[dependabot]

Bumps the npm_and_yarn group with 1 update in the /examples/apps/email directory: nodemailer.
Bumps the npm_and_yarn group with 1 update in the /examples/apps/email/fixtures/sdk9-consumer directory: nodemailer.

Updates nodemailer from 10.0.10 to 10.1.4

Release notes

Sourced from nodemailer's releases.

v10.1.4

10.1.4 (2026-10-18)

Bug Fixes

• addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)
• addressparser: bound group nesting at ten levels (ce63303)
• addressparser: drop the obsolete route from an angle-addr (3dbc730)
• addressparser: end a comment only at the ")" that closes the outermost one (0a87617)
• addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)
• addressparser: never read a mailbox out of a comment (a1538ea)
• addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)
• addressparser: read the first addr-spec of the display text (038940a)
• split a domain literal off at the "@" in front of it (d5983b0)

v10.1.3

10.1.3 (2026-10-18)

Bug Fixes

• format References and strip URLs in linear time, release any number of streams (2f18641)

v10.1.2

10.1.2 (2026-10-16)

Bug Fixes

• bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint (e347fa2)

v10.1.1

10.1.1 (2026-10-14)

Bug Fixes

• fetch: strip credentials on any cross-origin redirect (a15360c)

v10.1.0

10.1.0 (2026-10-10)

Behaviour changes

• Pooled connections are closed after 4 minutes without a message (new idleTimeout pool option, set it to 0 to keep them open). A message whose recipients are rejected no longer closes the pooled connection, it is reset with RSET and reused, and a message is requeued when the server dropped a reused connection before any of it was sent.
• connectionTimeout covers setting the session up as a whole: the DNS lookup, a proxy handshake, the TCP connection, TLS, the greeting and a STARTTLS upgrade. greetingTimeout still bounds the greeting and the STARTTLS handshake within it.
• Any 421 reply ends the SMTP session. When the server closes an idle connection, SMTPConnection emits only end, not an ECONNECTION error.
• A content stream that was already read or destroyed fails the message with ESTREAM instead of producing an empty attachment. Content streams of a message that fails are destroyed.
• With opportunisticTLS, authentication is skipped on the unencrypted connection after a failed STARTTLS, unless forceAuth is set.

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.1.4 (2026-10-18)

Bug Fixes

• addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)
• addressparser: bound group nesting at ten levels (ce63303)
• addressparser: drop the obsolete route from an angle-addr (3dbc730)
• addressparser: end a comment only at the ")" that closes the outermost one (0a87617)
• addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)
• addressparser: never read a mailbox out of a comment (a1538ea)
• addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)
• addressparser: read the first addr-spec of the display text (038940a)
• split a domain literal off at the "@" in front of it (d5983b0)

10.1.3 (2026-10-18)

Bug Fixes

• format References and strip URLs in linear time, release any number of streams (2f18641)

10.1.2 (2026-10-16)

Bug Fixes

• bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint (e347fa2)

10.1.1 (2026-10-14)

Bug Fixes

• fetch: strip credentials on any cross-origin redirect (a15360c)

10.1.0 (2026-10-10)

Features

• harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

• do not read the environment or the interface table on import (094179d)
• end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)
• keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)
• let the proxy handshake and the SMTP connection share one deadline (91ed683)

... (truncated)

Commits

• 2a7e952 chore(master): release 10.1.4 (#1897)
• 038940a fix(addressparser): read the first addr-spec of the display text
• ce63303 fix(addressparser): bound group nesting at ten levels
• a1538ea fix(addressparser): never read a mailbox out of a comment
• 3dbc730 fix(addressparser): drop the obsolete route from an angle-addr
• ba3c095 fix(addressparser): read CFWS beside the "@" of an addr-spec as nothing
• d5983b0 fix: split a domain literal off at the "@" in front of it
• ee35f57 fix(addressparser): apply the unexpected "<" rule outside quotes and comments
• 0a87617 fix(addressparser): end a comment only at the ")" that closes the outermost one
• 1cd57d2 fix(addressparser): honour quoted strings and comments inside an angle-addr a...
• Additional commits viewable in compare view

