build(deps): bump nodemailer from 9.0.6 to 10.0.3

[dependabot]

Bumps nodemailer from 9.0.6 to 10.0.3.

Release notes

Sourced from nodemailer's releases.

v10.0.3

10.0.3 (2026-09-10)

Bug Fixes

• fetch: honor the cookie Domain attribute without accepting public suffixes (1608391), closes #1856

v10.0.2

10.0.2 (2026-09-09)

Bug Fixes

• mime-node: flatten nested recipient arrays without recursion (ebe0849)
• shared: keep the TLS server name out of the DNS cache (a6512db)

v10.0.1

10.0.1 (2026-09-07)

Bug Fixes

• types: accept an explicit undefined for optional properties (209719d), closes #1853
• types: drop the internal members from the published declarations (81e64ea)

v10.0.0

10.0.0 (2026-09-03)

⚠ BREAKING CHANGES

• Node.js 20 or newer is required. The Node.js 6 syntax compatibility check and the .npmignore file are gone.

Features

• keep the @​types/nodemailer type layout working (1cc5356)
• migrate to TypeScript with ES module and CommonJS builds (f7cbf83)

Bug Fixes

• apply the other keys of a configuration object next to its url (29610f9)
• dkim: canonicalize raw messages the way verifiers do (2c84b11)
• keep a transporter assignable to the plain Transporter type (8bf55fb)
• shared: keep a colon in the user name of a connection or proxy url (6acf4b6)
• shared: refuse URL hosts the legacy parser would truncate (17a5068)
• shared: resolve hostnames when the runtime has no interface table (8b03240)
• smtp-connection: clear the timers of a connection dropped before the greeting (01dcaa0)
• smtp-connection: keep an incomplete server reply out of lastServerResponse (1a6e427)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.0.3 (2026-09-10)

Bug Fixes

• fetch: honor the cookie Domain attribute without accepting public suffixes (1608391), closes #1856

10.0.2 (2026-09-09)

Bug Fixes

• mime-node: flatten nested recipient arrays without recursion (ebe0849)
• shared: keep the TLS server name out of the DNS cache (a6512db)

10.0.1 (2026-09-07)

Bug Fixes

• types: accept an explicit undefined for optional properties (209719d), closes #1853
• types: drop the internal members from the published declarations (81e64ea)

10.0.0 (2026-09-03)

⚠ BREAKING CHANGES

• Node.js 20 or newer is required. The Node.js 6 syntax compatibility check and the .npmignore file are gone.

Features

• keep the @​types/nodemailer type layout working (1cc5356)
• migrate to TypeScript with ES module and CommonJS builds (f7cbf83)

Bug Fixes

• apply the other keys of a configuration object next to its url (29610f9)
• dkim: canonicalize raw messages the way verifiers do (2c84b11)
• keep a transporter assignable to the plain Transporter type (8bf55fb)
• shared: keep a colon in the user name of a connection or proxy url (6acf4b6)
• shared: refuse URL hosts the legacy parser would truncate (17a5068)
• shared: resolve hostnames when the runtime has no interface table (8b03240)
• smtp-connection: clear the timers of a connection dropped before the greeting (01dcaa0)
• smtp-connection: keep an incomplete server reply out of lastServerResponse (1a6e427)
• smtp-pool: free the pool slot when the proxy socket can not be opened (204a344)
• well-known: keep nodemailer/lib/well-known/services.json available (367730c)

9.1.1 (2026-09-01)

... (truncated)

Commits

• cae865b chore(master): release 10.0.3 (#1857)
• 1608391 fix(fetch): honor the cookie Domain attribute without accepting public suffixes
• 0195799 chore(master): release 10.0.2 (#1855)
• d456fd6 test: resolve the TLS server name test host without a resolver stub
• ebe0849 fix(mime-node): flatten nested recipient arrays without recursion
• a6512db fix(shared): keep the TLS server name out of the DNS cache
• 40d5221 chore(master): release 10.0.1 (#1854)
• 81e64ea fix(types): drop the internal members from the published declarations
• c5dba6e chore: turn on exactOptionalPropertyTypes for the type-check
• 209719d fix(types): accept an explicit undefined for optional properties
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

[dependabot]

Superseded by #1619.