Bump nodemailer and maildev

[dependabot]

Bumps nodemailer to 9.1.1 and updates ancestor dependency maildev. These dependencies need to be updated together.

Updates nodemailer from 6.10.1 to 9.1.1

Release notes

Sourced from nodemailer's releases.

v9.1.1

9.1.1 (2026-09-01)

Bug Fixes

• mailer: apply the message access policy in resolveContent (dc48ed3)
• mailer: keep message data from reopening the access sandbox (ab7ef34)
• mime-node: inherit the access policy from the tree a node hangs in (262d550)

v9.1.0

9.1.0 (2026-08-31)

Features

• mailer: cap recipients per message with maxRecipients (7279ac8)

Bug Fixes

• addressparser: handle address lists in linear time (9116da9)
• addressparser: terminate the domain at an RFC 5322 comment (902b63e)
• mime-node: apply UTS-46 mapping when encoding a domain (259c32d)
• mime-node: dedupe envelope recipients in linear time (7cc38af)
• mime-node: flatten parsed addresses without concat.apply (83b8c48)
• mime-node: keep the recipient dedupe linear across address headers (34da642)
• mime-node: keep URL delimiters away from the domain mapper (b212ac4)

v9.0.6

9.0.6 (2026-08-27)

Bug Fixes

• addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
• harden copies of user supplied keys and URL fetching (2f667f4)

v9.0.5

9.0.5 (2026-08-07)

Bug Fixes

• ci: retrigger the workflows dropped during the Actions outage (85d16c1)
• mailer: escape specials in List-* header comments (#1842) (75913bb)
• mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
• mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
• mime: encode DEL in header parameters and List-* comments (cf69430)
• mime: keep control chars out of the remaining header positions (5ed9d26)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

9.1.1 (2026-09-01)

Bug Fixes

• mailer: apply the message access policy in resolveContent (dc48ed3)
• mailer: keep message data from reopening the access sandbox (ab7ef34)
• mime-node: inherit the access policy from the tree a node hangs in (262d550)

9.1.0 (2026-08-31)

Features

• mailer: cap recipients per message with maxRecipients (7279ac8)

Bug Fixes

• addressparser: handle address lists in linear time (9116da9)
• addressparser: terminate the domain at an RFC 5322 comment (902b63e)
• mime-node: apply UTS-46 mapping when encoding a domain (259c32d)
• mime-node: dedupe envelope recipients in linear time (7cc38af)
• mime-node: flatten parsed addresses without concat.apply (83b8c48)
• mime-node: keep the recipient dedupe linear across address headers (34da642)
• mime-node: keep URL delimiters away from the domain mapper (b212ac4)

9.0.6 (2026-08-27)

Bug Fixes

• addressparser: recover the addr-spec from an angle-addr holding whitespace (e989a22)
• harden copies of user supplied keys and URL fetching (2f667f4)

9.0.5 (2026-08-07)

Bug Fixes

• ci: retrigger the workflows dropped during the Actions outage (85d16c1)
• mailer: escape specials in List-* header comments (#1842) (75913bb)
• mime-funcs: star the continuation key of a restarted parameter line (36bcf1a)
• mime-node: keep control chars out of header values and msg-id headers (15cf6d1)
• mime: encode DEL in header parameters and List-* comments (cf69430)
• mime: keep control chars out of the remaining header positions (5ed9d26)
• mime: normalize an address parsed out of a string as well (63685f7)
• mime: normalize an address so header and envelope agree (a9343b4)
• mime: stop a header key callback and the dkim tags from injecting (b7d772e)

... (truncated)

Commits

• ad4513f chore(master): release 9.1.1 (#1850)
• c3e261f docs: replace dead Node.js c-ares dependencies link (#1845)
• c158a38 docs: mark 9.x as the supported security line (#1846)
• 262d550 fix(mime-node): inherit the access policy from the tree a node hangs in
• ab7ef34 fix(mailer): keep message data from reopening the access sandbox
• dc48ed3 fix(mailer): apply the message access policy in resolveContent
• efd6e29 chore(master): release 9.1.0 (#1849)
• 1f9533b chore(deps): update dev dependencies
• b212ac4 fix(mime-node): keep URL delimiters away from the domain mapper
• 6aa7e3f refactor: fold review findings into the address parsing changes
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nodemailer since your current version.

Updates maildev from 2.2.1 to 3.0.0-rc.2

Release notes

Sourced from maildev's releases.

maildev@3.0.0-rc.1

MailDev 3.0.0 Release Candidate 1

MailDev 3.0 is a complete, ground-up rewrite. The entire stack has been rebuilt in TypeScript as a modern monorepo, the web UI has been rewritten in React, and the project now ships first-class Claude support via the Model Context Protocol (MCP). Your existing CLI flags, REST API, and .eml archives keep working.

