[dependabot]

Updates the requirements on phpmailer/phpmailer to permit the latest version.

Release notes

Sourced from phpmailer/phpmailer's releases.

PHPMailer 7.2.0

• XOAUTH authentication with long tokens could report success when it had failed.
• S/MIME signed messages no longer contain bare LF line breaks.
• PHPMailer::parseAddresses() is deprecated, and will be removed in 8.0; it's too difficult to maintain consistently with the removal of the PHP IMAP extension, and it is the only part of PHPMailer that handles existing messages.
• The pcre8 validation pattern is deprecated. The default PHP validator is fine, and the pattern has some distant possibilities for ReDoS problems, so it's going.
• Long address lines are now folded correctly.
• Don't send QUIT if the connection is closed while DATA is in progress. Thanks to @​dualfroz.
• XCLIENT commands should expect a 220 response, not 250, and reset to a pre-HELO state.
• XCLIENT properties are now expected to be raw values, and are xtext-encoded at send time. Strictly speaking this is a BC break, but the above issue meant that XCLIENT was broken anyway, so the break is academic.
• Switch tests to use BadSMTP instead of postfix's smtp-sink for more reliable CI.
• Enable PHP 8.7 in CI, don't allow PHP 8.6 to fail any more.

What's Changed

• Clarify Gmail app password usage in Gmail SMTP example by @​Safaa-Raboudi in PHPMailer/PHPMailer#3340
• Add missing French translations by @​Safaa-Raboudi in PHPMailer/PHPMailer#3341
• Fix smtps DSN encryption mode by @​Shushangw in PHPMailer/PHPMailer#3345
• GH Actions: fail "setup-php" if requested tooling could not be installed by @​jrfnl in PHPMailer/PHPMailer#3355
• Normalise line breaks in S/MIME signed messages by @​dualfroz in PHPMailer/PHPMailer#3358
• Fold long address headers by @​dualfroz in PHPMailer/PHPMailer#3361
• Don't send QUIT while DATA is in progress by @​dualfroz in PHPMailer/PHPMailer#3362
• Composer: allow for PHPCS 4.x by @​jrfnl in PHPMailer/PHPMailer#3372
• GH Actions: update for the upcoming release of PHP 8.6 by @​jrfnl in PHPMailer/PHPMailer#3373

New Contributors

• @​Safaa-Raboudi made their first contribution in PHPMailer/PHPMailer#3340
• @​Shushangw made their first contribution in PHPMailer/PHPMailer#3345
• @​dualfroz made their first contribution in PHPMailer/PHPMailer#3358

Full Changelog: PHPMailer/PHPMailer@v7.1.1...v7.2.0

Changelog

Sourced from phpmailer/phpmailer's changelog.

7.2.0

• XOAUTH authentication with long tokens could report success when it had failed.
• S/MIME signed messages no longer contain bare LF line breaks.
• PHPMailer::parseAddresses() is deprecated, and will be removed in 8.0; it's too difficult to maintain consistently with the removal of the PHP IMAP extension, and it is the only part of PHPMailer that handles existing messages.
• The pcre8 validation pattern is deprecated. The default PHP validator is fine, and the pattern has some distant possibilities for ReDoS problems, so it's going.
• Long address lines are now folded correctly.
• Don't send QUIT if the connection is closed while DATA is in progress. Thanks to @​dualfroz.
• XCLIENT commands should expect a 220 response, not 250, and reset to a pre-HELO state.
• XCLIENT properties are now expected to be raw values, and are xtext-encoded at send time. Strictly speaking this is a BC break, but the above issue meant that XCLIENT was broken anyway, so the break is academic.
• Switch tests to use BadSMTP instead of postfix's smtp-sink for more reliable CI.
• Enable PHP 8.7 in CI, don't allow PHP 8.6 to fail any more.

Version 7.1.1 (May 18th, 2026)

• Make encoding validator case-insensitive

Version 7.1.0 (May 15th, 2026)

• Validate MessageDate before including it in headers.
• Minor feature: some common non-RFC date formats and DateTime instances are now automatically converted to the right format for MessageDate.
• Strip breaks from XMailer, ContentType, and CharSet properties.
• Strip breaks from username and password properties before use in POP3.
• Enforce strict checks on Encoding values.
• Ease BC IMAP issues by allowing the parseAddresses $useimap parameter to be false or null without triggering a deprecation warning.
• Updated Turkish and Norwegian translations.
• Test case cleanup and improvements by @​jrfnl.
• Fix crash if Mailer ended up empty.
• Use Ubuntu 24.04 for tests.

Version 7.0.2 (January 9th, 2026)

• Fixes for sendmail parameter problems in WordPress, thanks to @​SirLouen.
• Reduce memory consumption when sending large attachments by @​RobinvanderVliet.

Version 7.0.1 (November 25th, 2025)

• Use From domain when generating CIDs in msgHTML.
• Update to PHPCompatibility 10, resolve numerous PHPCS issues in PHP 8.5.
• Revise GitHub actions for PHP 8.5 and experimental 8.6 tests.
• Switch gmail example from the deprecated IMAP extension to use directorytree/imapengine for IMAP uploads.
• Set htmlspecialchars() flags explicitly and consistently.
• Convert XOAUTH2 token exceptions into PHPMailer Exceptions. The original exception is available as an inner exception.
• Deprecate VERSION constants in POP3 and SMTP classes.
• Remove dependency on roave/security-advisories; it's now built into composer 2.9.
• Update Dutch, Esperanto, and Norwegian translations.

Version 7.0.0 (October 15th, 2025)

This is exactly the same as 6.11.1 but bumps the major version number to indicate the presence of a BC break in child classes. Specifically, lang(), setLanguage(), and $language are now static, and should be called statically.

Version 6.12.0 (October 15th, 2025)

This is exactly the same as 6.10.0, reverting all the changes in 6.11.0 and 6.11.1, which inadvertently introduced a BC break affecting child classes. 6.11.1 has been re-released as 7.0.0.

Version 6.11.1 (September 30th, 2025)

• Avoid function signature problems with the deprecation of $useimap in parseAddresses.

... (truncated)

Commits

• f5eb501 7.2.0
• 54791f3 Because I'm civilised.
• 6041fbc Changelog
• a526689 Merge branch 'badsmtp'
• 2517e0b Don't save messages during tests except for under PHP 8.5, uses new BadSMTP p...
• 5e345bd Merge pull request #3371 from PHPMailer/dependabot/github_actions/action-runn...
• 937bea7 Merge pull request #3373 from jrfnl/feature/ghactions-update-for-php-8.6-release
• 597b9cf Merge pull request #3372 from jrfnl/feature/composer-update-phpcs
• 2650ff3 Merge branch 'master' into dependabot/github_actions/action-runners-4179f0a880
• 87e9d5a Use TLS 1.0 port
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 40.85%. Comparing base (822ff1a) to head (b6870f8).

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #2634   +/-   ##
=========================================
  Coverage     40.84%   40.85%           
  Complexity     4457     4457           
=========================================
  Files           179      179           
  Lines         13347    13345    -2     
=========================================
  Hits           5452     5452           
+ Misses         7895     7893    -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.