nodemailer 10.3.0 → 10.3.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # CHANGELOG
 
+## [10.3.1](https://github.com/nodemailer/nodemailer/compare/v10.3.0...v10.3.1) (2026-10-29)
+
+
+### Bug Fixes
+
+* apply the otp option in MailComposer too ([1d4087f](https://github.com/nodemailer/nodemailer/commit/1d4087f358d124267bddd5eb5e11a4e22fccd3d0))
+
 ## [10.3.0](https://github.com/nodemailer/nodemailer/compare/v10.2.1...v10.3.0) (2026-10-29)
 
 

package/dist/cjs/mail-composer/index.d.ts

@@ -124,7 +124,7 @@ export interface MailComposerOptions {
     headers?: MimeNodeHeaders | undefined;
     /** List-* headers, read by the mailer */
     list?: MailComposerListHeaders | undefined;
-    /** One-time passcode for the OTP-Token header, read by the mailer */
+    /** One-time passcode for the OTP-Token header. An invalid value makes compile() throw an EOTP error */
     otp?: MailComposerOtp | undefined;
     /** SMTP envelope to use instead of the one generated from the headers */
     envelope?: MimeNodeEnvelopeInput | undefined;

package/dist/cjs/mail-composer/index.js

@@ -39,6 +39,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const index_js_1 = __importDefault(require("../mime-node/index.js"));
 const mimeFuncs = __importStar(require("../mime-funcs/index.js"));
+const errors = __importStar(require("../errors.js"));
 const index_js_2 = require("../shared/index.js");
 /**
  * Creates the object for composing a MimeNode instance out from the mail options
@@ -133,6 +134,10 @@ class MailComposer {
         if (this.mail.headers) {
             this.message.addHeader(this.mail.headers);
         }
+        // after the custom headers, so it replaces an OTP-Token from them, the field may appear only once
+        if (this.mail.otp) {
+            this.message.setHeader('OTP-Token', formatOtpToken(this.mail.otp));
+        }
         // Add headers to the root node, always overrides custom headers
         ['from', 'sender', 'to', 'cc', 'bcc', 'reply-to', 'in-reply-to', 'references', 'subject', 'message-id', 'date'].forEach(header => {
             const key = header.replace(/-(\w)/g, (o, c) => c.toUpperCase());
@@ -641,6 +646,54 @@ class MailComposer {
         return element;
     }
 }
+/**
+ * Returns the value of the OTP-Token header for the otp option. The header is defined by
+ * draft-goto-otp-token-01, an Internet-Draft that expires on 25 March 2027. By then check
+ * for a newer revision of the draft or a published RFC, the header name and its
+ * parameters are still open questions in the draft.
+ */
+function formatOtpToken(otp) {
+    // a structured field String can only hold printable ascii. The code is a secret the recipient
+    // compares against the one in the message body, so it is rejected rather than cleaned up
+    if (typeof otp.code !== 'string' || !/^[\x20-\x7e]+$/.test(otp.code)) {
+        throw otpError('The otp code must be a non-empty string of printable ASCII characters');
+    }
+    // a structured field String escapes the same two characters as a quoted-string
+    return mimeFuncs.quoteString(otp.code) + '; origin=' + mimeFuncs.quoteString(getOtpOrigin(otp.origin));
+}
+/**
+ * Returns the canonical ascii serialization of the origin the code is bound to. The draft
+ * requires a potentially trustworthy origin, so only https is accepted, plus http on a
+ * loopback host for local development
+ */
+function getOtpOrigin(origin) {
+    let url;
+    try {
+        url = new URL(String(origin));
+    }
+    catch {
+        // handled below
+    }
+    // the WHATWG parser lets characters such as a quote or a brace into a host, which the
+    // origin grammar the draft requires (RFC 6454) does not allow, so a receiver would discard
+    // the header. Only a DNS name, an IPv4 address or a bracketed IPv6 address is accepted.
+    // Userinfo is refused as well, an origin never has it and it turns a value built as
+    // 'https://example.com' + input into the origin of whatever host follows an "@"
+    if (!url || url.username || url.password || !/^([a-z0-9_-]+\.)*[a-z0-9_-]+$|^\[[0-9a-f:.]+\]$/.test(url.hostname)) {
+        throw otpError('The otp origin must be an absolute https URL');
+    }
+    const isLoopback = /^(localhost|.+\.localhost|127(\.\d+){3}|\[::1\])$/.test(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback)) {
+        throw otpError('The otp origin must be an https URL, or an http URL on a loopback host');
+    }
+    // the URL parser already lowercases the host, converts it to punycode and drops the default port
+    return url.origin;
+}
+function otpError(message) {
+    const err = new Error(message);
+    err.code = errors.EOTP;
+    return err;
+}
 exports.default = MailComposer;
 module.exports = exports.default;
 Object.defineProperty(module.exports, 'default', { value: exports.default, enumerable: false, writable: true, configurable: true });

