From 530eff26b5cd2c86548718599297584713866226 Mon Sep 17 00:00:00 2001 From: Aric Camarata Date: Sun, 13 Sep 2026 06:36:41 -0400 Subject: [PATCH] fix(deps): bump nodemailer to 9.1.1 in backend/functions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three open Dependabot high alerts against backend/functions, all on nodemailer and all fixed by 9.1.1: GHSA-2x7j-588g-ccc2 resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess via the legacy signature addressparser quadratic O(n^2) time, remote DoS via a crafted address list IDN/Punycode domain allow-list bypass, delivery to an attacker-controlled domain The declared range was already ^9.0.5, which permits 9.1.1, but package-lock.json pinned 9.0.5 and CI installs with npm ci — so the range alone fixed nothing. Raising the floor to ^9.1.1 as well so it cannot silently regress to a vulnerable patch. backend/functions is npm-managed (CI runs npm ci); left as npm rather than converted. Verified: npm ci exits 0, npm run typecheck clean, npm test 95 pass 0 fail. --- backend/functions/package-lock.json | 8 ++++---- backend/functions/package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/backend/functions/package-lock.json b/backend/functions/package-lock.json index d29f684..2938612 100644 --- a/backend/functions/package-lock.json +++ b/backend/functions/package-lock.json @@ -9,7 +9,7 @@ "version": "0.1.0", "dependencies": { "@sentry/node": "^8.0.0", - "nodemailer": "^9.0.5" + "nodemailer": "^9.1.1" }, "devDependencies": { "@types/node": "^20.0.0", @@ -1438,9 +1438,9 @@ "license": "MIT" }, "node_modules/nodemailer": { - "version": "9.0.5", - "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.0.5.tgz", - "integrity": "sha512-wvjiKvjczmsN7U/8006JOdXubgBk2XFAbioDMbT+sM7cPs0QrhJTa6KBRX7P5REGGkDcLUz/EarWidb8G8C1jQ==", + "version": "9.1.1", + "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.1.1.tgz", + "integrity": "sha512-izw9mVKFix6YSnC9eLgV6g1opl9DUlRio9ZNcq+Wu9Ujn2UwF+8Nl0B8nz22kEC+CTZCvinkxwJ0DeFbb6NwcQ==", "license": "MIT-0", "engines": { "node": ">=6.0.0" diff --git a/backend/functions/package.json b/backend/functions/package.json index fa4b8e0..8524d19 100644 --- a/backend/functions/package.json +++ b/backend/functions/package.json @@ -14,7 +14,7 @@ }, "dependencies": { "@sentry/node": "^8.0.0", - "nodemailer": "^9.0.5" + "nodemailer": "^9.1.1" }, "devDependencies": { "@types/node": "^20.0.0",