From cebdf23b3814398fa6ce15fe7feca83c4f7eae9e Mon Sep 17 00:00:00 2001 From: yusufipk Date: Sat, 27 Jun 2026 13:38:07 +0200 Subject: [PATCH] fix(security): bump nodemailer to 9.0.1 Resolves the high-severity advisory (dependabot #20) where the message-level raw option bypassed disableFileAccess/disableUrlAccess, enabling arbitrary file read and SSRF. We only use the standard createTransport/sendMail API, so the major bump is non-breaking. --- bun.lock | 4 ++-- package.json | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bun.lock b/bun.lock index 88894c8..84435f0 100644 --- a/bun.lock +++ b/bun.lock @@ -20,7 +20,7 @@ "next": "16.2.6", "next-auth": "^5.0.0-beta.30", "next-themes": "^0.4.6", - "nodemailer": "^8.0.5", + "nodemailer": "^9.0.1", "pg": "^8.18.0", "prisma": "^7.3.0", "radix-ui": "^1.4.3", @@ -1455,7 +1455,7 @@ "node-releases": ["node-releases@2.0.27", "", {}, "sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA=="], - "nodemailer": ["nodemailer@8.0.5", "", {}, "sha512-0PF8Yb1yZuQfQbq+5/pZJrtF6WQcjTd5/S4JOHs9PGFxuTqoB/icwuB44pOdURHJbRKX1PPoJZtY7R4VUoCC8w=="], + "nodemailer": ["nodemailer@9.0.1", "", {}, "sha512-Gwv8SQewT616ZM/URn0H54b8PWo/Wum7md3EW2aWy1lO27+WZCX+Xyak3J+NlmHUjDh5ME+uesJUDRbR3Ye8Bw=="], "npm-run-path": ["npm-run-path@5.3.0", "", { "dependencies": { "path-key": "^4.0.0" } }, "sha512-ppwTtiJZq0O/ai0z7yfudtBpWIoxM8yE6nHi1X47eFR2EWORqfbu6CnPlNsjeN683eT0qG6H/Pyf9fCcvjnnnQ=="], diff --git a/package.json b/package.json index 319e509..8dd9f9c 100644 --- a/package.json +++ b/package.json @@ -43,7 +43,7 @@ "next": "16.2.6", "next-auth": "^5.0.0-beta.30", "next-themes": "^0.4.6", - "nodemailer": "^8.0.5", + "nodemailer": "^9.0.1", "pg": "^8.18.0", "prisma": "^7.3.0", "radix-ui": "^1.4.3",