build(deps): bump nodemailer from 7.0.13 to 10.0.9

[dependabot]

Bumps nodemailer from 7.0.13 to 10.0.9.

Release notes

Sourced from nodemailer's releases.

v10.0.9

10.0.9 (2026-09-12)

Bug Fixes

• addressparser: bound the '@' probe to the run being scanned (1465c3f)
• addressparser: keep the text after a comment out of a quoted local part address (2f36eb1)

v10.0.8

10.0.8 (2026-09-11)

Bug Fixes

• mime-node: clean the boundary where it is written, not only where it is built (e14278d)
• mime-node: drop every control character from multipart boundary material (a82a355)

v10.0.7

10.0.7 (2026-09-11)

Bug Fixes

• mime-funcs: do not double encode Buffer input when chunking base64 mime words (#1865) (4327a59)
• mime-node: keep a boundary that is only line breaks from stripping to empty (ec46800)
• mime-node: strip line breaks from multipart boundary material (#1867) (03c1a5c)
• smtp-pool: release rate-limited connections on close (#1866) (7f5c7a4)

v10.0.6

10.0.6 (2026-09-11)

Bug Fixes

• addressparser: scan free text for an address in linear time (437d7fc)

v10.0.5

10.0.5 (2026-09-11)

Bug Fixes

• addressparser: parse comment-joined addresses in linear time (c07f175)

v10.0.4

10.0.4 (2026-09-11)

Bug Fixes

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.0.9 (2026-09-12)

Bug Fixes

• addressparser: bound the '@' probe to the run being scanned (1465c3f)
• addressparser: keep the text after a comment out of a quoted local part address (2f36eb1)

10.0.8 (2026-09-11)

Bug Fixes

• mime-node: clean the boundary where it is written, not only where it is built (e14278d)
• mime-node: drop every control character from multipart boundary material (a82a355)

10.0.7 (2026-09-11)

Bug Fixes

• mime-funcs: do not double encode Buffer input when chunking base64 mime words (#1865) (4327a59)
• mime-node: keep a boundary that is only line breaks from stripping to empty (ec46800)
• mime-node: strip line breaks from multipart boundary material (#1867) (03c1a5c)
• smtp-pool: release rate-limited connections on close (#1866) (7f5c7a4)

10.0.6 (2026-09-11)

Bug Fixes

• addressparser: scan free text for an address in linear time (437d7fc)

10.0.5 (2026-09-11)

Bug Fixes

• addressparser: parse comment-joined addresses in linear time (c07f175)

10.0.4 (2026-09-11)

Bug Fixes

• fetch: scope a cookie without a Path to the RFC 6265 default path (2f907cb)
• fetch: send cookies set with Path back to the exact path (#1861) (d557113)
• mail-composer: keep httpHeaders and tls for href alternatives and icalEvent (#1862) (7f502be)
• resolve well-known services by their primary domains (#1859) (085f525)
• ses-transport: throw a configuration error when the SES client is missing (#1863) (4d9c4c9)

... (truncated)

Commits

• 5a35d59 chore(master): release 10.0.9 (#1871)
• 2f36eb1 fix(addressparser): keep the text after a comment out of a quoted local part ...
• 1465c3f fix(addressparser): bound the '@' probe to the run being scanned
• 1732dc4 chore(deps): update dev dependencies
• ec7eda6 chore(deps): update dev dependencies
• 618f912 chore(master): release 10.0.8 (#1870)
• e14278d fix(mime-node): clean the boundary where it is written, not only where it is ...
• a82a355 fix(mime-node): drop every control character from multipart boundary material
• 29166ff chore(master): release 10.0.7 (#1869)
• ec46800 fix(mime-node): keep a boundary that is only line breaks from stripping to empty
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by CodeRabbit

• Chores
  • Updated the email delivery component to a newer version. This is a behind-the-scenes maintenance change; no new user-facing features are included in this update. The change does not describe any updates to the app’s visible interface or user workflows.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: d4a8bbab-ca29-422a-8b29-d699d1f54e48

📥 Commits

Reviewing files that changed from the base of the PR and between 1c0878e and 496a772.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The package manifest updates the Nodemailer dependency range from ^7.0.13 to ^10.0.9.

Changes

Nodemailer dependency update

Layer / File(s)	Summary
Update Nodemailer version range package.json	The required Nodemailer version range changes from ^7.0.13 to ^10.0.9.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Suggested reviewers: japsu

Architecture Summary

Architecture risk: 🔵 Low · up to 496a7

The change affects 1 system.

Changed systems: package.json

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — package.json (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in package.json: Updated the nodemailer dependency range from ^7.0.13 to ^10.0.9.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the dependency update from nodemailer 7.0.13 to 10.0.9.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

_{Comment @coderabbitai help to get the list of available commands.}