node_modules: update

node_modules/nodemailer/dist/esm/mime-funcs/index.d.ts

@@ -107,6 +107,22 @@ export declare function buildHeaderValue(structured: StructuredHeaderValue): str
  * @return A list of encoded keys and headers
  */
 export declare function buildHeaderParam(key: string, data: string | Buffer, maxLength?: number): EncodedHeaderParam[];
+/**
+ * Options of parseHeaderValue()
+ */
+export interface ParseHeaderValueOptions {
+    /**
+     * Drop the RFC 822 comments outside quoted strings, which the MIME headers allow and
+     * which are not part of the value: 'boundary=b (comment)' names the boundary 'b'. A
+     * parenthesis right behind the '=' of a parameter or behind a token character of its
+     * value continues the token, as it does for Python and postal-mime, so 'Invoice(1).pdf'
+     * keeps its name and 'boundary=(c)b' names the boundary '(c)b'. A comment that never
+     * closes runs to the end of the value, unless a parameter follows it, in which case it is
+     * content and the parameter survives. Comments are kept by default for the sake of the
+     * callers of this exported function, not because keeping them is ever the better reading
+     */
+    stripComments?: boolean | undefined;
+}
 /**
  * Parses a header value with key=value arguments into a structured
  * object.
@@ -120,9 +136,10 @@ export declare function buildHeaderParam(key: string, data: string | Buffer, max
  *   }
  *
  * @param str Header value
+ * @param options Options, see ParseHeaderValueOptions
  * @return Header value as a parsed structure
  */
-export declare function parseHeaderValue(str: string): ParsedHeaderValue;
+export declare function parseHeaderValue(str: string, options?: ParseHeaderValueOptions): ParsedHeaderValue;
 /**
  * Returns file extension for a content type string. If no suitable extensions
  * are found, 'bin' is used as the default extension

node_modules/nodemailer/dist/esm/mime-funcs/index.js

@@ -365,6 +365,26 @@ export function buildHeaderParam(key, data, maxLength) {
  * goes in. Whitespace used to come off it only because the value was trimmed first.
  */
 const TOKEN = /^[^\x00-\x20\x7f()<>@,;:\\"/[\]?=]+$/;
+/**
+ * Offset of the ')' that closes the RFC 822 comment opening at `start`, or -1 when the
+ * comment never closes. Comments nest, and a backslash escapes the character after it
+ */
+function _findCommentEnd(str, start) {
+    let depth = 0;
+    for (let i = start, len = str.length; i < len; i++) {
+        const c = str.charAt(i);
+        if (c === '\\') {
+            i++;
+        }
+        else if (c === '(') {
+            depth++;
+        }
+        else if (c === ')' && --depth === 0) {
+            return i;
+        }
+    }
+    return -1;
+}
 /**
  * Whether a string can be a header parameter name.
  *
@@ -391,13 +411,16 @@ function _isParamName(name) {
  *   }
  *
  * @param str Header value
+ * @param options Options, see ParseHeaderValueOptions
  * @return Header value as a parsed structure
  */
-export function parseHeaderValue(str) {
+export function parseHeaderValue(str, options) {
     const response = {
         value: '',
         params: {}
     };
+    // Cleared again by an unclosed '(', see the loop
+    let stripComments = !!options?.stripComments;
     // A duplicated parameter resolves to its first occurrence, the way a duplicated header
     // does. Letting the last one win disagrees with the receivers that take the first, and
     // the two readings of 'boundary="b"; boundary="c"' name different delimiters. The
@@ -459,6 +482,25 @@ export function parseHeaderValue(str) {
     };
     for (let i = 0, len = str.length; i < len; i++) {
         chr = str.charAt(i);
+        // With stripComments, an RFC 822 comment stands anywhere outside a quoted string but
+        // right behind a token it would continue, see ParseHeaderValueOptions. In the value
+        // of a parameter, no pending whitespace means the last significant character was the
+        // '=' or a character of the token
+        if (stripComments && chr === '(' && !quote && !quoteClosed && !(stage === 'value' && key !== false && !pendingSpace)) {
+            let end = _findCommentEnd(str, i);
+            if (end < 0 && str.indexOf(';', i) < 0) {
+                // a comment that never closes runs to the end of the value, unless a
+                // parameter follows it, which is content then and survives
+                end = len - 1;
+            }
+            if (end >= 0) {
+                i = end;
+                continue;
+            }
+            // looking for a closing ')' again would scan a run of unclosed '(' to its end
+            // once for each of them
+            stripComments = false;
+        }
         if (stage === 'key') {
             if (chr === '=') {
                 key = takeValue().trim();

node_modules/nodemailer/dist/esm/mime-node/index.js

@@ -616,15 +616,18 @@ class MimeNode {
                 return;
             }
             switch (header.key) {
+                // The comments of a MIME header are not part of its value and are dropped, so a
+                // caller supplied 'boundary=b (comment)' is the boundary b it names, and the
+                // header goes out without the comment
                 case 'Content-Disposition':
-                    structured = mimeFuncs.parseHeaderValue(value);
+                    structured = mimeFuncs.parseHeaderValue(value, { stripComments: true });
                     if (this.filename) {
                         structured.params.filename = this.filename;
                     }
                     value = mimeFuncs.buildHeaderValue(structured);
                     break;
                 case 'Content-Type':
-                    structured = mimeFuncs.parseHeaderValue(value);
+                    structured = mimeFuncs.parseHeaderValue(value, { stripComments: true });
                     // the type token decides multipart and charset below, so clean it before
                     // those run and not just on the way out, otherwise a control char makes
                     // the checks miss and the header ends up claiming a type it is not set up for

node_modules/nodemailer/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.2.0";
+export declare const version = "10.2.1";
 export declare const homepage = "https://nodemailer.com/";

node_modules/nodemailer/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.2.0';
+export const version = '10.2.1';
 export const homepage = 'https://nodemailer.com/';