build(deps): update phpmailer/phpmailer requirement from 7.0.2 to 7.1.0

[dependabot]

Updates the requirements on phpmailer/phpmailer to permit the latest version.

Release notes

Sourced from phpmailer/phpmailer's releases.

PHPMailer 7.1.0

This is a maintenance and minor security release.

What's changed

• Validate MessageDate before including it in headers.
• Minor feature: some common non-RFC date formats and DateTime instances are now automatically converted to the right format for MessageDate.
• Strip breaks from XMailer, ContentType, and CharSet properties.
• Strip breaks from username and password properties before use in POP3.
• Enforce strict checks on Encoding values.
• Ease BC IMAP issues by allowing the parseAddresses $useimap parameter to be false or null without triggering a deprecation warning.
• Updated Turkish and Norwegian translations.
• Test case cleanup and improvements by @​jrfnl.
• Fix crash if Mailer ended up empty.
• Use Ubuntu 24.04 for tests.

Security changes

We received several duplicate reports of the same issue, buried deep in reams of AI slop. Specifically, several PHPMailer properties and two POP3 properties were not sanitised before use. These properties are typically only set by developers, not exposed to user input, and would also have to be mishandled by host applications to become a problem. Nevertheless, these properties have now been rendered harmless.

New Contributors

• @​Musty-26 made their first contribution in PHPMailer/PHPMailer#3303
• @​ClearanceClarence made their first contribution in PHPMailer/PHPMailer#3306
• @​cri2net made their first contribution in PHPMailer/PHPMailer#3307
• @​jsoref made their first contribution in PHPMailer/PHPMailer#3315
• @​masskrdjn made their first contribution in PHPMailer/PHPMailer#3328

Full Changelog: PHPMailer/PHPMailer@v7.0.2...v7.1.0

Changelog

Sourced from phpmailer/phpmailer's changelog.

Version 7.1.0 (May 15th, 2026)

• Validate MessageDate before including it in headers.
• Minor feature: some common non-RFC date formats and DateTime instances are now automatically converted to the right format for MessageDate.
• Strip breaks from XMailer, ContentType, and CharSet properties.
• Strip breaks from username and password properties before use in POP3.
• Enforce strict checks on Encoding values.
• Ease BC IMAP issues by allowing the parseAddresses $useimap parameter to be false or null without triggering a deprecation warning.
• Updated Turkish and Norwegian translations.
• Test case cleanup and improvements by @​jrfnl.
• Fix crash if Mailer ended up empty.
• Use Ubuntu 24.04 for tests.

Version 7.0.2 (January 9th, 2026)

• Fixes for sendmail parameter problems in WordPress, thanks to @​SirLouen.
• Reduce memory consumption when sending large attachments by @​RobinvanderVliet.

Version 7.0.1 (November 25th, 2025)

• Use From domain when generating CIDs in msgHTML.
• Update to PHPCompatibility 10, resolve numerous PHPCS issues in PHP 8.5.
• Revise GitHub actions for PHP 8.5 and experimental 8.6 tests.
• Switch gmail example from the deprecated IMAP extension to use directorytree/imapengine for IMAP uploads.
• Set htmlspecialchars() flags explicitly and consistently.
• Convert XOAUTH2 token exceptions into PHPMailer Exceptions. The original exception is available as an inner exception.
• Deprecate VERSION constants in POP3 and SMTP classes.
• Remove dependency on roave/security-advisories; it's now built into composer 2.9.
• Update Dutch, Esperanto, and Norwegian translations.

Version 7.0.0 (October 15th, 2025)

This is exactly the same as 6.11.1 but bumps the major version number to indicate the presence of a BC break in child classes. Specifically, lang(), setLanguage(), and $language are now static, and should be called statically.

Version 6.12.0 (October 15th, 2025)

This is exactly the same as 6.10.0, reverting all the changes in 6.11.0 and 6.11.1, which inadvertently introduced a BC break affecting child classes. 6.11.1 has been re-released as 7.0.0.

Version 6.11.1 (September 30th, 2025)

• Avoid function signature problems with the deprecation of $useimap in parseAddresses.

Version 6.11.0 (September 29th, 2025)

• Add support for RFC4954 two-part authentication for large XOAUTH2 tokens.
• Also support empty tokens.
• Avoid bogus static analyser deprecation warnings in setFrom.
• Make language loading entirely static, thanks to @​SirLouen.
• Emit warnings when parseAddresses() is used without the IMAP extension.
• Handle mb_decode_mimeheader changes from PHP 8.3+.
• Deprecate the charset param to parseAddresses.
• Fix PHP 8.5 linting issue.
• Don't use -t switch when calling qmail.
• Checking for interrupted system calls now works in languages other than English.
• Add support for extracting gmail transaction IDs after sending.
• For consistency, the protected ReplyTo property has been changed to match the format used for other address arrays.
• Fix line length issues when using S/MIME signing.

... (truncated)

Commits

• e193b92 7.1.0
• 4a888c1 Strip breaks from username and password
• 5bb0a3e Changelog
• 0635324 Changelog
• 9bb152b Run on Ubuntu latest
• 6e56cd9 Make references to more recent versions more generic.
• e445e88 Merge pull request #3328 from masskrdjn/fix/3325-useimap-deprecation
• a5495d0 Refactor parseAddresses to handle deprecated $useimap argument and update tes...
• 816fef2 Merge branch 'master' into fix/3325-useimap-deprecation
• 3499cd9 Changelog
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)