chore(deps): bump nodemailer from 9.1.1 to 10.0.6 in /server

[dependabot]

Bumps nodemailer from 9.1.1 to 10.0.6.

Release notes

Sourced from nodemailer's releases.

v10.0.6

10.0.6 (2026-09-11)

Bug Fixes

• addressparser: scan free text for an address in linear time (437d7fc)

v10.0.5

10.0.5 (2026-09-11)

Bug Fixes

• addressparser: parse comment-joined addresses in linear time (c07f175)

v10.0.4

10.0.4 (2026-09-11)

Bug Fixes

• fetch: scope a cookie without a Path to the RFC 6265 default path (2f907cb)
• fetch: send cookies set with Path back to the exact path (#1861) (d557113)
• mail-composer: keep httpHeaders and tls for href alternatives and icalEvent (#1862) (7f502be)
• resolve well-known services by their primary domains (#1859) (085f525)
• ses-transport: throw a configuration error when the SES client is missing (#1863) (4d9c4c9)

v10.0.3

10.0.3 (2026-09-10)

Bug Fixes

• fetch: honor the cookie Domain attribute without accepting public suffixes (1608391), closes #1856

v10.0.2

10.0.2 (2026-09-09)

Bug Fixes

• mime-node: flatten nested recipient arrays without recursion (ebe0849)
• shared: keep the TLS server name out of the DNS cache (a6512db)

v10.0.1

10.0.1 (2026-09-07)

Bug Fixes

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.0.6 (2026-09-11)

Bug Fixes

• addressparser: scan free text for an address in linear time (437d7fc)

10.0.5 (2026-09-11)

Bug Fixes

• addressparser: parse comment-joined addresses in linear time (c07f175)

10.0.4 (2026-09-11)

Bug Fixes

• fetch: scope a cookie without a Path to the RFC 6265 default path (2f907cb)
• fetch: send cookies set with Path back to the exact path (#1861) (d557113)
• mail-composer: keep httpHeaders and tls for href alternatives and icalEvent (#1862) (7f502be)
• resolve well-known services by their primary domains (#1859) (085f525)
• ses-transport: throw a configuration error when the SES client is missing (#1863) (4d9c4c9)

10.0.3 (2026-09-10)

Bug Fixes

• fetch: honor the cookie Domain attribute without accepting public suffixes (1608391), closes #1856

10.0.2 (2026-09-09)

Bug Fixes

• mime-node: flatten nested recipient arrays without recursion (ebe0849)
• shared: keep the TLS server name out of the DNS cache (a6512db)

10.0.1 (2026-09-07)

Bug Fixes

• types: accept an explicit undefined for optional properties (209719d), closes #1853
• types: drop the internal members from the published declarations (81e64ea)

10.0.0 (2026-09-03)

... (truncated)

Commits

• 933d263 chore(master): release 10.0.6 (#1868)
• 437d7fc fix(addressparser): scan free text for an address in linear time
• 4dbeb23 chore(master): release 10.0.5 (#1864)
• c07f175 fix(addressparser): parse comment-joined addresses in linear time
• ad54add chore(master): release 10.0.4 (#1860)
• f463eca refactor(ses-transport): drop the options default the config guard makes unre...
• 2f907cb fix(fetch): scope a cookie without a Path to the RFC 6265 default path
• 4d9c4c9 fix(ses-transport): throw a configuration error when the SES client is missin...
• 7f502be fix(mail-composer): keep httpHeaders and tls for href alternatives and icalEv...
• d557113 fix(fetch): send cookies set with Path back to the exact path (#1861)
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

[strix-security]

Strix Security Review

Warning

This pull request has 57 commits after the last Strix review (67648b7). Strix has not reviewed these changes.
Automatic review on push is off for this repository. To review the latest changes, tag @strix-security in a comment, or turn on re-review on push.

No security issues found.

_{Updated for 67648b7.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.