nodemailer 10.1.4 → 10.1.5

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # CHANGELOG
 
+## [10.1.5](https://github.com/nodemailer/nodemailer/compare/v10.1.4...v10.1.5) (2026-10-18)
+
+
+### Bug Fixes
+
+* **addressparser:** handle an address list without copying it per address ([6bd09b3](https://github.com/nodemailer/nodemailer/commit/6bd09b395cb7ffd1b0ae95f960f3985ba9c25afb))
+* **addressparser:** tokenize into offsets instead of an object per token ([3fd3f50](https://github.com/nodemailer/nodemailer/commit/3fd3f50ce86671884896ef1eaddafff5e137f820))
+
 ## [10.1.4](https://github.com/nodemailer/nodemailer/compare/v10.1.3...v10.1.4) (2026-10-18)
 
 

package/dist/cjs/addressparser/index.js

@@ -1,5 +1,83 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+/* eslint-disable no-bitwise -- the kind of a token is a set of bit flags packed into one slot of a typed array */
+/** The token is an operator, a text run otherwise */
+const TOKEN_OPERATOR = 1;
+/** The next character continues the same run without whitespace in between */
+const TOKEN_NO_BREAK = 2;
+/** The text run holds characters its value leaves out or changes, so it is no plain slice */
+const TOKEN_DIRTY = 4;
+/** A backslash escapes the next character in the text run, inside a quoted string or a comment */
+const TOKEN_ESCAPES = 8;
+/** The text run opens on a character an escaping backslash in front of it has escaped */
+const TOKEN_STARTS_ESCAPED = 16;
+/**
+ * The tokens of an address field, kept as offsets into it.
+ *
+ * Every token used to be an object of its own, an operator for every ',' and a value string
+ * for every run of text, and a list of one letter names, 'a,a,a,...', took some 65 times its
+ * size in tokens before any address was read. A token is now three numbers in one typed
+ * array, its kind and the range of the field it covers, and its value is sliced off the field
+ * when it is read. The few text runs whose value differs from their slice, as they hold an
+ * escaping backslash, a line break or a control character, are rebuilt once and kept aside.
+ */
+class TokenList {
+    constructor(str) {
+        this.str = str;
+        this.slots = new Int32Array(48);
+        this.length = 0;
+        this.cleaned = new Map();
+    }
+    /**
+     * Appends a token
+     *
+     * @param kind Kind and flags of the token
+     * @param start Offset of its first character
+     * @param end Offset just past its last character
+     * @return Index of the token
+     */
+    push(kind, start, end) {
+        if ((this.length + 1) * 3 > this.slots.length) {
+            const grown = new Int32Array(this.slots.length * 2);
+            grown.set(this.slots);
+            this.slots = grown;
+        }
+        const at = this.length * 3;
+        this.slots[at] = kind;
+        this.slots[at + 1] = start;
+        this.slots[at + 2] = end;
+        return this.length++;
+    }
+    /**
+     * The character of an operator token, an empty string for a text run
+     */
+    operatorAt(index) {
+        const at = index * 3;
+        return this.slots[at] & TOKEN_OPERATOR ? this.str.charAt(this.slots[at + 1]) : '';
+    }
+    /**
+     * Whether a token is an operator
+     */
+    isOperator(index) {
+        return (this.slots[index * 3] & TOKEN_OPERATOR) !== 0;
+    }
+    /**
+     * Whether the next character continues the run of a token without whitespace in between
+     */
+    noBreak(index) {
+        return (this.slots[index * 3] & TOKEN_NO_BREAK) !== 0;
+    }
+    /**
+     * Value of a token
+     */
+    value(index) {
+        const cleaned = this.cleaned.get(index);
+        if (cleaned !== undefined) {
+            return cleaned;
+        }
+        return this.str.slice(this.slots[index * 3 + 1], this.slots[index * 3 + 2]);
+    }
+}
 /**
  * A domain literal that ends an address. dtext includes '@' (RFC 5322 3.4.1), so the '@'
  * in front of the literal is the one that splits the domain off, not the last one: reading
@@ -456,11 +534,13 @@ function _stripAddressComments(address) {
 /**
  * Converts tokens for a single address into an address object
  *
- * @param tokens Tokens object
+ * @param tokens Tokens of the whole address list
+ * @param from Index of the first token of this address
+ * @param to Index just past the last token of this address
  * @param depth Current recursion depth for nested group protection
  * @return Address object
  */
-function _handleAddress(tokens, depth) {
+function _handleAddress(tokens, from, to, depth) {
     let isGroup = false;
     let state = 'text';
     const addresses = [];
@@ -483,11 +563,13 @@ function _handleAddress(tokens, depth) {
     // character is carried along instead of re-read.
     const lastChars = { address: '', comment: '', group: '', text: '' };
     // Filter out <addresses>, (comments) and regular text
-    for (let i = 0, len = tokens.length; i < len; i++) {
-        const token = tokens[i];
-        const prevToken = i ? tokens[i - 1] : null;
-        if (token.type === 'operator') {
-            switch (token.value) {
+    for (let i = from; i < to; i++) {
+        const value = tokens.value(i);
+        // the operator in front of this token, if there is one, and whether it runs on into it
+        const prevOperator = i > from ? tokens.operatorAt(i - 1) : '';
+        const prevNoBreak = i > from && tokens.noBreak(i - 1);
+        if (tokens.isOperator(i)) {
+            switch (value) {
                 case '<':
                     state = 'address';
                     insideQuotes = false;
@@ -511,7 +593,7 @@ function _handleAddress(tokens, depth) {
                     break;
             }
         }
-        else if (token.value) {
+        else {
             // An empty quoted string is dropped by the tokenizer, leaving no text token of its
             // own for textWasQuoted to be recorded on, so the pair of quote operators right in
             // front of this token is all that is left of it and the run it opens carries the
@@ -519,44 +601,34 @@ function _handleAddress(tokens, depth) {
             // the quotes never go back on, and the value is no longer an addr-spec a trailing
             // comment can be peeled off of. It only ever opens a run: a run that already holds
             // material collected outside the quotes is not a quoted string, whatever follows it
-            const prevPrevToken = i > 1 ? tokens[i - 2] : null;
-            const opensAfterEmptyQuotedString = prevToken?.type === 'operator' &&
-                prevToken.value === '"' &&
-                !!prevToken.noBreak &&
-                prevPrevToken?.type === 'operator' &&
-                prevPrevToken.value === '"';
+            const opensAfterEmptyQuotedString = prevOperator === '"' && prevNoBreak && i > from + 1 && tokens.operatorAt(i - 2) === '"';
             // A comment is folding whitespace. It may sit inside an addr-spec, on either side
             // of the '@', but it cannot join two atoms into one: gluing across it would read
             // 'user@example.com(x)evil.com' as the single domain 'example.comevil.com' and
             // deliver to a domain the sender never named.
             const parts = data[state];
-            const joins = prevToken &&
-                prevToken.noBreak &&
-                parts.length &&
-                (prevToken.value !== ')' || lastChars[state] === '@' || token.value.charAt(0) === '@');
+            const joins = prevNoBreak && parts.length && (prevOperator !== ')' || lastChars[state] === '@' || value.charAt(0) === '@');
             if (joins) {
                 const last = data[state].length - 1;
                 if (state === 'text' && !insideQuotes) {
-                    if (lastTextPureQuoted && token.value.charAt(0) === '@') {
+                    if (lastTextPureQuoted && value.charAt(0) === '@') {
                         data.quotedLocalAt[last] = data.text[last].length;
                     }
                     lastTextPureQuoted = false;
                 }
-                data[state][last] += token.value;
-                if (token.value) {
-                    lastChars[state] = token.value.charAt(token.value.length - 1);
-                }
+                data[state][last] += value;
+                lastChars[state] = value.charAt(value.length - 1);
                 if (state === 'text' && insideQuotes) {
                     data.textWasQuoted[last] = true;
                 }
             }
             else {
-                data[state].push(token.value);
-                lastChars[state] = token.value.charAt(token.value.length - 1);
+                data[state].push(value);
+                lastChars[state] = value.charAt(value.length - 1);
                 if (state === 'text') {
                     data.textWasQuoted.push(insideQuotes || opensAfterEmptyQuotedString);
                     // an empty quoted string leaves no text of its own, so the '@' opens the run
-                    data.quotedLocalAt.push(opensAfterEmptyQuotedString && token.value.charAt(0) === '@' ? 0 : -1);
+                    data.quotedLocalAt.push(opensAfterEmptyQuotedString && value.charAt(0) === '@' ? 0 : -1);
                     lastTextPureQuoted = insideQuotes;
                 }
             }
@@ -719,6 +791,7 @@ function _handleAddress(tokens, depth) {
     }
     return addresses;
 }
+/* eslint-disable no-bitwise -- see TokenList */
 /**
  * Creates a Tokenizer object for tokenizing address field strings
  *
@@ -730,7 +803,7 @@ class Tokenizer {
         this.str = (str || '').toString();
         this.operatorCurrent = '';
         this.operatorExpecting = '';
-        this.node = null;
+        this.node = -1;
         this.escaped = false;
         this.inDomainLiteral = false;
         this.afterAt = false;
@@ -738,7 +811,7 @@ class Tokenizer {
         this.innerComment = 0;
         this.innerLiteral = false;
         this.innerEscaped = false;
-        this.list = [];
+        this.list = new TokenList(this.str);
         /**
          * Operator tokens and which tokens are expected to end the sequence
          */
@@ -763,27 +836,96 @@ class Tokenizer {
      * @return An array of operator|text tokens
      */
     tokenize() {
-        const list = [];
-        for (let i = 0, len = this.str.length; i < len; i++) {
-            const chr = this.str.charAt(i);
-            const nextChr = i < len - 1 ? this.str.charAt(i + 1) : null;
-            this.checkChar(chr, nextChr);
+        const str = this.str;
+        const len = str.length;
+        for (let i = 0; i < len; i++) {
+            this.checkChar(str.charAt(i), i);
         }
-        this.list.forEach(node => {
-            node.value = (node.value || '').toString().trim();
-            if (node.value) {
-                list.push(node);
+        this._closeText(len);
+        // Compacted in place: a text run is trimmed to its value and one left empty is
+        // dropped, and the value of a run that is no plain slice is rebuilt and kept aside
+        const list = this.list;
+        const slots = list.slots;
+        let kept = 0;
+        for (let i = 0, count = list.length; i < count; i++) {
+            const kind = slots[i * 3];
+            let start = slots[i * 3 + 1];
+            let end = slots[i * 3 + 2];
+            if (kind & TOKEN_DIRTY) {
+                const value = this._cleanValue(start, end, kind).trim();
+                if (!value) {
+                    continue;
+                }
+                list.cleaned.set(kept, value);
             }
-        });
+            else if (!(kind & TOKEN_OPERATOR)) {
+                while (start < end && _isSpaceCode(str.charCodeAt(start))) {
+                    start++;
+                }
+                while (end > start && _isSpaceCode(str.charCodeAt(end - 1))) {
+                    end--;
+                }
+                if (start === end) {
+                    continue;
+                }
+            }
+            slots[kept * 3] = kind;
+            slots[kept * 3 + 1] = start;
+            slots[kept * 3 + 2] = end;
+            kept++;
+        }
+        list.length = kept;
         return list;
     }
+    /**
+     * Ends the text run being collected, if there is one
+     *
+     * @param end Offset just past its last character
+     */
+    _closeText(end) {
+        if (this.node >= 0) {
+            this.list.slots[this.node * 3 + 2] = end;
+            this.node = -1;
+        }
+    }
+    /**
+     * Rebuilds the value of a text run that is no plain slice of the field, applying the
+     * rules checkChar collects characters by: an escaping backslash is dropped, a line break
+     * reads as a space and any other control character is left out
+     *
+     * @param start Offset of the first character of the run
+     * @param end Offset just past its last character
+     * @param kind Kind and flags of the run
+     * @return Value of the run
+     */
+    _cleanValue(start, end, kind) {
+        const str = this.str;
+        const escapes = (kind & TOKEN_ESCAPES) !== 0;
+        let escaped = (kind & TOKEN_STARTS_ESCAPED) !== 0;
+        let value = '';
+        for (let i = start; i < end; i++) {
+            const chr = str.charAt(i);
+            if (escapes && !escaped && chr === '\\') {
+                escaped = true;
+                continue;
+            }
+            escaped = false;
+            if (chr === '\n') {
+                value += ' ';
+            }
+            else if (chr.charCodeAt(0) >= 0x21 || chr === ' ' || chr === '\t') {
+                value += chr;
+            }
+        }
+        return value;
+    }
     /**
      * Checks if a character is an operator or text and acts accordingly
      *
      * @param chr Character from the address field
-     * @param nextChr Character following chr, null at the end of the field
+     * @param i Offset of the character in the field
      */
-    checkChar(chr, nextChr) {
+    checkChar(chr, i) {
         // Track RFC 5322 domain-literals ("[" *dtext "]"). The ":" of an IPv6
         // address-literal (user@[IPv6:2001:db8::1]) is dtext and must not be treated as
         // the group delimiter while inside the brackets. That is the only operator the
@@ -830,15 +972,9 @@ class Tokenizer {
             // ignore next condition blocks
         }
         else if (chr === this.operatorExpecting && !nested) {
-            this.node = {
-                type: 'operator',
-                value: chr
-            };
-            if (nextChr && ![' ', '\t', '\r', '\n', ',', ';'].includes(nextChr)) {
-                this.node.noBreak = true;
-            }
-            this.list.push(this.node);
-            this.node = null;
+            const nextChr = this.str.charAt(i + 1);
+            this._closeText(i);
+            this.list.push(nextChr && ![' ', '\t', '\r', '\n', ',', ';'].includes(nextChr) ? TOKEN_OPERATOR | TOKEN_NO_BREAK : TOKEN_OPERATOR, i, i + 1);
