Bump nodemailer from 8.0.11 to 9.0.1

[dependabot]

Bumps nodemailer from 8.0.11 to 9.0.1.

Release notes

Sourced from nodemailer's releases.

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

• enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

• HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

• replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)
• validate TLS certificates by default when fetching remote content (6a947ac)

Changelog

Sourced from nodemailer's changelog.

9.0.1 (2026-06-17)

Bug Fixes

• enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

• HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

• replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)
• validate TLS certificates by default when fetching remote content (6a947ac)

Commits

• 69cf625 chore(master): release 9.0.1 (#1828)
• a82e060 fix: enforce disableFileAccess/disableUrlAccess for raw message option
• 4e58450 chore: update dev dependencies
• 541f5fd chore(master): release 9.0.0 (#1827)
• 0c080fb fix: replace deprecated url.parse with a WHATWG URL wrapper
• 6a947ac fix!: validate TLS certificates by default when fetching remote content
• See full diff in compare view

[github-actions]

❌ Not Automerged

The PR does not match any automerge rules.

Details: No configuration rule matched this update

Dependabot Information:

• Package name(s): nodemailer
• Update type: major
• Dependency type: production
• Previous version: 8.0.11
• New version: 9.0.1

Modified Files:

• package-lock.json
• package.json

[github-actions]

❌ Not Automerged

The PR does not match any automerge rules.

Details: No configuration rule matched this update

Dependabot Information:

• Package name(s): nodemailer
• Update type: major
• Dependency type: production
• Previous version: 8.0.11
• New version: 9.0.1

Modified Files:

• package-lock.json
• package.json

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.