chore(deps): bump nodemailer to 10.0.10 and patch vulnerable undici copies

Merged
WA
1mo ago
+20-33

Summary

  • Supersedes #8392 — Dependabot bumped package.json without bun.lock, so every CI job failed on --frozen-lockfile
  • nodemailer 9.1.1 → 10.0.10 (GHSA-6vj9-mwq6-2f5v); 10.0.11+ are still inside the repo's 7-day minimum release age
  • undici 7.29.0 → 7.29.1 (the September undici advisory batch)
  • Patched the transitive undici copies too: e2b override 2.45.0 → 2.50.0 (pins undici8 8.10.2) and node-gyp's nested undici 6.28.0 → 6.28.1
  • nodemailer 10 ships its own types: dropped @types/nodemailer, switched nodemailer.Transporter / nodemailer.SendMailOptions namespace types to named type imports, and removed the SES double-cast-allowed cast whose only reason was the @types package's nested AWS SDK
  • Kept bun.lock at lockfileVersion 1. Scoped overrides (undici@8, parent>child) would force v3, which Bun 1.3.x ignores

Not covered: @earendil-works/pi-coding-agent@0.80.10 exact-pins undici@8.5.0; patched undici needs pi ≥ 0.86.0, which is a separate Pi bump

Type of Change

  • Dependency update / security fix

Testing

  • bun install --frozen-lockfile passes on Bun 1.4.2 (CI) and 1.3.14
  • apps/sim type-check clean
  • lib/internal/smtp + lib/messaging/email tests: 52 passed (gmail tests exercise the real MailComposer)
  • Real SMTP round-trip through sendSmtpMessage against a local SMTP server (message id, subject, attachment), plus the SES v2 transport with a stubbed client and MailComposer raw build
  • bun run lint, block registry check, bun run check:audits (51 audits), docs-manifest:check

Checklist

  • Code follows project style guidelines
  • Self-reviewed my changes
  • Tests added/updated and passing (new tests pass the test-audit authoring gate)
  • No new warnings introduced
  • I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)