Skip to content

fix(deps): update dependency nodemailer to v8 [security] #933

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ham-renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update dependency nodemailer to v8 [security] #933

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions platforms/blabsy/client/functions/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion platforms/blabsy/client/functions/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
"dependencies": {
"firebase-admin": "^10.2.0",
"firebase-functions": "^4.0.1",
"nodemailer": "^7.0.0"
"nodemailer": "^8.0.0"
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Mar 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Search for nodemailer usage patterns that may be affected by v8 breaking changes

echo "=== Checking createTransport usage ==="
rg -n -C3 'createTransport' --type=ts --glob='!node_modules/**'

echo -e "\n=== Checking for pool transport usage ==="
rg -n -C3 'pool.*:.*true' --type=ts --glob='!node_modules/**'

echo -e "\n=== Checking for direct transport usage ==="
rg -n -C3 'direct.*:.*true' --type=ts --glob='!node_modules/**'

echo -e "\n=== Checking for custom envelope properties ==="
rg -n -C3 'envelope\s*:' --type=ts --glob='!node_modules/**'

echo -e "\n=== Checking for stream transport usage ==="
rg -n -C3 'streamTransport' --type=ts --glob='!node_modules/**'

echo -e "\n=== Checking for XOAuth2 usage ==="
rg -n -C3 'xoauth2' --type=ts --glob='!node_modules/**'

Repository: MetaState-Prototype-Project/prototype

Length of output: 7943

🌐 Web query:

What are the breaking changes in nodemailer v8 and is @types/nodemailer v6.4.6 compatible with nodemailer v8.0.0?

💡 Result:

The breaking changes in Nodemailer v8.0.0 are minimal: the error code 'NoAuth' has been renamed to 'ENOAUTH'. This is the only explicitly marked breaking change in the official changelog and release notes. Other changes in v8 are primarily bug fixes, such as improved socket cleanup, DNS fallback hardening, centralized error codes, and connection fallbacks. @types/nodemailer v6.4.6 is not compatible with Nodemailer v8.0.0. The v6.x types predate Nodemailer v8 (with v6.4.x last updated around 2024), and a pull request to update the types specifically for v8.0.0 remains open as of March 3, 2026 (PR #74624 in DefinitelyTyped). While newer type versions like v7.x exist for Nodemailer v7, they do not cover v8 changes. Users should use @types/nodemailer@latest (currently ~6.4.x or v7.x branches) with potential type mismatches or wait for the v8 types PR to merge, or use skipLibCheck: true in tsconfig.json as a temporary workaround.

Citations:

Update @types/nodemailer to v8.x for type compatibility.

The nodemailer v8.0.0 upgrade correctly addresses a critical SMTP command injection vulnerability. The only breaking change in v8 is a renaming of the error code 'NoAuth' to 'ENOAUTH', which doesn't affect the codebase since it only uses basic createTransport() with Gmail service.

However, @types/nodemailer v6.4.6 is incompatible with nodemailer v8.0.0. Update line 22 to "@types/nodemailer": "^8.0.0" or use skipLibCheck: true in tsconfig.json as a temporary workaround while the type definitions PR merges.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@platforms/blabsy/client/functions/package.json` at line 19, Update the
mismatched types by changing the dev dependency "@types/nodemailer" to a
v8.x-compatible version to match "nodemailer": "^8.0.0" in package.json (update
the "@types/nodemailer" entry to "^8.0.0"); alternatively, as a temporary
workaround edit tsconfig.json to set "skipLibCheck": true to avoid the type
conflict until the official v8 type definitions land. Ensure you update the
package.json dependency key "@types/nodemailer" and run install to verify types
resolve correctly.

},
"devDependencies": {
"@types/nodemailer": "^6.4.6",
Expand Down
Loading