chore(deps-dev): bump nodemailer from 8.0.11 to 9.0.3

[dependabot]

Bumps nodemailer from 8.0.11 to 9.0.3.

Release notes

Sourced from nodemailer's releases.

v9.0.3

9.0.3 (2026-06-30)

Bug Fixes

• smtp-connection: harden STARTTLS upgrade and secure socket handling (#1835) (07d8253)

v9.0.2

9.0.2 (2026-06-29)

Bug Fixes

• addressparser: keep operator chars inside an address-literal as text (#1829) (9ba1064)
• harden smtp-connection low-severity issues (22ddcea)
• harden smtp-connection response parsing and socket lifecycle (68860b9)
• prevent SES transport callback double-invocation and hang on sync errors (#1831) (9517bc5)
• reject CRLF in HTTP proxy CONNECT destination to prevent request injection (6347b47)

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

• enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

• HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

• replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)
• validate TLS certificates by default when fetching remote content (6a947ac)

Changelog

Sourced from nodemailer's changelog.

9.0.3 (2026-06-30)

Bug Fixes

• smtp-connection: harden STARTTLS upgrade and secure socket handling (#1835) (07d8253)

9.0.2 (2026-06-29)

Bug Fixes

• addressparser: keep operator chars inside an address-literal as text (#1829) (9ba1064)
• harden smtp-connection low-severity issues (22ddcea)
• harden smtp-connection response parsing and socket lifecycle (68860b9)
• prevent SES transport callback double-invocation and hang on sync errors (#1831) (9517bc5)
• reject CRLF in HTTP proxy CONNECT destination to prevent request injection (6347b47)

9.0.1 (2026-06-17)

Bug Fixes

• enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

• HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

• replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)
• validate TLS certificates by default when fetching remote content (6a947ac)

Commits

• 1f61eb4 chore(master): release 9.0.3 (#1836)
• 07d8253 fix(smtp-connection): harden STARTTLS upgrade and secure socket handling (#1835)
• 4801f3a chore(master): release 9.0.2 (#1832)
• 9ba1064 fix(addressparser): keep operator chars inside an address-literal as text (#1...
• 22ddcea fix: harden smtp-connection low-severity issues
• af002eb chore: add Node.js 26 to the CI test matrix
• 6347b47 fix: reject CRLF in HTTP proxy CONNECT destination to prevent request injection
• 68860b9 fix: harden smtp-connection response parsing and socket lifecycle
• 9517bc5 fix: prevent SES transport callback double-invocation and hang on sync errors...
• 69cf625 chore(master): release 9.0.1 (#1828)
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
moddermore	Ready	Preview	Jul 9, 2026 6:38pm