nodemailer 10.1.7 → 10.2.1

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # CHANGELOG
 
+## [10.2.1](https://github.com/nodemailer/nodemailer/compare/v10.2.0...v10.2.1) (2026-10-22)
+
+
+### Bug Fixes
+
+* drop the comments of a Content-Type or Content-Disposition value with the stripComments option ([b3052b7](https://github.com/nodemailer/nodemailer/commit/b3052b7fe2e49b51dd66d6c7814a072e885f1ac8))
+
+## [10.2.0](https://github.com/nodemailer/nodemailer/compare/v10.1.7...v10.2.0) (2026-10-21)
+
+
+### Features
+
+* add info.serverMessageId from the final 250 reply ([108dddd](https://github.com/nodemailer/nodemailer/commit/108dddd88d9d71f708630b7aba7fa2a7d2f14076))
+* add pendingCount() to the SMTP pool ([6cffb70](https://github.com/nodemailer/nodemailer/commit/6cffb7037269a6012d992c263a8927fcaf0563f2))
+* make header value encoding public with MimeNode encodeHeaderValue() ([3b048c7](https://github.com/nodemailer/nodemailer/commit/3b048c7a0fb60f946985b09b3143b0680194e47b))
+* mark SMTP errors as permanent or transient with err.permanent ([6a20e2a](https://github.com/nodemailer/nodemailer/commit/6a20e2ae109eeb5662235d72d1e5a2d38515997a))
+
+
+### Bug Fixes
+
+* label an ASCII message/rfc822 attachment 7bit instead of 8bit ([ad66fa1](https://github.com/nodemailer/nodemailer/commit/ad66fa1a048135867a629bcb7b6dc308ee06a945))
+* report the recipients an LMTP server refuses after DATA in rejectedErrors ([dd64eb3](https://github.com/nodemailer/nodemailer/commit/dd64eb3171e3ab5629828084d3944a7859790968))
+
 ## [10.1.7](https://github.com/nodemailer/nodemailer/compare/v10.1.6...v10.1.7) (2026-10-18)
 
 

package/dist/cjs/addressparser/index.js

@@ -693,9 +693,7 @@ function _handleAddress(tokens, from, to) {
             // A run that is a quoted local part with its '@' and domain is an addr-spec of
             // its own, with the quoting put back on, and takes its turn like any other
             const local = data.quotedLocalAt[i];
-            const quotedLocal = data.textWasQuoted[i] && local >= 0 && QUOTED_LOCAL_DOMAIN.test(data.text[i].slice(local))
-                ? _quoteLocalPart(data.text[i])
-                : '';
+            const quotedLocal = data.textWasQuoted[i] && local >= 0 && QUOTED_LOCAL_DOMAIN.test(data.text[i].slice(local)) ? _quoteLocalPart(data.text[i]) : '';
             if (quotedLocal || (!data.textWasQuoted[i] && _isAddrSpec(candidates[i]))) {
                 data.address = [quotedLocal || candidates[i]];
                 data.text.splice(i, 1);
@@ -1020,8 +1018,7 @@ class Tokenizer {
             return;
         }
         if (this.node < 0) {
-            this.node = this.list.push((this.operatorExpecting === '"' || this.operatorExpecting === ')' ? TOKEN_ESCAPES : 0) |
-                (this.escaped ? TOKEN_STARTS_ESCAPED : 0), i, i);
+            this.node = this.list.push((this.operatorExpecting === '"' || this.operatorExpecting === ')' ? TOKEN_ESCAPES : 0) | (this.escaped ? TOKEN_STARTS_ESCAPED : 0), i, i);
         }
         if (chr === '\n') {
             // Convert newlines to spaces. Carriage return is ignored as \r and \n usually

package/dist/cjs/dkim/index.js

@@ -25,9 +25,7 @@ class DKIMSigner {
         this.chunks = [];
         this.chunklen = 0;
         this.readPos = 0;
-        this.cachePath = this.cacheDir
-            ? node_path_1.default.join(this.cacheDir, 'message.' + Date.now() + '-' + node_crypto_1.default.randomBytes(14).toString('hex'))
-            : false;
+        this.cachePath = this.cacheDir ? node_path_1.default.join(this.cacheDir, 'message.' + Date.now() + '-' + node_crypto_1.default.randomBytes(14).toString('hex')) : false;
         this.cache = false;
         this.headers = false;
         this.bodyHash = false;

package/dist/cjs/errors.d.ts

@@ -68,6 +68,18 @@ export declare const isTransientError: (err: {
     code?: string | undefined;
     responseCode?: number | undefined;
 }) => boolean;
+/**
+ * Tells whether an SMTP reply code is a permanent rejection, one that retrying the same
+ * message would get again. RFC 5321 makes every 5yz reply a permanent negative completion
+ * and every 4yz reply a transient one. 503 (bad sequence of commands) is the exception: it
+ * says the session was in the wrong state for the command rather than that the message was
+ * refused, so the same message can go through on a new connection. 2yz and 3yz replies are
+ * only an error when the client expected something else, and are not permanent either.
+ *
+ * @param responseCode SMTP reply code
+ * @returns true for a permanent rejection
+ */
+export declare const isPermanentResponseCode: (responseCode: number) => boolean;
 /**
  * Code Node.js sets on an error when its permission model (`--permission`) denies an
  * operation. It is not replaced with the Nodemailer code of the failing step (`ESOCKET`,
@@ -89,6 +101,13 @@ export interface NodemailerError extends NodeJS.ErrnoException {
     response?: string | undefined;
     /** Numeric SMTP response code */
     responseCode?: number | undefined;
+    /**
+     * Set together with responseCode, from the reply class: true when the server rejected the
+     * message for good (5xx except 503), false when the same message may be accepted on a later
+     * attempt (4xx, 503, or an unexpected 2xx or 3xx). Not set on an error that carries no SMTP
+     * reply, such as a connection failure or missing credentials, see isPermanentResponseCode
+     */
+    permanent?: boolean | undefined;
     /** URL of the resource that could not be fetched */
     sourceUrl?: string | undefined;
     /** Recipient address the error applies to */

package/dist/cjs/errors.js

@@ -10,7 +10,7 @@
  *   err.code = errors.ECONNECTION;
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ERR_ACCESS_DENIED = exports.isTransientError = exports.EFETCH = exports.EURLACCESS = exports.EFILEACCESS = exports.EPROXY = exports.ECONFIG = exports.ESES = exports.ESENDMAIL = exports.EMAXRECIPIENTS = exports.EMAXLIMIT = exports.EOAUTH2 = exports.ENOAUTH = exports.EAUTH = exports.ESTREAM = exports.EMESSAGE = exports.EENVELOPE = exports.EPROTOCOL = exports.EREQUIRETLS = exports.ETLS = exports.EDNS = exports.ESOCKET = exports.ETIMEDOUT = exports.ECONNECTION = exports.ERROR_CODES = void 0;
+exports.ERR_ACCESS_DENIED = exports.isPermanentResponseCode = exports.isTransientError = exports.EFETCH = exports.EURLACCESS = exports.EFILEACCESS = exports.EPROXY = exports.ECONFIG = exports.ESES = exports.ESENDMAIL = exports.EMAXRECIPIENTS = exports.EMAXLIMIT = exports.EOAUTH2 = exports.ENOAUTH = exports.EAUTH = exports.ESTREAM = exports.EMESSAGE = exports.EENVELOPE = exports.EPROTOCOL = exports.EREQUIRETLS = exports.ETLS = exports.EDNS = exports.ESOCKET = exports.ETIMEDOUT = exports.ECONNECTION = exports.ERROR_CODES = void 0;
 /**
  * Error code descriptions for documentation and debugging
  */
@@ -73,6 +73,19 @@ exports.EFETCH = 'EFETCH';
  */
 const isTransientError = (err) => err.responseCode === 421 || err.code === exports.ECONNECTION || err.code === exports.ESOCKET || err.code === exports.ETIMEDOUT;
 exports.isTransientError = isTransientError;
+/**
+ * Tells whether an SMTP reply code is a permanent rejection, one that retrying the same
+ * message would get again. RFC 5321 makes every 5yz reply a permanent negative completion
+ * and every 4yz reply a transient one. 503 (bad sequence of commands) is the exception: it
+ * says the session was in the wrong state for the command rather than that the message was
+ * refused, so the same message can go through on a new connection. 2yz and 3yz replies are
+ * only an error when the client expected something else, and are not permanent either.
+ *
+ * @param responseCode SMTP reply code
+ * @returns true for a permanent rejection
+ */
+const isPermanentResponseCode = (responseCode) => responseCode >= 500 && responseCode < 600 && responseCode !== 503;
+exports.isPermanentResponseCode = isPermanentResponseCode;
 /**
  * Code Node.js sets on an error when its permission model (`--permission`) denies an
  * operation. It is not replaced with the Nodemailer code of the failing step (`ESOCKET`,

