build(deps): bump nodemailer from 8.0.1 to 9.0.6

[dependabot]

Bumps nodemailer from 8.0.1 to 9.0.6.

Release notes

Sourced from nodemailer's releases.

v9.0.6

9.0.6 (2026-08-27)

Bug Fixes

• addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
• harden copies of user supplied keys and URL fetching (2f667f4)

v9.0.5

9.0.5 (2026-08-07)

Bug Fixes

• ci: retrigger the workflows dropped during the Actions outage (85d16c1)
• mailer: escape specials in List-* header comments (#1842) (75913bb)
• mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
• mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
• mime: encode DEL in header parameters and List-* comments (cf69430)
• mime: keep control chars out of the remaining header positions (5ed9d26)
• mime: normalize an address parsed out of a string as well (63685f7)
• mime: normalize an address so header and envelope agree (a9343b4)
• mime: stop a header key callback and the dkim tags from injecting (b7d772e)

v9.0.4

9.0.4 (2026-08-04)

Bug Fixes

• mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
• mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)
• mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
• mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)
• mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)

v9.0.3

9.0.3 (2026-06-30)

Bug Fixes

• smtp-connection: harden STARTTLS upgrade and secure socket handling (#1835) (07d8253)

v9.0.2

9.0.2 (2026-06-29)

Bug Fixes

... (truncated)

Changelog

Sourced from nodemailer's changelog.

9.0.6 (2026-08-27)

Bug Fixes

• addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
• harden copies of user supplied keys and URL fetching (2f667f4)

9.0.5 (2026-08-07)

Bug Fixes

• ci: retrigger the workflows dropped during the Actions outage (85d16c1)
• mailer: escape specials in List-* header comments (#1842) (75913bb)
• mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
• mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
• mime: encode DEL in header parameters and List-* comments (cf69430)
• mime: keep control chars out of the remaining header positions (5ed9d26)
• mime: normalize an address parsed out of a string as well (63685f7)
• mime: normalize an address so header and envelope agree (a9343b4)
• mime: stop a header key callback and the dkim tags from injecting (b7d772e)

9.0.4 (2026-08-04)

Bug Fixes

• mime-funcs: do not let an unpaired surrogate consume the next character (9797f7f)
• mime-funcs: keep any surrogate pair intact when chunking base64 mime words (#1838) (5bd3a65)
• mime-funcs: percent encode unpaired surrogates in header parameter values (78f4aa2)
• mime-node: escape backslash and quote in the Content-Type name parameter (#1837) (adcfc4f)
• mime: encode HT/CR/LF in header parameter values instead of quoting them (#1840) (5bc9cab)

9.0.3 (2026-06-30)

Bug Fixes

• smtp-connection: harden STARTTLS upgrade and secure socket handling (#1835) (07d8253)

9.0.2 (2026-06-29)

Bug Fixes

• addressparser: keep operator chars inside an address-literal as text (#1829) (9ba1064)
• harden smtp-connection low-severity issues (22ddcea)
• harden smtp-connection response parsing and socket lifecycle (68860b9)
• prevent SES transport callback double-invocation and hang on sync errors (#1831) (9517bc5)

... (truncated)

Commits

• 4e467a8 chore(master): release 9.0.6 (#1844)
• e989a22 fix(addressparser): recover the addr-spec from an angle-addr holding whitespace
• 7237b91 chore(deps): update dev dependencies
• 34bc3d8 docs: reframe the EmailEngine README mentions
• 2f667f4 fix: harden copies of user supplied keys and URL fetching
• 742cff9 chore(master): release 9.0.5 (#1843)
• 524f0af chore: apply prettier to the punycode decode loop
• 63685f7 fix(mime): normalize an address parsed out of a string as well
• d899213 test: cover the custom envelope path of every transport
• c4daee0 chore(ci): trigger the workflows now that the Actions outage is over
• Additional commits viewable in compare view