[dependabot]

Bumps nodemailer from 10.1.2 to 10.1.4.

Release notes

Sourced from nodemailer's releases.

v10.1.4

10.1.4 (2026-10-18)

Bug Fixes

• addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)
• addressparser: bound group nesting at ten levels (ce63303)
• addressparser: drop the obsolete route from an angle-addr (3dbc730)
• addressparser: end a comment only at the ")" that closes the outermost one (0a87617)
• addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)
• addressparser: never read a mailbox out of a comment (a1538ea)
• addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)
• addressparser: read the first addr-spec of the display text (038940a)
• split a domain literal off at the "@" in front of it (d5983b0)

v10.1.3

10.1.3 (2026-10-18)

Bug Fixes

• format References and strip URLs in linear time, release any number of streams (2f18641)

Changelog

Sourced from nodemailer's changelog.

10.1.4 (2026-10-18)

Bug Fixes

• addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)
• addressparser: bound group nesting at ten levels (ce63303)
• addressparser: drop the obsolete route from an angle-addr (3dbc730)
• addressparser: end a comment only at the ")" that closes the outermost one (0a87617)
• addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)
• addressparser: never read a mailbox out of a comment (a1538ea)
• addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)
• addressparser: read the first addr-spec of the display text (038940a)
• split a domain literal off at the "@" in front of it (d5983b0)

10.1.3 (2026-10-18)

Bug Fixes

• format References and strip URLs in linear time, release any number of streams (2f18641)

Commits

• 2a7e952 chore(master): release 10.1.4 (#1897)
• 038940a fix(addressparser): read the first addr-spec of the display text
• ce63303 fix(addressparser): bound group nesting at ten levels
• a1538ea fix(addressparser): never read a mailbox out of a comment
• 3dbc730 fix(addressparser): drop the obsolete route from an angle-addr
• ba3c095 fix(addressparser): read CFWS beside the "@" of an addr-spec as nothing
• d5983b0 fix: split a domain literal off at the "@" in front of it
• ee35f57 fix(addressparser): apply the unexpected "<" rule outside quotes and comments
• 0a87617 fix(addressparser): end a comment only at the ")" that closes the outermost one
• 1cd57d2 fix(addressparser): honour quoted strings and comments inside an angle-addr a...
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7d5225a7-f96a-40ac-b751-706c523fd83f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/nodemailer	^10.1.4	Unknown	Unknown
npm/nodemailer	10.1.4	🟢 5.7	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Code-Review ⚠️ 0 Found 0/24 approved changesets -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 License 🟢 9 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• apps/web/package.json
• pnpm-lock.yaml