package/dist/cjs/fetch/cookies.js

@@ -198,16 +198,14 @@ class Cookies {
         // check if hostname matches
         // .foo.com also matches subdomains, foo.com does not
         if (urlparts.hostname !== cookie.domain &&
-            (cookie.domain.charAt(0) !== '.' ||
-                ('.' + urlparts.hostname).substr(-cookie.domain.length) !== cookie.domain)) {
+            (cookie.domain.charAt(0) !== '.' || ('.' + urlparts.hostname).substr(-cookie.domain.length) !== cookie.domain)) {
             return false;
         }
         // check if the request path path-matches the cookie path (RFC 6265 section 5.1.4):
         // identical paths match, otherwise the cookie path must be a directory prefix
         const pathname = urlparts.pathname || '/';
         const cookiePath = cookie.path;
-        const pathMatches = pathname === cookiePath ||
-            (pathname.startsWith(cookiePath) && (cookiePath.endsWith('/') || pathname.charAt(cookiePath.length) === '/'));
+        const pathMatches = pathname === cookiePath || (pathname.startsWith(cookiePath) && (cookiePath.endsWith('/') || pathname.charAt(cookiePath.length) === '/'));
         if (!pathMatches) {
             return false;
         }

package/dist/cjs/fetch/index.js

@@ -262,11 +262,7 @@ function nmfetch(url, options) {
             }
         });
     }
-    if (parsed.protocol === 'https:' &&
-        parsed.hostname &&
-        parsed.hostname !== reqOptions.host &&
-        !node_net_1.default.isIP(parsed.hostname) &&
-        !reqOptions.servername) {
+    if (parsed.protocol === 'https:' && parsed.hostname && parsed.hostname !== reqOptions.host && !node_net_1.default.isIP(parsed.hostname) && !reqOptions.servername) {
         reqOptions.servername = parsed.hostname;
     }
     try {
@@ -369,9 +365,7 @@ function nmfetch(url, options) {
             // downgrade would also put them on the wire in cleartext). Strip sensitive
             // request headers so an attacker who controls the redirect target cannot
             // harvest them.
-            const crossOrigin = redirectParsed.protocol !== parsed.protocol ||
-                redirectParsed.hostname !== parsed.hostname ||
-                fetchPort(redirectParsed) !== fetchPort(parsed);
+            const crossOrigin = redirectParsed.protocol !== parsed.protocol || redirectParsed.hostname !== parsed.hostname || fetchPort(redirectParsed) !== fetchPort(parsed);
             if (options.headers && crossOrigin) {
                 const sensitive = ['authorization', 'cookie', 'proxy-authorization'];
                 Object.keys(options.headers).forEach(key => {

package/dist/cjs/mail-composer/index.js

@@ -54,6 +54,40 @@ function isContentObject(value) {
     const content = value;
     return typeof value === 'object' && !!(content.content || content.path || content.href || content.raw);
 }
+/**
+ * Tells whether attachment content is a string or a Buffer that 7bit can describe: ASCII
+ * only, no NUL and no line over the 998 octets of RFC 5322. Anything else, a stream or a
+ * file path included, can not be checked here
+ */
+function fitsSevenBit(content) {
+    let at;
+    let length;
+    if (typeof content === 'string') {
+        at = i => content.charCodeAt(i);
+        length = content.length;
+    }
+    else if (Buffer.isBuffer(content)) {
+        at = i => content[i];
+        length = content.length;
+    }
+    else {
+        return false;
+    }
+    let lineLength = 0;
+    for (let i = 0; i < length; i++) {
+        const c = at(i);
+        if (c === 0 || c > 0x7f) {
+            return false;
+        }
+        if (c === 0x0a || c === 0x0d) {
+            lineLength = 0;
+        }
+        else if (++lineLength > 998) {
+            return false;
+        }
+    }
+    return true;
+}
 class MailComposer {
     constructor(mail) {
         this.mail = mail || {};
@@ -136,8 +170,11 @@ class MailComposer {
                 contentTransferEncoding = attachment.contentTransferEncoding;
             }
             else if (isMessageNode) {
-                // the content might include non-ASCII bytes but at this point we do not know it yet
-                contentTransferEncoding = '8bit';
+                // a message/* part can not be encoded (RFC 2046 5.2.1), so the label has to describe
+                // the content as it is. A stream or a file might hold non-ASCII bytes that can not be
+                // checked here, so only content at hand that fits 7bit is labelled as such
+                // content with an `encoding` is decoded later, so what it decodes to is not known here either
+                contentTransferEncoding = !attachment.encoding && fitsSevenBit(attachment.content) ? '7bit' : '8bit';
             }
             else {
                 contentTransferEncoding = 'base64'; // the default
@@ -152,9 +189,7 @@ class MailComposer {
             }
             else if (!isMessageNode && attachment.filename !== false) {
                 // a backslash separates as well, so a Windows path does not put the sender's directories in the headers
-                data.filename =
-                    (attachment.path || attachment.href || '').split(/[/\\]/).pop().split('?').shift() ||
-                        'attachment-' + (i + 1);
+                data.filename = (attachment.path || attachment.href || '').split(/[/\\]/).pop().split('?').shift() || 'attachment-' + (i + 1);
                 if (data.filename.indexOf('.') < 0) {
                     data.filename += '.' + mimeFuncs.detectExtension(data.contentType);
                 }
@@ -315,8 +350,7 @@ class MailComposer {
         if (this.mail.icalEvent) {
             eventObject = Object.assign({}, this._getIcalEvent());
             eventObject.filename = false;
-            eventObject.contentType =
-                'text/calendar; charset=utf-8; method=' + (eventObject.method || 'PUBLISH').toString().trim().toUpperCase();
+            eventObject.contentType = 'text/calendar; charset=utf-8; method=' + (eventObject.method || 'PUBLISH').toString().trim().toUpperCase();
             if (!eventObject.headers) {
                 eventObject.headers = {};
             }
@@ -344,8 +378,7 @@ class MailComposer {
                 alternative = this._processDataUrl(alternative);
             }
             const data = {
-                contentType: alternative.contentType ||
-                    mimeFuncs.detectMimeType(alternative.filename || alternative.path || alternative.href || 'txt'),
+                contentType: alternative.contentType || mimeFuncs.detectMimeType(alternative.filename || alternative.path || alternative.href || 'txt'),
                 contentTransferEncoding: alternative.contentTransferEncoding
             };
             if (alternative.filename) {

package/dist/cjs/mailer/mail-message.js

@@ -109,8 +109,7 @@ class MailMessage {
                 if (!attachment.filename) {
                     // a backslash separates as well, so a Windows path does not put the sender's directories in the headers
                     attachment.filename =
-                        (attachment.path || attachment.href || '').split(/[/\\]/).pop().split('?').shift() ||
-                            'attachment-' + (i + 1);
+                        (attachment.path || attachment.href || '').split(/[/\\]/).pop().split('?').shift() || 'attachment-' + (i + 1);
                     if (attachment.filename.indexOf('.') < 0) {
                         attachment.filename += '.' + mimeFuncs.detectExtension(attachment.contentType);
                     }
@@ -245,7 +244,7 @@ class MailMessage {
                 value = (value && value.value) || value;
                 if (value) {
                     if (['references', 'in-reply-to', 'message-id', 'content-id'].includes(key)) {
-                        value = this.message._encodeHeaderValue(key, value);
+                        value = this.message.encodeHeaderValue(key, value);
                     }
                     data.normalizedHeaders[key] = value;
                 }
@@ -257,10 +256,10 @@ class MailMessage {
                 });
             }
             if (data.references) {
-                data.normalizedHeaders.references = this.message._encodeHeaderValue('references', data.references);
+                data.normalizedHeaders.references = this.message.encodeHeaderValue('references', data.references);
             }
             if (data.inReplyTo) {
-                data.normalizedHeaders['in-reply-to'] = this.message._encodeHeaderValue('in-reply-to', data.inReplyTo);
+                data.normalizedHeaders['in-reply-to'] = this.message.encodeHeaderValue('in-reply-to', data.inReplyTo);
             }
             return callback(null, data);
         });
@@ -329,7 +328,7 @@ class MailMessage {
                             comment = needsEncoding ? mimeFuncs.encodeWord(comment) : mimeFuncs.quoteString(comment);
                             // List-ID expects a bare domain-like identifier, so strip the
                             // scheme prefix that _formatListUrl adds or passes through
-                            return ((value.comment ? comment + ' ' : '') + this._formatListUrl(value.url).replace(/^<[^:]+:\/{0,2}/, '<'));
+                            return (value.comment ? comment + ' ' : '') + this._formatListUrl(value.url).replace(/^<[^:]+:\/{0,2}/, '<');
                         }
                         // List-*: <http://domain> (comment)
                         // the ctext specials go out as quoted-pairs, otherwise a ")" closes the

package/dist/cjs/mime-funcs/index.d.ts

@@ -107,6 +107,22 @@ export declare function buildHeaderValue(structured: StructuredHeaderValue): str
  * @return A list of encoded keys and headers
  */
 export declare function buildHeaderParam(key: string, data: string | Buffer, maxLength?: number): EncodedHeaderParam[];
+/**
+ * Options of parseHeaderValue()
+ */
+export interface ParseHeaderValueOptions {
+    /**
+     * Drop the RFC 822 comments outside quoted strings, which the MIME headers allow and
+     * which are not part of the value: 'boundary=b (comment)' names the boundary 'b'. A
+     * parenthesis right behind the '=' of a parameter or behind a token character of its
+     * value continues the token, as it does for Python and postal-mime, so 'Invoice(1).pdf'
+     * keeps its name and 'boundary=(c)b' names the boundary '(c)b'. A comment that never
+     * closes runs to the end of the value, unless a parameter follows it, in which case it is
+     * content and the parameter survives. Comments are kept by default for the sake of the
+     * callers of this exported function, not because keeping them is ever the better reading
+     */
+    stripComments?: boolean | undefined;
+}
 /**
  * Parses a header value with key=value arguments into a structured
  * object.
@@ -120,9 +136,10 @@ export declare function buildHeaderParam(key: string, data: string | Buffer, max
  *   }
  *
  * @param str Header value
+ * @param options Options, see ParseHeaderValueOptions
  * @return Header value as a parsed structure
  */
-export declare function parseHeaderValue(str: string): ParsedHeaderValue;
+export declare function parseHeaderValue(str: string, options?: ParseHeaderValueOptions): ParsedHeaderValue;
 /**
  * Returns file extension for a content type string. If no suitable extensions
  * are found, 'bin' is used as the default extension

