Skip to content

chore: upgrade nodemailer to ^9.0.1 to address GHSA-p6gq-j5cr-w38f#1356

Draft
linear-code[bot] wants to merge 2 commits into
mainfrom
linear/sou-1410-sourcebot-devsourcebot-ghsa-p6gq-j5cr-w38f-nodemailer-ab79
Draft

chore: upgrade nodemailer to ^9.0.1 to address GHSA-p6gq-j5cr-w38f#1356
linear-code[bot] wants to merge 2 commits into
mainfrom
linear/sou-1410-sourcebot-devsourcebot-ghsa-p6gq-j5cr-w38f-nodemailer-ab79

Conversation

@linear-code

@linear-code linear-code Bot commented Jun 21, 2026

Copy link
Copy Markdown
Contributor

Fixes SOU-1410

Upgrades nodemailer from ^8.0.9 (resolving to 8.0.11) to ^9.0.1 to address GHSA-p6gq-j5cr-w38f, where a message-level raw option bypassed disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF.

nodemailer is a top-level dependency of packages/web; the only usage is the standard createTransport / sendMail API in the next-auth email provider, which is unchanged across the v8→v9 major.

@github-actions

Copy link
Copy Markdown
Contributor

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.

1 similar comment
@github-actions

Copy link
Copy Markdown
Contributor

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants