build(deps): bump nodemailer from 9.1.1 to 10.0.0

[dependabot]

Bumps nodemailer from 9.1.1 to 10.0.0.

Release notes

Sourced from nodemailer's releases.

v10.0.0

10.0.0 (2026-09-03)

⚠ BREAKING CHANGES

• Node.js 20 or newer is required. The Node.js 6 syntax compatibility check and the .npmignore file are gone.

Features

• keep the @​types/nodemailer type layout working (1cc5356)
• migrate to TypeScript with ES module and CommonJS builds (f7cbf83)

Bug Fixes

• apply the other keys of a configuration object next to its url (29610f9)
• dkim: canonicalize raw messages the way verifiers do (2c84b11)
• keep a transporter assignable to the plain Transporter type (8bf55fb)
• shared: keep a colon in the user name of a connection or proxy url (6acf4b6)
• shared: refuse URL hosts the legacy parser would truncate (17a5068)
• shared: resolve hostnames when the runtime has no interface table (8b03240)
• smtp-connection: clear the timers of a connection dropped before the greeting (01dcaa0)
• smtp-connection: keep an incomplete server reply out of lastServerResponse (1a6e427)
• smtp-pool: free the pool slot when the proxy socket can not be opened (204a344)
• well-known: keep nodemailer/lib/well-known/services.json available (367730c)

Changelog

Sourced from nodemailer's changelog.

10.0.0 (2026-09-03)

⚠ BREAKING CHANGES

• Node.js 20 or newer is required. The Node.js 6 syntax compatibility check and the .npmignore file are gone.

Features

• keep the @​types/nodemailer type layout working (1cc5356)
• migrate to TypeScript with ES module and CommonJS builds (f7cbf83)

Bug Fixes

• apply the other keys of a configuration object next to its url (29610f9)
• dkim: canonicalize raw messages the way verifiers do (2c84b11)
• keep a transporter assignable to the plain Transporter type (8bf55fb)
• shared: keep a colon in the user name of a connection or proxy url (6acf4b6)
• shared: refuse URL hosts the legacy parser would truncate (17a5068)
• shared: resolve hostnames when the runtime has no interface table (8b03240)
• smtp-connection: clear the timers of a connection dropped before the greeting (01dcaa0)
• smtp-connection: keep an incomplete server reply out of lastServerResponse (1a6e427)
• smtp-pool: free the pool slot when the proxy socket can not be opened (204a344)
• well-known: keep nodemailer/lib/well-known/services.json available (367730c)

Commits

• 2ee030c chore(master): release 10.0.0 (#1852)
• 8bf55fb fix: keep a transporter assignable to the plain Transporter type
• 62202a8 docs: mark 10.x as the supported security line
• d9316d1 refactor(punycode): write the RFC 3490 separators as escape sequences
• d1d3fb5 test(dkim): cover the signing failure path
• 1a6e427 fix(smtp-connection): keep an incomplete server reply out of lastServerResponse
• 70b2197 test(dkim): skip the mailauth verification where mailauth does not load
• 7c1ca6d test: cover the mailer, the transports and the utility modules
• 29610f9 fix: apply the other keys of a configuration object next to its url
• 6acf4b6 fix(shared): keep a colon in the user name of a connection or proxy url
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

[dependabot]

Superseded by #4078.