package/dist/cjs/mime-funcs/index.js

@@ -414,6 +414,26 @@ function buildHeaderParam(key, data, maxLength) {
  * goes in. Whitespace used to come off it only because the value was trimmed first.
  */
 const TOKEN = /^[^\x00-\x20\x7f()<>@,;:\\"/[\]?=]+$/;
+/**
+ * Offset of the ')' that closes the RFC 822 comment opening at `start`, or -1 when the
+ * comment never closes. Comments nest, and a backslash escapes the character after it
+ */
+function _findCommentEnd(str, start) {
+    let depth = 0;
+    for (let i = start, len = str.length; i < len; i++) {
+        const c = str.charAt(i);
+        if (c === '\\') {
+            i++;
+        }
+        else if (c === '(') {
+            depth++;
+        }
+        else if (c === ')' && --depth === 0) {
+            return i;
+        }
+    }
+    return -1;
+}
 /**
  * Whether a string can be a header parameter name.
  *
@@ -440,13 +460,16 @@ function _isParamName(name) {
  *   }
  *
  * @param str Header value
+ * @param options Options, see ParseHeaderValueOptions
  * @return Header value as a parsed structure
  */
-function parseHeaderValue(str) {
+function parseHeaderValue(str, options) {
     const response = {
         value: '',
         params: {}
     };
+    // Cleared again by an unclosed '(', see the loop
+    let stripComments = !!options?.stripComments;
     // A duplicated parameter resolves to its first occurrence, the way a duplicated header
     // does. Letting the last one win disagrees with the receivers that take the first, and
     // the two readings of 'boundary="b"; boundary="c"' name different delimiters. The
@@ -508,6 +531,25 @@ function parseHeaderValue(str) {
     };
     for (let i = 0, len = str.length; i < len; i++) {
         chr = str.charAt(i);
+        // With stripComments, an RFC 822 comment stands anywhere outside a quoted string but
+        // right behind a token it would continue, see ParseHeaderValueOptions. In the value
+        // of a parameter, no pending whitespace means the last significant character was the
+        // '=' or a character of the token
+        if (stripComments && chr === '(' && !quote && !quoteClosed && !(stage === 'value' && key !== false && !pendingSpace)) {
+            let end = _findCommentEnd(str, i);
+            if (end < 0 && str.indexOf(';', i) < 0) {
+                // a comment that never closes runs to the end of the value, unless a
+                // parameter follows it, which is content then and survives
+                end = len - 1;
+            }
+            if (end >= 0) {
+                i = end;
+                continue;
+            }
+            // looking for a closing ')' again would scan a run of unclosed '(' to its end
+            // once for each of them
+            stripComments = false;
+        }
         if (stage === 'key') {
             if (chr === '=') {
                 key = takeValue().trim();

package/dist/cjs/mime-funcs/mime-types.js

@@ -1104,10 +1104,7 @@ const extensions = new Map([
     ['bdm', 'application/vnd.syncml.dm+wbxml'],
     ['bed', 'application/vnd.realvnc.bed'],
     ['bh2', 'application/vnd.fujitsu.oasysprs'],
-    [
-        'bin',
-        ['application/octet-stream', 'application/mac-binary', 'application/macbinary', 'application/x-macbinary', 'application/x-binary']
-    ],
+    ['bin', ['application/octet-stream', 'application/mac-binary', 'application/macbinary', 'application/x-macbinary', 'application/x-binary']],
     ['bm', 'image/bmp'],
     ['bmi', 'application/vnd.bmi'],
     ['bmp', ['image/bmp', 'image/x-windows-bmp']],
@@ -1152,10 +1149,7 @@ const extensions = new Map([
     ['cii', 'application/vnd.anser-web-certificate-issue-initiation'],
     ['cil', 'application/vnd.ms-artgalry'],
     ['cla', 'application/vnd.claymore'],
-    [
-        'class',
-        ['application/octet-stream', 'application/java', 'application/java-byte-code', 'application/java-vm', 'application/x-java-class']
-    ],
+    ['class', ['application/octet-stream', 'application/java', 'application/java-byte-code', 'application/java-vm', 'application/x-java-class']],
     ['clkk', 'application/vnd.crick.clicker.keyboard'],
     ['clkp', 'application/vnd.crick.clicker.palette'],
     ['clkt', 'application/vnd.crick.clicker.template'],
@@ -1760,10 +1754,7 @@ const extensions = new Map([
     ['sbml', 'application/sbml+xml'],
     ['sc', 'application/vnd.ibm.secure-container'],
     ['scd', 'application/x-msschedule'],
-    [
-        'scm',
-        ['application/vnd.lotus-screencam', 'video/x-scm', 'text/x-script.guile', 'application/x-lotusscreencam', 'text/x-script.scheme']
-    ],
+    ['scm', ['application/vnd.lotus-screencam', 'video/x-scm', 'text/x-script.guile', 'application/x-lotusscreencam', 'text/x-script.scheme']],
     ['scq', 'application/scvp-cv-request'],
     ['scs', 'application/scvp-cv-response'],
     ['sct', 'text/scriptlet'],

package/dist/cjs/mime-node/index.d.ts

@@ -58,6 +58,13 @@ export interface MimeNodePreparedHeaderValue {
  * objects (for the address headers), a prepared value object, or a list of these
  */
 export type MimeNodeHeaderValue = string | number | boolean | Date | MimeNodeAddress | MimeNodePreparedHeaderValue | MimeNodeHeaderValue[] | null | undefined;
+/**
+ * Options for the static MimeNode.encodeHeaderValue
+ */
+export interface MimeNodeHeaderEncodingOptions {
+    /** Either 'Q' (the default) or 'B' */
+    textEncoding?: string | undefined;
+}
 /**
  * A single header, the shape the headers are stored in and one of the list forms
  * setHeader and addHeader accept
@@ -319,6 +326,31 @@ declare class MimeNode {
      * @param raw Raw MIME contents
      */
     setRaw(raw: MimeNodeContent): this;
+    /**
+     * Encodes a header value the way this node encodes it in the generated message:
+     * address headers are punycoded and mime encoded, message id headers get their
+     * angle brackets, a Date object is formatted and any other value is mime encoded
+     * when it holds non-ascii or control characters (using the node's `textEncoding`).
+     *
+     * The result is a single unfolded line without the key. Fold it before writing it
+     * into a message, `key + ': ' + value` folded at 76 characters is what the node does.
+     *
+     * @param key Header key, case insensitive
+     * @param value Header value
+     * @returns Encoded header value
+     */
+    encodeHeaderValue(key: string, value: MimeNodeHeaderValue): string;
+    /**
+     * Encodes a header value without a node at hand. Same as the instance method of a
+     * node created with the given options.
+     *
+     * @param key Header key, case insensitive
+     * @param value Header value
+     * @param [options] Encoding options
+     * @param [options.textEncoding] either 'Q' (the default) or 'B'
+     * @returns Encoded header value
+     */
+    static encodeHeaderValue(key: string, value: MimeNodeHeaderValue, options?: MimeNodeHeaderEncodingOptions): string;
 }
 /**
  * Type aliases in the layout of @types/nodemailer, so `MimeNode.Options` style references keep working
@@ -327,7 +359,8 @@ declare namespace MimeNode {
     type Options = MimeNodeOptions;
     type Addresses = MimeNodeAddresses;
     type Envelope = MimeNodeEnvelope;
+    type HeaderEncodingOptions = MimeNodeHeaderEncodingOptions;
 }
 /** The same aliases as module level exports, for `import * as MimeNode` and `import MimeNode = require()` */
-export type { MimeNodeOptions as Options, MimeNodeAddresses as Addresses, MimeNodeEnvelope as Envelope };
+export type { MimeNodeOptions as Options, MimeNodeAddresses as Addresses, MimeNodeEnvelope as Envelope, MimeNodeHeaderEncodingOptions as HeaderEncodingOptions };
 export default MimeNode;

package/dist/cjs/mime-node/index.js

@@ -155,9 +155,7 @@ function exceedsDomainLimits(domain) {
  */
 function normalizeDomain(domain, toUnicode) {
     // domainToASCII and domainToUnicode landed in Node 7, the bundled codec covers Node 6
-    if (typeof node_url_1.default.domainToASCII === 'function' &&
-        typeof node_url_1.default.domainToUnicode === 'function' &&
-        !URL_PARSER_UNSAFE.test(domain)) {
+    if (typeof node_url_1.default.domainToASCII === 'function' && typeof node_url_1.default.domainToUnicode === 'function' && !URL_PARSER_UNSAFE.test(domain)) {
         // The U-label form is decoded from the A-label form rather than from the input:
         // Deno's domainToASCII returns an empty string for a label it cannot decode, while
         // its domainToUnicode returns the label with U+FFFD in place of the bad part
@@ -656,23 +654,24 @@ class MimeNode {
                 return;
             }
             switch (header.key) {
+                // The comments of a MIME header are not part of its value and are dropped, so a
+                // caller supplied 'boundary=b (comment)' is the boundary b it names, and the
+                // header goes out without the comment
                 case 'Content-Disposition':
-                    structured = mimeFuncs.parseHeaderValue(value);
+                    structured = mimeFuncs.parseHeaderValue(value, { stripComments: true });
                     if (this.filename) {
                         structured.params.filename = this.filename;
                     }
                     value = mimeFuncs.buildHeaderValue(structured);
                     break;
                 case 'Content-Type':
-                    structured = mimeFuncs.parseHeaderValue(value);
+                    structured = mimeFuncs.parseHeaderValue(value, { stripComments: true });
                     // the type token decides multipart and charset below, so clean it before
                     // those run and not just on the way out, otherwise a control char makes
                     // the checks miss and the header ends up claiming a type it is not set up for
                     structured.value = (structured.value || '').toString().replace(/[\x00-\x1f\x7f]/g, '');
                     this._handleContentType(structured);
-                    if (structured.value.match(/^text\/plain\b/) &&
-                        typeof this.content === 'string' &&
-                        /[\u0080-\uFFFF]/.test(this.content)) {
+                    if (structured.value.match(/^text\/plain\b/) && typeof this.content === 'string' && /[\u0080-\uFFFF]/.test(this.content)) {
                         structured.params.charset = 'utf-8';
                     }
                     if (this.filename) {
@@ -713,7 +712,7 @@ class MimeNode {
                     }
                     break;
             }
-            value = this._encodeHeaderValue(key, value);
+            value = this.encodeHeaderValue(key, value);
             // skip empty lines
             if (!(value || '').toString().trim()) {
                 return;
@@ -1331,8 +1330,7 @@ class MimeNode {
             // where it came from. MimeNode is exported and subclassable, so the generator is
             // not necessarily the one below. Stripping twice costs nothing, it is idempotent.
             const declared = _stripBoundaryControls(structured.params.boundary || this.boundary || '');
-            this.boundary = structured.params.boundary =
-                declared || _stripBoundaryControls(this._generateBoundary());
+            this.boundary = structured.params.boundary = declared || _stripBoundaryControls(this._generateBoundary());
         }
         else {
             this.boundary = false;
@@ -1350,13 +1348,19 @@ class MimeNode {
         return _stripBoundaryControls(this.rootNode.boundaryPrefix + '-' + this.rootNode.baseBoundary) + '-Part_' + this._nodeId;
     }
     /**
-     * Encodes a header value for use in the generated rfc2822 email.
+     * Encodes a header value the way this node encodes it in the generated message:
+     * address headers are punycoded and mime encoded, message id headers get their
+     * angle brackets, a Date object is formatted and any other value is mime encoded
+     * when it holds non-ascii or control characters (using the node's `textEncoding`).
      *
-     * @param key Header key
+     * The result is a single unfolded line without the key. Fold it before writing it
+     * into a message, `key + ': ' + value` folded at 76 characters is what the node does.
+     *
+     * @param key Header key, case insensitive
      * @param value Header value
-     * @internal
+     * @returns Encoded header value
      */
-    _encodeHeaderValue(key, value) {
+    encodeHeaderValue(key, value) {
         key = this._normalizeHeaderKey(key);
         switch (key) {
             // Structured headers
@@ -1421,6 +1425,27 @@ class MimeNode {
                 return this._encodeHeaderText(value);
         }
     }
+    /**
+     * Encodes a header value without a node at hand. Same as the instance method of a
+     * node created with the given options.
+     *
+     * @param key Header key, case insensitive
+     * @param value Header value
+     * @param [options] Encoding options
+     * @param [options.textEncoding] either 'Q' (the default) or 'B'
+     * @returns Encoded header value
+     */
+    static encodeHeaderValue(key, value, options) {
+        return new MimeNode(false, { textEncoding: options?.textEncoding }).encodeHeaderValue(key, value);
+    }
+    /**
+     * Alias of encodeHeaderValue, kept for callers that used the method before it was public
+     *
+     * @internal
+     */
+    _encodeHeaderValue(key, value) {
+        return this.encodeHeaderValue(key, value);
+    }
     /**
      * Rebuilds address object using punycode and other adjustments
      *

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.1.7";
+export declare const version = "10.2.1";
 export declare const homepage = "https://nodemailer.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.1.7';
+exports.version = '10.2.1';
 exports.homepage = 'https://nodemailer.com/';