Skip to content

Bump nodemailer and webgme - #116

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-fe15f7164b
Open

Bump nodemailer and webgme#116
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/multi-fe15f7164b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026

Copy link
Copy Markdown
Contributor

Bumps nodemailer and webgme. These dependencies needed to be updated together.
Updates nodemailer from 8.0.11 to 9.0.5

Release notes

Sourced from nodemailer's releases.

v9.0.5

9.0.5 (2026-08-07)

Bug Fixes

  • ci: retrigger the workflows dropped during the Actions outage (85d16c1)
  • mailer: escape specials in List-* header comments (#1842) (75913bb)
  • mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
  • mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
  • mime: encode DEL in header parameters and List-* comments (cf69430)
  • mime: keep control chars out of the remaining header positions (5ed9d26)
  • mime: normalize an address parsed out of a string as well (63685f7)
  • mime: normalize an address so header and envelope agree (a9343b4)
  • mime: stop a header key callback and the dkim tags from injecting (b7d772e)

v9.0.4

9.0.4 (2026-08-04)

Bug Fixes

  • mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
  • mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)
  • mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
  • mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)
  • mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)

v9.0.3

9.0.3 (2026-06-30)

Bug Fixes

  • smtp-connection: harden STARTTLS upgrade and secure socket handling (#1835) (07d8253)

v9.0.2

9.0.2 (2026-06-29)

Bug Fixes

  • addressparser: keep operator chars inside an address-literal as text (#1829) (9ba1064)
  • harden smtp-connection low-severity issues (22ddcea)
  • harden smtp-connection response parsing and socket lifecycle (68860b9)
  • prevent SES transport callback double-invocation and hang on sync errors (#1831) (9517bc5)
  • reject CRLF in HTTP proxy CONNECT destination to prevent request injection (6347b47)

v9.0.1

9.0.1 (2026-06-17)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

9.0.5 (2026-08-07)

Bug Fixes

  • ci: retrigger the workflows dropped during the Actions outage (85d16c1)
  • mailer: escape specials in List-* header comments (#1842) (75913bb)
  • mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
  • mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
  • mime: encode DEL in header parameters and List-* comments (cf69430)
  • mime: keep control chars out of the remaining header positions (5ed9d26)
  • mime: normalize an address parsed out of a string as well (63685f7)
  • mime: normalize an address so header and envelope agree (a9343b4)
  • mime: stop a header key callback and the dkim tags from injecting (b7d772e)

9.0.4 (2026-08-04)

Bug Fixes

  • mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
  • mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)
  • mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
  • mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)
  • mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)

9.0.3 (2026-06-30)

Bug Fixes

  • smtp-connection: harden STARTTLS upgrade and secure socket handling (#1835) (07d8253)

9.0.2 (2026-06-29)

Bug Fixes

  • addressparser: keep operator chars inside an address-literal as text (#1829) (9ba1064)
  • harden smtp-connection low-severity issues (22ddcea)
  • harden smtp-connection response parsing and socket lifecycle (68860b9)
  • prevent SES transport callback double-invocation and hang on sync errors (#1831) (9517bc5)
  • reject CRLF in HTTP proxy CONNECT destination to prevent request injection (6347b47)

9.0.1 (2026-06-17)

Bug Fixes

  • enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

... (truncated)

Commits
  • 742cff9 chore(master): release 9.0.5 (#1843)
  • 524f0af chore: apply prettier to the punycode decode loop
  • 63685f7 fix(mime): normalize an address parsed out of a string as well
  • d899213 test: cover the custom envelope path of every transport
  • c4daee0 chore(ci): trigger the workflows now that the Actions outage is over
  • 85d16c1 fix(ci): retrigger the workflows dropped during the Actions outage
  • 76d0d92 chore(deps): update devDependencies
  • a9343b4 fix(mime): normalize an address so header and envelope agree
  • b7d772e fix(mime): stop a header key callback and the dkim tags from injecting
  • 5ed9d26 fix(mime): keep control chars out of the remaining header positions
  • Additional commits viewable in compare view

Updates webgme from 2.49.0 to 2.50.0

Release notes

Sourced from webgme's releases.

v2.50.0

What's Changed

Full Changelog: webgme/webgme@v2.49.0...v2.50.0

Commits
  • b77a74b Release 2.50.0
  • 579e8c2 Bump engine to 2.32.0 and set chai and mocha to latest (#1817)
  • b5c2319 Change webgme-engine dependency to GitHub source
  • 2866bc1 Add project info UI for kind and metadata editing. (#1815)
  • 8334ff9 Add history export/import UI and harmonize export menus. (#1816)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [nodemailer](https://github.com/nodemailer/nodemailer) and [webgme](https://github.com/webgme/webgme). These dependencies needed to be updated together.

Updates `nodemailer` from 8.0.11 to 9.0.5
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v8.0.11...v9.0.5)

Updates `webgme` from 2.49.0 to 2.50.0
- [Release notes](https://github.com/webgme/webgme/releases)
- [Changelog](https://github.com/webgme/webgme/blob/main/CHANGELOG.md)
- [Commits](webgme/webgme@v2.49.0...v2.50.0)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 9.0.5
  dependency-type: indirect
- dependency-name: webgme
  dependency-version: 2.50.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants