[dependabot]

Bumps nodemailer from 7.0.13 to 10.3.0.

Release notes

Sourced from nodemailer's releases.

v10.3.0

10.3.0 (2026-10-29)

Summary

This release adds support for the OTP-Token header from the IETF draft draft-goto-otp-token, which lets mail clients and browsers offer a one-time passcode for autofill on the site it belongs to. It also fixes how a Content-ID header is encoded.

Who should upgrade

• Anyone sending one-time passcodes by email who wants them to be machine-readable.
• Anyone already setting an OTP-Token header through headers: before this release it went out MIME encoded and could not be parsed.
• Anyone embedding images with a cid that holds a non-ASCII character or a quote.

Highlights

• New otp message option: otp: { code: '123456', origin: 'https://example.com' } adds OTP-Token: "123456"; origin="https://example.com". The origin is reduced to its canonical form, only https (or http on a loopback host) is accepted, and invalid values fail the send with the new EOTP error code. See Message configuration.
• A custom OTP-Token header is no longer MIME word encoded. Line breaks and control characters are still removed.
• OTP-Token is included in the DKIM signature by default.
• A Content-ID header, from an attachment cid or set through headers, is now encoded as a message id rather than as text, so a cid with a non-ASCII character or a quote keeps matching the cid: URL in the HTML.
• Groundmail added to the well-known services.

Features

• add the otp option for the OTP-Token header (7789e15)

Bug Fixes

• encode a Content-ID header as a message id (#1904) (47f2b25)

v10.2.1

10.2.1 (2026-10-22)

Bug Fixes

• drop the comments of a Content-Type or Content-Disposition value with the stripComments option (b3052b7)

v10.2.0

10.2.0 (2026-10-21)

Features

• add info.serverMessageId from the final 250 reply (108dddd)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.3.0 (2026-10-29)

Features

• add the otp option for the OTP-Token header (7789e15)

Bug Fixes

• encode a Content-ID header as a message id (#1904) (47f2b25)

10.2.1 (2026-10-22)

Bug Fixes

• drop the comments of a Content-Type or Content-Disposition value with the stripComments option (b3052b7)

10.2.0 (2026-10-21)

Features

• add info.serverMessageId from the final 250 reply (108dddd)
• add pendingCount() to the SMTP pool (6cffb70)
• make header value encoding public with MimeNode encodeHeaderValue() (3b048c7)
• mark SMTP errors as permanent or transient with err.permanent (6a20e2a)

Bug Fixes

• label an ASCII message/rfc822 attachment 7bit instead of 8bit (ad66fa1)
• report the recipients an LMTP server refuses after DATA in rejectedErrors (dd64eb3)

10.1.7 (2026-10-18)

Bug Fixes

• mime-funcs: encode parameter values that look like encoded words (651d79b)

10.1.6 (2026-10-18)

Bug Fixes

• addressparser: read groups in the same pass as the rest of the list (ddf0de1)

10.1.5 (2026-10-18)

... (truncated)

Commits

• 5de343d chore(master): release 10.3.0 (#1905)
• 7789e15 feat: add the otp option for the OTP-Token header
• 47f2b25 fix: encode a Content-ID header as a message id (#1904)
• a6e7a70 chore(services): add Groundmail (#1903)
• a0cea19 chore(deps): update development dependencies [skip ci]
• 568fdd4 chore(deps): update development dependencies [skip ci]
• 8dd0aac chore(deps): update development dependencies [skip ci]
• 8dbff1d Merge pull request #1902 from nodemailer/release-please--branches--master--co...
• 6fe37ea test: import mailauth only on a Node.js it supports
• 9f02395 chore(master): release 10.2.1
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5a30f0a0-7d03-46af-ab72-2d3bcbf6dc6b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn