chore: upgrade nodemailer to 9.1.1 to address GHSA-2x7j-588g-ccc2, GHSA-8m3c-c648-2xjj, GHSA-cc9r-2j5m-2m83, GHSA-wmmp-3585-3rmp

[claude]

Fixes SOU-2207
Fixes SOU-2208
Fixes SOU-2209
Fixes SOU-2210

Refreshes the yarn.lock entry for nodemailer from 9.0.1 to 9.1.1.

nodemailer is a direct dependency of packages/web at ^9.0.1, which already admitted the patched release, so this is a lockfile refresh only. No package.json change and no resolutions override were needed.

Advisories addressed

Advisory	Patched in	Summary
GHSA-2x7j-588g-ccc2	9.1.0	Quadratic time complexity in addressparser allows remote DoS via a crafted address list
GHSA-cc9r-2j5m-2m83	9.1.0	Recipient-domain validation bypass via RFC 5322 comment mis-parsing
GHSA-wmmp-3585-3rmp	9.1.0	IDN/Punycode domain allow-list bypass
GHSA-8m3c-c648-2xjj	9.1.1	resolveContent() on a MailMessage bypasses disableFileAccess/disableUrlAccess with the legacy signature

9.1.1 is at or above every patched floor above.

Verification

• yarn why nodemailer reports a single instance, nodemailer@npm:9.1.1, with no vulnerable version remaining in the graph.
• yarn workspace @sourcebot/web test --run — 140 files, 1440 tests passed.

🤖 Generated with Claude Code

---

Note

Low Risk
Dependency lockfile refresh to a patched minor/patch release with no application code changes.

Overview
Security patch: bumps the locked nodemailer version from 9.0.1 to 9.1.1 in yarn.lock only—packages/web already declares ^9.0.1, so no package.json or resolutions change.

This addresses four GitHub advisories (DoS in addressparser, recipient-domain validation bypass, IDN allow-list bypass, and resolveContent() bypassing file/URL access restrictions). Verification noted in the PR: single resolved instance at 9.1.1 and web tests passing.

^{Reviewed by Cursor Bugbot for commit 0ff8b91. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Upgrades nodemailer in yarn.lock from 9.0.1 to 9.1.1 to fix four security advisories (GHSA-2x7j-588g-ccc2, GHSA-8m3c-c648-2xjj, GHSA-cc9r-2j5m-2m83, GHSA-wmmp-3585-3rmp). The existing ^9.0.1 range already allowed the patched version, so this is a lockfile refresh only.

^{Written for commit 0ff8b91. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 8a78fcb8-e79f-423d-88f5-05a3f8d94d20

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

License Audit

⚠️ Status: PASS

Metric	Count
Total packages	2174
Resolved (non-standard)	26
Unresolved	0
Strong copyleft	0
Weak copyleft	28

Weak Copyleft Packages (informational)

Package	Version	License
@img/sharp-libvips-darwin-arm64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linux-x64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64	1.3.3	LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64	1.3.3	LGPL-3.0-or-later
@img/sharp-wasm32	0.35.4	Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64	0.35.4	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32	0.35.4	Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64	0.35.4	Apache-2.0 AND LGPL-3.0-or-later
axe-core	4.10.3	MPL-2.0
dompurify	3.4.13	(MPL-2.0 OR Apache-2.0)
lightningcss	1.32.0	MPL-2.0
lightningcss-android-arm64	1.32.0	MPL-2.0
lightningcss-darwin-arm64	1.32.0	MPL-2.0
lightningcss-darwin-x64	1.32.0	MPL-2.0
lightningcss-freebsd-x64	1.32.0	MPL-2.0
lightningcss-linux-arm-gnueabihf	1.32.0	MPL-2.0
lightningcss-linux-arm64-gnu	1.32.0	MPL-2.0
lightningcss-linux-arm64-musl	1.32.0	MPL-2.0
lightningcss-linux-x64-gnu	1.32.0	MPL-2.0
lightningcss-linux-x64-musl	1.32.0	MPL-2.0
lightningcss-win32-arm64-msvc	1.32.0	MPL-2.0
lightningcss-win32-x64-msvc	1.32.0	MPL-2.0

Resolved Packages (26)

Package	Version	Original	Resolved	Source
@sentry/cli	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-darwin	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-darwin	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-linux-arm	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-linux-arm	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-linux-arm64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-linux-arm64	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-linux-i686	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-linux-i686	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-linux-x64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-linux-x64	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-win32-arm64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-win32-arm64	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-win32-i686	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-win32-i686	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-win32-x64	2.58.5	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
@sentry/cli-win32-x64	2.58.6	FSL-1.1-MIT	FSL-1.1-MIT	LICENSE file shipped in installed package (verified license text) (Functional Source License 1.1, MIT Future License; converts to MIT two years after release)
codemirror-lang-elixir	4.0.0	UNKNOWN	Apache-2.0	LICENSE file shipped in installed package (verified license text); corroborated by GitHub repo license detection (Apache-2.0)
khroma	2.1.0	UNKNOWN	MIT	LICENSE file shipped in installed package (verified license text); corroborated by GitHub repo license detection (MIT)
lezer-elixir	1.1.2	UNKNOWN	Apache-2.0	LICENSE file shipped in installed package (verified license text); corroborated by GitHub repo license detection (Apache-2.0)
map-stream	0.1.0	UNKNOWN	MIT	LICENSE file shipped in installed package (verified license text); corroborated by GitHub repo license detection (MIT)
memorystream	0.3.1	UNKNOWN	MIT	extracted from object (legacy "licenses" array, type=MIT); confirmed by LICENSE file shipped in installed package (verified license text)
pause-stream	0.0.11	["MIT", "Apache2"]	(MIT OR Apache-2.0)	extracted from object (array ["MIT","Apache2"]); confirmed by LICENSE file shipped in installed package (verified license text) which states "Dual Licensed MIT and Apache 2"
posthog-js	1.369.0	SEE LICENSE IN LICENSE	Apache-2.0	LICENSE file shipped in installed package (verified license text) (Apache-2.0 grant; bundled third-party excerpts are MIT)
valid-url	1.0.9	UNKNOWN	MIT	LICENSE file shipped in installed package (verified license text) (canonical MIT/Expat text; GitHub reports NOASSERTION because the file omits a title line)