Skip to content

fix(deps): update dependency nodemailer to v8 [security] #8341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
backstage-goalie wants to merge 1 commit into
base: main
Choose a base branch
from
+29 −147
Open

fix(deps): update dependency nodemailer to v8 [security] #8341

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions workspaces/feedback/.changeset/renovate-b1242b5.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@backstage-community/plugin-feedback-backend': patch
---

Updated dependency `nodemailer` to `^8.0.0`.
2 changes: 1 addition & 1 deletion workspaces/feedback/plugins/feedback-backend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@
"express-promise-router": "^4.1.0",
"knex": "^3.1.0",
"node-fetch": "^2.6.7",
"nodemailer": "^7.0.7",
"nodemailer": "^8.0.0",
"short-uuid": "^4.2.2",
Comment on lines 53 to 55
Copy link

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nodemailer was bumped to v8, but the TypeScript typings are still pinned to @types/nodemailer v7.0.11. This can lead to incorrect typings or TS build failures if the v8 surface differs. Consider updating @types/nodemailer to a v8-compatible release (if available) or removing it if Nodemailer v8 ships its own types.

Copilot uses AI. Check for mistakes.
Comment on lines +54 to 55
Copy link

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nodemailer is being bumped to a new major (v8) but the package still pins @types/nodemailer at 7.0.11. If the DefinitelyTyped package tracks Nodemailer majors (or if Nodemailer now ships its own typings), this mismatch can lead to stale/incorrect types or even duplicate module declaration errors during TS builds. Please update @types/nodemailer to a v8-compatible version (or remove it if Nodemailer provides built-in types) and regenerate the lockfile accordingly.

Copilot uses AI. Check for mistakes.
"yn": "^4.0.0"
Comment on lines 52 to 56
Copy link

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nodemailer is being bumped to ^8.0.0, but this package still pins @types/nodemailer to 7.0.11 in devDependencies. This leaves a major-version mismatch between runtime and TypeScript typings and can lead to incorrect types or build failures; align the @types/nodemailer major version with Nodemailer v8 (or remove @types/nodemailer if Nodemailer now ships its own types for this repo’s TS setup).

Copilot uses AI. Check for mistakes.
Comment on lines 52 to 56
Copy link

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nodemailer was bumped to v8, but this package still pins @types/nodemailer to 7.0.11. That can lead to incorrect typings or TS build failures (the v7 types may not match the v8 API). Update @types/nodemailer to a compatible v8 release if available, or remove it if Nodemailer’s bundled types are being used.

Copilot uses AI. Check for mistakes.
},
Comment on lines 51 to 57
Copy link

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nodemailer was upgraded to v8, but the devDependency @types/nodemailer remains pinned to 7.0.11. The major-version mismatch can lead to incorrect typings (or duplicate/conflicting types if nodemailer now ships its own). Consider updating @types/nodemailer to a compatible major version or removing it if v8 provides bundled TypeScript types.

Copilot uses AI. Check for mistakes.
Expand Down
169 changes: 23 additions & 146 deletions workspaces/feedback/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2952,7 +2952,7 @@ __metadata:
knex: "npm:^3.1.0"
msw: "npm:1.3.5"
node-fetch: "npm:^2.6.7"
nodemailer: "npm:^7.0.7"
nodemailer: "npm:^8.0.0"
react: "npm:^16.13.1 || ^17.0.0 || ^18.0.0"
react-dom: "npm:^18"
react-router-dom: "npm:^6.26.1"
Expand Down Expand Up @@ -5947,7 +5947,7 @@ __metadata:
languageName: node
linkType: hard

"@jridgewell/trace-mapping@npm:^0.3.12, @jridgewell/trace-mapping@npm:^0.3.18, @jridgewell/trace-mapping@npm:^0.3.20, @jridgewell/trace-mapping@npm:^0.3.24, @jridgewell/trace-mapping@npm:^0.3.25":
"@jridgewell/trace-mapping@npm:^0.3.12, @jridgewell/trace-mapping@npm:^0.3.18, @jridgewell/trace-mapping@npm:^0.3.24, @jridgewell/trace-mapping@npm:^0.3.25":
version: 0.3.25
resolution: "@jridgewell/trace-mapping@npm:0.3.25"
dependencies:
Expand Down Expand Up @@ -9928,20 +9928,20 @@ __metadata:
languageName: node
linkType: hard

"@types/estree@npm:*, @types/estree@npm:1.0.6, @types/estree@npm:^1.0.0":
version: 1.0.6
resolution: "@types/estree@npm:1.0.6"
checksum: 10/9d35d475095199c23e05b431bcdd1f6fec7380612aed068b14b2a08aa70494de8a9026765a5a91b1073f636fb0368f6d8973f518a31391d519e20c59388ed88d
languageName: node
linkType: hard

"@types/estree@npm:^1.0.8":
"@types/estree@npm:*, @types/estree@npm:^1.0.0, @types/estree@npm:^1.0.8":
version: 1.0.8
resolution: "@types/estree@npm:1.0.8"
checksum: 10/25a4c16a6752538ffde2826c2cc0c6491d90e69cd6187bef4a006dd2c3c45469f049e643d7e516c515f21484dc3d48fd5c870be158a5beb72f5baf3dc43e4099
languageName: node
linkType: hard

"@types/estree@npm:1.0.6":
version: 1.0.6
resolution: "@types/estree@npm:1.0.6"
checksum: 10/9d35d475095199c23e05b431bcdd1f6fec7380612aed068b14b2a08aa70494de8a9026765a5a91b1073f636fb0368f6d8973f518a31391d519e20c59388ed88d
languageName: node
linkType: hard

"@types/express-serve-static-core@npm:*, @types/express-serve-static-core@npm:^4.17.33, @types/express-serve-static-core@npm:^4.17.5":
version: 4.19.5
resolution: "@types/express-serve-static-core@npm:4.19.5"
Expand Down Expand Up @@ -11020,16 +11020,7 @@ __metadata:
languageName: node
linkType: hard

"acorn@npm:^8.1.0, acorn@npm:^8.11.0, acorn@npm:^8.4.1, acorn@npm:^8.8.1, acorn@npm:^8.8.2, acorn@npm:^8.9.0":
version: 8.14.0
resolution: "acorn@npm:8.14.0"
bin:
acorn: bin/acorn
checksum: 10/6df29c35556782ca9e632db461a7f97947772c6c1d5438a81f0c873a3da3a792487e83e404d1c6c25f70513e91aa18745f6eafb1fcc3a43ecd1920b21dd173d2
languageName: node
linkType: hard

"acorn@npm:^8.15.0, acorn@npm:^8.16.0":
"acorn@npm:^8.1.0, acorn@npm:^8.11.0, acorn@npm:^8.15.0, acorn@npm:^8.16.0, acorn@npm:^8.4.1, acorn@npm:^8.8.1, acorn@npm:^8.9.0":
version: 8.16.0
resolution: "acorn@npm:8.16.0"
bin:
Expand Down Expand Up @@ -12343,21 +12334,7 @@ __metadata:
languageName: node
linkType: hard

"browserslist@npm:^4.0.0, browserslist@npm:^4.18.1, browserslist@npm:^4.21.4, browserslist@npm:^4.24.0, browserslist@npm:^4.24.2":
version: 4.24.2
resolution: "browserslist@npm:4.24.2"
dependencies:
caniuse-lite: "npm:^1.0.30001669"
electron-to-chromium: "npm:^1.5.41"
node-releases: "npm:^2.0.18"
update-browserslist-db: "npm:^1.1.1"
bin:
browserslist: cli.js
checksum: 10/f8a9d78bbabe466c57ffd5c50a9e5582a5df9aa68f43078ca62a9f6d0d6c70ba72eca72d0a574dbf177cf55cdca85a46f7eb474917a47ae5398c66f8b76f7d1c
languageName: node
linkType: hard

"browserslist@npm:^4.28.1":
"browserslist@npm:^4.0.0, browserslist@npm:^4.18.1, browserslist@npm:^4.21.4, browserslist@npm:^4.24.0, browserslist@npm:^4.24.2, browserslist@npm:^4.28.1":
version: 4.28.1
resolution: "browserslist@npm:4.28.1"
dependencies:
Expand Down Expand Up @@ -12667,14 +12644,7 @@ __metadata:
languageName: node
linkType: hard

"caniuse-lite@npm:^1.0.0, caniuse-lite@npm:^1.0.30001669":
version: 1.0.30001676
resolution: "caniuse-lite@npm:1.0.30001676"
checksum: 10/73d5ff987c4075fe3885282361626956d50124c01c6811cca071efd94c2a26ff5045cd3b902a418b505840eb4b3fc8e0252a65392effd7061749e9c9e6c16d35
languageName: node
linkType: hard

