SSE/WebsiteTheSSEquel
4
0
Fork 0
Code Issues 82 Pull requests 21 Projects Releases Packages Wiki Activity Actions

deps: bump nodemailer from 7.0.13 to 9.0.3 in /next #564

Open
dependabot[bot] wants to merge 1 commit from dependabot/npm_and_yarn/next/main/nodemailer-9.0.3 into main
pull from: dependabot/npm_and_yarn/next/main/nodemailer-9.0.3
merge into: SSE:main
Conversation 0 Commits 1 Files changed 2 +5 -5
dependabot[bot] commented 2026-07-19 22:38:01 +00:00 (Migrated from github.com)
Copy link

Bumps nodemailer from 7.0.13 to 9.0.3.

Release notes

Sourced from nodemailer's releases.

v9.0.3

9.0.3 (2026-06-30)

Bug Fixes

  • smtp-connection: harden STARTTLS upgrade and secure socket handling (#1835) (07d8253)

v9.0.2

9.0.2 (2026-06-29)

Bug Fixes

  • addressparser: keep operator chars inside an address-literal as text (#1829) (9ba1064)
  • harden smtp-connection low-severity issues (22ddcea)
  • harden smtp-connection response parsing and socket lifecycle (68860b9)
  • prevent SES transport callback double-invocation and hang on sync errors (#1831) (9517bc5)
  • reject CRLF in HTTP proxy CONNECT destination to prevent request injection (6347b47)

v9.0.1

9.0.1 (2026-06-17)

Bug Fixes

  • enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

  • HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

  • replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)
  • validate TLS certificates by default when fetching remote content (6a947ac)

v8.0.11

8.0.11 (2026-06-10)

Bug Fixes

  • apply the transport-level newline option in stream and sendmail transports (cb4f904)
  • include icalEvent path/href content in the application/ics attachment (b801c48)
  • parse Ethereal response props without polynomial regex backtracking (067aebe)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

9.0.3 (2026-06-30)

Bug Fixes

  • smtp-connection: harden STARTTLS upgrade and secure socket handling (#1835) (07d8253)

9.0.2 (2026-06-29)

Bug Fixes

  • addressparser: keep operator chars inside an address-literal as text (#1829) (9ba1064)
  • harden smtp-connection low-severity issues (22ddcea)
  • harden smtp-connection response parsing and socket lifecycle (68860b9)
  • prevent SES transport callback double-invocation and hang on sync errors (#1831) (9517bc5)
  • reject CRLF in HTTP proxy CONNECT destination to prevent request injection (6347b47)

9.0.1 (2026-06-17)

Bug Fixes

  • enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

9.0.0 (2026-06-14)

⚠ BREAKING CHANGES

  • HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

  • replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)
  • validate TLS certificates by default when fetching remote content (6a947ac)

8.0.11 (2026-06-10)

Bug Fixes

  • apply the transport-level newline option in stream and sendmail transports (cb4f904)
  • include icalEvent path/href content in the application/ics attachment (b801c48)
  • parse Ethereal response props without polynomial regex backtracking (067aebe)
  • resolve oauth2_provision_cb at send time for non-pooled SMTP transports (203c8ec)
  • return the promise from every resolveContent branch (07ffe8c)
  • strip the url scheme from List-ID header values (77e5885)
  • tag AWS SES transport errors with the ESES code (efa647a)

... (truncated)

Commits
  • 1f61eb4 chore(master): release 9.0.3 (#1836)
  • 07d8253 fix(smtp-connection): harden STARTTLS upgrade and secure socket handling (#1835)
  • 4801f3a chore(master): release 9.0.2 (#1832)
  • 9ba1064 fix(addressparser): keep operator chars inside an address-literal as text (#1...
  • 22ddcea fix: harden smtp-connection low-severity issues
  • af002eb chore: add Node.js 26 to the CI test matrix
  • 6347b47 fix: reject CRLF in HTTP proxy CONNECT destination to prevent request injection
  • 68860b9 fix: harden smtp-connection response parsing and socket lifecycle
  • 9517bc5 fix: prevent SES transport callback double-invocation and hang on sync errors...
  • 69cf625 chore(master): release 9.0.1 (#1828)
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 7.0.13 to 9.0.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nodemailer/nodemailer/releases">nodemailer's releases</a>.</em></p> <blockquote> <h2>v9.0.3</h2> <h2><a href="https://github.com/nodemailer/nodemailer/compare/v9.0.2...v9.0.3">9.0.3</a> (2026-06-30)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>smtp-connection:</strong> harden STARTTLS upgrade and secure socket handling (<a href="https://redirect.github.com/nodemailer/nodemailer/issues/1835">#1835</a>) (<a href="https://github.com/nodemailer/nodemailer/commit/07d8253326ecefff9f7d92c157429ce8bc7335f8">07d8253</a>)</li> </ul> <h2>v9.0.2</h2> <h2><a href="https://github.com/nodemailer/nodemailer/compare/v9.0.1...v9.0.2">9.0.2</a> (2026-06-29)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>addressparser:</strong> keep operator chars inside an address-literal as text (<a href="https://redirect.github.com/nodemailer/nodemailer/issues/1829">#1829</a>) (<a href="https://github.com/nodemailer/nodemailer/commit/9ba1064f3b115cd60cb63aa954a3c0961e86fbb7">9ba1064</a>)</li> <li>harden smtp-connection low-severity issues (<a href="https://github.com/nodemailer/nodemailer/commit/22ddcea8ed043e4ea23b8971b75a2df196b5a581">22ddcea</a>)</li> <li>harden smtp-connection response parsing and socket lifecycle (<a href="https://github.com/nodemailer/nodemailer/commit/68860b94311b5b6837754e5e790f186ca8a00b70">68860b9</a>)</li> <li>prevent SES transport callback double-invocation and hang on sync errors (<a href="https://redirect.github.com/nodemailer/nodemailer/issues/1831">#1831</a>) (<a href="https://github.com/nodemailer/nodemailer/commit/9517bc5dc94e77907bb157e3466bf73a2b327f5c">9517bc5</a>)</li> <li>reject CRLF in HTTP proxy CONNECT destination to prevent request injection (<a href="https://github.com/nodemailer/nodemailer/commit/6347b47c7d12f9d3acf53d391b921e836f400640">6347b47</a>)</li> </ul> <h2>v9.0.1</h2> <h2><a href="https://github.com/nodemailer/nodemailer/compare/v9.0.0...v9.0.1">9.0.1</a> (2026-06-17)</h2> <h3>Bug Fixes</h3> <ul> <li>enforce disableFileAccess/disableUrlAccess for raw message option (<a href="https://github.com/nodemailer/nodemailer/commit/a82e060d978f27e5f41369a9a9807b1e3dedc2e2">a82e060</a>)</li> </ul> <h2>v9.0.0</h2> <h2><a href="https://github.com/nodemailer/nodemailer/compare/v8.0.11...v9.0.0">9.0.0</a> (2026-06-14)</h2> <h3>⚠ BREAKING CHANGES</h3> <ul> <li>HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment <code>tls</code> option).</li> </ul> <h3>Bug Fixes</h3> <ul> <li>replace deprecated url.parse with a WHATWG URL wrapper (<a href="https://github.com/nodemailer/nodemailer/commit/0c080fbf3278926f013a5c2ad06f5f6f0e18f5ed">0c080fb</a>)</li> <li>validate TLS certificates by default when fetching remote content (<a href="https://github.com/nodemailer/nodemailer/commit/6a947ac7114a16da1e6a50d9a6f4e17026ce145d">6a947ac</a>)</li> </ul> <h2>v8.0.11</h2> <h2><a href="https://github.com/nodemailer/nodemailer/compare/v8.0.10...v8.0.11">8.0.11</a> (2026-06-10)</h2> <h3>Bug Fixes</h3> <ul> <li>apply the transport-level newline option in stream and sendmail transports (<a href="https://github.com/nodemailer/nodemailer/commit/cb4f904a53d2c2feeaf327203c92378d46304398">cb4f904</a>)</li> <li>include icalEvent path/href content in the application/ics attachment (<a href="https://github.com/nodemailer/nodemailer/commit/b801c48fab8e9b71bc7e0ea1fb32ce6b34675b15">b801c48</a>)</li> <li>parse Ethereal response props without polynomial regex backtracking (<a href="https://github.com/nodemailer/nodemailer/commit/067aebec83b8cbe7682905e89b30ab19d260b503">067aebe</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md">nodemailer's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/nodemailer/nodemailer/compare/v9.0.2...v9.0.3">9.0.3</a> (2026-06-30)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>smtp-connection:</strong> harden STARTTLS upgrade and secure socket handling (<a href="https://redirect.github.com/nodemailer/nodemailer/issues/1835">#1835</a>) (<a href="https://github.com/nodemailer/nodemailer/commit/07d8253326ecefff9f7d92c157429ce8bc7335f8">07d8253</a>)</li> </ul> <h2><a href="https://github.com/nodemailer/nodemailer/compare/v9.0.1...v9.0.2">9.0.2</a> (2026-06-29)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>addressparser:</strong> keep operator chars inside an address-literal as text (<a href="https://redirect.github.com/nodemailer/nodemailer/issues/1829">#1829</a>) (<a href="https://github.com/nodemailer/nodemailer/commit/9ba1064f3b115cd60cb63aa954a3c0961e86fbb7">9ba1064</a>)</li> <li>harden smtp-connection low-severity issues (<a href="https://github.com/nodemailer/nodemailer/commit/22ddcea8ed043e4ea23b8971b75a2df196b5a581">22ddcea</a>)</li> <li>harden smtp-connection response parsing and socket lifecycle (<a href="https://github.com/nodemailer/nodemailer/commit/68860b94311b5b6837754e5e790f186ca8a00b70">68860b9</a>)</li> <li>prevent SES transport callback double-invocation and hang on sync errors (<a href="https://redirect.github.com/nodemailer/nodemailer/issues/1831">#1831</a>) (<a href="https://github.com/nodemailer/nodemailer/commit/9517bc5dc94e77907bb157e3466bf73a2b327f5c">9517bc5</a>)</li> <li>reject CRLF in HTTP proxy CONNECT destination to prevent request injection (<a href="https://github.com/nodemailer/nodemailer/commit/6347b47c7d12f9d3acf53d391b921e836f400640">6347b47</a>)</li> </ul> <h2><a href="https://github.com/nodemailer/nodemailer/compare/v9.0.0...v9.0.1">9.0.1</a> (2026-06-17)</h2> <h3>Bug Fixes</h3> <ul> <li>enforce disableFileAccess/disableUrlAccess for raw message option (<a href="https://github.com/nodemailer/nodemailer/commit/a82e060d978f27e5f41369a9a9807b1e3dedc2e2">a82e060</a>)</li> </ul> <h2><a href="https://github.com/nodemailer/nodemailer/compare/v8.0.11...v9.0.0">9.0.0</a> (2026-06-14)</h2> <h3>⚠ BREAKING CHANGES</h3> <ul> <li>HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment <code>tls</code> option).</li> </ul> <h3>Bug Fixes</h3> <ul> <li>replace deprecated url.parse with a WHATWG URL wrapper (<a href="https://github.com/nodemailer/nodemailer/commit/0c080fbf3278926f013a5c2ad06f5f6f0e18f5ed">0c080fb</a>)</li> <li>validate TLS certificates by default when fetching remote content (<a href="https://github.com/nodemailer/nodemailer/commit/6a947ac7114a16da1e6a50d9a6f4e17026ce145d">6a947ac</a>)</li> </ul> <h2><a href="https://github.com/nodemailer/nodemailer/compare/v8.0.10...v8.0.11">8.0.11</a> (2026-06-10)</h2> <h3>Bug Fixes</h3> <ul> <li>apply the transport-level newline option in stream and sendmail transports (<a href="https://github.com/nodemailer/nodemailer/commit/cb4f904a53d2c2feeaf327203c92378d46304398">cb4f904</a>)</li> <li>include icalEvent path/href content in the application/ics attachment (<a href="https://github.com/nodemailer/nodemailer/commit/b801c48fab8e9b71bc7e0ea1fb32ce6b34675b15">b801c48</a>)</li> <li>parse Ethereal response props without polynomial regex backtracking (<a href="https://github.com/nodemailer/nodemailer/commit/067aebec83b8cbe7682905e89b30ab19d260b503">067aebe</a>)</li> <li>resolve oauth2_provision_cb at send time for non-pooled SMTP transports (<a href="https://github.com/nodemailer/nodemailer/commit/203c8ecf97594ac2e69919b0f3ba966c0f86750e">203c8ec</a>)</li> <li>return the promise from every resolveContent branch (<a href="https://github.com/nodemailer/nodemailer/commit/07ffe8cfd97f0486b8c7b541f398922ddab47882">07ffe8c</a>)</li> <li>strip the url scheme from List-ID header values (<a href="https://github.com/nodemailer/nodemailer/commit/77e5885cfa0c6723ea7749c1ee74b1c11aeb78bd">77e5885</a>)</li> <li>tag AWS SES transport errors with the ESES code (<a href="https://github.com/nodemailer/nodemailer/commit/efa647a125dd698413a7cf6813b8e36881a06f91">efa647a</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nodemailer/nodemailer/commit/1f61eb49b4316589045576752c721bd89918ef21"><code>1f61eb4</code></a> chore(master): release 9.0.3 (<a href="https://redirect.github.com/nodemailer/nodemailer/issues/1836">#1836</a>)</li> <li><a href="https://github.com/nodemailer/nodemailer/commit/07d8253326ecefff9f7d92c157429ce8bc7335f8"><code>07d8253</code></a> fix(smtp-connection): harden STARTTLS upgrade and secure socket handling (<a href="https://redirect.github.com/nodemailer/nodemailer/issues/1835">#1835</a>)</li> <li><a href="https://github.com/nodemailer/nodemailer/commit/4801f3aa1a30ae96439c2899c58cc14a18a169ba"><code>4801f3a</code></a> chore(master): release 9.0.2 (<a href="https://redirect.github.com/nodemailer/nodemailer/issues/1832">#1832</a>)</li> <li><a href="https://github.com/nodemailer/nodemailer/commit/9ba1064f3b115cd60cb63aa954a3c0961e86fbb7"><code>9ba1064</code></a> fix(addressparser): keep operator chars inside an address-literal as text (<a href="https://redirect.github.com/nodemailer/nodemailer/issues/1">#1</a>...</li> <li><a href="https://github.com/nodemailer/nodemailer/commit/22ddcea8ed043e4ea23b8971b75a2df196b5a581"><code>22ddcea</code></a> fix: harden smtp-connection low-severity issues</li> <li><a href="https://github.com/nodemailer/nodemailer/commit/af002eb353760b171b1c76f1c14311b07d224386"><code>af002eb</code></a> chore: add Node.js 26 to the CI test matrix</li> <li><a href="https://github.com/nodemailer/nodemailer/commit/6347b47c7d12f9d3acf53d391b921e836f400640"><code>6347b47</code></a> fix: reject CRLF in HTTP proxy CONNECT destination to prevent request injection</li> <li><a href="https://github.com/nodemailer/nodemailer/commit/68860b94311b5b6837754e5e790f186ca8a00b70"><code>68860b9</code></a> fix: harden smtp-connection response parsing and socket lifecycle</li> <li><a href="https://github.com/nodemailer/nodemailer/commit/9517bc5dc94e77907bb157e3466bf73a2b327f5c"><code>9517bc5</code></a> fix: prevent SES transport callback double-invocation and hang on sync errors...</li> <li><a href="https://github.com/nodemailer/nodemailer/commit/69cf6252cd18227c79b75dd484357ee1e760e56e"><code>69cf625</code></a> chore(master): release 9.0.1 (<a href="https://redirect.github.com/nodemailer/nodemailer/issues/1828">#1828</a>)</li> <li>Additional commits viewable in <a href="https://github.com/nodemailer/nodemailer/compare/v7.0.13...v9.0.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=nodemailer&package-manager=npm_and_yarn&previous-version=7.0.13&new-version=9.0.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
This pull request has changes conflicting with the target branch.
  • next/package-lock.json
View command line instructions

Manual merge helper

Use this merge commit message when completing the merge manually.

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin dependabot/npm_and_yarn/next/main/nodemailer-9.0.3:dependabot/npm_and_yarn/next/main/nodemailer-9.0.3
git switch dependabot/npm_and_yarn/next/main/nodemailer-9.0.3

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff dependabot/npm_and_yarn/next/main/nodemailer-9.0.3
git switch dependabot/npm_and_yarn/next/main/nodemailer-9.0.3
git rebase main
git switch main
git merge --ff-only dependabot/npm_and_yarn/next/main/nodemailer-9.0.3
git switch dependabot/npm_and_yarn/next/main/nodemailer-9.0.3
git rebase main
git switch main
git merge --no-ff dependabot/npm_and_yarn/next/main/nodemailer-9.0.3
git switch main
git merge --squash dependabot/npm_and_yarn/next/main/nodemailer-9.0.3
git switch main
git merge --ff-only dependabot/npm_and_yarn/next/main/nodemailer-9.0.3
git switch main
git merge dependabot/npm_and_yarn/next/main/nodemailer-9.0.3
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
accessibility
Accessibility improvements

  
api

   
auth.js
Issues involving Auth.js authentication

  
backend

   
copy
Writing tasks

  
database

   
defect
Something is not as it should be

  
dependencies

   
design
Task related to UI/UX wireframing and style

  
discussion

   
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
epic
Track a larger initiative made up of stories

  
feature

   
front-end

   
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
next.js
Issues involving Next.js

  
noscript
Related to noscript / no-JS fallback support

  
on hold
This is being put on hold for now...

  
operations

   
optimization

   
postgresql
Issues involving PostgreSQL

  
prisma
Issues involving the Prisma ORM

  
prototype
Creating spike deliverables or prototypes

  
question
Further information is requested

  
react
Issue involving react

  
spike
Learning material

  
stale
This is old and should be reviewed for closure.

  
story
Track a user-facing or system-facing story

  
tailwind
Issues involving Tailwind CSS

  
vulnerability
Addressing a security vulnerability

  
wontfix
This will not be worked on

No labels
accessibility
api
auth.js
backend
copy
database
defect
dependencies
design
discussion
documentation
duplicate
enhancement
epic
feature
front-end
good first issue
help wanted
invalid
next.js
noscript
on hold
operations
optimization
postgresql
prisma
prototype
question
react
spike
stale
story
tailwind
vulnerability
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
SSE/WebsiteTheSSEquel!564
No description provided.