chore(deps): bump postal-mime from 2.7.5 to 4.0.5

[dependabot]

Bumps postal-mime from 2.7.5 to 4.0.5.

Release notes

Sourced from postal-mime's releases.

v4.0.5

4.0.5 (2026-10-07)

Bug Fixes

• bound the number of MIME parts with a maxPartCount option (87eaedd)
• convert html with many unclosed link tags to text in linear time (c8e5792)
• decode uppercase hex, NUL and C1 numeric character references like a browser (ee12306)
• delete the trailing white space of quoted-printable lines (0639c5e)
• end the headers at a whitespace-only line when no header can follow it (0639c5e)
• fold line breaks out of decoded encoded words and RFC 2231 filenames (1f25e26)
• hand attachment bytes through as sent and read legacy mail the lax way (0639c5e)
• keep an escaped parenthesis inside an RFC 5322 comment (a2a07ce)
• keep the line endings of 7bit, 8bit and binary parts and normalize text to LF (0639c5e)
• read a multipart without a boundary parameter as plain text (0639c5e)
• read text without a usable charset as UTF-8 or windows-1252 and honor an html meta charset (0639c5e)
• unfold format=flowed quoted paragraphs as RFC 3676 reads them (0639c5e)

v4.0.4

4.0.4 (2026-10-03)

Bug Fixes

• stop decoding the CRLF before a multipart boundary as part content (004eec7), closes #102

v4.0.3

4.0.3 (2026-10-03)

Bug Fixes

• keep a continuation from overriding the plain parameter of the same name (6fa92ad)
• stop the junk behind a closed quoted string from hiding the whole body (535fcf8)

v4.0.2

4.0.2 (2026-09-30)

Bug Fixes

• stop a "[" from hiding the operators after it (2797ee5)

v4.0.1

4.0.1 (2026-09-30)

Bug Fixes

... (truncated)

Changelog

Sourced from postal-mime's changelog.

4.0.5 (2026-10-07)

Bug Fixes

• bound the number of MIME parts with a maxPartCount option (87eaedd)
• convert html with many unclosed link tags to text in linear time (c8e5792)
• decode uppercase hex, NUL and C1 numeric character references like a browser (ee12306)
• delete the trailing white space of quoted-printable lines (0639c5e)
• end the headers at a whitespace-only line when no header can follow it (0639c5e)
• fold line breaks out of decoded encoded words and RFC 2231 filenames (1f25e26)
• hand attachment bytes through as sent and read legacy mail the lax way (0639c5e)
• keep an escaped parenthesis inside an RFC 5322 comment (a2a07ce)
• keep the line endings of 7bit, 8bit and binary parts and normalize text to LF (0639c5e)
• read a multipart without a boundary parameter as plain text (0639c5e)
• read text without a usable charset as UTF-8 or windows-1252 and honor an html meta charset (0639c5e)
• unfold format=flowed quoted paragraphs as RFC 3676 reads them (0639c5e)

4.0.4 (2026-10-03)

Bug Fixes

• stop decoding the CRLF before a multipart boundary as part content (004eec7), closes #102

4.0.3 (2026-10-03)

Bug Fixes

• keep a continuation from overriding the plain parameter of the same name (6fa92ad)
• stop the junk behind a closed quoted string from hiding the whole body (535fcf8)

4.0.2 (2026-09-30)

Bug Fixes

• stop a "[" from hiding the operators after it (2797ee5)

4.0.1 (2026-09-30)

Bug Fixes

• do not read an address out of a quoted encoded word (c88eaf5)
• keep a display name holding an encoded word out of the address (ce5ba24)
• open a domain-literal only after the '@' of an address (776b951)
• port the address parser fixes from Nodemailer (902bd3f)

... (truncated)

Commits

• 16a157b chore(master): release 4.0.5 (#106)
• a2a07ce fix: keep an escaped parenthesis inside an RFC 5322 comment
• 472121f test: compare the windows-1252 fallback with the runtime's own decoder
• f5506e2 test: fuzz the parser with mutated fixtures and round trip messages composed ...
• 0639c5e fix: hand attachment bytes through as sent and read legacy mail the lax way
• a8135c7 docs: sandbox the demo iframe and note what the parsed output needs sanitizin...
• 1f25e26 fix: fold line breaks out of decoded encoded words and RFC 2231 filenames
• ee12306 fix: decode uppercase hex, NUL and C1 numeric character references like a bro...
• c8e5792 fix: convert html with many unclosed link tags to text in linear time
• 87eaedd fix: bound the number of MIME parts with a maxPartCount option
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)