[dependabot]

Bumps the default group with 1 update: nodemailer.

Updates nodemailer from 10.2.1 to 10.3.1

Release notes

Sourced from nodemailer's releases.

v10.3.1

10.3.1 (2026-10-29)

Bug Fixes

• apply the otp option in MailComposer too (1d4087f)

v10.3.0

10.3.0 (2026-10-29)

Summary

This release adds support for the OTP-Token header from the IETF draft draft-goto-otp-token, which lets mail clients and browsers offer a one-time passcode for autofill on the site it belongs to. It also fixes how a Content-ID header is encoded.

Who should upgrade

• Anyone sending one-time passcodes by email who wants them to be machine-readable.
• Anyone already setting an OTP-Token header through headers: before this release it went out MIME encoded and could not be parsed.
• Anyone embedding images with a cid that holds a non-ASCII character or a quote.

Highlights

• New otp message option: otp: { code: '123456', origin: 'https://example.com' } adds OTP-Token: "123456"; origin="https://example.com". The origin is reduced to its canonical form, only https (or http on a loopback host) is accepted, and invalid values fail the send with the new EOTP error code. See Message configuration.
• A custom OTP-Token header is no longer MIME word encoded. Line breaks and control characters are still removed.
• OTP-Token is included in the DKIM signature by default.
• A Content-ID header, from an attachment cid or set through headers, is now encoded as a message id rather than as text, so a cid with a non-ASCII character or a quote keeps matching the cid: URL in the HTML.
• Groundmail added to the well-known services.

Features

• add the otp option for the OTP-Token header (7789e15)

Bug Fixes

• encode a Content-ID header as a message id (#1904) (47f2b25)

Changelog

Sourced from nodemailer's changelog.

10.3.1 (2026-10-29)

Bug Fixes

• apply the otp option in MailComposer too (1d4087f)

10.3.0 (2026-10-29)

Features

• add the otp option for the OTP-Token header (7789e15)

Bug Fixes

• encode a Content-ID header as a message id (#1904) (47f2b25)

Commits

• 26555d0 Merge pull request #1906 from nodemailer/release-please--branches--master--co...
• 3e5bb55 chore(master): release 10.3.1
• 1d4087f fix: apply the otp option in MailComposer too
• 488ce9c chore(deps): update development dependencies
• 41eda65 chore(deps): update development dependencies
• 5de343d chore(master): release 10.3.0 (#1905)
• 7789e15 feat: add the otp option for the OTP-Token header
• 47f2b25 fix: encode a Content-ID header as a message id (#1904)
• a6e7a70 chore(services): add Groundmail (#1903)
• a0cea19 chore(deps): update development dependencies [skip ci]
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions