Bump nodemailer from 6.9.3 to 7.0.7 in /website by dependabot[bot] · Pull Request #41 · ArmorCode-Public-Test/Open-Assistant

dependabot · 2025-10-06T21:31:32Z

Bumps nodemailer from 6.9.3 to 7.0.7.

Release notes

v7.0.7

7.0.7 (2025-10-05)

Bug Fixes

addressparser: Fixed addressparser handling of quoted nested email addresses (1150d99)

dns: add memory leak prevention for DNS cache (0240d67)

linter: Updated eslint and created prettier formatting task (df13b74)

refresh expired DNS cache on error (#1759) (ea0fc5a)

resolve linter errors in DNS cache tests (3b8982c)

v7.0.6

7.0.6 (2025-08-27)

Bug Fixes

encoder: avoid silent data loss by properly flushing trailing base64 (#1747) (01ae76f)

handle multiple XOAUTH2 token requests correctly (#1754) (dbe0028)

ReDoS vulnerability in parseDataURI and _processDataUrl (#1755) (90b3e24)

v7.0.5

7.0.5 (2025-07-07)

Bug Fixes

updated well known delivery service list (fa2724b)

v7.0.4

7.0.4 (2025-06-29)

Bug Fixes

pools: Emit 'clear' once transporter is idle and all connections are closed (839e286)

smtp-connection: jsdoc public annotation for socket (#1741) (c45c84f)

well-known-services: Added AliyunQiye (bb9e6da)

v7.0.3

7.0.3 (2025-05-08)

Bug Fixes

attachments: Set the default transfer encoding for message/rfc822 attachments as '7bit' (007d5f3)

v7.0.2

7.0.2 (2025-05-04)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

7.0.7 (2025-10-05)

Bug Fixes

addressparser: Fixed addressparser handling of quoted nested email addresses (1150d99)

dns: add memory leak prevention for DNS cache (0240d67)

linter: Updated eslint and created prettier formatting task (df13b74)

refresh expired DNS cache on error (#1759) (ea0fc5a)

resolve linter errors in DNS cache tests (3b8982c)

7.0.6 (2025-08-27)

Bug Fixes

encoder: avoid silent data loss by properly flushing trailing base64 (#1747) (01ae76f)

handle multiple XOAUTH2 token requests correctly (#1754) (dbe0028)

ReDoS vulnerability in parseDataURI and _processDataUrl (#1755) (90b3e24)

7.0.5 (2025-07-07)

Bug Fixes

updated well known delivery service list (fa2724b)

7.0.4 (2025-06-29)

Bug Fixes

pools: Emit 'clear' once transporter is idle and all connections are closed (839e286)

smtp-connection: jsdoc public annotation for socket (#1741) (c45c84f)

well-known-services: Added AliyunQiye (bb9e6da)

7.0.3 (2025-05-08)

Bug Fixes

attachments: Set the default transfer encoding for message/rfc822 attachments as '7bit' (007d5f3)

7.0.2 (2025-05-04)

Bug Fixes

ses: Fixed structured from header (faa9a5e)

7.0.1 (2025-05-04)

Bug Fixes

ses: Use formatted FromEmailAddress for SES emails (821cd09)

... (truncated)

Commits

9357a71 chore(master): release 7.0.7 [skip-ci] (#1761)
df13b74 fix(linter): Updated eslint and created prettier formatting task
62629a0 Updated tests for addressparser
1150d99 fix(addressparser): Fixed addressparser handling of quoted nested email addre...
3b8982c fix: resolve linter errors in DNS cache tests
0240d67 fix(dns): add memory leak prevention for DNS cache
ea0fc5a fix: refresh expired DNS cache on error (#1759)
430ca75 chore(master): release 7.0.6 [skip-ci] (#1753)
e3e700c Bumped deps
f322c38 replaced escaped single quotes with unescaped ones
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 6.9.3 to 7.0.7. - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v6.9.3...v7.0.7) --- updated-dependencies: - dependency-name: nodemailer dependency-version: 7.0.7 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2025-10-06T21:32:40Z