Updates nodemailer from 10.0.10 to 10.1.4

Release notes

Sourced from nodemailer's releases.

v10.1.4

10.1.4 (2026-10-18)

Bug Fixes

• addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)
• addressparser: bound group nesting at ten levels (ce63303)
• addressparser: drop the obsolete route from an angle-addr (3dbc730)
• addressparser: end a comment only at the ")" that closes the outermost one (0a87617)
• addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)
• addressparser: never read a mailbox out of a comment (a1538ea)
• addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)
• addressparser: read the first addr-spec of the display text (038940a)
• split a domain literal off at the "@" in front of it (d5983b0)

v10.1.3

10.1.3 (2026-10-18)

Bug Fixes

• format References and strip URLs in linear time, release any number of streams (2f18641)

v10.1.2

10.1.2 (2026-10-16)

Bug Fixes

• bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint (e347fa2)

v10.1.1

10.1.1 (2026-10-14)

Bug Fixes

• fetch: strip credentials on any cross-origin redirect (a15360c)

v10.1.0

10.1.0 (2026-10-10)

Behaviour changes

• Pooled connections are closed after 4 minutes without a message (new idleTimeout pool option, set it to 0 to keep them open). A message whose recipients are rejected no longer closes the pooled connection, it is reset with RSET and reused, and a message is requeued when the server dropped a reused connection before any of it was sent.
• connectionTimeout covers setting the session up as a whole: the DNS lookup, a proxy handshake, the TCP connection, TLS, the greeting and a STARTTLS upgrade. greetingTimeout still bounds the greeting and the STARTTLS handshake within it.
• Any 421 reply ends the SMTP session. When the server closes an idle connection, SMTPConnection emits only end, not an ECONNECTION error.
• A content stream that was already read or destroyed fails the message with ESTREAM instead of producing an empty attachment. Content streams of a message that fails are destroyed.
• With opportunisticTLS, authentication is skipped on the unencrypted connection after a failed STARTTLS, unless forceAuth is set.

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.1.4 (2026-10-18)

Bug Fixes

• addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)
• addressparser: bound group nesting at ten levels (ce63303)
• addressparser: drop the obsolete route from an angle-addr (3dbc730)
• addressparser: end a comment only at the ")" that closes the outermost one (0a87617)
• addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)
• addressparser: never read a mailbox out of a comment (a1538ea)
• addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)
• addressparser: read the first addr-spec of the display text (038940a)
• split a domain literal off at the "@" in front of it (d5983b0)

10.1.3 (2026-10-18)

Bug Fixes

• format References and strip URLs in linear time, release any number of streams (2f18641)

10.1.2 (2026-10-16)

Bug Fixes

• bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint (e347fa2)

10.1.1 (2026-10-14)

Bug Fixes

• fetch: strip credentials on any cross-origin redirect (a15360c)

10.1.0 (2026-10-10)

Features

• harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

• do not read the environment or the interface table on import (094179d)
• end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)
• keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)
• let the proxy handshake and the SMTP connection share one deadline (91ed683)

... (truncated)

Commits

• 2a7e952 chore(master): release 10.1.4 (#1897)
• 038940a fix(addressparser): read the first addr-spec of the display text
• ce63303 fix(addressparser): bound group nesting at ten levels
• a1538ea fix(addressparser): never read a mailbox out of a comment
• 3dbc730 fix(addressparser): drop the obsolete route from an angle-addr
• ba3c095 fix(addressparser): read CFWS beside the "@" of an addr-spec as nothing
• d5983b0 fix: split a domain literal off at the "@" in front of it
• ee35f57 fix(addressparser): apply the unexpected "<" rule outside quotes and comments
• 0a87617 fix(addressparser): end a comment only at the ")" that closes the outermost one
• 1cd57d2 fix(addressparser): honour quoted strings and comments inside an angle-addr a...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.