Skip to content

chore(deps): close ~36 Dependabot advisories via resolutions and direct bumps #40174

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ggazzo merged 15 commits into from
Apr 17, 2026
+113 −127
Merged

chore(deps): close ~36 Dependabot advisories via resolutions and direct bumps #40174

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
c26d7e2
chore(deps): pin yauzl to ^3.2.1 (GHSA-gmq8-994r-jv83)
ggazzo Apr 15, 2026
953950d
chore(deps): pin serialize-javascript to ^7.0.5 (GHSA-qj8w-gfj5-8c6v)
ggazzo Apr 15, 2026
46813c0
chore(deps): pin path-to-regexp ^8.1.0 range to ^8.4.0 (GHSA-27v5-c46…
ggazzo Apr 15, 2026
c58ac8c
chore(deps): pin markdown-it to ^14.1.1 (GHSA-38c4-r59v-3vqw)
ggazzo Apr 15, 2026
b3ff071
chore(deps): pin follow-redirects to ^1.16.0 (GHSA-r4q5-vmmm-2653)
ggazzo Apr 15, 2026
f470675
chore(deps): pin picomatch 2.x and 4.x ranges (GHSA-3v7f-55p6-f55p)
ggazzo Apr 15, 2026
b868422
chore(deps): pin brace-expansion 2.x and 5.x ranges (GHSA-f886-m6hf-6…
ggazzo Apr 15, 2026
63fafa4
chore(deps): pin yaml 1.x and 2.x ranges (GHSA-48c2-rrv3-qjmp)
ggazzo Apr 15, 2026
517fce4
chore(deps): pin undici 6.x to ^6.24.0
ggazzo Apr 15, 2026
c16ad75
chore(deps): pin handlebars to ^4.7.9
ggazzo Apr 15, 2026
487cb3e
chore(deps): pin fast-xml-parser 4.x and 5.x ranges
ggazzo Apr 15, 2026
4857212
chore(deps): bump lodash resolution from 4.17.21 to ^4.18.0 (GHSA-f23…
ggazzo Apr 15, 2026
ebcada5
chore(deps): bump nodemailer 7.0.13 → 8.0.5 in apps/meteor
ggazzo Apr 15, 2026
afb732d
chore(deps): bump file-type 16.5.4 → 21.3.1 in apps/meteor (GHSA-5v7r…
ggazzo Apr 15, 2026
b0d8225
Revert "chore(deps): bump file-type 16.5.4 → 21.3.1 in apps/meteor (G…
ggazzo Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions apps/meteor/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -255,7 +255,7 @@
"node-dogstatsd": "^0.0.7",
"node-fetch": "2.7.0",
"node-rsa": "^1.1.1",
"nodemailer": "^7.0.13",
"nodemailer": "^8.0.5",

@coderabbitai coderabbitai Bot Apr 17, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# List all direct usages of the nodemailer runtime/type surface in apps/meteor to scope verification.
rg -nP --type=ts -C2 "from ['\"]nodemailer(/[^'\"]+)?['\"]" apps/meteor
rg -nP --type=ts -C2 '\b(createTransport|sendMail)\s*\(' apps/meteor/server/features/EmailInbox

Repository: RocketChat/Rocket.Chat

Length of output: 2081

🏁 Script executed:

# Check the current package.json to see final state of both packages
grep -A2 -B2 'nodemailer' apps/meteor/package.json | head -20

# Search for any other usages of Mail type or nodemailer in apps/meteor
rg -n 'Mail\.' apps/meteor/server/features/EmailInbox --type=ts

# Check if there are any TypeScript config or type checking setups
find apps/meteor -name 'tsconfig*.json' -type f | head -5

Repository: RocketChat/Rocket.Chat

Length of output: 962

🏁 Script executed:

# Check the exact imports and types being used
cat -n apps/meteor/server/features/EmailInbox/EmailInbox_Outgoing.ts | sed -n '1,30p'

# Search for Mail usage more broadly
rg 'Mail\.(Options|Attachment)' apps/meteor/server/features/EmailInbox --type=ts -n

Repository: RocketChat/Rocket.Chat

Length of output: 2181

🏁 Script executed:

# Check if there are any type errors in the EmailInbox files
# Look for any recent changes or fixes related to nodemailer types
git log --oneline --all -20 -- apps/meteor/package.json | head -20

# Check the current branches to see if this is merged or in progress
git status

Repository: RocketChat/Rocket.Chat

Length of output: 1544

🏁 Script executed:

# Search for any changeset or PR information about nodemailer bump
find . -name '*.md' -path '*changeset*' -type f | xargs grep -l "nodemailer" 2>/dev/null | head -5

# Check the PR or changeset details
rg "nodemailer" --type=md -B3 -A3 .changeset/ 2>/dev/null | head -40

# Verify the actual structure: does `@types/nodemailer` export Mail as default?
# Search online documentation or check if there's a test that uses Mail type
rg "Mail\." apps/meteor --type=ts -B1 | head -50

Repository: RocketChat/Rocket.Chat

Length of output: 814

🌐 Web query:

@types/nodemailer v8.0.0 Mail type export default nodemailer/lib/mailer

💡 Result:

In @types/nodemailer v8.0.0, the Mail type is exported from the main index.d.ts module via import Mail = require("./lib/mailer");, making it available as a named export Mail. It is not a default export from nodemailer/lib/mailer itself, but an alias re-exported for convenience in the public API. The lib/mailer/index.d.ts file defines the Mail class (extends EventEmitter, with properties like options: Mail.Options, transporter: Transport, etc.), and the main module uses export type Transporter<T = any, D extends TransportOptions = TransportOptions> = Mail<T, D>; and export type SendMailOptions = Mail.Options;. This structure matches the nodemailer library's design where createTransport returns a Mail instance.

Citations:

🏁 Script executed:

# Check if the codebase has a recent build or if there are known type errors
# Look for build output or type check results
find . -name 'tsconfig.json' -path '*/apps/meteor*' -type f | head -3

# Check the actual tsconfig to see if strict type checking is enabled
cat apps/meteor/tsconfig.json | head -30

# Verify if the Mail type import actually works by checking if there are type errors
# Search for how Mail type is imported in v8 types in test files or other places
rg "import.*Mail.*from.*nodemailer" --type=ts -B2 -A2 | head -40

Repository: RocketChat/Rocket.Chat

Length of output: 1781

🏁 Script executed:

# Check what the actual PR changed in these files
git diff HEAD -- apps/meteor/server/features/EmailInbox/EmailInbox_Outgoing.ts apps/meteor/server/features/EmailInbox/EmailInbox.ts 2>/dev/null | head -100

# Also check package.json diff to see what was changed
git diff HEAD -- apps/meteor/package.json | grep -A2 -B2 nodemailer

Repository: RocketChat/Rocket.Chat

Length of output: 48

🏁 Script executed:

# Let me check the actual `@types/nodemailer` package to understand the export structure
# by looking at the node_modules if available, or checking if there's evidence of type issues
rg "export.*Mail" --type=ts 2>/dev/null | grep nodemailer | head -10

# Search for any recent issues or PRs mentioning nodemailer type issues
rg "nodemailer.*type" .changeset --type=md 2>/dev/null

# Check if the import syntax `import type Mail from 'nodemailer/lib/mailer'` is correct
# by looking at the `@types/nodemailer` structure in DefinitelyTyped
python3 << 'EOF'
import json
import urllib.request

try:
    # Check DefinitelyTyped repo for `@types/nodemailer` v8 structure
    url = "https://raw.githubusercontent.com/DefinitelyTyped/DefinitelyTyped/master/types/nodemailer/lib/mailer/index.d.ts"
    response = urllib.request.urlopen(url, timeout=5)
    content = response.read().decode('utf-8')
    # Look for export statements
    lines = content.split('\n')
    export_lines = [l for l in lines if 'export' in l and ('class' in l or 'interface' in l or 'type' in l)]
    for line in export_lines[:10]:
        print(line.strip())
except Exception as e:
    print(f"Could not fetch: {e}")
    print("This is expected if no internet access is available.")
EOF

Repository: RocketChat/Rocket.Chat

Length of output: 263

Nodemailer major bump (7→8) — no type-compatibility concerns; verify testing before merge.

The Mail type and its nested types (Mail.Options, Mail.Attachment) are properly exported in @types/nodemailer v8.0.0, and the import syntax import type Mail from 'nodemailer/lib/mailer' is valid. The v7→v8 bump for nodemailer and the v6→v8 jump for @types/nodemailer carry no type-breaking changes; the public API surface used in apps/meteor/server/features/EmailInbox/EmailInbox.ts and EmailInbox_Outgoing.ts remains stable.

