[dependabot]

Bumps lettermint from 2.7.0 to 3.1.0.

Release notes

Sourced from lettermint's releases.

v3.1.0

What's Changed

• ci: fix the red release run and the changelog order by @​bjarn in lettermint/lettermint-node#38
• feat: add analyticsPages, retryAfter on server errors and the latest API types by @​bjarn in lettermint/lettermint-node#37

Full Changelog: lettermint/lettermint-node@v3.0.0...v3.1.0

v3.0.0

What's Changed

• feat(webhooks)!: add Basic Auth and required read flags by @​bjarn in lettermint/lettermint-node#35
• feat!: Lettermint Node SDK 3.0 by @​bjarn in lettermint/lettermint-node#36

Full Changelog: lettermint/lettermint-node@v2.8.0...v3.0.0

v2.8.0

What's Changed

• Use the SDK release bot for changelog updates by @​bjarn in lettermint/lettermint-node#30
• Read the release bot identity from GitHub by @​bjarn in lettermint/lettermint-node#31
• feat(api): align sandbox responses with OpenAPI by @​bjarn in lettermint/lettermint-node#32
• feat(api): add analytics and project report forwarding by @​bjarn in lettermint/lettermint-node#33
• fix(types): expose nullable inbound route domains by @​bjarn in lettermint/lettermint-node#34

Full Changelog: lettermint/lettermint-node@v2.7.0...v2.8.0

Changelog

Sourced from lettermint's changelog.

v3.1.0 - 2026-10-11

What's Changed

• ci: fix the red release run and the changelog order by @​bjarn in lettermint/lettermint-node#38
• feat: add analyticsPages, retryAfter on server errors and the latest API types by @​bjarn in lettermint/lettermint-node#37

Full Changelog: lettermint/lettermint-node@v3.0.0...v3.1.0

v3.0.0 - 2026-10-04

What's Changed

• feat(webhooks)!: add Basic Auth and required read flags by @​bjarn in lettermint/lettermint-node#35
• feat!: Lettermint Node SDK 3.0 by @​bjarn in lettermint/lettermint-node#36

Full Changelog: lettermint/lettermint-node@v2.8.0...v3.0.0

v2.8.0 - 2026-10-01

What's Changed

• Use the SDK release bot for changelog updates by @​bjarn in lettermint/lettermint-node#30
• Read the release bot identity from GitHub by @​bjarn in lettermint/lettermint-node#31
• feat(api): align sandbox responses with OpenAPI by @​bjarn in lettermint/lettermint-node#32
• feat(api): add analytics and project report forwarding by @​bjarn in lettermint/lettermint-node#33
• fix(types): expose nullable inbound route domains by @​bjarn in lettermint/lettermint-node#34

Full Changelog: lettermint/lettermint-node@v2.7.0...v2.8.0

Upgrade guide

Sourced from lettermint's upgrade guide.

Upgrade guide

• Upgrade from 2.x to 3.0
• Upgrade from 1.x to 2.0

Upgrade from 2.x to 3.0

2.x no longer receives updates, including fixes. Upgrade to 3.0 to keep getting them.

3.0 is a new major version. The main reason is safety: in 2.x, Lettermint.email(token) returned one mutable builder per client. Two emails composed at the same time on one client could mix recipients, content and Idempotency-Key, and an email abandoned halfway (for example because tags() threw) leaked into the next send. 3.0 stores nothing about a message on the client.

Highlights

• One client: new Lettermint({ sendingToken, teamToken }), or new Lettermint(token). It replaces Lettermint.email() and Lettermint.api().
• Sending is stateless: emails.send(message, options), emails.sendBatch(messages, options) and an immutable emails.compose() builder. The Idempotency-Key is a per-call option.
• Each part uses its own token: emails.* uses the sending token, the Team API uses the team token. The SDK never falls back to the other token.
• Typed errors for every outcome, including empty or HTML responses, redirects, timeouts and network failures.
• Redirects are never followed, so tokens are never sent to another host.
• Tokens never appear in console.log, util.inspect or JSON.stringify output.
• Webhook verification is async (Web Crypto) and requires both signature headers.
• Typed query objects ({ page: { size: 30 } }) and iterate() helpers that follow next_cursor.
• Types are generated from the current API specification and use its names (see Type names).
• Runs on Node.js 20+, Bun, Deno and edge runtimes. Node.js 18 is no longer supported.

Requirements

• Node.js 20 or later (or Bun, Deno, Cloudflare Workers, Vercel Edge).
• TypeScript users: the type declarations need lib: ["dom"] or @types/node 20+ for fetch, Headers and AbortSignal.

Upgrade with a coding agent

You can let a coding agent (Claude Code, Codex, Cursor, Copilot, …) do the upgrade. Copy this instruction into the agent from your project's root, then review its changes:

Upgrade this project from the `lettermint` Node.js SDK 2.x to 3.0.

Install lettermint@^3.0.0 with the project's package manager. 3.0 needs Node.js 20 or newer: check engines, CI workflows and Dockerfiles, and report anything older.
Read the upgrade guide before changing code: node_modules/lettermint/UPGRADE.md, or https://github.com/lettermint/lettermint-node/blob/main/UPGRADE.md. Treat it as the source of truth and don't guess APIs; when unsure, read the type declarations in node_modules/lettermint/dist/index.d.ts.
Find every use of the SDK: imports or requires of lettermint, Lettermint.email(, Lettermint.api(, new Lettermint(, .sendBatch(, .idempotencyKey(, .attach(, Webhook, verifyHeaders(, the 2.x error classes, and the 2.x type names from the guide's type-name table.
Rewrite each use following the guide's before/after examples:

Create one client with new Lettermint({ sendingToken }), adding teamToken only where the Team API is used. Keep the project's existing environment variable names.
Replace fluent builder chains with lettermint.emails.send({ ... }), or with lettermint.emails.compose() per email. Never keep a builder in module scope or share it between emails.
Move idempotency keys into the send() / sendBatch() options. Attachments become objects: { filename, content, contentType?, contentId? }.
Team API: use the same client, typed query objects instead of 'page[size]'-style strings, and the renamed methods from the guide.
Errors: switch to the 3.0 classes (ApiError, ValidationError, RateLimitError, …) and check them with instanceof.
Webhooks: await new Webhook(secret).verify(rawBody, headers). Keep passing the raw request body, keep the secret's whsec_ prefix, and make sure the X-Lettermint-Signature and X-Lettermint-Delivery headers reach the handler.
Rename types using the guide's type-name table.


Run the type checker, linter and tests, and fix every error. Don't send real email or call the live API while testing.
Finish with a summary: the files you changed, anything you could not migrate with certainty, and behaviour changes I should review.

</tr></table>

... (truncated)

Commits

• de8b03b feat: add analyticsPages, retryAfter on server errors and the latest API type...
• 0cce899 ci: fix the red release run and the changelog order (#38)
• 7ef2ba4 Update CHANGELOG
• 423c35d feat!: Lettermint Node SDK 3.0 (#36)
• fa7471c feat(webhooks)!: add Basic Auth and required read flags (#35)
• 1f224a3 Update CHANGELOG
• 4f790b5 fix(types): expose nullable inbound route domains (#34)
• 79b6103 feat(api): add analytics and project report forwarding (#33)
• 894d8d1 feat(api): align sandbox responses with OpenAPI
• 5df909e Read the release bot identity from GitHub (#31)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)