[dependabot]

Bumps postal-mime from 2.7.6 to 4.0.2.

Release notes

Sourced from postal-mime's releases.

v4.0.2

4.0.2 (2026-09-30)

Bug Fixes

• stop a "[" from hiding the operators after it (2797ee5)

v4.0.1

4.0.1 (2026-09-30)

Bug Fixes

• do not read an address out of a quoted encoded word (c88eaf5)
• keep a display name holding an encoded word out of the address (ce5ba24)
• open a domain-literal only after the '@' of an address (776b951)
• port the address parser fixes from Nodemailer (902bd3f)

v4.0.0

4.0.0 (2026-09-26)

⚠ BREAKING CHANGES

• Node.js 20 or newer is required.
• Attachment.disposition is typed as AttachmentDisposition | null, which accepts any Content-Disposition token, instead of 'attachment' | 'inline' | null. The parsed output is unchanged, but code that assigns the value to the narrower type has to widen it.
• the ES module entry point moved from src/postal-mime.js to dist/esm/postal-mime.js, so browser code that imported the file from node_modules directly has to use the new path. Consumers that import postal-mime by name are unaffected.

Features

• convert to TypeScript and ship ES module and CommonJS builds (2559c82)
• declare the CommonJS entry point with export = and ship source maps (84d1159)
• type the attachment disposition as the token the message carries (4bb2796)

Bug Fixes

• keep the public object types assignable to an index signature (3363039)

Miscellaneous Chores

• require Node.js 20 or newer (21eaae6)

v3.0.1

3.0.1 (2026-09-25)

Bug Fixes

... (truncated)

Changelog

Sourced from postal-mime's changelog.

4.0.2 (2026-09-30)

Bug Fixes

• stop a "[" from hiding the operators after it (2797ee5)

4.0.1 (2026-09-30)

Bug Fixes

• do not read an address out of a quoted encoded word (c88eaf5)
• keep a display name holding an encoded word out of the address (ce5ba24)
• open a domain-literal only after the '@' of an address (776b951)
• port the address parser fixes from Nodemailer (902bd3f)

4.0.0 (2026-09-26)

⚠ BREAKING CHANGES

• Node.js 20 or newer is required.
• Attachment.disposition is typed as AttachmentDisposition | null, which accepts any Content-Disposition token, instead of 'attachment' | 'inline' | null. The parsed output is unchanged, but code that assigns the value to the narrower type has to widen it.
• the ES module entry point moved from src/postal-mime.js to dist/esm/postal-mime.js, so browser code that imported the file from node_modules directly has to use the new path. Consumers that import postal-mime by name are unaffected.

Features

• convert to TypeScript and ship ES module and CommonJS builds (2559c82)
• declare the CommonJS entry point with export = and ship source maps (84d1159)
• type the attachment disposition as the token the message carries (4bb2796)

Bug Fixes

• keep the public object types assignable to an index signature (3363039)

Miscellaneous Chores

• require Node.js 20 or newer (21eaae6)

3.0.1 (2026-09-25)

Bug Fixes

• collect parsed addresses in linear time (68cd065), closes #97
• convert html to text in linear time (38b2a83), closes #97
• detect angle bracket addresses in decoded words in linear time (390be2b), closes #97

... (truncated)

Commits

• a64b943 chore(master): release 4.0.2 (#101)
• 2797ee5 fix: stop a "[" from hiding the operators after it
• b9406e6 chore(master): release 4.0.1 (#100)
• 053d18d chore: update dependencies
• 776b951 fix: open a domain-literal only after the '@' of an address
• c88eaf5 fix: do not read an address out of a quoted encoded word
• ce5ba24 fix: keep a display name holding an encoded word out of the address
• 902bd3f fix: port the address parser fixes from Nodemailer
• 7800715 chore(master): release 4.0.0 (#99)
• ec42302 chore: update dependencies
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)