❌ pre-commit failed.
Please run pre-commit run --all-files locally and commit the changes.
Find more information in the repository's CONTRIBUTING.md

socket-security · 2025-10-06T21:51:52Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Quality
	crypto-js@4.1.1
	form-data@3.0.1 ⏵ 4.0.0	⁺¹	⁺¹
	number-is-nan@1.0.1
	has@1.0.3
	node-releases@2.0.10
	has-property-descriptors@1.0.0
	isarray@0.0.1
	define-properties@1.2.0
	path-parse@1.0.7
	array-flatten@2.1.2
	indent-string@4.0.0
	object-keys@1.1.1
	has-symbols@1.0.3
	object.assign@4.1.4
	is-core-module@2.11.0
	function-bind@1.1.1
	minimalistic-assert@1.0.1
	object-assign@4.1.1
	boolbase@1.0.0
	path-is-inside@1.0.2
	is-arrayish@0.2.1
	get-own-enumerable-property-symbols@3.0.2
	@docsearch/css@3.3.3
	at-least-node@1.0.0
	@babel/plugin-transform-react-jsx-development@7.22.5 ⏵ 7.18.6
	is-regexp@1.0.0
	@algolia/logger-console@4.17.0
	detect-node@2.1.0
	@algolia/logger-common@4.17.0
	@algolia/cache-in-memory@4.17.0
	@algolia/requester-common@4.17.0
	@webassemblyjs/helper-api-error@1.11.5 ⏵ 1.11.1		⁺²
See 604 more rows in the dashboard

View full report

socket-security · 2025-10-06T21:51:54Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		`crypto-js@4.1.1` has a Critical CVE. CVE: GHSA-xwcq-pm8m-c4vf crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard (CRITICAL) Affected versions: < 4.2.0 Patched version: 4.2.0 From: docs/yarn.lock → `npm/crypto-js@4.1.1` ℹ Read more on: This package \| This alert \| What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/crypto-js@4.1.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot · 2025-10-13T21:42:44Z

Superseded by #43.

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 6, 2025

dependabot bot mentioned this pull request Oct 6, 2025

Bump nodemailer from 6.9.3 to 7.0.6 in /website #33

Closed

dependabot bot closed this Oct 13, 2025

dependabot bot deleted the dependabot/npm_and_yarn/website/nodemailer-7.0.7 branch October 13, 2025 21:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump nodemailer from 6.9.3 to 7.0.7 in /website#41

Bump nodemailer from 6.9.3 to 7.0.7 in /website#41
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/website/nodemailer-7.0.7

dependabot bot commented on behalf of github Oct 6, 2025

Uh oh!

github-actions bot commented Oct 6, 2025

Uh oh!

socket-security bot commented Oct 6, 2025

Uh oh!

socket-security bot commented Oct 6, 2025

Uh oh!

dependabot bot commented on behalf of github Oct 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Oct 6, 2025

v7.0.7

7.0.7 (2025-10-05)

Bug Fixes

v7.0.6

7.0.6 (2025-08-27)

Bug Fixes

v7.0.5

7.0.5 (2025-07-07)

Bug Fixes

v7.0.4

7.0.4 (2025-06-29)

Bug Fixes

v7.0.3

7.0.3 (2025-05-08)

Bug Fixes

v7.0.2

7.0.2 (2025-05-04)

7.0.7 (2025-10-05)

Bug Fixes

7.0.6 (2025-08-27)

Bug Fixes

7.0.5 (2025-07-07)

Bug Fixes

7.0.4 (2025-06-29)

Bug Fixes

7.0.3 (2025-05-08)

Bug Fixes

7.0.2 (2025-05-04)

Bug Fixes

7.0.1 (2025-05-04)

Bug Fixes

Uh oh!

github-actions bot commented Oct 6, 2025

Uh oh!

socket-security bot commented Oct 6, 2025

Uh oh!

socket-security bot commented Oct 6, 2025

Uh oh!

dependabot bot commented on behalf of github Oct 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants