chore: upgrade nodemailer to 9.1.1 to address GHSA-2x7j-588g-ccc2, GHSA-8m3c-c648-2xjj, GHSA-cc9r-2j5m-2m83, GHSA-wmmp-3585-3rmp
Fixes SOU-2207
Fixes SOU-2208
Fixes SOU-2209
Fixes SOU-2210
Refreshes the yarn.lock entry for nodemailer from 9.0.1 to 9.1.1.
nodemailer is a direct dependency of packages/web at ^9.0.1, which already admitted the patched release, so this is a lockfile refresh only. No package.json change and no resolutions override were needed.
Advisories addressed
| Advisory | Patched in | Summary |
|---|---|---|
| GHSA-2x7j-588g-ccc2 | 9.1.0 | Quadratic time complexity in addressparser allows remote DoS via a crafted address list |
| GHSA-cc9r-2j5m-2m83 | 9.1.0 | Recipient-domain validation bypass via RFC 5322 comment mis-parsing |
| GHSA-wmmp-3585-3rmp | 9.1.0 | IDN/Punycode domain allow-list bypass |
| GHSA-8m3c-c648-2xjj | 9.1.1 | resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess with the legacy signature |
9.1.1 is at or above every patched floor above.
Verification
yarn why nodemailerreports a single instance,nodemailer@npm:9.1.1, with no vulnerable version remaining in the graph.yarn workspace @sourcebot/web test --run— 140 files, 1440 tests passed.
🤖 Generated with Claude Code
[!NOTE]
Low Risk
Dependency lockfile refresh to a patched minor/patch release with no application code changes.
Overview
Security patch: bumps the locked nodemailer version from 9.0.1 to 9.1.1 in yarn.lock only—packages/web already declares ^9.0.1, so no package.json or resolutions change.
This addresses four GitHub advisories (DoS in addressparser, recipient-domain validation bypass, IDN allow-list bypass, and resolveContent() bypassing file/URL access restrictions). Verification noted in the PR: single resolved instance at 9.1.1 and web tests passing.
Reviewed by Cursor Bugbot for commit 0ff8b9151ab0aae137b29b10bb0f6a7e00c65549. Bugbot is set up for automated code reviews on this repo. Configure here.
Summary by cubic
Upgrades nodemailer in yarn.lock from 9.0.1 to 9.1.1 to fix four security advisories (GHSA-2x7j-588g-ccc2, GHSA-8m3c-c648-2xjj, GHSA-cc9r-2j5m-2m83, GHSA-wmmp-3585-3rmp). The existing ^9.0.1 range already allowed the patched version, so this is a lockfile refresh only.