             if (chr !== ')') {
                 // a comment is folding whitespace, it does not part the "@" from the "["
                 this.afterAt = false;
@@ -849,12 +985,8 @@ class Tokenizer {
             return;
         }
         else if (!this.operatorExpecting && !(this.inDomainLiteral && chr === ':') && chr in this.operators) {
-            this.node = {
-                type: 'operator',
-                value: chr
-            };
-            this.list.push(this.node);
-            this.node = null;
+            this._closeText(i);
+            this.list.push(TOKEN_OPERATOR, i, i + 1);
             if (chr !== '(') {
                 this.afterAt = false;
             }
@@ -869,29 +1001,34 @@ class Tokenizer {
             // only in quoted strings let an escaped parenthesis close the comment, which
             // released the rest of it, an address included, into the header
             this.escaped = true;
+            if (this.node >= 0) {
+                // the backslash is left out of the value
+                this.list.slots[this.node * 3] |= TOKEN_DIRTY;
+            }
             return;
         }
-        if (!this.node) {
-            this.node = {
-                type: 'text',
-                value: ''
-            };
-            this.list.push(this.node);
+        if (this.node < 0) {
+            this.node = this.list.push((this.operatorExpecting === '"' || this.operatorExpecting === ')' ? TOKEN_ESCAPES : 0) |
+                (this.escaped ? TOKEN_STARTS_ESCAPED : 0), i, i);
         }
         if (chr === '\n') {
             // Convert newlines to spaces. Carriage return is ignored as \r and \n usually
             // go together anyway and there already is a WS for \n. Lone \r means something is fishy.
             chr = ' ';
+            this.list.slots[this.node * 3] |= TOKEN_DIRTY;
         }
-        if (chr.charCodeAt(0) >= 0x21 || [' ', '\t'].includes(chr)) {
-            // skip command bytes
-            this.node.value += chr;
+        if (chr.charCodeAt(0) >= 0x21 || chr === ' ' || chr === '\t') {
+            // the character is part of the value, which is read off the field later
             // text inside a quoted string or a comment is not part of an addr-spec. Tracked
             // as it goes rather than read back off the value (see lastChars in _handleAddress)
             if (!this.operatorExpecting && chr !== ' ' && chr !== '\t') {
                 this.afterAt = chr === '@';
             }
         }
+        else {
+            // skip command bytes
+            this.list.slots[this.node * 3] |= TOKEN_DIRTY;
+        }
         this.escaped = false;
     }
     /**
@@ -967,6 +1104,7 @@ class Tokenizer {
         this.innerEscaped = false;
     }
 }
+/* eslint-enable no-bitwise */
 /**
  * Maximum recursion depth for parsing nested groups.
  * RFC 5322 doesn't allow nested groups, so this is a safeguard against
@@ -993,31 +1131,28 @@ function _parseAddressList(str, depth) {
     }
     const tokenizer = new Tokenizer(str);
     const tokens = tokenizer.tokenize();
-    const addresses = [];
-    let address = [];
     const parsedAddresses = [];
-    tokens.forEach(token => {
-        if (token.type === 'operator' && (token.value === ',' || token.value === ';')) {
-            if (address.length) {
-                addresses.push(address);
-            }
-            address = [];
+    // Every address is handed over as the range of the token list it covers, as soon as the
+    // separator after it is seen. Copying the tokens of each address into an array of its own,
+    // and collecting those before handling any, held a second structure as large as the token
+    // list for the whole parse, and an array that receives a single push is allocated room for
+    // seventeen: a list of one letter names took some 80 times its size in that alone
+    let from = 0;
+    for (let i = 0, len = tokens.length; i <= len; i++) {
+        const operator = i < len ? tokens.operatorAt(i) : '';
+        if (i < len && operator !== ',' && operator !== ';') {
+            continue;
         }
-        else {
-            address.push(token);
+        if (i > from) {
+            const handled = _handleAddress(tokens, from, i, depth);
+            // Appended in place. Rebuilding the accumulator with concat() would copy every
+            // entry collected so far on each address, making a flat list cost O(n^2).
+            for (let j = 0; j < handled.length; j++) {
+                parsedAddresses.push(handled[j]);
+            }
         }
-    });
-    if (address.length) {
-        addresses.push(address);
+        from = i + 1;
     }
-    addresses.forEach(addr => {
-        const handled = _handleAddress(addr, depth);
-        // Appended in place. Rebuilding the accumulator with concat() would copy every
-        // entry collected so far on each address, making a flat list cost O(n^2).
-        for (let i = 0; i < handled.length; i++) {
-            parsedAddresses.push(handled[i]);
-        }
-    });
     // Merge fragments produced when unquoted display names contain commas.
