From 9ef38cf2898480846a6fcd9ecdb36e47b5eb049d Mon Sep 17 00:00:00 2001
From: nicktrn <55853254+nicktrn@users.noreply.github.com>
Date: Mon, 27 Apr 2026 15:51:13 +0100
Subject: [PATCH] chore(security): bump nodemailer 7 -> 8 for CRLF injection
 CVE

---
 internal-packages/emails/package.json |  4 ++--
 pnpm-lock.yaml                        | 23 ++++++++++-------------
 2 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/internal-packages/emails/package.json b/internal-packages/emails/package.json
index 68b01563b..65bc33e9d 100644
--- a/internal-packages/emails/package.json
+++ b/internal-packages/emails/package.json
@@ -13,7 +13,7 @@
     "@aws-sdk/client-sesv2": "^3.716.0",
     "@react-email/components": "0.0.16",
     "@react-email/render": "^0.0.12",
-    "nodemailer": "^7.0.11",
+    "nodemailer": "^8.0.6",
     "react": "^18.2.0",
     "react-email": "^2.1.1",
     "resend": "^3.2.0",
@@ -21,7 +21,7 @@
     "zod": "3.25.76"
   },
   "devDependencies": {
-    "@types/nodemailer": "^7.0.4",
+    "@types/nodemailer": "^8.0.0",
     "@types/react": "18.2.69"
   },
   "engines": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index c31ca4f27..784c9d440 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1138,8 +1138,8 @@ importers:
         specifier: ^0.0.12
         version: 0.0.12
       nodemailer:
-        specifier: ^7.0.11
-        version: 7.0.11
+        specifier: ^8.0.6
+        version: 8.0.6
       react:
         specifier: ^18.2.0
         version: 18.3.1
@@ -1157,8 +1157,8 @@ importers:
         version: 3.25.76
     devDependencies:
       '@types/nodemailer':
-        specifier: ^7.0.4
-        version: 7.0.4
+        specifier: ^8.0.0
+        version: 8.0.0
       '@types/react':
         specifier: 18.2.69
         version: 18.2.69
@@ -10752,8 +10752,8 @@ packages:
   '@types/node@20.14.14':
     resolution: {integrity: sha512-d64f00982fS9YoOgJkAMolK7MN8Iq3TDdVjchbYHdEmjth/DHowx82GnoA+tVUAN+7vxfYUgAzi+JXbKNd2SDQ==}
 
-  '@types/nodemailer@7.0.4':
-    resolution: {integrity: sha512-ee8fxWqOchH+Hv6MDDNNy028kwvVnLplrStm4Zf/3uHWw5zzo8FoYYeffpJtGs2wWysEumMH0ZIdMGMY1eMAow==}
+  '@types/nodemailer@8.0.0':
+    resolution: {integrity: sha512-fyf8jWULsCo0d0BuoQ75i6IeoHs47qcqxWc7yUdUcV0pOZGjUTTOvwdG1PRXUDqN/8A64yQdQdnA2pZgcdi+cA==}
 
   '@types/normalize-package-data@2.4.1':
     resolution: {integrity: sha512-Gj7cI7z+98M282Tqmp2K5EIsoouUEzbBJhQQzDE3jSIRk6r9gsz0oUokqIUR4u1R3dMHo0pDHM7sNOHyhulypw==}
@@ -16391,8 +16391,8 @@ packages:
   node-releases@2.0.36:
     resolution: {integrity: sha512-TdC8FSgHz8Mwtw9g5L4gR/Sh9XhSP/0DEkQxfEFXOpiul5IiHgHan2VhYYb6agDSfp4KuvltmGApc8HMgUrIkA==}
 
-  nodemailer@7.0.11:
-    resolution: {integrity: sha512-gnXhNRE0FNhD7wPSCGhdNh46Hs6nm+uTyg+Kq0cZukNQiYdnCsoQjodNP9BQVG9XrcK/v6/MgpAPBUFyzh9pvw==}
+  nodemailer@8.0.6:
+    resolution: {integrity: sha512-Nm2XeuDwwy2wi5A+8jPWwQwNzcjNjhWdE3pVLoXEusxJqCnAPAgnBGkSmiLknbnWuOF9qraRpYZjfxqtKZ4tPw==}
     engines: {node: '>=6.0.0'}
 
   non.geist@1.0.2:
@@ -31170,12 +31170,9 @@ snapshots:
     dependencies:
       undici-types: 5.26.5
 
-  '@types/nodemailer@7.0.4':
+  '@types/nodemailer@8.0.0':
     dependencies:
-      '@aws-sdk/client-sesv2': 3.940.0
       '@types/node': 20.14.14
-    transitivePeerDependencies:
-      - aws-crt
 
   '@types/normalize-package-data@2.4.1': {}
 
@@ -37936,7 +37933,7 @@ snapshots:
 
   node-releases@2.0.36: {}
 
-  nodemailer@7.0.11: {}
+  nodemailer@8.0.6: {}
 
   non.geist@1.0.2: {}