[dependabot]

Bumps postal-mime from 4.0.5 to 4.2.0.

Release notes

Sourced from postal-mime's releases.

v4.2.0

4.2.0 (2026-10-29)

Features

• parse the OTP-Token header into email.otp (740b3ab)

v4.1.4

4.1.4 (2026-10-22)

Bug Fixes

• end the header block at the first line that is neither a field nor a fold (0018555)
• honour only the utf-16 charset labels Python or iconv-lite decode (4d96a49)
• honour only the utf-16 charset labels that Python and iconv-lite both decode (afbe5a9)
• keep a base64 or quoted-printable message/rfc822 part as an attachment (0e0582e)
• percent encode a mailto address in runs instead of one character at a time (dd73f5c)
• percent encode the mailto address in the demo (7da508e)
• read a multipart whose boundary holds a non-ASCII character as text/plain (a7d4dad)
• read the transfer encoding token from the start of the value only (e66830a)
• reject a maxPartCount of zero as an invalid option (35bde9d)
• render the dates of forwarded headers with one shared formatter (ca27168)
• unfold format=flowed text in a text/plain part only (336378a)

v4.1.3

4.1.3 (2026-10-21)

Bug Fixes

• honour a byte order mark only under a utf-16 label that leaves the order open (db9a6ce)

v4.1.2

4.1.2 (2026-10-21)

Bug Fixes

• copy the characters of a structured header as runs instead of one at a time (f0edeee)

v4.1.1

4.1.1 (2026-10-21)

Bug Fixes

• decode a charset of the replacement encoding to the replacement character (0624f77)
• drop a script or style body holding any line terminator from the text of an html part (78e00e6)

... (truncated)

Changelog

Sourced from postal-mime's changelog.

4.2.0 (2026-10-29)

Features

• parse the OTP-Token header into email.otp (740b3ab)

4.1.4 (2026-10-22)

Bug Fixes

• end the header block at the first line that is neither a field nor a fold (0018555)
• honour only the utf-16 charset labels Python or iconv-lite decode (4d96a49)
• honour only the utf-16 charset labels that Python and iconv-lite both decode (afbe5a9)
• keep a base64 or quoted-printable message/rfc822 part as an attachment (0e0582e)
• percent encode a mailto address in runs instead of one character at a time (dd73f5c)
• percent encode the mailto address in the demo (7da508e)
• read a multipart whose boundary holds a non-ASCII character as text/plain (a7d4dad)
• read the transfer encoding token from the start of the value only (e66830a)
• reject a maxPartCount of zero as an invalid option (35bde9d)
• render the dates of forwarded headers with one shared formatter (ca27168)
• unfold format=flowed text in a text/plain part only (336378a)

4.1.3 (2026-10-21)

Bug Fixes

• honour a byte order mark only under a utf-16 label that leaves the order open (db9a6ce)

4.1.2 (2026-10-21)

Bug Fixes

• copy the characters of a structured header as runs instead of one at a time (f0edeee)

4.1.1 (2026-10-21)

Bug Fixes

• decode a charset of the replacement encoding to the replacement character (0624f77)
• drop a script or style body holding any line terminator from the text of an html part (78e00e6)
• keep the whitespace around a field name in its key (8b79d3e)
• let a byte order mark decide the byte order under a utf-16 label (0624f77)
• match a boundary line against the outermost open boundary first (a2083ec)
• match the Content-Transfer-Encoding token whole, so x-base64 decodes nothing (8b79d3e)
• never read a mailbox out of an encoded word (e06badb)

... (truncated)

Commits

• 939a220 chore(master): release 4.2.0 (#122)
• 740b3ab feat: parse the OTP-Token header into email.otp
• d96e201 chore(master): release 4.1.4 (#121)
• c93049e docs: note that whitespace before the colon keeps a line a header
• afbe5a9 fix: honour only the utf-16 charset labels that Python and iconv-lite both de...
• faf1be5 docs: state that maxPartCount must be positive
• a29b895 test: consolidate the header block and utf-16 label tests
• dd0c2ec refactor: drop the whitespace-only line bookkeeping the header block rule sub...
• 060083d refactor: resolve the utf-16 charset labels through one table of their own
• fa4bbf0 refactor: encode a mailto address with one replace over its unsafe runs
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.