build(deps): bump nodemailer from 9.0.3 to 9.0.5

[dependabot]

Bumps nodemailer from 9.0.3 to 9.0.5.

Release notes

Sourced from nodemailer's releases.

v9.0.5

9.0.5 (2026-08-07)

Bug Fixes

• ci: retrigger the workflows dropped during the Actions outage (85d16c1)
• mailer: escape specials in List-* header comments (#1842) (75913bb)
• mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
• mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
• mime: encode DEL in header parameters and List-* comments (cf69430)
• mime: keep control chars out of the remaining header positions (5ed9d26)
• mime: normalize an address parsed out of a string as well (63685f7)
• mime: normalize an address so header and envelope agree (a9343b4)
• mime: stop a header key callback and the dkim tags from injecting (b7d772e)

v9.0.4

9.0.4 (2026-08-04)

Bug Fixes

• mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
• mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)
• mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
• mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)
• mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)

Changelog

Sourced from nodemailer's changelog.

9.0.5 (2026-08-07)

Bug Fixes

• ci: retrigger the workflows dropped during the Actions outage (85d16c1)
• mailer: escape specials in List-* header comments (#1842) (75913bb)
• mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
• mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
• mime: encode DEL in header parameters and List-* comments (cf69430)
• mime: keep control chars out of the remaining header positions (5ed9d26)
• mime: normalize an address parsed out of a string as well (63685f7)
• mime: normalize an address so header and envelope agree (a9343b4)
• mime: stop a header key callback and the dkim tags from injecting (b7d772e)

9.0.4 (2026-08-04)

Bug Fixes

• mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
• mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)
• mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
• mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)
• mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)

Commits

• 742cff9 chore(master): release 9.0.5 (#1843)
• 524f0af chore: apply prettier to the punycode decode loop
• 63685f7 fix(mime): normalize an address parsed out of a string as well
• d899213 test: cover the custom envelope path of every transport
• c4daee0 chore(ci): trigger the workflows now that the Actions outage is over
• 85d16c1 fix(ci): retrigger the workflows dropped during the Actions outage
• 76d0d92 chore(deps): update devDependencies
• a9343b4 fix(mime): normalize an address so header and envelope agree
• b7d772e fix(mime): stop a header key callback and the dkim tags from injecting
• 5ed9d26 fix(mime): keep control chars out of the remaining header positions
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nodemailer@​9.0.3 ⏵ 9.0.5			+1

View full report