chore(deps): bump hyperpolymath/smtp-notify-action from 0.1.0 to 0.2.0 in the actions group

[dependabot]

Bumps the actions group with 1 update: hyperpolymath/smtp-notify-action.

Updates hyperpolymath/smtp-notify-action from 0.1.0 to 0.2.0

Release notes

Sourced from hyperpolymath/smtp-notify-action's releases.

v0.2.0

Static, byte-reproducible smtp-notify binaries. CI rebuilt them from this tag and verified they hash to exactly the SHA-256 pins inside this tag's action.yml before publishing.

Changelog

Sourced from hyperpolymath/smtp-notify-action's changelog.

== v0.2.0 — 2026-09-03

[IMPORTANT]

Upgrading from v0.1.0 changes behaviour. secure is now fail-closed: a value this action does not recognise is rejected instead of being treated as plaintext. A workflow that passed secure: false expecting dawidd6's "STARTTLS when the server offers it" now fails with a message naming the cause, rather than downgrading to cleartext. Sending in the clear requires typing plaintext. See MIGRATION.adoc.

This release also closes the v0.1.0 window described in the previous edition of this file: action.yml here downloads the v0.2.0 binaries and carries their SHA-256 pins, so the behaviour described below is the behaviour that runs.

=== Changed

• secure is now fail-closed. Transport selection accepts true/implicit (SMTPS), false/starttls, and plaintext. Any other value is rejected outright. false fails with a clear message because STARTTLS is not yet implemented, rather than silently downgrading. This is a deliberate incompatibility with dawidd6/action-send-mail, where false means "STARTTLS when the server offers it"; previously an unrecognised value here meant plaintext.
• Sending in the clear now requires typing plaintext explicitly.

=== Added

• Runner OS gate, checked before the architecture gate. Windows and Intel macOS both report x86_64 from uname -m, so an architecture-only gate downloaded the Linux binary, passed the SHA-256 check because the file was intact, and then died at exec with a confusing exec-format error. The failure now names the real cause.
• Whole-run watchdog, bounding connection, TLS handshake, and every read and write, exposed as timeout_seconds (default 60). It replaces a per-operation connect deadline that Zig 0.16.0 cannot honour — see BUSTFILE.adoc, BUST-2026-001 and BUST-2026-002. It is a whole-run deadline, not an idle timer.
• BUSTFILE.adoc — defects in dependencies, each with a hazard-control disposition and a re-check trigger.
• KNOWN-DEFECTS.adoc — our own defects, published rather than waited upon, including the exact scope of the formal claims.
• MIGRATION.adoc — migration guide from dawidd6/action-send-mail with the full input compatibility table.
• Community health: .github/SECURITY.md and .github/CONTRIBUTING.md, and this changelog.

=== Fixed

• Server reply text is now surfaced in diagnostics, so a rejection says what the server said instead of only that it failed.
• CI: strip CRLF from the mailpit raw fetch before whole-line greps, which had

... (truncated)

Commits

• ede1191 docs: restore the "@​main is not a release" statement, and say why (#15)
• ea60deb release: v0.2.0 — action.yml fetches the fixed binaries (#14)
• 93ee757 docs: security policy, contributing guide and changelog (#13)
• 4077691 fix: fail-closed transport, OS gate, server reply text, whole-run watchdog (#12)
• 5730180 docs: defect registers — Bustfile (dependencies) and known defects (ours) (#11)
• f3d5c1a docs: migration guide from dawidd6/action-send-mail (#8)
• 6d6147e docs: describe the dawidd6 relationship honestly (#7)
• f9809b1 fix(ci): strip CRLF from mailpit raw fetch before whole-line greps
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 69308594-5ae8-4966-90c4-c28b2239677a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}