[dependabot]

Bumps github.com/wneessen/go-mail from 0.8.1 to 0.8.2.

Release notes

Sourced from github.com/wneessen/go-mail's releases.

v0.8.2

[!IMPORTANT] This release fixes two vulnerabilities. All users are encouraged to update to this release at their earliest convenience.

Welcome to go-mail v0.8.2! 🎉

This release fixes two vulnerabilities and brings some additional bugfixes and improvements.

Notable features / improvements / fixes

Fixes for two vulnerabilities

• Unchecked out of bounds read in EML parser can cause panic (GHSA-f82v-42xw-72cj) Reported by @​4n86rakam1 and @​lml20000827 Affected versions: >= v0.4.2
• Unfiltered List-Unsubscribe helper function can lead to CRLF header injection (GHSA-w8w6-94hg-2qpm) Reported by: @​4n86rakam1, @​NotAFlightRisk, @​Hama1cco and @​lml20000827 Affected version: v0.8.1

Both vulnerabilities were reported independently in the same timeframe by different reporters and have been merged into two dedicated security advisories. Thanks to everbody who helped improving go-mail's security.

CVEs for both vulnerabilities have been requested, but so far GH has not reacted. In case CVEs are issued by GH, these will be added once received.

Version bump minimal required Go version

PR #645 bumps the minimal required Go version to 1.26.10 to mitigate CVE-2026-111943. Given the severity of the CVE, this makes sure no MitM is possible when talking to TLS secured servers.

Connection closing fixes

PRs #633, #634 and #653 fix issues in the SMTP connection opening and closing logic that could lead to potential process leaking in some edge cases. Thanks to @​riabkovK, @​mai7star and @​bensynapse for reporting the issues and also providing the corresponding PRs.

Client connection without EHLO

PR #641 adds a new configuration flag (WithoutEhlo) that allows the client to skip the initial EHLO attempt when dialing, and only include the HELO call, for when we're certain that the server does not support EHLO (and might misbehave when receiving an unknown command). Thanks to @​Neelo16 for providing the PR.

Encode non-ASCII attachment filenames as RFC 2231 extended parameters

PR #605 fixes the encoding of non-ASCII attachment and embed filenames which were written as RFC 2047 encoded-words inside the quoted parameter (which is explicitly forbidden by RFC 2047 section 5). Thanks to @​binggao1230 for submitting the PR.

Fixes to formatted mail address handling

PR #657 fixes the formatted address handling in all *Format() functions. Previously addresses that were supposed to be quoted, were not quoted correctly. e. g. Robert "Bob" Tester as name would have resulted in "Robert Bob Tester". With the fix, the name is quoted correctly into "Robert \"Bob\" Tester". Thanks to @​wleeaf for reporting the issue and providing a suggested fix PR, which has partly been incoorporated into #657.

Fixes to IPv6 dial address handling

PR #661 fixes the Client dial address handling, that would fail on IPv6 literal hosts. Thanks to @​Narek-Khachikyan for submitting the PR.

What's Changed

• Updated Go module dependencies and Go version by @​wneessen in wneessen/go-mail#619
• Refactored msgwriter_test.go by @​wneessen in wneessen/go-mail#620
• Updated dependencies in go.mod and go.sum by @​wneessen in wneessen/go-mail#644

... (truncated)

Commits

• c9de003 Update doc.go
• acb8216 Merge commit from fork
• 76dcf24 security(msg): Sanitize List-Unsubscribe URIs
• 24f8292 Merge commit from fork
• 4cb4854 security(eml): fix slice out of bounds read
• 175b419 Merge pull request #661 from Narek-Khachikyan/bugfix/660_ipv6-dial-address
• 8f7a6f9 Merge pull request #657 from wneessen/bugfix/652_fix-address-quoting
• 8a34282 Add test cases for quoted display names in addresses
• f52b570 Add lcov.info to ignored coverage data
• 78dbbf9 Add tests for RequestMDNToMailAddr
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[ecosquad-autoreview]

Review: Dependabot — bump go-mail 0.8.1 → 0.8.2

Verdict: ✅ Approve

This is a standard dependabot security bump of github.com/wneessen/go-mail from v0.8.1 to v0.8.2, which fixes two security advisories (out-of-bounds read in the EML parser, GHSA-f82v-42xw-72cj, and CRLF header injection via List-Unsubscribe, GHSA-w8w6-94hg-2qpm), plus connection-handling and IPv6 dial fixes. It also raises the go directive to 1.26.10 (required by the upstream module for the CVE-2026-111943 mitigation) and updates indirect golang.org/x/* dependencies accordingly.

What I verified

• API compatibility — the only go-mail usage in the repo is internal/notification/smtp.go (mail.NewClient + options, NewMsg/From/To/Subject/SetBodyString, DialAndSendWithContext, *mail.SendError). All of these are stable APIs, unchanged in the 0.8.x patch series. The behavioral changes in v0.8.2 (display-name quoting, List-Unsubscribe sanitization, EML parser bounds checks) don't affect this code path, since we only send plain messages and never set List-Unsubscribe or parse inbound mail.
• go.sum — the updated h1:/go.mod hashes for go-mail v0.8.2 and the bumped golang.org/x/{crypto,net,sys,text,tools} indirect deps are present and consistent with the go.mod changes.
• CI — build, go-test, go-test-acc, ent-codegen, and lint checks all pass on the head commit, so the module graph and the newer minimum Go version compile and test cleanly.

Findings

• suggestion — Dockerfile (ARG GO_VERSION=1.26) and .github/workflows/ci.yaml (GO_VERSION: '1.26') pin only the minor version. The new go 1.26.10 directive in go.mod is satisfied because the floating golang:1.26 / actions/setup-go tags resolve to the latest 1.26.x patch release (≥ 1.26.10, confirmed by the passing build). This is a bit fragile: reproducibility depends on the tag continuing to point at a new enough patch. Consider pinning to 1.26.10 explicitly in both places, or leaving a note. Not blocking — CI already proves it works at the current patch level.

Nothing else of note; no security, correctness, or data-loss concerns. Please merge.