From 8b03fb450e383c74ec392b576e8fd9e2e76f2355 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Thu, 18 Jun 2026 23:04:27 +0200 Subject: [PATCH] fix(deps): patch undici and nodemailer high-severity advisories Bump undici 8.4.1 -> 8.5.0 (GHSA-vmh5-mc38-953g, TLS certificate validation bypass in the SOCKS5 ProxyAgent) and nodemailer 9.0.0 -> 9.0.1 (GHSA-p6gq-j5cr-w38f), both direct dependencies. Clears the production high-severity dependency audit; no API change. --- package.json | 4 ++-- pnpm-lock.yaml | 20 ++++++++++---------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/package.json b/package.json index 7d097d9ba..ca1f3164d 100644 --- a/package.json +++ b/package.json @@ -73,11 +73,11 @@ "mmdb-lib": "^3.0.2", "next": "16.2.6", "next-themes": "^0.4.6", + "nodemailer": "^9.0.1", "p-limit": "^7.3.0", "pg-boss": "^12.18.2", "prisma": "^7.8.0", "qrcode": "^1.5.4", - "nodemailer": "^9.0.0", "radix-ui": "^1.4.3", "react": "19.2.7", "react-dom": "19.2.7", @@ -87,7 +87,7 @@ "sax": "^1.6.0", "sonner": "^2.0.7", "tailwind-merge": "^3.6.0", - "undici": "^8.4.1", + "undici": "^8.5.0", "web-push": "^3.6.7", "yaml": "^2.8.4", "zod": "^4.4.3", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 15afc4d70..a1db36f88 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -82,8 +82,8 @@ importers: specifier: ^0.4.6 version: 0.4.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7) nodemailer: - specifier: ^9.0.0 - version: 9.0.0 + specifier: ^9.0.1 + version: 9.0.1 p-limit: specifier: ^7.3.0 version: 7.3.0 @@ -124,8 +124,8 @@ importers: specifier: ^3.6.0 version: 3.6.0 undici: - specifier: ^8.4.1 - version: 8.4.1 + specifier: ^8.5.0 + version: 8.5.0 web-push: specifier: ^3.6.7 version: 3.6.7 @@ -5196,8 +5196,8 @@ packages: resolution: {integrity: sha512-GYVXHE2KnrzAfsAjl4uP++evGFCrAU1jta4ubEjIG7YWt/64Gqv66a30yKwWczVjA6j3bM4nBwH7Pk1JmDHaxQ==} engines: {node: '>=18'} - nodemailer@9.0.0: - resolution: {integrity: sha512-tbPTid7d/p9jAA8CRZ3iomvrMaST0o6NYuY7v6JQZHpPRZ61mLFSPKYd7342NtOFuej9/+L48SOIxwfu2uDvtw==} + nodemailer@9.0.1: + resolution: {integrity: sha512-Gwv8SQewT616ZM/URn0H54b8PWo/Wum7md3EW2aWy1lO27+WZCX+Xyak3J+NlmHUjDh5ME+uesJUDRbR3Ye8Bw==} engines: {node: '>=6.0.0'} non-error@0.1.0: @@ -6345,8 +6345,8 @@ packages: resolution: {integrity: sha512-3O9Tf67pGhgOv9jM35AbhkXAKi13f3oy3aE4CSgr+TckGeY+/iu97ZXN+J7DpHPzLbVApFd1IFhcnBjREYXYcg==} engines: {node: '>=20.18.1'} - undici@8.4.1: - resolution: {integrity: sha512-RNHlB4fxZK0IrkhBsxhlbx7s8kFWwr7rzzOqj5nvZugw3ig3RsB7KW3zVlV0eu8POl+rx5d1hmL7rRg0z1owow==} + undici@8.5.0: + resolution: {integrity: sha512-xamtWoB1EshgjpmlXd7GGm2VfdDtw1+rD8uhry8pSNW3If6S8E0m2T2+orSKeZXEn/aPJMviCpDBA65WJt8zhg==} engines: {node: '>=22.19.0'} unicorn-magic@0.3.0: @@ -11834,7 +11834,7 @@ snapshots: node-releases@2.0.46: {} - nodemailer@9.0.0: {} + nodemailer@9.0.1: {} non-error@0.1.0: {} @@ -13233,7 +13233,7 @@ snapshots: undici@7.26.0: {} - undici@8.4.1: {} + undici@8.5.0: {} unicorn-magic@0.3.0: {}