1.4.4

• fix(security): reject unsafe header names
• fix(security): normalize and centralize unsafe header-name rejection
• keep clean header lines on the fast path
• deps: bump versions

1.4.3

• fix: strip CR/LF from decoded RFC 2047 encoded words
• deps(all): bump versions

1.4.2

• fix(header): get_addresses parses the raw header, then decodes phrases

1.4.1

• fix(header): replace RFC 2231 regex with tokenizer (lib/rfc2231.js)
  • 20-40% faster typical case, 8,000% faster adversarial case
• fix(header): replace RFC 2047 regex with tokenizer (lib/rfc2047.js)
  • 2x-3x faster typical case, 1,500% faster adversarial case
• packaging / meta updates (#26)

1.4.0

• feat(header): get_addresses(key) returns parsed Address|Group

1.3.4

• fix(attachment-stream): cap paused buffer (default 64MB) at mailparser.attachment_max_buffered and abort with error when exceeded
• fix(body): require exact MIME boundary delimiter per RFC 2046 §5.1.1
• fix(body): pass contentDisposition to filters on non-empty bodies
• fix(body): propagate #depth + 1 to sibling parts in parse_child
• feat(body): options.maxMimeDepth overrides the config-derived cap
• perf(header): short-circuit _parse_rfc2231 to avoid ReDOS
• deps(all): bumped to latest

1.3.3

• dep(message-stream): update to 2.0.4

1.3.2

• replace polynomial regex with much faster slice()

1.3.1

Fixes

• header: prevent prototype pollution
  • belt: use Object.create instead of {}
  • suspenders: add guards for proto, constructor, and prototype
• header: switch from recursion to iteration in parser
  • prevents stack exhaustion vulnerabilities
• body: added max_mime_depth, default 100
• body: disallow empty boundaries

Changes

• dep(message-stream): update to v2
• test: added vulnerability test suite
• test: added additional test coverage
• test: ES2024, table driven

1.3.0

• change: split index.js into lib/ files
• style(esnext): some updates
  • private fields (#)
• doc(README): practical makeover
• test: organize the test suite
• test: switch test runner from mocha to node --test