fix(deps): update nodemailer to v9 to resolve SSRF vulnerability (GHSA-p6gq-j5cr-w38f)

package.json

@@ -68,7 +68,7 @@
 		"next-auth": "5.0.0-beta.32",
 		"next-intl": "^4.13.3",
 		"next-view-transitions": "^0.3.5",
-		"nodemailer": "^8.0.0",
+		"nodemailer": "^9.0.3",
 		"otplib": "^13.4.1",
 		"pino": "^10.3.1",
 		"react": "^19.2.8",

pnpm-lock.yaml

@@ -93,7 +93,7 @@ importers:
         version: 16.2.11(@babel/[email protected])(@opentelemetry/[email protected])(@playwright/[email protected])([email protected])([email protected]([email protected]))([email protected])
       next-auth:
         specifier: 5.0.0-beta.32
-        version: 5.0.0-beta.32([email protected](@babel/[email protected])(@opentelemetry/[email protected])(@playwright/[email protected])([email protected])([email protected]([email protected]))([email protected]))(nodemailer@8.0.11)([email protected])
+        version: 5.0.0-beta.32([email protected](@babel/[email protected])(@opentelemetry/[email protected])(@playwright/[email protected])([email protected])([email protected]([email protected]))([email protected]))(nodemailer@9.0.3)([email protected])
       next-intl:
         specifier: ^4.13.3
         version: 4.13.3([email protected](@babel/[email protected])(@opentelemetry/[email protected])(@playwright/[email protected])([email protected])([email protected]([email protected]))([email protected]))([email protected])([email protected])
@@ -101,8 +101,8 @@ importers:
         specifier: ^0.3.5
         version: 0.3.5([email protected](@babel/[email protected])(@opentelemetry/[email protected])(@playwright/[email protected])([email protected])([email protected]([email protected]))([email protected]))([email protected]([email protected]))([email protected])
       nodemailer:
-        specifier: ^8.0.0
+        specifier: ^9.0.3
-        version: 8.0.11
+        version: 9.0.3
       otplib:
         specifier: ^13.4.1
         version: 13.4.1
@@ -2969,6 +2969,11 @@ packages:
     engines: {node: '>=6.0.0'}
     hasBin: true
 
+  [email protected]:
+    resolution: {integrity: sha512-s4+sLr9mZ/CyqeRritFeYV/Zx73OAtmaHn6kkBS1XRoJn1hrg3xIDUcpicAEX68tkcIN0iBCgti31C8zxtkhsQ==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
   [email protected]:
     resolution: {integrity: sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw==}
     engines: {node: '>=10.0.0'}
@@ -2996,6 +3001,11 @@ packages:
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
     hasBin: true
 
+  [email protected]:
+    resolution: {integrity: sha512-JxV13hNrFxqjOc8alRbq9dK1MM79NEXYpma2B2J4wAtpWS5zIEIKqWPGCl7N4o7Uc7B7itylh7SuDujATRyyTw==}
+    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
+    hasBin: true
+
   [email protected]:
     resolution: {integrity: sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==}
 
@@ -3388,6 +3398,9 @@ packages:
   [email protected]:
     resolution: {integrity: sha512-kiDJdIUawuEIcp9XoICKp1iTYDEbgguIPq526N1Q7jIQDeQ3CqoMx71025PI/7E48Ddtw2HuWsVjY7afEgNxmg==}
 
+  [email protected]:
+    resolution: {integrity: sha512-yHiw2Y3C3H9U6TMbOfoWK/BPreiOPXRfTWPBwQBoZG6/8TB6eOPnsy5oaRYuatR7Fw2SJ4kKforgufeo7fq0EQ==}
+
   [email protected]:
     resolution: {integrity: sha512-zxxR9k+rx5ktMwT/FwyLdPCrq7xN6e4VGGHH8hA01vVYKjTFik7nHOxBnAYtrgYUB1RpAiLvA1/U2YraWxyKKg==}
 
@@ -3409,6 +3422,10 @@ packages:
     resolution: {integrity: sha512-rpsZEGT1jFuve6QlpyRp9ckQ+kN61hvF9BzCPyMdaKTm8UJce96KBn3sorXOFXlzjPrs3Vc4T1NsSroZ3PxlFw==}
     engines: {node: '>=10.13.0'}
 
+  [email protected]:
+    resolution: {integrity: sha512-PwKooW9JUzh5chmYfHM3IQl5OkK2u2Nm011MgeZrss3JmFraUx/fqrf78kk8GUMYoibx/14MdwTl/1WKkG7TpQ==}
+    engines: {node: '>=10.13.0'}
+
   [email protected]:
     resolution: {integrity: sha512-rRqJg/6gd538VHvR3PSrdRBb/1Vy2YfzHqzvbhGIQpDRKIa4FgV/54b5Q1xYSxOOwKvjXweS26E0Q+nAMwp2pQ==}
     engines: {node: '>=8.6'}
@@ -4488,8 +4505,8 @@ packages:
     resolution: {integrity: sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ==}
     engines: {node: '>=18'}
 
