[dependabot]

Bumps nodemailer from 10.4.1 to 10.5.0.

Release notes

Sourced from nodemailer's releases.

v10.5.0

10.5.0 (2026-11-10)

Summary

Adds per-message cancellation to sendMail() with an AbortSignal, plus two encoding fixes: DKIM signatures for internationalized domains, and header text that looks like a broken encoded-word.

Who should upgrade

• Anyone who signs with DKIM for a domain written with upper case or mapped non-ASCII characters (an upper case IDN label, or one holding a soft hyphen). The d= tag named a different domain than From:, so verification and DMARC alignment failed.
• Anyone who wants to cancel or time-limit a single send without closing the transport or pool.

Highlights

• AbortSignal per send: sendMail({ ..., signal }) on SMTP and pooled SMTP. An abort removes a queued message from the pool, or closes only the connection delivering it, and the send fails with an AbortError (code EABORT). Other transports honor a signal that is already aborted and otherwise ignore it. Note that an abort late in DATA does not prove the server did not accept the message, so do not treat EABORT as safe to retry blindly.
• DKIM: the d= domain is encoded with UTS-46 mapping, the same way as the address headers.
• Header encoding: plain text that a receiver would decode as an encoded-word without it being a valid one (such as =?utf-8?Q?a b?= across a space) is now encoded. A valid encoded-word is still passed through, so subjects that are already encoded are not encoded twice.
• SMTP connection: a supplied socket no longer connects, and TLS no longer starts, after the connection was closed.

Features

• smtp: support AbortSignal for individual sends (#1911) (66387ed), closes #1910

Bug Fixes

• dkim: encode the d= domain the same way as the address headers (#1908) (4ebf03f)
• mime-funcs: encode header text that would be decoded as an invalid encoded word (#1912) (7a7b942)

Changelog

Sourced from nodemailer's changelog.

10.5.0 (2026-11-10)

Features

• smtp: support AbortSignal for individual sends (#1911) (66387ed), closes #1910

Bug Fixes

• dkim: encode the d= domain the same way as the address headers (#1908) (4ebf03f)
• mime-funcs: encode header text that would be decoded as an invalid encoded word (#1912) (7a7b942)

Commits

• f4bacd5 chore(master): release 10.5.0 (#1914)
• 66387ed feat(smtp): support AbortSignal for individual sends (#1911)
• 7a7b942 fix(mime-funcs): encode header text that would be decoded as an invalid encod...
• 4ebf03f fix(dkim): encode the d= domain the same way as the address headers (#1908)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)