fix: nodemailer is vulnerable to DoS through uncontrolled recursion. (#16698)

Resolves [Dependabot Alert
331](https://github.com/twentyhq/twenty/security/dependabot/331),
[Dependabot Alert
332](https://github.com/twentyhq/twenty/security/dependabot/332),
[Dependabot Alert
349](https://github.com/twentyhq/twenty/security/dependabot/349), and
[Dependabot Alert
350](https://github.com/twentyhq/twenty/security/dependabot/350).

Updated Nodemailer and packages dependent on it to use the fixed patch
version (7.0.11).
This commit is contained in:
Abdullah.
2025-12-19 19:12:07 +05:00
committed by GitHub
parent 088cd3025a
commit 27ca79be7d
4 changed files with 37 additions and 55 deletions
@@ -37,7 +37,7 @@
"lodash.pickby": "^4.6.0",
"lodash.snakecase": "^4.1.1",
"lodash.upperfirst": "^4.3.1",
"nodemailer": "^7.0.10",
"nodemailer": "^7.0.11",
"sharp": "^0.33.5",
"uuid": "^10.0.0",
"winston": "^3.14.2"
@@ -2325,10 +2325,10 @@ __metadata:
languageName: node
linkType: hard
"nodemailer@npm:^7.0.10":
version: 7.0.10
resolution: "nodemailer@npm:7.0.10"
checksum: 10c0/9bb39bde904397879a6394e5202146167cabc3bd4089c1b0255ce16875e721d1cf132afde25a570fc4cf38f159ba6b6b5411d3b9371775543d38343fbd505101
"nodemailer@npm:^7.0.11":
version: 7.0.11
resolution: "nodemailer@npm:7.0.11"
checksum: 10c0/208f108fdb4c5dd0e3a2f013578d53dad505cf1b9c7a084f6d22fc9d6f3912daafb4a23793ca568ff848afc35f15f4eb24382d3f6f9fb8ede4a8410d4ca63618
languageName: node
linkType: hard
@@ -2682,7 +2682,7 @@ __metadata:
lodash.pickby: "npm:^4.6.0"
lodash.snakecase: "npm:^4.1.1"
lodash.upperfirst: "npm:^4.3.1"
nodemailer: "npm:^7.0.10"
nodemailer: "npm:^7.0.11"
sharp: "npm:^0.33.5"
uuid: "npm:^10.0.0"
winston: "npm:^3.14.2"