Nodemailer v8.0.5 includes the CRLF injection fix (GHSA-vvjj-xcjg-gr5g), making this a justified security update. Before merging, ensure the EmailInbox SMTP send/receive path has been tested at least once against v8, particularly the sendEmail() and buildMailAttachment() functions in EmailInbox_Outgoing.ts.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@apps/meteor/package.json` at line 258, Update and verify the Nodemailer v8
bump by running the SMTP send/receive path tests focused on the functions
sendEmail() and buildMailAttachment() in EmailInbox_Outgoing.ts (and related
usage in EmailInbox.ts); confirm the import type Mail from
'nodemailer/lib/mailer' still resolves and that Mail.Options / Mail.Attachment
typings match usage (adjust parameter types if TypeScript reports mismatches),
run integration tests or a manual send to ensure CRLF injection fix behavior
doesn't change message content/headers, and fix any runtime/type errors
discovered before merging.

"object-path": "^0.11.8",
"overlayscrollbars": "^2.11.4",
"overlayscrollbars-react": "^0.5.6",
Expand Down Expand Up @@ -378,7 +378,7 @@
"@types/mocha": "github:whitecolor/mocha-types",
"@types/node": "~22.16.5",
"@types/node-rsa": "^1.1.4",
"@types/nodemailer": "~6.4.22",
"@types/nodemailer": "^8.0.0",
"@types/oauth2-server": "^3.0.18",
"@types/object-path": "^0.11.4",
"@types/parseurl": "^1.3.3",
Expand Down
23 changes: 22 additions & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,13 +37,34 @@
"resolutions": {
"@sematext/gc-stats@npm:^1.5.9": "patch:@sematext/gc-stats@npm%3A1.5.9#~/.yarn/patches/@sematext-gc-stats-npm-1.5.9-01e77be4d0.patch",
"adm-zip": "0.5.9",
"brace-expansion@npm:^2.0.1": "^2.0.3",
"brace-expansion@npm:^5.0.2": "^5.0.5",
"cross-spawn": "7.0.6",
"drachtio-srf": "patch:drachtio-srf@npm%3A5.0.12#~/.yarn/patches/drachtio-srf-npm-5.0.12-b0b1afaad6.patch",
"lodash": "4.17.21",
"fast-xml-parser@npm:^4.2.4": "^4.5.5",
"fast-xml-parser@npm:^4.4.1": "^4.5.5",
"fast-xml-parser@npm:5.3.6": "^5.5.7",
"follow-redirects": "^1.16.0",
"handlebars": "^4.7.9",
"lodash": "^4.18.0",
"markdown-it": "^14.1.1",
"minimist": "1.2.6",
"mongodb": "6.10.0",
"picomatch@npm:^2.0.4": "^2.3.2",
"picomatch@npm:^2.2.1": "^2.3.2",
"picomatch@npm:^2.2.3": "^2.3.2",
"picomatch@npm:^2.3.1": "^2.3.2",
"picomatch@npm:^4.0.2": "^4.0.4",
"picomatch@npm:^4.0.3": "^4.0.4",
"path-to-regexp@npm:^8.1.0": "^8.4.0",
"serialize-javascript": "^7.0.5",
"underscore": "1.13.8",
"undici@npm:^6.19.5": "^6.24.0",
"webpack": "~5.104.0",
"yaml@npm:^1.10.0": "^1.10.3",
"yaml@npm:^2.2.2": "^2.8.3",
"yaml@npm:^2.8.1": "^2.8.3",
"yauzl": "^3.2.1",
"yoga-layout@npm:^3.2.1": "patch:yoga-layout@npm%3A3.2.1#~/.yarn/patches/yoga-layout-npm-3.2.1-51ec934670.patch",
"@react-pdf/layout@npm:^4.4.2": "patch:@react-pdf/layout@npm%3A4.4.2#~/.yarn/patches/@react-pdf-layout-npm-4.4.2-6c2e3312fa.patch",
"react-aria@npm:~3.37.0": "patch:react-aria@npm%3A3.37.0#~/.yarn/patches/react-aria-npm-3.37.0-83959bd2fa.patch",
Expand Down
Loading
Loading