"caniuse-lite@npm:^1.0.30001759":
"caniuse-lite@npm:^1.0.0, caniuse-lite@npm:^1.0.30001759":
version: 1.0.30001774
resolution: "caniuse-lite@npm:1.0.30001774"
checksum: 10/63c87aeac08548847ecd12746144029761707d9eae57750f673543a2b2a6126bca98584dd551818e8dc2a480d11489bebe0027af26de4ee46466e7b216109862
Expand Down Expand Up @@ -14898,13 +14868,6 @@ __metadata:
languageName: node
linkType: hard

"electron-to-chromium@npm:^1.5.41":
version: 1.5.49
resolution: "electron-to-chromium@npm:1.5.49"
checksum: 10/4c368eca149587619bbc961490883cca510c8ab1986abee6cbbb7ed245a06d68607245c25078a9460c0d18ea4179411abed94b755d7b7a82a3f4e696494c4360
languageName: node
linkType: hard

"elliptic@npm:^6.5.3, elliptic@npm:^6.5.5":
version: 6.5.7
resolution: "elliptic@npm:6.5.7"
Expand Down Expand Up @@ -14987,17 +14950,7 @@ __metadata:
languageName: node
linkType: hard

"enhanced-resolve@npm:^5.18.0":
version: 5.18.1
resolution: "enhanced-resolve@npm:5.18.1"
dependencies:
graceful-fs: "npm:^4.2.4"
tapable: "npm:^2.2.0"
checksum: 10/50e81c7fe2239fba5670ebce78a34709906ed3a79274aa416434f7307b252e0b7824d76a7dd403eca795571dc6afd9a44183fc45a68475e8f2fdfbae6e92fcc3
languageName: node
linkType: hard

"enhanced-resolve@npm:^5.19.0":
"enhanced-resolve@npm:^5.18.0, enhanced-resolve@npm:^5.19.0":
version: 5.19.0
resolution: "enhanced-resolve@npm:5.19.0"
dependencies:
Expand Down Expand Up @@ -22257,13 +22210,6 @@ __metadata:
languageName: node
linkType: hard

"node-releases@npm:^2.0.18":
version: 2.0.18
resolution: "node-releases@npm:2.0.18"
checksum: 10/241e5fa9556f1c12bafb83c6c3e94f8cf3d8f2f8f904906ecef6e10bcaa1d59aa61212d4651bec70052015fc54bd3fdcdbe7fc0f638a17e6685aa586c076ec4e
languageName: node
linkType: hard

"node-releases@npm:^2.0.27":
version: 2.0.27
resolution: "node-releases@npm:2.0.27"
Expand Down Expand Up @@ -22327,10 +22273,10 @@ __metadata:
languageName: node
linkType: hard

"nodemailer@npm:^7.0.7":
version: 7.0.11
resolution: "nodemailer@npm:7.0.11"
checksum: 10/2ad4dd56a4caf84a83aa6f4378ded26d5ef8a644ca3be09c3b4fb2255d861369e620f29be6c3c97148ac4a50aa5fdff6240b9d60805362bd99ca15f2ea62e8a2
"nodemailer@npm:^8.0.0":
version: 8.0.5
resolution: "nodemailer@npm:8.0.5"
checksum: 10/84d44afb0cd20ce02d5e4f0f8465b02aa0af0e11c1b0d40a4e9658d07321655a8ea528533840a38f213a45ca7865ec85f0aed6dc3ac3038d7b2c9405db6cd353
languageName: node
linkType: hard

Expand Down Expand Up @@ -25721,19 +25667,7 @@ __metadata:
languageName: node
linkType: hard

"schema-utils@npm:^4.0.0, schema-utils@npm:^4.2.0":
version: 4.2.0
resolution: "schema-utils@npm:4.2.0"
dependencies:
"@types/json-schema": "npm:^7.0.9"
ajv: "npm:^8.9.0"
ajv-formats: "npm:^2.1.1"
ajv-keywords: "npm:^5.1.0"
checksum: 10/808784735eeb153ab7f3f787f840aa3bc63f423d2a5a7e96c9e70a0e53d0bc62d7b37ea396fc598ce19196e4fb86a72f897154b7c6ce2358bbc426166f205e14
languageName: node
linkType: hard

"schema-utils@npm:^4.3.0, schema-utils@npm:^4.3.3":
"schema-utils@npm:^4.0.0, schema-utils@npm:^4.2.0, schema-utils@npm:^4.3.0, schema-utils@npm:^4.3.3":
version: 4.3.3
resolution: "schema-utils@npm:4.3.3"
dependencies:
Expand Down Expand Up @@ -25858,7 +25792,7 @@ __metadata:
languageName: node
linkType: hard