     // "Joe Foo, PhD <joe@example.com>" is split on the comma into
     // [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}].

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.1.4";
+export declare const version = "10.1.5";
 export declare const homepage = "https://nodemailer.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.1.4';
+exports.version = '10.1.5';
 exports.homepage = 'https://nodemailer.com/';

package/dist/esm/addressparser/index.js

@@ -1,3 +1,81 @@
+/* eslint-disable no-bitwise -- the kind of a token is a set of bit flags packed into one slot of a typed array */
+/** The token is an operator, a text run otherwise */
+const TOKEN_OPERATOR = 1;
+/** The next character continues the same run without whitespace in between */
+const TOKEN_NO_BREAK = 2;
+/** The text run holds characters its value leaves out or changes, so it is no plain slice */
+const TOKEN_DIRTY = 4;
+/** A backslash escapes the next character in the text run, inside a quoted string or a comment */
+const TOKEN_ESCAPES = 8;
+/** The text run opens on a character an escaping backslash in front of it has escaped */
+const TOKEN_STARTS_ESCAPED = 16;
+/**
+ * The tokens of an address field, kept as offsets into it.
+ *
+ * Every token used to be an object of its own, an operator for every ',' and a value string
+ * for every run of text, and a list of one letter names, 'a,a,a,...', took some 65 times its
+ * size in tokens before any address was read. A token is now three numbers in one typed
+ * array, its kind and the range of the field it covers, and its value is sliced off the field
+ * when it is read. The few text runs whose value differs from their slice, as they hold an
+ * escaping backslash, a line break or a control character, are rebuilt once and kept aside.
+ */
+class TokenList {
+    constructor(str) {
+        this.str = str;
+        this.slots = new Int32Array(48);
+        this.length = 0;
+        this.cleaned = new Map();
+    }
+    /**
+     * Appends a token
+     *
+     * @param kind Kind and flags of the token
+     * @param start Offset of its first character
+     * @param end Offset just past its last character
+     * @return Index of the token
+     */
+    push(kind, start, end) {
+        if ((this.length + 1) * 3 > this.slots.length) {
+            const grown = new Int32Array(this.slots.length * 2);
+            grown.set(this.slots);
+            this.slots = grown;
+        }
+        const at = this.length * 3;
+        this.slots[at] = kind;
+        this.slots[at + 1] = start;
+        this.slots[at + 2] = end;
+        return this.length++;
+    }
+    /**
+     * The character of an operator token, an empty string for a text run
+     */
+    operatorAt(index) {
+        const at = index * 3;
+        return this.slots[at] & TOKEN_OPERATOR ? this.str.charAt(this.slots[at + 1]) : '';
+    }
+    /**
+     * Whether a token is an operator
+     */
+    isOperator(index) {
+        return (this.slots[index * 3] & TOKEN_OPERATOR) !== 0;
+    }
+    /**
+     * Whether the next character continues the run of a token without whitespace in between
+     */
+    noBreak(index) {
+        return (this.slots[index * 3] & TOKEN_NO_BREAK) !== 0;
+    }
+    /**
+     * Value of a token
+     */
+    value(index) {
+        const cleaned = this.cleaned.get(index);
+        if (cleaned !== undefined) {
+            return cleaned;
+        }
+        return this.str.slice(this.slots[index * 3 + 1], this.slots[index * 3 + 2]);
+    }
+}
 /**
  * A domain literal that ends an address. dtext includes '@' (RFC 5322 3.4.1), so the '@'
  * in front of the literal is the one that splits the domain off, not the last one: reading
@@ -454,11 +532,13 @@ function _stripAddressComments(address) {
 /**
  * Converts tokens for a single address into an address object
  *
- * @param tokens Tokens object
+ * @param tokens Tokens of the whole address list
+ * @param from Index of the first token of this address
+ * @param to Index just past the last token of this address
  * @param depth Current recursion depth for nested group protection
  * @return Address object
  */
-function _handleAddress(tokens, depth) {
+function _handleAddress(tokens, from, to, depth) {
     let isGroup = false;
     let state = 'text';
     const addresses = [];
@@ -481,11 +561,13 @@ function _handleAddress(tokens, depth) {
     // character is carried along instead of re-read.
