queueEntry && connection.queueEntry.callback) {
             try {
-                connection.queueEntry.callback(new Error('Reached maximum number of retries after connection was closed'));
+                const err = new Error('Reached maximum number of retries after connection was closed');
+                err.code = errors.ECONNECTION;
+                connection.queueEntry.callback(err);
             }
             catch (E) {
                 this.logger.error({
@@ -339,6 +358,7 @@ class SMTPPool extends EventEmitter {
     }
     /** @internal */
     _requeueEntryOnConnectionClose(connection) {
+        const delay = Math.min(REQUEUE_BASE_DELAY * 2 ** connection.queueEntry.requeueAttempts, REQUEUE_MAX_DELAY);
         connection.queueEntry.requeueAttempts += 1;
         this.logger.debug({
             tnx: 'pool',
@@ -348,6 +368,7 @@ class SMTPPool extends EventEmitter {
         }, 'Re-queued message <%s> for #%s. Attempt: #%s', connection.queueEntry.messageId, connection.id, connection.queueEntry.requeueAttempts);
         this._queue.unshift(connection.queueEntry);
         connection.queueEntry = false;
+        return delay;
     }
     /**
      * Continue to process message if the pool hasn't closed
@@ -468,10 +489,15 @@ class SMTPPool extends EventEmitter {
                 connection.quit();
                 return done(null, true);
             };
-            connection.connect(() => {
+            connection.connect(err => {
                 if (returned) {
                     return;
                 }
+                if (err) {
+                    returned = true;
+                    connection.close();
+                    return done(err);
+                }
                 if (auth && (connection.allowsAuth || options.forceAuth)) {
                     connection.login(auth, err => {
                         if (returned) {

package/dist/esm/smtp-pool/pool-resource.js

@@ -28,7 +28,7 @@ export default class PoolResource extends EventEmitter {
                         method: 'XOAUTH2'
                     };
                     oauth2.on('token', (token) => this.pool.mailer.emit('token', token));
-                    oauth2.on('error', err => this.emit('error', err));
+                    oauth2.on('error', err => this._fail(err));
                     break;
                 }
                 default:
@@ -51,6 +51,19 @@ export default class PoolResource extends EventEmitter {
         this._connected = false;
         this.messages = 0;
         this.available = true;
+        this._failed = false;
+    }
+    /**
+     * Emits 'error' for the first failure only. A dead resource can report the same failure more
+     * than once (the connection error, then the send callback), the pool handles it once
+     * @internal
+     */
+    _fail(err) {
+        if (this._failed) {
+            return;
+        }
+        this._failed = true;
+        this.emit('error', err);
     }
     /**
      * Initiates a connection to the SMTP server
@@ -63,7 +76,7 @@ export default class PoolResource extends EventEmitter {
                 // nothing was connected, so no 'close' event is coming that would free the
                 // slot this resource holds in the pool, report the failure the way a failed
                 // login does
-                this.emit('error', err);
+                this._fail(err);
                 return callback(err);
             }
             let returned = false;
@@ -80,8 +93,8 @@ export default class PoolResource extends EventEmitter {
                 options = Object.assign(assign(false, options), socketOptions);
             }
             this.connection = new SMTPConnection(options);
-            this.connection.once('error', err => {
-                this.emit('error', err);
+            this.connection.on('error', err => {
+                this._fail(err);
                 if (returned) {
                     return;
                 }
@@ -90,33 +103,18 @@ export default class PoolResource extends EventEmitter {
             });
             this.connection.once('end', () => {
                 this.close();
-                if (returned) {
-                    return;
-                }
                 returned = true;
-                const timer = setTimeout(() => {
-                    if (returned) {
-                        return;
-                    }
-                    // still have not returned, this means we have an unexpected connection close
-                    const err = new Error('Unexpected socket close');
-                    if (this.connection && this.connection.upgrading) {
-                        // starttls connection errors
-                        err.code = errors.ETLS;
-                    }
-                    callback(err);
-                }, 1000);
-                try {
-                    timer.unref();
-                }
-                catch (_E) {
-                    // Ignore. Happens on envs with non-node timer implementation
-                }
             });
-            this.connection.connect(() => {
+            this.connection.connect(err => {
                 if (returned) {
                     return;
                 }
+                if (err) {
+                    // a close before the greeting, the 'end' that follows closes this resource
+                    // and the pool requeues or fails the entry, bounded by maxRequeues
+                    returned = true;
+                    return;
+                }
                 if (this.auth && (this.connection.allowsAuth || options.forceAuth)) {
                     this.connection.login(this.auth, err => {
                         if (returned) {
@@ -125,7 +123,7 @@ export default class PoolResource extends EventEmitter {
                         returned = true;
                         if (err) {
                             this.connection.close();
-                            this.emit('error', err);
+                            this._fail(err);
                             return callback(err);
                         }
                         this._connected = true;
@@ -177,7 +175,7 @@ export default class PoolResource extends EventEmitter {
             this.messages++;
             if (err) {
                 this.connection.close();
-                this.emit('error', err);
+                this._fail(err);
                 return callback(err);
             }
             info.envelope = {
@@ -190,7 +188,7 @@ export default class PoolResource extends EventEmitter {
                     const err = new Error('Resource exhausted');
                     err.code = errors.EMAXLIMIT;
                     this.connection.close();
-                    this.emit('error', err);
+                    this._fail(err);
                 }
                 else {
                     this.pool._checkRateLimit(() => {