"serialize-javascript@npm:^6.0.1, serialize-javascript@npm:^6.0.2":
"serialize-javascript@npm:^6.0.2":
version: 6.0.2
resolution: "serialize-javascript@npm:6.0.2"
dependencies:
Expand Down Expand Up @@ -27150,14 +27084,7 @@ __metadata:
languageName: node
linkType: hard

"tapable@npm:^2.0.0, tapable@npm:^2.2.0, tapable@npm:^2.2.1":
version: 2.2.1
resolution: "tapable@npm:2.2.1"
checksum: 10/1769336dd21481ae6347611ca5fca47add0962fd8e80466515032125eca0084a4f0ede11e65341b9c0018ef4e1cf1ad820adbb0fba7cc99865c6005734000b0a
languageName: node
linkType: hard

"tapable@npm:^2.3.0":
"tapable@npm:^2.0.0, tapable@npm:^2.2.1, tapable@npm:^2.3.0":
version: 2.3.0
resolution: "tapable@npm:2.3.0"
checksum: 10/496a841039960533bb6e44816a01fffc2a1eb428bb2051ecab9e87adf07f19e1f937566cbbbb09dceff31163c0ffd81baafcad84db900b601f0155dd0b37e9f2
Expand Down Expand Up @@ -27279,29 +27206,7 @@ __metadata:
languageName: node
linkType: hard

"terser-webpack-plugin@npm:^5.1.3":
version: 5.3.10
resolution: "terser-webpack-plugin@npm:5.3.10"
dependencies:
"@jridgewell/trace-mapping": "npm:^0.3.20"
jest-worker: "npm:^27.4.5"
schema-utils: "npm:^3.1.1"
serialize-javascript: "npm:^6.0.1"
terser: "npm:^5.26.0"
peerDependencies:
webpack: ^5.1.0
peerDependenciesMeta:
"@swc/core":
optional: true
esbuild:
optional: true
uglify-js:
optional: true
checksum: 10/fb1c2436ae1b4e983be043fa0a3d355c047b16b68f102437d08c736d7960c001e7420e2f722b9d99ce0dc70ca26a68cc63c0b82bc45f5b48671142b352a9d938
languageName: node
linkType: hard

"terser-webpack-plugin@npm:^5.3.16":
"terser-webpack-plugin@npm:^5.1.3, terser-webpack-plugin@npm:^5.3.16":
version: 5.3.16
resolution: "terser-webpack-plugin@npm:5.3.16"
dependencies:
Expand All @@ -27323,21 +27228,7 @@ __metadata:
languageName: node
linkType: hard

"terser@npm:^5.10.0, terser@npm:^5.26.0":
version: 5.31.6
resolution: "terser@npm:5.31.6"
dependencies:
"@jridgewell/source-map": "npm:^0.3.3"
acorn: "npm:^8.8.2"
commander: "npm:^2.20.0"
source-map-support: "npm:~0.5.20"
bin:
terser: bin/terser
checksum: 10/78057c58025151c9bdad82a050f0b51175f9fe3117d8ee369ca7effe038cdd540da2fd5985a4f8ee08dba5616e7911e1392d40670698ff42a49fec338d369e80
languageName: node
linkType: hard

"terser@npm:^5.31.1":
"terser@npm:^5.10.0, terser@npm:^5.31.1":
version: 5.46.0
resolution: "terser@npm:5.46.0"
dependencies:
Expand Down Expand Up @@ -28376,20 +28267,6 @@ __metadata:
languageName: node
linkType: hard

"update-browserslist-db@npm:^1.1.1":
version: 1.1.1
resolution: "update-browserslist-db@npm:1.1.1"
dependencies:
escalade: "npm:^3.2.0"
picocolors: "npm:^1.1.0"
peerDependencies:
browserslist: ">= 4.21.0"
bin:
update-browserslist-db: cli.js
checksum: 10/7678dd8609750588d01aa7460e8eddf2ff9d16c2a52fb1811190e0d056390f1fdffd94db3cf8fb209cf634ab4fa9407886338711c71cc6ccade5eeb22b093734
languageName: node
linkType: hard

"update-browserslist-db@npm:^1.2.0":
version: 1.2.3
resolution: "update-browserslist-db@npm:1.2.3"
Expand Down
Loading