build(deps): bump phpmailer/phpmailer from 7.0.2 to 7.1.1

[dependabot]

Bumps phpmailer/phpmailer from 7.0.2 to 7.1.1.

Release notes

Sourced from phpmailer/phpmailer's releases.

PHPMailer 7.1.1

This is a maintenance release.

7.1.0 introduced strict validation of the Encoding property, but it was a bit too strict; this release makes it case-insensitive, meaning that 8Bit will work just as 8bit does. If you're using the PHPMailer constants, this won't affect you as they were already lower-case.

PHPMailer 7.1.0

This is a maintenance and minor security release.

What's changed

• Validate MessageDate before including it in headers.
• Minor feature: some common non-RFC date formats and DateTime instances are now automatically converted to the right format for MessageDate.
• Strip breaks from XMailer, ContentType, and CharSet properties.
• Strip breaks from username and password properties before use in POP3.
• Enforce strict checks on Encoding values.
• Ease BC IMAP issues by allowing the parseAddresses $useimap parameter to be false or null without triggering a deprecation warning.
• Updated Turkish and Norwegian translations.
• Test case cleanup and improvements by @​jrfnl.
• Fix crash if Mailer ended up empty.
• Use Ubuntu 24.04 for tests.

Security changes

We received several duplicate reports of the same issue, buried deep in reams of AI slop. Specifically, several PHPMailer properties and two POP3 properties were not sanitised before use. These properties are typically only set by developers, not exposed to user input, and would also have to be mishandled by host applications to become a problem. Nevertheless, these properties have now been rendered harmless.

New Contributors

• @​Musty-26 made their first contribution in PHPMailer/PHPMailer#3303
• @​ClearanceClarence made their first contribution in PHPMailer/PHPMailer#3306
• @​cri2net made their first contribution in PHPMailer/PHPMailer#3307
• @​jsoref made their first contribution in PHPMailer/PHPMailer#3315
• @​masskrdjn made their first contribution in PHPMailer/PHPMailer#3328

Full Changelog: PHPMailer/PHPMailer@v7.0.2...v7.1.0

Changelog

Sourced from phpmailer/phpmailer's changelog.

Version 7.1.1 (May 18th, 2026)

• Make encoding validator case-insensitive

Version 7.1.0 (May 15th, 2026)

• Validate MessageDate before including it in headers.
• Minor feature: some common non-RFC date formats and DateTime instances are now automatically converted to the right format for MessageDate.
• Strip breaks from XMailer, ContentType, and CharSet properties.
• Strip breaks from username and password properties before use in POP3.
• Enforce strict checks on Encoding values.
• Ease BC IMAP issues by allowing the parseAddresses $useimap parameter to be false or null without triggering a deprecation warning.
• Updated Turkish and Norwegian translations.
• Test case cleanup and improvements by @​jrfnl.
• Fix crash if Mailer ended up empty.
• Use Ubuntu 24.04 for tests.

Commits

• 1bc1716 7.1.1
• 6663c65 Make encoding validation case-insensitive, fixes #3331
• 6ebbc6d Merge pull request #3332 from PHPMailer/dependabot/github_actions/action-runn...
• a7d2952 GH Actions: Bump github/codeql-action in the action-runners group
• 689b960 Dependabot cooldown
• e193b92 7.1.0
• 4a888c1 Strip breaks from username and password
• 5bb0a3e Changelog
• 0635324 Changelog
• 9bb152b Run on Ubuntu latest
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)