package/dist/esm/smtp-transport/index.js

@@ -139,31 +139,6 @@ class SMTPTransport extends EventEmitter {
                 connection.close();
                 return callback(err);
             });
-            connection.once('end', () => {
-                if (returned) {
-                    return;
-                }
-                const timer = setTimeout(() => {
-                    if (returned) {
-                        return;
-                    }
-                    returned = true;
-                    cleanupPerCallAuth();
-                    // still have not returned, this means we have an unexpected connection close
-                    const err = new Error('Unexpected socket close');
-                    if (connection && connection.upgrading) {
-                        // starttls connection errors
-                        err.code = errors.ETLS;
-                    }
-                    callback(err);
-                }, 1000);
-                try {
-                    timer.unref();
-                }
-                catch (_E) {
-                    // Ignore. Happens on envs with non-node timer implementation
-                }
-            });
             const sendMessage = () => {
                 const envelope = mail.message.getEnvelope();
                 const messageId = mail.message.messageId();
@@ -183,6 +158,10 @@ class SMTPTransport extends EventEmitter {
                     messageId
                 }, 'Sending message %s to <%s>', messageId, recipients.join(', '));
                 connection.send(envelope, mail.message.createReadStream(), (err, info) => {
+                    if (returned) {
+                        // the connection error handler has already reported this send
+                        return;
+                    }
                     returned = true;
                     cleanupPerCallAuth();
                     connection.close();
@@ -209,10 +188,16 @@ class SMTPTransport extends EventEmitter {
                     }
                 });
             };
-            connection.connect(() => {
+            connection.connect(err => {
                 if (returned) {
                     return;
                 }
+                if (err) {
+                    // the server closed the connection before the greeting
+                    returned = true;
+                    connection.close();
+                    return callback(err);
+                }
                 perCallAuth = this.getAuth(mail.data.auth);
                 if (perCallAuth && (connection.allowsAuth || options.forceAuth)) {
                     connection.login(perCallAuth, err => {
@@ -294,10 +279,15 @@ class SMTPTransport extends EventEmitter {
                 connection.quit();
                 return done(null, true);
             };
-            connection.connect(() => {
+            connection.connect(err => {
                 if (returned) {
                     return;
                 }
+                if (err) {
+                    returned = true;
+                    connection.close();
+                    return done(err);
+                }
                 perCallAuth = this.getAuth({});
                 if (perCallAuth && (connection.allowsAuth || options.forceAuth)) {
                     connection.login(perCallAuth, err => {

package/dist/esm/xoauth2/index.d.ts

@@ -61,6 +61,8 @@ export interface XOAuth2Options {
     component?: string | undefined;
     /** Extra headers for the token request */
     customHeaders?: OutgoingHttpHeaders | undefined;
+    /** Timeout for the token request in milliseconds, defaults to 60000, 0 disables it */
+    requestTimeout?: number | undefined;
     /** Extra form fields for the token request */
     customParams?: {
         [key: string]: any;

package/dist/esm/xoauth2/index.js

@@ -36,12 +36,14 @@ class XOAuth2 extends Stream {
     constructor(options, logger) {
         super();
         this.options = options || {};
+        this.configError = false;
         if (options && options.serviceClient) {
             if (!options.privateKey || !options.user) {
+                // reported through getToken() rather than an 'error' event: the transports forward
+                // that event up to the Mail object, where nothing may be listening
                 const err = new Error('Options "privateKey" and "user" are required for service account!');
                 err.code = errors.EOAUTH2;
-                setImmediate(() => this.emit('error', err));
-                return;
+                this.configError = err;
             }
             const serviceRequestTimeout = Math.min(Math.max(Number(this.options.serviceRequestTimeout) || 0, 0), 3600);
             this.options.serviceRequestTimeout = serviceRequestTimeout || 5 * 60;
@@ -75,6 +77,9 @@ class XOAuth2 extends Stream {
     getToken(renew, callback) {
         // the error paths hand over the error alone
         const done = callback;
+        if (this.configError) {
+            return done(this.configError);
+        }
         if (!renew && this.accessToken && (!this.expires || this.expires > Date.now())) {
             this.logger.debug({
                 tnx: 'OAUTH2',
@@ -311,7 +316,10 @@ class XOAuth2 extends Stream {
             method: 'post',
             headers: params.customHeaders,
             body: payload,
-            allowErrorResponse: true
+            allowErrorResponse: true,
+            // unset falls back to the fetch default, a stalled token endpoint would otherwise keep
+            // `renewing` set and queue every later request
+            timeout: params.requestTimeout
         };
         // OAuth2 token endpoints are credential-bearing. src/fetch already
         // validates certs by default; pin rejectUnauthorized:true here so the

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.0.11",
+    "version": "10.0.13",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",
@@ -151,24 +151,24 @@
     },
     "homepage": "https://nodemailer.com/",
     "devDependencies": {
-        "@aws-sdk/client-sesv2": "3.1141.0",
+        "@aws-sdk/client-sesv2": "3.1143.0",
         "@types/node": "20.19.43",
         "bunyan": "1.8.15",
         "c8": "12.0.0",
         "eslint": "10.11.0",
         "eslint-config-prettier": "10.1.8",
         "globals": "17.12.0",
-        "libbase64": "1.3.0",
-        "libmime": "5.4.4",
-        "libqp": "2.1.1",
+        "libbase64": "1.3.1",
+        "libmime": "5.4.6",
+        "libqp": "2.1.2",
         "mailauth": "7.1.0",
         "prettier": "3.9.9",
         "proxy": "1.0.2",
         "proxy-test-server": "1.0.0",
-        "smtp-server": "3.19.13",
+        "smtp-server": "3.19.15",
         "tsx": "4.23.15",
         "typescript": "6.0.3",
-        "typescript-eslint": "8.70.1"
+        "typescript-eslint": "8.71.0"
     },
     "engines": {
         "node": ">=20.0.0"