nodemailer 10.0.15 → 10.0.16

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # CHANGELOG
 
+## [10.0.16](https://github.com/nodemailer/nodemailer/compare/v10.0.15...v10.0.16) (2026-10-07)
+
+
+### Bug Fixes
+
+* **addressparser:** keep an escaped parenthesis inside a comment ([c4ae20d](https://github.com/nodemailer/nodemailer/commit/c4ae20d074ac0510cc2d0cbd6039ee7fab3a4ca8))
+* **fetch:** keep the case of cookie names ([#1888](https://github.com/nodemailer/nodemailer/issues/1888)) ([9f16eed](https://github.com/nodemailer/nodemailer/commit/9f16eedf8de0485e6d07969113db992ff70f89ce))
+* **fetch:** read the cookie name-value pair by position ([645e97c](https://github.com/nodemailer/nodemailer/commit/645e97c8f0586404d9fb861c9527be7572c2c832))
+
 ## [10.0.15](https://github.com/nodemailer/nodemailer/compare/v10.0.14...v10.0.15) (2026-10-05)
 
 

package/dist/cjs/addressparser/index.js

@@ -670,7 +670,11 @@ class Tokenizer {
             this.escaped = false;
             return;
         }
-        else if (['"', "'"].includes(this.operatorExpecting) && chr === '\\') {
+        else if (['"', "'", ')'].includes(this.operatorExpecting) && chr === '\\') {
+            // A backslash escapes the next character inside a quoted string and inside a
+            // comment alike (RFC 5322 3.2.2, ccontent includes quoted-pair). Honouring it
+            // only in quoted strings let an escaped parenthesis close the comment, which
+            // released the rest of it, an address included, into the header
             this.escaped = true;
             return;
         }

package/dist/cjs/fetch/cookies.js

@@ -130,19 +130,31 @@ class Cookies {
      */
     parse(cookieStr) {
         const cookie = {};
+        let hasNameValue = false;
         (cookieStr || '')
             .toString()
             .split(';')
             .forEach(cookiePart => {
+            if (!cookiePart.trim()) {
+                // skip empty parts
+                return;
+            }
             const valueParts = cookiePart.split('=');
-            const key = valueParts.shift().trim().toLowerCase();
+            const name = valueParts.shift().trim();
             let value = valueParts.join('=').trim();
             let domain;
-            if (!key) {
-                // skip empty parts
+            // the first part is always the name-value pair, so a cookie named
+            // like an attribute is not mistaken for one (RFC 6265 section 5.2)
+            if (!hasNameValue) {
+                hasNameValue = true;
+                if (name) {
+                    // cookie names are case-sensitive, only attribute names are not
+                    cookie.name = name;
+                    cookie.value = value;
+                }
                 return;
             }
-            switch (key) {
+            switch (name.toLowerCase()) {
                 case 'expires': {
                     const expires = new Date(value);
                     // ignore date if can not parse it
@@ -170,11 +182,6 @@ class Cookies {
                 case 'httponly':
                     cookie.httponly = true;
                     break;
-                default:
-                    if (!cookie.name) {
-                        cookie.name = key;
-                        cookie.value = value;
-                    }
             }
         });
         return cookie;

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.0.15";
+export declare const version = "10.0.16";
 export declare const homepage = "https://nodemailer.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.0.15';
+exports.version = '10.0.16';
 exports.homepage = 'https://nodemailer.com/';

package/dist/esm/addressparser/index.js

@@ -668,7 +668,11 @@ class Tokenizer {
             this.escaped = false;
             return;
         }
-        else if (['"', "'"].includes(this.operatorExpecting) && chr === '\\') {
+        else if (['"', "'", ')'].includes(this.operatorExpecting) && chr === '\\') {
+            // A backslash escapes the next character inside a quoted string and inside a
+            // comment alike (RFC 5322 3.2.2, ccontent includes quoted-pair). Honouring it
+            // only in quoted strings let an escaped parenthesis close the comment, which
+            // released the rest of it, an address included, into the header
             this.escaped = true;
             return;
         }

package/dist/esm/fetch/cookies.js

@@ -92,19 +92,31 @@ class Cookies {
      */
     parse(cookieStr) {
         const cookie = {};
+        let hasNameValue = false;
         (cookieStr || '')
             .toString()
             .split(';')
             .forEach(cookiePart => {
+            if (!cookiePart.trim()) {
+                // skip empty parts
+                return;
+            }
             const valueParts = cookiePart.split('=');
-            const key = valueParts.shift().trim().toLowerCase();
+            const name = valueParts.shift().trim();
             let value = valueParts.join('=').trim();
             let domain;
-            if (!key) {
-                // skip empty parts
+            // the first part is always the name-value pair, so a cookie named
+            // like an attribute is not mistaken for one (RFC 6265 section 5.2)
+            if (!hasNameValue) {
+                hasNameValue = true;
+                if (name) {
+                    // cookie names are case-sensitive, only attribute names are not
+                    cookie.name = name;
+                    cookie.value = value;
+                }
                 return;
             }
-            switch (key) {
+            switch (name.toLowerCase()) {
                 case 'expires': {
                     const expires = new Date(value);
                     // ignore date if can not parse it
@@ -132,11 +144,6 @@ class Cookies {
                 case 'httponly':
                     cookie.httponly = true;
                     break;
-                default:
-                    if (!cookie.name) {
-                        cookie.name = key;
-                        cookie.value = value;
-                    }
             }
         });
         return cookie;

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.0.15";
+export declare const version = "10.0.16";
 export declare const homepage = "https://nodemailer.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.0.15';
+export const version = '10.0.16';
 export const homepage = 'https://nodemailer.com/';

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.0.15",
+    "version": "10.0.16",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",
@@ -168,7 +168,7 @@
         "smtp-server": "3.19.17",
         "tsx": "4.23.15",
         "typescript": "6.0.3",
-        "typescript-eslint": "8.71.0"
+        "typescript-eslint": "8.71.1"
     },
     "engines": {
         "node": ">=20.0.0"