package/dist/cjs/mailer/index.js

@@ -183,7 +183,6 @@ class Mail extends node_events_1.EventEmitter {
                 mail.setMailerHeader();
                 mail.setPriorityHeaders();
                 mail.setListHeaders();
-                mail.setOtpHeader();
                 recipientCount = mail.message.getEnvelope().to.length;
             }
             catch (err) {

package/dist/cjs/mailer/mail-message.d.ts

@@ -103,11 +103,4 @@ export default class MailMessage<T = SentMessageInfo> {
     setMailerHeader(): void;
     setPriorityHeaders(): void;
     setListHeaders(): void;
-    /**
-     * Sets the OTP-Token header from the otp option. The header is defined by
-     * draft-goto-otp-token-01, an Internet-Draft that expires on 25 March 2027. By then check
-     * for a newer revision of the draft or a published RFC, the header name and its
-     * parameters are still open questions in the draft.
-     */
-    setOtpHeader(): void;
 }

package/dist/cjs/mailer/mail-message.js

@@ -39,7 +39,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const shared = __importStar(require("../shared/index.js"));
 const index_js_1 = __importDefault(require("../mime-node/index.js"));
 const mimeFuncs = __importStar(require("../mime-funcs/index.js"));
-const errors = __importStar(require("../errors.js"));
 // Only an own key counts as already set. `key in obj` also matches every member of
 // Object.prototype, which silently drops a transporter default legitimately named
 // toString or constructor.
@@ -301,26 +300,6 @@ class MailMessage {
             });
         });
     }
-    /**
-     * Sets the OTP-Token header from the otp option. The header is defined by
-     * draft-goto-otp-token-01, an Internet-Draft that expires on 25 March 2027. By then check
-     * for a newer revision of the draft or a published RFC, the header name and its
-     * parameters are still open questions in the draft.
-     */
-    setOtpHeader() {
-        const otp = this.data.otp;
-        if (!this.message || !otp) {
-            return;
-        }
-        // a structured field String can only hold printable ascii. The code is a secret the recipient
-        // compares against the one in the message body, so it is rejected rather than cleaned up
-        if (typeof otp.code !== 'string' || !/^[\x20-\x7e]+$/.test(otp.code)) {
-            throw otpError('The otp code must be a non-empty string of printable ASCII characters');
-        }
-        // a structured field String escapes the same two characters as a quoted-string. setHeader
-        // replaces any OTP-Token from the custom headers, the field may appear only once
-        this.message.setHeader('OTP-Token', mimeFuncs.quoteString(otp.code) + '; origin=' + mimeFuncs.quoteString(getOtpOrigin(otp.origin)));
-    }
     /** @internal */
     _getListHeaders(listData) {
         // make sure an url looks like <protocol:url>
@@ -381,38 +360,5 @@ class MailMessage {
     }
 }
 exports.default = MailMessage;
-/**
- * Returns the canonical ascii serialization of the origin the code is bound to. The draft
- * requires a potentially trustworthy origin, so only https is accepted, plus http on a
- * loopback host for local development
- */
-function getOtpOrigin(origin) {
-    let url;
-    try {
-        url = new URL(String(origin));
-    }
-    catch {
-        // handled below
-    }
-    // the WHATWG parser lets characters such as a quote or a brace into a host, which the
-    // origin grammar the draft requires (RFC 6454) does not allow, so a receiver would discard
-    // the header. Only a DNS name, an IPv4 address or a bracketed IPv6 address is accepted.
-    // Userinfo is refused as well, an origin never has it and it turns a value built as
-    // 'https://example.com' + input into the origin of whatever host follows an "@"
-    if (!url || url.username || url.password || !/^([a-z0-9_-]+\.)*[a-z0-9_-]+$|^\[[0-9a-f:.]+\]$/.test(url.hostname)) {
-        throw otpError('The otp origin must be an absolute https URL');
-    }
-    const isLoopback = /^(localhost|.+\.localhost|127(\.\d+){3}|\[::1\])$/.test(url.hostname);
-    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback)) {
-        throw otpError('The otp origin must be an https URL, or an http URL on a loopback host');
-    }
-    // the URL parser already lowercases the host, converts it to punycode and drops the default port
-    return url.origin;
-}
-function otpError(message) {
-    const err = new Error(message);
-    err.code = errors.EOTP;
-    return err;
-}
 module.exports = exports.default;
 Object.defineProperty(module.exports, 'default', { value: exports.default, enumerable: false, writable: true, configurable: true });

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.3.0";
+export declare const version = "10.3.1";
 export declare const homepage = "https://nodemailer.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.3.0';
+exports.version = '10.3.1';
 exports.homepage = 'https://nodemailer.com/';

package/dist/esm/mail-composer/index.d.ts

@@ -124,7 +124,7 @@ export interface MailComposerOptions {
     headers?: MimeNodeHeaders | undefined;
     /** List-* headers, read by the mailer */
     list?: MailComposerListHeaders | undefined;
-    /** One-time passcode for the OTP-Token header, read by the mailer */
+    /** One-time passcode for the OTP-Token header. An invalid value makes compile() throw an EOTP error */
     otp?: MailComposerOtp | undefined;
     /** SMTP envelope to use instead of the one generated from the headers */
     envelope?: MimeNodeEnvelopeInput | undefined;

package/dist/esm/mail-composer/index.js

@@ -1,6 +1,7 @@
 /* eslint no-undefined: 0 */
 import MimeNode from '../mime-node/index.js';
 import * as mimeFuncs from '../mime-funcs/index.js';
+import * as errors from '../errors.js';
 import { parseDataURI, copyOwnKeys } from '../shared/index.js';
 /**
  * Creates the object for composing a MimeNode instance out from the mail options
@@ -95,6 +96,10 @@ class MailComposer {
         if (this.mail.headers) {
             this.message.addHeader(this.mail.headers);
         }
+        // after the custom headers, so it replaces an OTP-Token from them, the field may appear only once
+        if (this.mail.otp) {
+            this.message.setHeader('OTP-Token', formatOtpToken(this.mail.otp));
+        }
         // Add headers to the root node, always overrides custom headers
         ['from', 'sender', 'to', 'cc', 'bcc', 'reply-to', 'in-reply-to', 'references', 'subject', 'message-id', 'date'].forEach(header => {
             const key = header.replace(/-(\w)/g, (o, c) => c.toUpperCase());
@@ -603,4 +608,52 @@ class MailComposer {
         return element;
     }
 }
+/**
+ * Returns the value of the OTP-Token header for the otp option. The header is defined by
+ * draft-goto-otp-token-01, an Internet-Draft that expires on 25 March 2027. By then check
+ * for a newer revision of the draft or a published RFC, the header name and its
+ * parameters are still open questions in the draft.
+ */
+function formatOtpToken(otp) {
+    // a structured field String can only hold printable ascii. The code is a secret the recipient
+    // compares against the one in the message body, so it is rejected rather than cleaned up
+    if (typeof otp.code !== 'string' || !/^[\x20-\x7e]+$/.test(otp.code)) {
+        throw otpError('The otp code must be a non-empty string of printable ASCII characters');
+    }
+    // a structured field String escapes the same two characters as a quoted-string
+    return mimeFuncs.quoteString(otp.code) + '; origin=' + mimeFuncs.quoteString(getOtpOrigin(otp.origin));
+}
+/**
+ * Returns the canonical ascii serialization of the origin the code is bound to. The draft
+ * requires a potentially trustworthy origin, so only https is accepted, plus http on a
+ * loopback host for local development
+ */
+function getOtpOrigin(origin) {
+    let url;
+    try {
+        url = new URL(String(origin));
+    }
+    catch {
+        // handled below
+    }
+    // the WHATWG parser lets characters such as a quote or a brace into a host, which the
+    // origin grammar the draft requires (RFC 6454) does not allow, so a receiver would discard
+    // the header. Only a DNS name, an IPv4 address or a bracketed IPv6 address is accepted.
+    // Userinfo is refused as well, an origin never has it and it turns a value built as
+    // 'https://example.com' + input into the origin of whatever host follows an "@"
+    if (!url || url.username || url.password || !/^([a-z0-9_-]+\.)*[a-z0-9_-]+$|^\[[0-9a-f:.]+\]$/.test(url.hostname)) {
+        throw otpError('The otp origin must be an absolute https URL');
+    }
+    const isLoopback = /^(localhost|.+\.localhost|127(\.\d+){3}|\[::1\])$/.test(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback)) {
+        throw otpError('The otp origin must be an https URL, or an http URL on a loopback host');
+    }
+    // the URL parser already lowercases the host, converts it to punycode and drops the default port
+    return url.origin;
+}
+function otpError(message) {
+    const err = new Error(message);
+    err.code = errors.EOTP;
+    return err;
+}
 export default MailComposer;

package/dist/esm/mailer/index.js

@@ -145,7 +145,6 @@ class Mail extends EventEmitter {
                 mail.setMailerHeader();
                 mail.setPriorityHeaders();
                 mail.setListHeaders();
-                mail.setOtpHeader();
                 recipientCount = mail.message.getEnvelope().to.length;
             }
             catch (err) {

package/dist/esm/mailer/mail-message.d.ts

@@ -103,11 +103,4 @@ export default class MailMessage<T = SentMessageInfo> {
     setMailerHeader(): void;
     setPriorityHeaders(): void;
     setListHeaders(): void;
-    /**
-     * Sets the OTP-Token header from the otp option. The header is defined by
-     * draft-goto-otp-token-01, an Internet-Draft that expires on 25 March 2027. By then check
-     * for a newer revision of the draft or a published RFC, the header name and its
-     * parameters are still open questions in the draft.
-     */
-    setOtpHeader(): void;
 }

package/dist/esm/mailer/mail-message.js

@@ -1,7 +1,6 @@
 import * as shared from '../shared/index.js';
 import MimeNode from '../mime-node/index.js';
 import * as mimeFuncs from '../mime-funcs/index.js';
-import * as errors from '../errors.js';
 // Only an own key counts as already set. `key in obj` also matches every member of
 // Object.prototype, which silently drops a transporter default legitimately named
 // toString or constructor.
@@ -263,26 +262,6 @@ export default class MailMessage {
             });
         });
     }
-    /**
-     * Sets the OTP-Token header from the otp option. The header is defined by
-     * draft-goto-otp-token-01, an Internet-Draft that expires on 25 March 2027. By then check
-     * for a newer revision of the draft or a published RFC, the header name and its
-     * parameters are still open questions in the draft.
-     */
-    setOtpHeader() {
-        const otp = this.data.otp;
-        if (!this.message || !otp) {
-            return;
-        }
-        // a structured field String can only hold printable ascii. The code is a secret the recipient
-        // compares against the one in the message body, so it is rejected rather than cleaned up
-        if (typeof otp.code !== 'string' || !/^[\x20-\x7e]+$/.test(otp.code)) {
-            throw otpError('The otp code must be a non-empty string of printable ASCII characters');
-        }
-        // a structured field String escapes the same two characters as a quoted-string. setHeader
-        // replaces any OTP-Token from the custom headers, the field may appear only once
-        this.message.setHeader('OTP-Token', mimeFuncs.quoteString(otp.code) + '; origin=' + mimeFuncs.quoteString(getOtpOrigin(otp.origin)));
-    }
     /** @internal */
     _getListHeaders(listData) {
         // make sure an url looks like <protocol:url>
@@ -342,36 +321,3 @@ export default class MailMessage {
         return '<http://' + url + '>';
     }
 }
-/**
- * Returns the canonical ascii serialization of the origin the code is bound to. The draft
- * requires a potentially trustworthy origin, so only https is accepted, plus http on a
- * loopback host for local development
- */
-function getOtpOrigin(origin) {
-    let url;
-    try {
-        url = new URL(String(origin));
-    }
-    catch {
-        // handled below
-    }
-    // the WHATWG parser lets characters such as a quote or a brace into a host, which the
-    // origin grammar the draft requires (RFC 6454) does not allow, so a receiver would discard
-    // the header. Only a DNS name, an IPv4 address or a bracketed IPv6 address is accepted.
-    // Userinfo is refused as well, an origin never has it and it turns a value built as
-    // 'https://example.com' + input into the origin of whatever host follows an "@"
-    if (!url || url.username || url.password || !/^([a-z0-9_-]+\.)*[a-z0-9_-]+$|^\[[0-9a-f:.]+\]$/.test(url.hostname)) {
-        throw otpError('The otp origin must be an absolute https URL');
-    }
-    const isLoopback = /^(localhost|.+\.localhost|127(\.\d+){3}|\[::1\])$/.test(url.hostname);
-    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback)) {
-        throw otpError('The otp origin must be an https URL, or an http URL on a loopback host');
-    }
-    // the URL parser already lowercases the host, converts it to punycode and drops the default port
-    return url.origin;
-}
-function otpError(message) {
-    const err = new Error(message);
-    err.code = errors.EOTP;
-    return err;
-}

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.3.0";
+export declare const version = "10.3.1";
 export declare const homepage = "https://nodemailer.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.3.0';
+export const version = '10.3.1';
 export const homepage = 'https://nodemailer.com/';

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.3.0",
+    "version": "10.3.1",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",
@@ -153,7 +153,7 @@
     },
     "homepage": "https://nodemailer.com/",
     "devDependencies": {
-        "@aws-sdk/client-sesv2": "3.1156.0",
+        "@aws-sdk/client-sesv2": "3.1159.0",
         "@types/node": "20.19.43",
         "bunyan": "1.8.15",
         "c8": "12.0.0",
@@ -167,10 +167,10 @@
         "prettier": "3.9.10",
         "proxy": "1.0.2",
         "proxy-test-server": "1.0.0",
-        "smtp-server": "3.21.1",
+        "smtp-server": "3.21.2",
         "tsx": "4.23.15",
         "typescript": "6.0.3",
-        "typescript-eslint": "8.72.0"
+        "typescript-eslint": "8.72.1"
     },
     "engines": {
         "node": ">=20.0.0"