chore(deps): bump aiosmtplib from 5.1.2 to 5.1.3 in /backend

[dependabot]

Bumps aiosmtplib from 5.1.2 to 5.1.3.

Release notes

Sourced from aiosmtplib's releases.

v5.1.3

What's Changed

• Security: reject addresses containing whitespace or angle brackets outside of a quoted local part in mail, rcpt, vrfy, expn and sendmail. Previously, a caller supplied address such as user@example.com> AUTH=<attacker@example.com could smuggle additional ESMTP parameters onto the command line. This is a follow up to the fix in 5.1.1 for CVE-2026-53533 (GHSA-v3q9-hj7j-63hq), which only rejected control characters. sendmail now validates all addresses before sending any commands.
• Bugfix: reject local_hostname values (and the hostname argument to helo/ehlo) containing whitespace or control characters, so a hostname such as me.example.com XCLIENT ADDR=1.2.3.4 can no longer smuggle extra parameters onto the EHLO/HELO command line. Surrounding whitespace is stripped.
• Bugfix: raise SMTPAuthenticationError instead of binascii.Error when the server sends a malformed (non-base64) CRAM-MD5 challenge, so login can fall back to the next auth method
• Bugfix: prevent SMTP command/response desync from unsolicited server data (thanks @​Charisn for contributing)
• Bugfix: handle protocol connection lost callback arriving after reconnect
• Bugfix: close connection on async context manager exit in cases of a server error response
• Bugfix: release connection lock on connect timeout
• Bugfix: re-derive the default port on each connect() so changing use_tls/start_tls between connects no longer reuses a stale default. Defaulted port/hostname are now resolved per-connect rather than written back onto the instance, so they read back as None when unset
• Bugfix: typeerror in latest ty
• Bugfix: mark response waiter exceptions as retrieved when they are set, so Future exception was never retrieved is no longer logged on free-threaded builds where the previous __del__ based cleanup ran too late
• CI: test on free-threaded 3.14 and on 3.15 (standard and free-threaded)
• Bugfix: the SIZE parameter sent with MAIL FROM now reports the number of octets as the message will be transmitted (with CRLF line endings), rather than the raw length of the message argument
• Bugfix: data arriving on the transport after the connection is lost is now dropped instead of raising RuntimeError from the protocol callback
• Bugfix: SMTPProtocol now records that it is using TLS after a successful start_tls, so a second upgrade attempt on the protocol is rejected
• Bugfix: starttls now validates its TLS options before sending EHLO, so invalid options raise ValueError without touching the connection
• Bugfix: helo no longer records a failed response as last_helo_response, so a rejected HELO does not leave the session looking as if a greeting succeeded
• Bugfix: bytearray and memoryview values are no longer silently passed through the auth encoding helpers; only str and bytes are accepted, as the type annotations already stated
• Bugfix: TLS context setup now run in thread (thanks @​tr4nt0r)

New Contributors

... (truncated)

Changelog

Sourced from aiosmtplib's changelog.

5.1.3

• Security: reject addresses containing whitespace or angle brackets outside of a quoted local part in mail, rcpt, vrfy, expn and sendmail. Previously, a caller supplied address such as user@example.com> AUTH=<attacker@example.com could smuggle additional ESMTP parameters onto the command line. This is a follow up to the fix in 5.1.1 for CVE-2026-53533 (GHSA-v3q9-hj7j-63hq), which only rejected control characters. sendmail now validates all addresses before sending any commands.
• Bugfix: reject local_hostname values (and the hostname argument to helo/ehlo) containing whitespace or control characters, so a hostname such as me.example.com XCLIENT ADDR=1.2.3.4 can no longer smuggle extra parameters onto the EHLO/HELO command line. Surrounding whitespace is stripped.
• Bugfix: raise SMTPAuthenticationError instead of binascii.Error when the server sends a malformed (non-base64) CRAM-MD5 challenge, so login can fall back to the next auth method
• Bugfix: prevent SMTP command/response desync from unsolicited server data (thanks @​Charisn for contributing)
• Bugfix: handle protocol connection lost callback arriving after reconnect
• Bugfix: close connection on async context manager exit in cases of a server error response
• Bugfix: release connection lock on connect timeout
• Bugfix: re-derive the default port on each connect() so changing use_tls/start_tls between connects no longer reuses a stale default. Defaulted port/hostname are now resolved per-connect rather than written back onto the instance, so they read back as None when unset
• Bugfix: typeerror in latest ty
• Bugfix: mark response waiter exceptions as retrieved when they are set, so Future exception was never retrieved is no longer logged on free-threaded builds where the previous __del__ based cleanup ran too late
• CI: test on free-threaded 3.14 and on 3.15 (standard and free-threaded)
• Bugfix: the SIZE parameter sent with MAIL FROM now reports the number of octets as the message will be transmitted (with CRLF line endings), rather than the raw length of the message argument
• Bugfix: data arriving on the transport after the connection is lost is now dropped instead of raising RuntimeError from the protocol callback
• Bugfix: SMTPProtocol now records that it is using TLS after a successful start_tls, so a second upgrade attempt on the protocol is rejected
• Bugfix: starttls now validates its TLS options before sending EHLO, so invalid options raise ValueError without touching the connection
• Bugfix: helo no longer records a failed response as last_helo_response, so a rejected HELO does not leave the session looking as if a greeting succeeded
• Bugfix: bytearray and memoryview values are no longer silently passed through the auth encoding helpers; only str and bytes are accepted, as the type annotations already stated
• Bugfix: TLS context setup now run in thread (thanks @​tr4nt0r)

Commits

• 9cc4254 ci: only twine-check wheel and sdist in buildcheck
• e4ee41a release: v5.1.3
• 8ee1047 test: replace event_loop_policy override with pytest_asyncio_loop_factories hook
• ddf47a7 ci: test on free-threaded 3.14 and on 3.15 (standard and free-threaded)
• ced720d test: expect HeaderWriteError for non-ASCII address on Python 3.15+
• 4d22898 fix: mark response waiter exceptions as retrieved when set
• 7b8e3de fix: report SIZE as transmitted octets, not raw message length
• aa0d536 fix: drop data received after connection loss instead of raising
• bdc17f5 fix: mark SMTPProtocol as over SSL after a successful start_tls
• 1d84d57 fix: validate starttls options before sending EHLO
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: backend, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.