✨ New Features

• Claude / AI integration via MCP — A built-in Model Context Protocol server lets Claude and other AI assistants interact with your dev inbox in natural language: searching emails, pulling verification links, analyzing content, and monitoring delivery. Enable the integrated HTTP transport with maildev --mcp (served at http://localhost:1080/mcp), or run the standalone maildev-mcp stdio server for Claude Desktop. Ships 5 tools, 3 resources, and 4 ready-made prompts (verify signup, check password reset, analyze email, monitor delivery).
• Brand-new React web UI — Rewritten from the ground up with React 19, TanStack Query, and React Router. Includes dark mode, responsive layout, and email device previews.
• Command palette (⌘K) — Fast, keyboard-driven access to actions.
• Keyboard navigation — Gmail-style shortcuts and arrow-key navigation, including navigation while searching.
• maildev init — Scaffold a config file to get started quickly.
• Configuration files — Native support for .maildevrc.json and maildev.config.js / .ts, plus MAILDEV_* environment variables, layered on top of CLI flags.
• Modern programmatic API — import { MailDev } from 'maildev' with a clean async/await start() / stop() lifecycle and typed server access.
• Published as scoped packages — Compose your own setup from @​maildev/core, @​maildev/smtp, @​maildev/api, @​maildev/ui, and @​maildev/mcp, or keep using the all-in-one maildev CLI.

⚠️ Breaking Changes

• Node.js 20+ required (was 18+).
• Web UI completely replaced — The AngularJS front end has been removed and rewritten in React. There is no in-place upgrade path for UI customizations built against the old front end.
• Callback-style APIs removed — The programmatic API is now async/await throughout (await maildev.start() instead of callbacks).
• New configuration format — Config files use the new format; environment-variable and CLI-flag configuration continue to work.

✅ Still compatible

• CLI flags — All 30+ v2 options (--smtp, --web, --incoming-, --outgoing-, --auto-relay, --web-user/--web-pass, --https, --base-pathname, etc.) are preserved.
• REST API — v2 endpoints remain backward compatible.
• Email archives — v2.x .eml mail directories are loaded automatically (--mail-directory).
• Docker — Same image usage and 1025/1080 port defaults.

🔧 Technical & Internal Improvements

• pnpm + Turbo monorepo — Split into six focused packages (core, smtp, api, ui, mcp, cli) with incremental, cached builds.

... (truncated)

Changelog

Sourced from maildev's changelog.

3.0.0-rc.2

Patch Changes

• d34aaa3: Fix the Docker healthcheck so containers report healthy out of the box. A dedicated healthcheck entrypoint (dist/bin/healthcheck.js) now:

  • probes 127.0.0.1 instead of localhost, so it no longer fails when localhost resolves to IPv6 (::1) while the web server binds IPv4 only (#537);
  • falls back to a TCP check on the SMTP port when the web UI is disabled with --disable-web, instead of probing an endpoint that isn't there (#544);
  • normalizes MAILDEV_BASE_PATHNAME so a trailing slash can't produce a // in the probe URL (#542).

• 196f277: Serve the web UI / REST API over HTTPS when --https (with --https-cert and --https-key) is set. The Fastify server now actually honors these options — previously the flags existed but the web server always served plain HTTP. HTTPS can also be configured via MAILDEV_HTTPS, MAILDEV_HTTPS_CERT, and MAILDEV_HTTPS_KEY, and the Docker healthcheck detects MAILDEV_HTTPS and probes over HTTPS so TLS-enabled containers report healthy.

• 42d3708: Add an opt-in maxEmails limit that also bounds the mail directory

  An opt-in maxEmails limit (default 0 = unlimited; set --max-emails to cap) discards the oldest emails along with their .eml files and attachments, so both memory and the mail directory can be kept bounded. When set, leftover files from earlier runs are trimmed at startup. The default keeps MailDev's historical unbounded behaviour, so persisted mail stays durable across restarts (no data loss by default).

  Breaking change:

  • @maildev/core: Storage implementations must now provide onEvicted. A new EvictHandler type and mapLimit helper are exported.

• fc7e584: Add a configurable maximum message size and reject oversized messages. A new --max-message-size option (env MAILDEV_MAX_MESSAGE_SIZE, default 50 MB) advertises the SMTP SIZE extension and refuses messages larger than the limit. The bytes forwarded to the parser are capped at the limit, so a malicious multipart message with a huge number of parts can no longer tie up the parser (addresses the unbounded MIME sibling-part fanout in #531). Set to 0 to disable the limit.

• 781cc0c: Restore persisted emails on startup. When --mail-directory (MAILDEV_MAIL_DIRECTORY) is set, existing .eml files in the directory are now loaded back into the UI when MailDev starts, so mail survives a restart (e.g. across container/pod restarts with a mounted volume).

• Updated dependencies [5d79197]

• Updated dependencies [c96f68f]

• Updated dependencies [b8462db]

• Updated dependencies [41cfcae]

• Updated dependencies [196f277]

• Updated dependencies [e7bc086]

• Updated dependencies [42d3708]

• Updated dependencies [fc7e584]

• Updated dependencies [7dd67c6]

  • @​maildev/api@​3.0.0-rc.2
  • @​maildev/core@​3.0.0-rc.2
  • @​maildev/mcp@​3.0.0-rc.2
  • @​maildev/ui@​3.0.0-rc.2
  • @​maildev/smtp@​3.0.0-rc.2

3.0.0-rc.1

Major Changes

• Complete project re-build

... (truncated)

Commits

• 77425eb Version packages 3.0.0-rc.2
• 2f287c0 Remove sponsorship
• 42d3708 feat: opt-in maxEmails limit that also bounds the mail directory (#559)
• 196f277 Serve the web UI/API over HTTPS (#555)
• fc7e584 Add configurable max message size to bound MIME parsing (#551)
• 781cc0c Restore persisted emails on startup (#549)
• d34aaa3 Fix Docker healthcheck for IPv6, disabled web UI, and base paths (#550)
• e363329 Update MCP docs
• 0c61202 Security updates
• 00435e7 Updates for Docker release
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.