nodemailer 9.1.0 → 10.0.0

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # CHANGELOG
 
+## [10.0.0](https://github.com/nodemailer/nodemailer/compare/v9.1.1...v10.0.0) (2026-09-03)
+
+
+### ⚠ BREAKING CHANGES
+
+* Node.js 20 or newer is required. The Node.js 6 syntax compatibility check and the .npmignore file are gone.
+
+### Features
+
+* keep the @types/nodemailer type layout working ([1cc5356](https://github.com/nodemailer/nodemailer/commit/1cc535627e1bb672214b09fa4cc503567275fd7f))
+* migrate to TypeScript with ES module and CommonJS builds ([f7cbf83](https://github.com/nodemailer/nodemailer/commit/f7cbf8384e0ea6055efcc514afb8bc070ac3a2b1))
+
+
+### Bug Fixes
+
+* apply the other keys of a configuration object next to its url ([29610f9](https://github.com/nodemailer/nodemailer/commit/29610f9fe04dbd8af04c4a3362f3b68d293592da))
+* **dkim:** canonicalize raw messages the way verifiers do ([2c84b11](https://github.com/nodemailer/nodemailer/commit/2c84b117d4d138751e9ffa8607f3796771bb5e66))
+* keep a transporter assignable to the plain Transporter type ([8bf55fb](https://github.com/nodemailer/nodemailer/commit/8bf55fb177cf155b24d6bb86a7cd86670146d551))
+* **shared:** keep a colon in the user name of a connection or proxy url ([6acf4b6](https://github.com/nodemailer/nodemailer/commit/6acf4b67d919971f516f58940113c9b8598b2254))
+* **shared:** refuse URL hosts the legacy parser would truncate ([17a5068](https://github.com/nodemailer/nodemailer/commit/17a5068f06e62fc04e1d5545ed70d4248bef258e))
+* **shared:** resolve hostnames when the runtime has no interface table ([8b03240](https://github.com/nodemailer/nodemailer/commit/8b032407135ea05ae377e623a7021705a4a139d0))
+* **smtp-connection:** clear the timers of a connection dropped before the greeting ([01dcaa0](https://github.com/nodemailer/nodemailer/commit/01dcaa05b212aafc33747041027fb8c66497e0eb))
+* **smtp-connection:** keep an incomplete server reply out of lastServerResponse ([1a6e427](https://github.com/nodemailer/nodemailer/commit/1a6e4271adb808509adf11832ad1adfdfc05c31b))
+* **smtp-pool:** free the pool slot when the proxy socket can not be opened ([204a344](https://github.com/nodemailer/nodemailer/commit/204a344f7e4068ff41385195ee394a223ebadd84))
+* **well-known:** keep nodemailer/lib/well-known/services.json available ([367730c](https://github.com/nodemailer/nodemailer/commit/367730cce85bc78c7804405c2cc7d89d93aafdd1))
+
+## [9.1.1](https://github.com/nodemailer/nodemailer/compare/v9.1.0...v9.1.1) (2026-09-01)
+
+
+### Bug Fixes
+
+* **mailer:** apply the message access policy in resolveContent ([dc48ed3](https://github.com/nodemailer/nodemailer/commit/dc48ed395c4d6c79ee5c95eb6eff17bafe391474))
+* **mailer:** keep message data from reopening the access sandbox ([ab7ef34](https://github.com/nodemailer/nodemailer/commit/ab7ef348b9a97b1fd70e7bfbeb56d4ea4a07946b))
+* **mime-node:** inherit the access policy from the tree a node hangs in ([262d550](https://github.com/nodemailer/nodemailer/commit/262d550b1e121e3ff4ef6675d6771a5b2b4ddcec))
+
 ## [9.1.0](https://github.com/nodemailer/nodemailer/compare/v9.0.6...v9.1.0) (2026-08-31)
 
 

package/README.md

@@ -10,15 +10,19 @@ See [nodemailer.com](https://nodemailer.com/) for documentation and terms.
 
 > Nodemailer is developed by the team behind **[EmailEngine](https://emailengine.app/?utm_source=nodemailer-readme&utm_medium=readme&utm_campaign=oss-docs)**, a self-hosted email API that turns any Gmail, Microsoft 365, or IMAP account into a REST endpoint, with managed OAuth2, webhooks for incoming mail, and built-in [sending](https://emailengine.app/sending-emails?utm_source=nodemailer-readme&utm_medium=readme&utm_campaign=oss-docs). If you would rather call an HTTP API than maintain IMAP and SMTP connections yourself, that is what it is for.
 
+## Supported runtimes
+
+Nodemailer targets Node.js 20 and later. The ES module build also runs on [Bun](https://bun.sh/) (tested against the latest release) and on [Cloudflare Workers](https://developers.cloudflare.com/workers/) with the `nodejs_compat` compatibility flag. On Workers only the SMTP based transports apply, `sendmail` needs a child process, and the runtime does not allow turning certificate validation off, so `tls.rejectUnauthorized: false` fails there with an error.
+
 ## Having an issue?
 
 #### First review the docs
 
 Documentation for Nodemailer can be found at [nodemailer.com](https://nodemailer.com/about/).
 
-#### Nodemailer throws a SyntaxError for "..."
+#### Nodemailer fails to load or throws a SyntaxError
 
-You are using an older Node.js version than v6.0. Upgrade Node.js to get support for the spread operator. Nodemailer supports all Node.js versions starting from Node.js@v6.0.0.
+Nodemailer 10 and later require Node.js 20 or newer. The package ships both ES module and CommonJS builds, so `import nodemailer from 'nodemailer'` and `const nodemailer = require('nodemailer')` both work. If you need to run on an older Node.js version, stay on the 9.x line.
 
 #### I'm having issues with Gmail
 
@@ -52,7 +56,7 @@ let configOptions = {
 
 #### I have issues with DNS / hosts file
 
-Node.js uses [c-ares](https://nodejs.org/en/docs/meta/topics/dependencies/#c-ares) to resolve domain names, not the DNS library provided by the system, so if you have some custom DNS routing set up, it might be ignored. Nodemailer runs [dns.resolve4()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnsresolve4hostname-options-callback) and [dns.resolve6()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnsresolve6hostname-options-callback) to resolve hostname into an IP address. If both calls fail, then Nodemailer will fall back to [dns.lookup()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnslookuphostname-options-callback). If this does not work for you, you can hard code the IP address into the configuration like shown below. In that case, Nodemailer would not perform any DNS lookups.
+Node.js uses [c-ares](https://github.com/c-ares/c-ares) to resolve domain names, not the DNS library provided by the system, so if you have some custom DNS routing set up, it might be ignored. Nodemailer runs [dns.resolve4()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnsresolve4hostname-options-callback) and [dns.resolve6()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnsresolve6hostname-options-callback) to resolve hostname into an IP address. If both calls fail, then Nodemailer will fall back to [dns.lookup()](https://nodejs.org/dist/latest-v16.x/docs/api/dns.html#dnslookuphostname-options-callback). If this does not work for you, you can hard code the IP address into the configuration like shown below. In that case, Nodemailer would not perform any DNS lookups.
 
 ```js
 let configOptions = {
@@ -68,7 +72,7 @@ let configOptions = {
 
 #### I have an issue with TypeScript types
 
-Nodemailer has official support for Node.js only. For anything related to TypeScript, you need to directly contact the authors of the [type definitions](https://www.npmjs.com/package/@types/nodemailer).
+Nodemailer 10 and later are written in TypeScript and ship their own type definitions, so `@types/nodemailer` is no longer needed and should be removed from your project to avoid conflicting declarations. The type names follow the layout of the old definitions, so references such as `Mail.Options`, `SMTPTransport.Options` or `Transporter<SMTPTransport.SentMessageInfo>` keep compiling, and the most used types (`SendMailOptions`, `Transporter`, `SentMessageInfo`, `Attachment`, `Address`) are exported from the package root. For older Nodemailer versions, the community maintained [type definitions](https://www.npmjs.com/package/@types/nodemailer) still apply.
 
 #### I have a different problem
 

package/SECURITY.md

@@ -6,13 +6,13 @@ reports seriously and aim to respond quickly.
 ## Supported Versions
 
 Security fixes are released only against the latest major version. We do not
-backport patches to older majors — upgrading to the current release line is the
-supported way to receive security updates.
+backport patches to older majors, so upgrading to the current release line is
+the supported way to receive security updates.
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 8.x     | :white_check_mark: |
-| < 8.0   | :x:                |
+| 10.x    | :white_check_mark: |
+| < 10.0  | :x:                |
 
 If you are on an older major, please upgrade. See the migration notes at
 <https://nodemailer.com/> before updating.
@@ -41,7 +41,7 @@ When reporting, please include as much of the following as you can:
 - Any suggested remediation, if you have one.
 
 Nodemailer is maintained by a single person, so there is no guaranteed response
-time — sometimes reports are handled within hours, sometimes they take longer.
+time: sometimes reports are handled within hours, sometimes they take longer.
 Accepted issues are fixed in a new release and coordinated through a GitHub
 Security Advisory, and reporters who wish to be named are credited.
 
@@ -49,12 +49,12 @@ Security Advisory, and reporters who wish to be named are credited.
 
 We track and disclose vulnerabilities through GitHub Security Advisories. We do
 not request or manage CVE identifiers ourselves. If you need a CVE assigned for a
-reported issue, please request one yourself — for example, through GitHub's own
+reported issue, please request one yourself, for example through GitHub's own
 CVE request flow on the published advisory, or another CNA.
 
 ## Scope
 
-In scope: the `nodemailer` package source in this repository — message and MIME
+In scope: the `nodemailer` package source in this repository: message and MIME
 generation, SMTP/LMTP client behaviour, address parsing, header handling, DKIM
 signing, and the bundled transports.
 

package/dist/cjs/addressparser/index.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Options for addressparser
+ */
+export interface AddressParserOptions {
+    /** Flatten groups into a single list of mailboxes */
+    flatten?: boolean;
+    /** Internal recursion depth counter (do not set manually) */
+    _depth?: number;
+}
+/**
+ * A single mailbox. Either value may be an empty string when the input did not carry it
+ */
+export interface MailboxAddress {
+    name: string;
+    address: string;
+    group?: undefined;
+}
+/**
+ * An address group. RFC 5322 does not allow nested groups, so any nesting is flattened
+ * into `group`
+ */
+export interface GroupAddress {
+    name: string;
+    group: Address[];
+    address?: undefined;
+}
+/**
+ * A parsed address entry, either a mailbox or a group
+ */
+export type Address = MailboxAddress | GroupAddress;
+/**
+ * Parses structured e-mail addresses from an address field
+ *
+ * Example:
+ *
+ *    'Name <address@domain>'
+ *
+ * will be converted to
+ *
+ *     [{name: 'Name', address: 'address@domain'}]
+ *
+ * @param str Address field
+ * @param options Optional options object
+ * @param options._depth Internal recursion depth counter (do not set manually)
+ * @return An array of address objects
+ */
+export default function addressparser(str?: string | null, options?: AddressParserOptions): Address[];