chore(deps): bump nodemailer from 8 to 9#456
Merged
Merged
Conversation
Fixes the one remaining high advisory that had no in-range fix: the message-level raw option bypassing disableFileAccess (vulnerable <=9.0.0). The only breaking change in v9 is that HTTPS requests made while fetching remote content now validate TLS certificates by default -- attachment href/path URLs, OAuth2 token endpoints and HTTP proxy CONNECT. None of those apply here: sendEmail passes rendered HTML with no attachments, the production transport uses plain SMTP auth against smtp2go, and the development transport is mailpit on localhost with ignoreTLS. Verified by sending a real email through sendEmail into the local mailpit container and asserting it arrived, plus npm run lint and npm run build. Stacked on top of the Dependabot batch (#455).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the last high-severity advisory that had no in-range fix. The message-level
rawoption bypassesdisableFileAccess, and the advisory range is<=9.0.0, so 9.0.x is the only way out —npm audit fixcannot reach it.Why this is low risk
v9 has exactly one breaking change: HTTPS requests made while fetching remote content now validate TLS certificates by default. That covers attachment
href/pathURLs, OAuth2 token endpoints, and HTTP/HTTPS proxy CONNECT.None of those apply to
src/server/services/mailer.tsx, which is the only place nodemailer is used:sendEmailpasses rendered HTML — no attachments, so no remote fetches.mail.smtp2go.com— no OAuth2.localhost:1025withignoreTLS: true.Verification
Rather than trusting the changelog, I sent a real email through the app's own
sendEmailinto the local mailpit container and asserted via mailpit's API that it arrived with the right recipient. That test was temporary and is not in this diff — CI has only Postgres and Redis, so a mailpit-dependent test would fail there.Also:
npm run lint,npm run build.Note
Stacked on #455 — the base will retarget to
mainautomatically once that merges.🤖 Generated with Claude Code