chore(deps): bump nodemailer to 9.0.1#4772
Conversation
- Recreates wrong-base #4765 (targeted main, closed) - Security fix: nodemailer 9.0.1 enforces disableFileAccess/disableUrlAccess for raw message option and validates TLS certificates by default - Updates lockfile from 9.0.0 to 9.0.1
![aegis-gh-agent[bot]](https://avatars.githubusercontent.com/u/106186915?s=60&v=4){kind=small}
There was a problem hiding this comment.
Argus fast-track review — PR #4772 (HIGH security fix)
Substance: PASS — Minimal, focused patch bump. nodemailer ^9.0.0 → ^9.0.1 in package.json + lockfile update. Version numbers correct, integrity hash updated, resolved URL points to registry. No scope creep, no unrelated changes.
Security context: VERIFIED — Trivy SCA (root) now PASSING on this PR (was failing on #4771 / develop base). Confirms the 9.0.1 bump resolves HIGH vuln GHSA-p6gq-j5cr-w38f. 9.0.1 enforces disableFileAccess/disableUrlAccess for raw message option + TLS cert validation by default for remote content fetches.
CI status:
- ✅ Trivy SCA (root) — PASS (security gate cleared)
- ✅ CodeQL, GitGuardian, Gitleaks, lint, lint-pr-title, dashboard-e2e, platform-smoke (mac/win), sdk-drift, feat-minor-bump-gate — all PASS
- ⏳ helm-smoke — pending
- ⏳ test (ubuntu-latest, 20) — pending
- ⏳ test (ubuntu-latest, 22) — pending
These 3 pending checks were the same ones failing on #4771 (pre-existing nodemailer 9.0.0 vuln). Expected to pass once the bump resolves the root cause.
Gate status:
- Gate 1 (review): ✅ In progress — this review
- Gate 2 (no conflicts): ✅ mergeable=True
- Gate 3 (CI green): ⏳ Trivy cleared, 3 checks pending
- Gate 4 (no regressions): ✅ No code changes, dependency bump only
- Gate 5 (unit tests): N/A — no code changes
- Gate 6 (E2E/UAT): N/A — no functional changes
- Gate 7 (documented): ✅ PR body explains security context
- Gate 8 (security clean): ✅ Trivy now green, no secrets
- Gate 9 (targets develop): ✅ base=develop
App-authored PR note: This PR is opened by aegis-gh-agent[bot]. Per established workflow, requires human approval before merge.
Request: @OneStepAt4time (Boss) — please approve for fast-track. This is a HIGH security fix that unblocks develop CI (Trivy + test failures). Once the 3 pending checks complete green + your approval, I will squash-merge immediately.
|
Argus — closed as superseded by #4773. #4773 has the identical nodemailer 9.0.1 bump with all 14 CI checks green (including helm-smoke + test ubuntu-20/22, which were pending here). Minor formatting fix in optionalDependencies (alphabetical reordering) also included. All review activity moved to #4773. |
|
Closing as duplicate — #4773 (same nodemailer 9.0.1 bump) was merged to develop. |
1 participant
main, closed)disableFileAccess/disableUrlAccessfor raw message optionpackage.json+package-lock.json