     const lastChars = { address: '', comment: '', group: '', text: '' };
     // Filter out <addresses>, (comments) and regular text
-    for (let i = 0, len = tokens.length; i < len; i++) {
-        const token = tokens[i];
-        const prevToken = i ? tokens[i - 1] : null;
-        if (token.type === 'operator') {
-            switch (token.value) {
+    for (let i = from; i < to; i++) {
+        const value = tokens.value(i);
+        // the operator in front of this token, if there is one, and whether it runs on into it
+        const prevOperator = i > from ? tokens.operatorAt(i - 1) : '';
+        const prevNoBreak = i > from && tokens.noBreak(i - 1);
+        if (tokens.isOperator(i)) {
+            switch (value) {
                 case '<':
                     state = 'address';
                     insideQuotes = false;
@@ -509,7 +591,7 @@ function _handleAddress(tokens, depth) {
                     break;
             }
         }
-        else if (token.value) {
+        else {
             // An empty quoted string is dropped by the tokenizer, leaving no text token of its
             // own for textWasQuoted to be recorded on, so the pair of quote operators right in
             // front of this token is all that is left of it and the run it opens carries the
@@ -517,44 +599,34 @@ function _handleAddress(tokens, depth) {
             // the quotes never go back on, and the value is no longer an addr-spec a trailing
             // comment can be peeled off of. It only ever opens a run: a run that already holds
             // material collected outside the quotes is not a quoted string, whatever follows it
-            const prevPrevToken = i > 1 ? tokens[i - 2] : null;
-            const opensAfterEmptyQuotedString = prevToken?.type === 'operator' &&
-                prevToken.value === '"' &&
-                !!prevToken.noBreak &&
-                prevPrevToken?.type === 'operator' &&
-                prevPrevToken.value === '"';
+            const opensAfterEmptyQuotedString = prevOperator === '"' && prevNoBreak && i > from + 1 && tokens.operatorAt(i - 2) === '"';
             // A comment is folding whitespace. It may sit inside an addr-spec, on either side
             // of the '@', but it cannot join two atoms into one: gluing across it would read
             // 'user@example.com(x)evil.com' as the single domain 'example.comevil.com' and
             // deliver to a domain the sender never named.
             const parts = data[state];
-            const joins = prevToken &&
-                prevToken.noBreak &&
-                parts.length &&
-                (prevToken.value !== ')' || lastChars[state] === '@' || token.value.charAt(0) === '@');
+            const joins = prevNoBreak && parts.length && (prevOperator !== ')' || lastChars[state] === '@' || value.charAt(0) === '@');
             if (joins) {
                 const last = data[state].length - 1;
                 if (state === 'text' && !insideQuotes) {
-                    if (lastTextPureQuoted && token.value.charAt(0) === '@') {
+                    if (lastTextPureQuoted && value.charAt(0) === '@') {
                         data.quotedLocalAt[last] = data.text[last].length;
                     }
                     lastTextPureQuoted = false;
                 }
-                data[state][last] += token.value;
-                if (token.value) {
-                    lastChars[state] = token.value.charAt(token.value.length - 1);
-                }
+                data[state][last] += value;
+                lastChars[state] = value.charAt(value.length - 1);
                 if (state === 'text' && insideQuotes) {
                     data.textWasQuoted[last] = true;
                 }
             }
             else {
-                data[state].push(token.value);
-                lastChars[state] = token.value.charAt(token.value.length - 1);
+                data[state].push(value);
+                lastChars[state] = value.charAt(value.length - 1);
                 if (state === 'text') {
                     data.textWasQuoted.push(insideQuotes || opensAfterEmptyQuotedString);
                     // an empty quoted string leaves no text of its own, so the '@' opens the run
-                    data.quotedLocalAt.push(opensAfterEmptyQuotedString && token.value.charAt(0) === '@' ? 0 : -1);
+                    data.quotedLocalAt.push(opensAfterEmptyQuotedString && value.charAt(0) === '@' ? 0 : -1);
                     lastTextPureQuoted = insideQuotes;
                 }
             }
@@ -717,6 +789,7 @@ function _handleAddress(tokens, depth) {
     }
     return addresses;
 }
+/* eslint-disable no-bitwise -- see TokenList */
 /**
  * Creates a Tokenizer object for tokenizing address field strings
  *
@@ -728,7 +801,7 @@ class Tokenizer {
         this.str = (str || '').toString();
         this.operatorCurrent = '';
         this.operatorExpecting = '';
-        this.node = null;
+        this.node = -1;
         this.escaped = false;
         this.inDomainLiteral = false;
         this.afterAt = false;
@@ -736,7 +809,7 @@ class Tokenizer {
         this.innerComment = 0;
         this.innerLiteral = false;
         this.innerEscaped = false;
-        this.list = [];
+        this.list = new TokenList(this.str);
         /**
          * Operator tokens and which tokens are expected to end the sequence
          */
@@ -761,27 +834,96 @@ class Tokenizer {
      * @return An array of operator|text tokens
      */
     tokenize() {
-        const list = [];
-        for (let i = 0, len = this.str.length; i < len; i++) {
-            const chr = this.str.charAt(i);
-            const nextChr = i < len - 1 ? this.str.charAt(i + 1) : null;
-            this.checkChar(chr, nextChr);
+        const str = this.str;
+        const len = str.length;
+        for (let i = 0; i < len; i++) {
+            this.checkChar(str.charAt(i), i);
         }
-        this.list.forEach(node => {
-            node.value = (node.value || '').toString().trim();
-            if (node.value) {
-                list.push(node);
+        this._closeText(len);
+        // Compacted in place: a text run is trimmed to its value and one left empty is
+        // dropped, and the value of a run that is no plain slice is rebuilt and kept aside
+        const list = this.list;
+        const slots = list.slots;
+        let kept = 0;
+        for (let i = 0, count = list.length; i < count; i++) {
+            const kind = slots[i * 3];
+            let start = slots[i * 3 + 1];
+            let end = slots[i * 3 + 2];
+            if (kind & TOKEN_DIRTY) {
+                const value = this._cleanValue(start, end, kind).trim();
+                if (!value) {
+                    continue;
+                }
+                list.cleaned.set(kept, value);
             }
-        });
+            else if (!(kind & TOKEN_OPERATOR)) {
+                while (start < end && _isSpaceCode(str.charCodeAt(start))) {
+                    start++;
+                }
+                while (end > start && _isSpaceCode(str.charCodeAt(end - 1))) {
+                    end--;
+                }
+                if (start === end) {
+                    continue;
+                }
+            }
+            slots[kept * 3] = kind;
+            slots[kept * 3 + 1] = start;
+            slots[kept * 3 + 2] = end;
+            kept++;
+        }
+        list.length = kept;
         return list;
     }
+    /**
+     * Ends the text run being collected, if there is one
+     *
+     * @param end Offset just past its last character
+     */
+    _closeText(end) {
+        if (this.node >= 0) {
+            this.list.slots[this.node * 3 + 2] = end;
+            this.node = -1;
+        }
+    }
+    /**
+     * Rebuilds the value of a text run that is no plain slice of the field, applying the
+     * rules checkChar collects characters by: an escaping backslash is dropped, a line break
+     * reads as a space and any other control character is left out
+     *
+     * @param start Offset of the first character of the run
+     * @param end Offset just past its last character
+     * @param kind Kind and flags of the run
+     * @return Value of the run
+     */
+    _cleanValue(start, end, kind) {
+        const str = this.str;
+        const escapes = (kind & TOKEN_ESCAPES) !== 0;
+        let escaped = (kind & TOKEN_STARTS_ESCAPED) !== 0;
+        let value = '';
+        for (let i = start; i < end; i++) {
+            const chr = str.charAt(i);
+            if (escapes && !escaped && chr === '\\') {
+                escaped = true;
+                continue;
+            }
+            escaped = false;
+            if (chr === '\n') {
+                value += ' ';
+            }
+            else if (chr.charCodeAt(0) >= 0x21 || chr === ' ' || chr === '\t') {
+                value += chr;
+            }
+        }
+        return value;
+    }
     /**
      * Checks if a character is an operator or text and acts accordingly
      *
      * @param chr Character from the address field
-     * @param nextChr Character following chr, null at the end of the field
+     * @param i Offset of the character in the field
      */
-    checkChar(chr, nextChr) {
+    checkChar(chr, i) {
         // Track RFC 5322 domain-literals ("[" *dtext "]"). The ":" of an IPv6
         // address-literal (user@[IPv6:2001:db8::1]) is dtext and must not be treated as
         // the group delimiter while inside the brackets. That is the only operator the
@@ -828,15 +970,9 @@ class Tokenizer {
             // ignore next condition blocks
         }
         else if (chr === this.operatorExpecting && !nested) {
-            this.node = {
-                type: 'operator',
-                value: chr
-            };
-            if (nextChr && ![' ', '\t', '\r', '\n', ',', ';'].includes(nextChr)) {
-                this.node.noBreak = true;
-            }
-            this.list.push(this.node);
-            this.node = null;
+            const nextChr = this.str.charAt(i + 1);
+            this._closeText(i);
+            this.list.push(nextChr && ![' ', '\t', '\r', '\n', ',', ';'].includes(nextChr) ? TOKEN_OPERATOR | TOKEN_NO_BREAK : TOKEN_OPERATOR, i, i + 1);
             if (chr !== ')') {
                 // a comment is folding whitespace, it does not part the "@" from the "["
                 this.afterAt = false;
@@ -847,12 +983,8 @@ class Tokenizer {
             return;
         }
         else if (!this.operatorExpecting && !(this.inDomainLiteral && chr === ':') && chr in this.operators) {
-            this.node = {
-                type: 'operator',
-                value: chr
-            };
-            this.list.push(this.node);
-            this.node = null;
+            this._closeText(i);
+            this.list.push(TOKEN_OPERATOR, i, i + 1);
             if (chr !== '(') {
                 this.afterAt = false;
             }
@@ -867,29 +999,34 @@ class Tokenizer {
             // only in quoted strings let an escaped parenthesis close the comment, which
             // released the rest of it, an address included, into the header
             this.escaped = true;
+            if (this.node >= 0) {
+                // the backslash is left out of the value
+                this.list.slots[this.node * 3] |= TOKEN_DIRTY;
+            }
             return;
         }
-        if (!this.node) {
-            this.node = {
-                type: 'text',
-                value: ''
-            };
-            this.list.push(this.node);
+        if (this.node < 0) {
+            this.node = this.list.push((this.operatorExpecting === '"' || this.operatorExpecting === ')' ? TOKEN_ESCAPES : 0) |
+                (this.escaped ? TOKEN_STARTS_ESCAPED : 0), i, i);
         }
         if (chr === '\n') {
             // Convert newlines to spaces. Carriage return is ignored as \r and \n usually
             // go together anyway and there already is a WS for \n. Lone \r means something is fishy.
             chr = ' ';
+            this.list.slots[this.node * 3] |= TOKEN_DIRTY;
         }
-        if (chr.charCodeAt(0) >= 0x21 || [' ', '\t'].includes(chr)) {
-            // skip command bytes
-            this.node.value += chr;
+        if (chr.charCodeAt(0) >= 0x21 || chr === ' ' || chr === '\t') {
+            // the character is part of the value, which is read off the field later
             // text inside a quoted string or a comment is not part of an addr-spec. Tracked
             // as it goes rather than read back off the value (see lastChars in _handleAddress)
             if (!this.operatorExpecting && chr !== ' ' && chr !== '\t') {
                 this.afterAt = chr === '@';
             }
         }
+        else {
+            // skip command bytes
+            this.list.slots[this.node * 3] |= TOKEN_DIRTY;
+        }
         this.escaped = false;
     }
     /**
@@ -965,6 +1102,7 @@ class Tokenizer {
         this.innerEscaped = false;
     }
 }
+/* eslint-enable no-bitwise */
 /**
  * Maximum recursion depth for parsing nested groups.
  * RFC 5322 doesn't allow nested groups, so this is a safeguard against
@@ -991,31 +1129,28 @@ function _parseAddressList(str, depth) {
     }
     const tokenizer = new Tokenizer(str);
     const tokens = tokenizer.tokenize();
-    const addresses = [];
-    let address = [];
     const parsedAddresses = [];
-    tokens.forEach(token => {
-        if (token.type === 'operator' && (token.value === ',' || token.value === ';')) {
-            if (address.length) {
-                addresses.push(address);
-            }
-            address = [];
+    // Every address is handed over as the range of the token list it covers, as soon as the
+    // separator after it is seen. Copying the tokens of each address into an array of its own,
+    // and collecting those before handling any, held a second structure as large as the token
+    // list for the whole parse, and an array that receives a single push is allocated room for
+    // seventeen: a list of one letter names took some 80 times its size in that alone
+    let from = 0;
+    for (let i = 0, len = tokens.length; i <= len; i++) {
+        const operator = i < len ? tokens.operatorAt(i) : '';
+        if (i < len && operator !== ',' && operator !== ';') {
+            continue;
         }
-        else {
-            address.push(token);
+        if (i > from) {
+            const handled = _handleAddress(tokens, from, i, depth);
+            // Appended in place. Rebuilding the accumulator with concat() would copy every
+            // entry collected so far on each address, making a flat list cost O(n^2).
+            for (let j = 0; j < handled.length; j++) {
+                parsedAddresses.push(handled[j]);
+            }
         }
-    });
-    if (address.length) {
-        addresses.push(address);
+        from = i + 1;
     }
-    addresses.forEach(addr => {
-        const handled = _handleAddress(addr, depth);
-        // Appended in place. Rebuilding the accumulator with concat() would copy every
-        // entry collected so far on each address, making a flat list cost O(n^2).
-        for (let i = 0; i < handled.length; i++) {
-            parsedAddresses.push(handled[i]);
-        }
-    });
     // Merge fragments produced when unquoted display names contain commas.
     // "Joe Foo, PhD <joe@example.com>" is split on the comma into
     // [{name:"Joe Foo", address:""}, {name:"PhD", address:"joe@example.com"}].

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.1.4";
+export declare const version = "10.1.5";
 export declare const homepage = "https://nodemailer.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.1.4';
+export const version = '10.1.5';
 export const homepage = 'https://nodemailer.com/';

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.1.4",
+    "version": "10.1.5",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",