From f660708962f5c40fc2a87b8c5d596b0499e451ea Mon Sep 17 00:00:00 2001 From: oxmc7769 Date: Sun, 5 Jul 2026 06:22:11 -0700 Subject: [PATCH] chore: bump nodemailer v6 -> v9 (resolves high-severity advisories) createTransport()/sendMail() callback API unchanged between majors - smoke tested the transport directly (confirmed correct error type, not an API shape error) since the test suite doesn't exercise the email-sending path (EMAIL_VERIFICATION off in tests). Full build + 179-test suite still pass. 3 unique vulnerable packages remain (aws-sdk's own advisory + its nested uuid, vite/esbuild dev-server issue needing a major v5->v8 bump) - left deliberately, all lower practical risk or need a dedicated upgrade pass. --- package-lock.json | 16 ++++++++-------- package.json | 4 ++-- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/package-lock.json b/package-lock.json index 6a881f5..31baea6 100644 --- a/package-lock.json +++ b/package-lock.json @@ -38,7 +38,7 @@ "lodash.debounce": "^4.0.8", "mongodb": "^6.21.0", "mongoose": "^8.4.1", - "nodemailer": "^6.9.14", + "nodemailer": "^9.0.3", "normalize.css": "^8.0.1", "password-prompt": "^1.1.2", "progress-stream": "^2.0.0", @@ -85,7 +85,7 @@ "@types/jsonwebtoken": "^8.3.9", "@types/lodash": "^4.17.5", "@types/node": "^20.14.2", - "@types/nodemailer": "^6.4.15", + "@types/nodemailer": "^8.0.1", "@types/prompts": "^2.4.9", "@types/react": "^18.3.3", "@types/react-dom": "^18.3.0", @@ -4895,9 +4895,9 @@ } }, "node_modules/@types/nodemailer": { - "version": "6.4.17", - "resolved": "https://registry.npmjs.org/@types/nodemailer/-/nodemailer-6.4.17.tgz", - "integrity": "sha512-I9CCaIp6DTldEg7vyUTZi8+9Vo0hi1/T8gv3C89yk1rSAAzoKQ8H8ki/jBYJSFoH/BisgLP8tkZMlQ91CIquww==", + "version": "8.0.1", + "resolved": "https://registry.npmjs.org/@types/nodemailer/-/nodemailer-8.0.1.tgz", + "integrity": "sha512-PxpaInm8V1JQDd4j0ds5HfvWQk8JupS1C0Picb96QJsrrRDjBH+DlK7L4ZdNSqNULhiZRQHc40nLVShaGxXAMw==", "dev": true, "license": "MIT", "dependencies": { @@ -11819,9 +11819,9 @@ "license": "MIT" }, "node_modules/nodemailer": { - "version": "6.10.1", - "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-6.10.1.tgz", - "integrity": "sha512-Z+iLaBGVaSjbIzQ4pX6XV41HrooLsQ10ZWPUehGmuantvzWoDVBnmsdUcOIDM1t+yPor5pDhVlDESgOMEGxhHA==", + "version": "9.0.3", + "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.0.3.tgz", + "integrity": "sha512-n+YP+NKwR5zRWa60k3GiQ6Q3B4KXCoAw40dAKeCtYn020iNN74aWK2liXIC3ZEATeGql7we3tE3t8QwhY0eskw==", "license": "MIT-0", "engines": { "node": ">=6.0.0" diff --git a/package.json b/package.json index a20249c..6f74ac3 100755 --- a/package.json +++ b/package.json @@ -50,7 +50,7 @@ "lodash.debounce": "^4.0.8", "mongodb": "^6.21.0", "mongoose": "^8.4.1", - "nodemailer": "^6.9.14", + "nodemailer": "^9.0.3", "normalize.css": "^8.0.1", "password-prompt": "^1.1.2", "progress-stream": "^2.0.0", @@ -97,7 +97,7 @@ "@types/jsonwebtoken": "^8.3.9", "@types/lodash": "^4.17.5", "@types/node": "^20.14.2", - "@types/nodemailer": "^6.4.15", + "@types/nodemailer": "^8.0.1", "@types/prompts": "^2.4.9", "@types/react": "^18.3.3", "@types/react-dom": "^18.3.0",