Skip to content

build(deps): bump nodemailer from 10.2.1 to 10.3.1 - #4244

Merged
github-actions[bot] merged 1 commit into
masterfrom
dependabot/npm_and_yarn/nodemailer-10.3.1
Nov 2, 2026
Merged

github-actions[bot] merged 1 commit into
masterfrom
dependabot/npm_and_yarn/nodemailer-10.3.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps nodemailer from 10.2.1 to 10.3.1.

Release notes

Sourced from nodemailer's releases.

v10.3.1

10.3.1 (2026-10-29)

Bug Fixes

  • apply the otp option in MailComposer too (1d4087f)

v10.3.0

10.3.0 (2026-10-29)

Summary

This release adds support for the OTP-Token header from the IETF draft draft-goto-otp-token, which lets mail clients and browsers offer a one-time passcode for autofill on the site it belongs to. It also fixes how a Content-ID header is encoded.

Who should upgrade

  • Anyone sending one-time passcodes by email who wants them to be machine-readable.
  • Anyone already setting an OTP-Token header through headers: before this release it went out MIME encoded and could not be parsed.
  • Anyone embedding images with a cid that holds a non-ASCII character or a quote.

Highlights

  • New otp message option: otp: { code: '123456', origin: 'https://example.com' } adds OTP-Token: "123456"; origin="https://example.com". The origin is reduced to its canonical form, only https (or http on a loopback host) is accepted, and invalid values fail the send with the new EOTP error code. See Message configuration.
  • A custom OTP-Token header is no longer MIME word encoded. Line breaks and control characters are still removed.
  • OTP-Token is included in the DKIM signature by default.
  • A Content-ID header, from an attachment cid or set through headers, is now encoded as a message id rather than as text, so a cid with a non-ASCII character or a quote keeps matching the cid: URL in the HTML.
  • Groundmail added to the well-known services.

Features

  • add the otp option for the OTP-Token header (7789e15)

Bug Fixes

  • encode a Content-ID header as a message id (#1904) (47f2b25)
Changelog

Sourced from nodemailer's changelog.

10.3.1 (2026-10-29)

Bug Fixes

  • apply the otp option in MailComposer too (1d4087f)

10.3.0 (2026-10-29)

Features

  • add the otp option for the OTP-Token header (7789e15)

Bug Fixes

  • encode a Content-ID header as a message id (#1904) (47f2b25)
Commits
  • 26555d0 Merge pull request #1906 from nodemailer/release-please--branches--master--co...
  • 3e5bb55 chore(master): release 10.3.1
  • 1d4087f fix: apply the otp option in MailComposer too
  • 488ce9c chore(deps): update development dependencies
  • 41eda65 chore(deps): update development dependencies
  • 5de343d chore(master): release 10.3.0 (#1905)
  • 7789e15 feat: add the otp option for the OTP-Token header
  • 47f2b25 fix: encode a Content-ID header as a message id (#1904)
  • a6e7a70 chore(services): add Groundmail (#1903)
  • a0cea19 chore(deps): update development dependencies [skip ci]
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 10.2.1 to 10.3.1.
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v10.2.1...v10.3.1)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 10.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 2, 2026
@coderabbitai

coderabbitai Bot commented Nov 2, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@github-actions
github-actions Bot enabled auto-merge (squash) November 2, 2026 04:03
@github-actions
github-actions Bot merged commit cd81dbb into master Nov 2, 2026
6 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/nodemailer-10.3.1 branch November 2, 2026 04:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants