chore(deps): bump hyperpolymath/smtp-notify-action from 0.1.0 to 0.2.0 in the actions group

[dependabot]

Bumps the actions group with 1 update: hyperpolymath/smtp-notify-action.

Updates hyperpolymath/smtp-notify-action from 0.1.0 to 0.2.0

Release notes

Sourced from hyperpolymath/smtp-notify-action's releases.

v0.2.0

Static, byte-reproducible smtp-notify binaries. CI rebuilt them from this tag and verified they hash to exactly the SHA-256 pins inside this tag's action.yml before publishing.

Changelog

Sourced from hyperpolymath/smtp-notify-action's changelog.

// SPDX-License-Identifier: MPL-2.0 = Changelog :toc: macro :toclevels: 2

All notable changes to this action are recorded here. The format follows https://keepachangelog.com/en/1.1.0/[Keep a Changelog]; versions follow https://semver.org/spec/v2.0.0.html[Semantic Versioning].

The unit of release is the action ref: the tag or commit you pin determines both action.yml and, through the SHA-256 pins inside it, the exact binary that runs.

toc::[]

== Unreleased

[IMPORTANT]

main is not a release, and pinning @main is not supported.

Between a release commit landing on main and its tag being pushed, action.yml on main names assets that do not exist yet, so @main fails at the download step. This window is unavoidable rather than an oversight: the release workflow refuses to publish unless the asset URL in the tagged commit already names the tag being released, so the commit must precede the tag. The window is minutes long and is one more reason @main is not a supported ref.

Pin a tag, or a commit SHA that is an ancestor of one.

== v0.2.0 — 2026-09-03

[IMPORTANT]

Upgrading from v0.1.0 changes behaviour. secure is now fail-closed: a value this action does not recognise is rejected instead of being treated as plaintext. A workflow that passed secure: false expecting dawidd6's "STARTTLS when the server offers it" now fails with a message naming the cause, rather than downgrading to cleartext. Sending in the clear requires typing plaintext. See MIGRATION.adoc.

This release also closes the v0.1.0 window described in the previous edition of this file: action.yml here downloads the v0.2.0 binaries and carries their SHA-256 pins, so the behaviour described below is the behaviour that runs.

=== Changed

• secure is now fail-closed. Transport selection accepts true/implicit (SMTPS), false/starttls, and plaintext. Any other value is rejected outright. false fails with a clear message because STARTTLS is not yet implemented, rather than silently downgrading. This is a deliberate

... (truncated)

Commits

• ede1191 docs: restore the "@​main is not a release" statement, and say why (#15)
• ea60deb release: v0.2.0 — action.yml fetches the fixed binaries (#14)
• 93ee757 docs: security policy, contributing guide and changelog (#13)
• 4077691 fix: fail-closed transport, OS gate, server reply text, whole-run watchdog (#12)
• 5730180 docs: defect registers — Bustfile (dependencies) and known defects (ours) (#11)
• f3d5c1a docs: migration guide from dawidd6/action-send-mail (#8)
• 6d6147e docs: describe the dawidd6 relationship honestly (#7)
• f9809b1 fix(ci): strip CRLF from mailpit raw fetch before whole-line greps
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions