chore(deps): bump nodemailer from 10.0.0 to 10.0.9 in /.repos/effect-smol

[dependabot]

Bumps nodemailer from 10.0.0 to 10.0.9.

Release notes

Sourced from nodemailer's releases.

v10.0.9

10.0.9 (2026-09-12)

Bug Fixes

• addressparser: bound the '@' probe to the run being scanned (1465c3f)
• addressparser: keep the text after a comment out of a quoted local part address (2f36eb1)

v10.0.8

10.0.8 (2026-09-11)

Bug Fixes

• mime-node: clean the boundary where it is written, not only where it is built (e14278d)
• mime-node: drop every control character from multipart boundary material (a82a355)

v10.0.7

10.0.7 (2026-09-11)

Bug Fixes

• mime-funcs: do not double encode Buffer input when chunking base64 mime words (#1865) (4327a59)
• mime-node: keep a boundary that is only line breaks from stripping to empty (ec46800)
• mime-node: strip line breaks from multipart boundary material (#1867) (03c1a5c)
• smtp-pool: release rate-limited connections on close (#1866) (7f5c7a4)

v10.0.6

10.0.6 (2026-09-11)

Bug Fixes

• addressparser: scan free text for an address in linear time (437d7fc)

v10.0.5

10.0.5 (2026-09-11)

Bug Fixes

• addressparser: parse comment-joined addresses in linear time (c07f175)

v10.0.4

10.0.4 (2026-09-11)

Bug Fixes

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.0.9 (2026-09-12)

Bug Fixes

• addressparser: bound the '@' probe to the run being scanned (1465c3f)
• addressparser: keep the text after a comment out of a quoted local part address (2f36eb1)

10.0.8 (2026-09-11)

Bug Fixes

• mime-node: clean the boundary where it is written, not only where it is built (e14278d)
• mime-node: drop every control character from multipart boundary material (a82a355)

10.0.7 (2026-09-11)

Bug Fixes

• mime-funcs: do not double encode Buffer input when chunking base64 mime words (#1865) (4327a59)
• mime-node: keep a boundary that is only line breaks from stripping to empty (ec46800)
• mime-node: strip line breaks from multipart boundary material (#1867) (03c1a5c)
• smtp-pool: release rate-limited connections on close (#1866) (7f5c7a4)

10.0.6 (2026-09-11)

Bug Fixes

• addressparser: scan free text for an address in linear time (437d7fc)

10.0.5 (2026-09-11)

Bug Fixes

• addressparser: parse comment-joined addresses in linear time (c07f175)

10.0.4 (2026-09-11)

Bug Fixes

• fetch: scope a cookie without a Path to the RFC 6265 default path (2f907cb)
• fetch: send cookies set with Path back to the exact path (#1861) (d557113)
• mail-composer: keep httpHeaders and tls for href alternatives and icalEvent (#1862) (7f502be)
• resolve well-known services by their primary domains (#1859) (085f525)
• ses-transport: throw a configuration error when the SES client is missing (#1863) (4d9c4c9)

... (truncated)

Commits

• 5a35d59 chore(master): release 10.0.9 (#1871)
• 2f36eb1 fix(addressparser): keep the text after a comment out of a quoted local part ...
• 1465c3f fix(addressparser): bound the '@' probe to the run being scanned
• 1732dc4 chore(deps): update dev dependencies
• ec7eda6 chore(deps): update dev dependencies
• 618f912 chore(master): release 10.0.8 (#1870)
• e14278d fix(mime-node): clean the boundary where it is written, not only where it is ...
• a82a355 fix(mime-node): drop every control character from multipart boundary material
• 29166ff chore(master): release 10.0.7 (#1869)
• ec46800 fix(mime-node): keep a boundary that is only line breaks from stripping to empty
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[cursor]

PR Summary

Low Risk
Patch-level dependency update with no repo code changes; typical Dependabot risk profile.

Overview
Bumps nodemailer from ^10.0.0 to ^10.0.9 in ai-docs/package.json and refreshes pnpm-lock.yaml to resolve 10.0.9.

That patch range pulls in upstream fixes (address parsing, MIME multipart boundaries, SMTP pool cleanup, and related mail handling). No application source in this PR is edited—only the dependency declaration and lockfile.

The lockfile diff also removes the scratchpad workspace importer block, which is consistent with a full lock refresh rather than a separate feature change.

^{Reviewed by Cursor Bugbot for commit 5b8505f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.5 KiB	+8 B (+0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	0 B (0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	+8 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.2 KiB	56.3 KiB	+44 B (+0.1%)	66.4 KiB	✅
Codex	Live turn messages	9	10	+1 (+11.1%)	21	✅
Claude	Total thread wire	13.5 KiB	13.5 KiB	−1 B (−0.0%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	+1 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−2 B (−0.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.0 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	9	9	0 (0.0%)	21	✅

Baseline: f5cb3b4 · PR result: 5b8505f · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 114.0 KiB
• Claude decoded thread snapshot: 114.7 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.