-  nodemailer@8.0.11:
+  nodemailer@9.0.3:
-    resolution: {integrity: sha512-nrO/pDAUKl+wXX+lx16tDLbnm0fW6sK/x8mgohaCpg+CdCEl482bD4tCuAZk2DyliruiNTIZxRCoWkDqJEnAiA==}
+    resolution: {integrity: sha512-n+YP+NKwR5zRWa60k3GiQ6Q3B4KXCoAw40dAKeCtYn020iNN74aWK2liXIC3ZEATeGql7we3tE3t8QwhY0eskw==}
     engines: {node: '>=6.0.0'}
 
   [email protected]:
@@ -5650,7 +5667,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@auth/[email protected](nodemailer@8.0.11)':
+  '@auth/[email protected](nodemailer@9.0.3)':
     dependencies:
       '@panva/hkdf': 1.2.1
       jose: 6.2.3
@@ -5658,7 +5675,7 @@ snapshots:
       preact: 10.24.3
       preact-render-to-string: 6.5.11([email protected])
     optionalDependencies:
-      nodemailer: 8.0.11
+      nodemailer: 9.0.3
 
   '@babel/[email protected]':
     dependencies:
@@ -8058,6 +8075,8 @@ snapshots:
 
   [email protected]: {}
 
+  [email protected]: {}
+
   [email protected]: {}
 
   [email protected]:
@@ -8101,6 +8120,14 @@ snapshots:
       node-releases: 2.0.51
       update-browserslist-db: 1.2.3([email protected])
 
+  [email protected]:
+    dependencies:
+      baseline-browser-mapping: 2.11.4
+      caniuse-lite: 1.0.30001806
+      electron-to-chromium: 1.5.396
+      node-releases: 2.0.51
+      update-browserslist-db: 1.2.3([email protected])
+
   [email protected]: {}
 
   [email protected]: {}
@@ -8468,6 +8495,8 @@ snapshots:
 
   [email protected]: {}
 
+  [email protected]: {}
+
   [email protected]: {}
 
   [email protected]: {}
@@ -8485,6 +8514,11 @@ snapshots:
       graceful-fs: 4.2.11
       tapable: 2.3.3
 
+  [email protected]:
+    dependencies:
+      graceful-fs: 4.2.11
+      tapable: 2.3.3
+
   [email protected]:
     dependencies:
       ansi-colors: 4.1.3
@@ -9499,13 +9533,13 @@ snapshots:
 
   [email protected]: {}
 
-  [email protected]([email protected](@babel/[email protected])(@opentelemetry/[email protected])(@playwright/[email protected])([email protected])([email protected]([email protected]))([email protected]))(nodemailer@8.0.11)([email protected]):
+  [email protected]([email protected](@babel/[email protected])(@opentelemetry/[email protected])(@playwright/[email protected])([email protected])([email protected]([email protected]))([email protected]))(nodemailer@9.0.3)([email protected]):
     dependencies:
-      '@auth/core': 0.41.3(nodemailer@8.0.11)
+      '@auth/core': 0.41.3(nodemailer@9.0.3)
       next: 16.2.11(@babel/[email protected])(@opentelemetry/[email protected])(@playwright/[email protected])([email protected])([email protected]([email protected]))([email protected])
       react: 19.2.8
     optionalDependencies:
-      nodemailer: 8.0.11
+      nodemailer: 9.0.3
 
   [email protected]: {}
 
@@ -9571,7 +9605,7 @@ snapshots:
 
   [email protected]: {}
 
-  nodemailer@8.0.11: {}
+  nodemailer@9.0.3: {}
 
   [email protected]: {}
 
@@ -10562,6 +10596,12 @@ snapshots:
       escalade: 3.2.0
       picocolors: 1.1.1
 
+  [email protected]([email protected]):
+    dependencies:
+      browserslist: 4.28.7
+      escalade: 3.2.0
+      picocolors: 1.1.1
+
   [email protected]:
     dependencies:
       punycode: 2.3.1
@@ -10690,9 +10730,9 @@ snapshots:
       '@webassemblyjs/wasm-parser': 1.14.1
       acorn: 8.17.0
       acorn-import-phases: 1.0.4([email protected])
-      browserslist: 4.28.6
+      browserslist: 4.28.7
       chrome-trace-event: 1.0.4
-      enhanced-resolve: 5.24.2
+      enhanced-resolve: 5.24.3
       es-module-lexer: 2.3.1
       eslint-scope: 5.1.1
       events: 3.3.0