chore(deps/backend): bump nodemailer from 9.0.5 to 10.0.3 in /backend

[dependabot]

Bumps nodemailer from 9.0.5 to 10.0.3.

Release notes

Sourced from nodemailer's releases.

v10.0.3

10.0.3 (2026-09-10)

Bug Fixes

• fetch: honor the cookie Domain attribute without accepting public suffixes (1608391), closes #1856

v10.0.2

10.0.2 (2026-09-09)

Bug Fixes

• mime-node: flatten nested recipient arrays without recursion (ebe0849)
• shared: keep the TLS server name out of the DNS cache (a6512db)

v10.0.1

10.0.1 (2026-09-07)

Bug Fixes

• types: accept an explicit undefined for optional properties (209719d), closes #1853
• types: drop the internal members from the published declarations (81e64ea)

v10.0.0

10.0.0 (2026-09-03)

⚠ BREAKING CHANGES

• Node.js 20 or newer is required. The Node.js 6 syntax compatibility check and the .npmignore file are gone.

Features

• keep the @​types/nodemailer type layout working (1cc5356)
• migrate to TypeScript with ES module and CommonJS builds (f7cbf83)

Bug Fixes

• apply the other keys of a configuration object next to its url (29610f9)
• dkim: canonicalize raw messages the way verifiers do (2c84b11)
• keep a transporter assignable to the plain Transporter type (8bf55fb)
• shared: keep a colon in the user name of a connection or proxy url (6acf4b6)
• shared: refuse URL hosts the legacy parser would truncate (17a5068)
• shared: resolve hostnames when the runtime has no interface table (8b03240)
• smtp-connection: clear the timers of a connection dropped before the greeting (01dcaa0)
• smtp-connection: keep an incomplete server reply out of lastServerResponse (1a6e427)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.0.3 (2026-09-10)

Bug Fixes

• fetch: honor the cookie Domain attribute without accepting public suffixes (1608391), closes #1856

10.0.2 (2026-09-09)

Bug Fixes

• mime-node: flatten nested recipient arrays without recursion (ebe0849)
• shared: keep the TLS server name out of the DNS cache (a6512db)

10.0.1 (2026-09-07)

Bug Fixes

• types: accept an explicit undefined for optional properties (209719d), closes #1853
• types: drop the internal members from the published declarations (81e64ea)

10.0.0 (2026-09-03)

⚠ BREAKING CHANGES

• Node.js 20 or newer is required. The Node.js 6 syntax compatibility check and the .npmignore file are gone.

Features

• keep the @​types/nodemailer type layout working (1cc5356)
• migrate to TypeScript with ES module and CommonJS builds (f7cbf83)

Bug Fixes

• apply the other keys of a configuration object next to its url (29610f9)
• dkim: canonicalize raw messages the way verifiers do (2c84b11)
• keep a transporter assignable to the plain Transporter type (8bf55fb)
• shared: keep a colon in the user name of a connection or proxy url (6acf4b6)
• shared: refuse URL hosts the legacy parser would truncate (17a5068)
• shared: resolve hostnames when the runtime has no interface table (8b03240)
• smtp-connection: clear the timers of a connection dropped before the greeting (01dcaa0)
• smtp-connection: keep an incomplete server reply out of lastServerResponse (1a6e427)
• smtp-pool: free the pool slot when the proxy socket can not be opened (204a344)
• well-known: keep nodemailer/lib/well-known/services.json available (367730c)

9.1.1 (2026-09-01)

... (truncated)

Commits

• cae865b chore(master): release 10.0.3 (#1857)
• 1608391 fix(fetch): honor the cookie Domain attribute without accepting public suffixes
• 0195799 chore(master): release 10.0.2 (#1855)
• d456fd6 test: resolve the TLS server name test host without a resolver stub
• ebe0849 fix(mime-node): flatten nested recipient arrays without recursion
• a6512db fix(shared): keep the TLS server name out of the DNS cache
• 40d5221 chore(master): release 10.0.1 (#1854)
• 81e64ea fix(types): drop the internal members from the published declarations
• c5dba6e chore: turn on exactOptionalPropertyTypes for the type-check
• 209719d fix(types): accept an explicit undefined for optional properties
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: backend, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.