chore(deps): bump nodemailer from 8.0.6 to 8.0.9

[dependabot]

Bumps nodemailer from 8.0.6 to 8.0.9.

Release notes

Sourced from nodemailer's releases.

v8.0.9

8.0.9 (2026-05-26)

Bug Fixes

• two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

v8.0.8

8.0.8 (2026-05-23)

Bug Fixes

• enforce strict TLS for OAuth2 and Ethereal credential requests (#1818) (833d6e5)
• four listener/stream leaks in SMTP transport, connection, pool (#1817) (850bb91)

v8.0.7

8.0.7 (2026-04-27)

Bug Fixes

• keep domain as UTF-8 when local part is non-ASCII (#1814) (66d4ecb)

Changelog

Sourced from nodemailer's changelog.

8.0.9 (2026-05-26)

Bug Fixes

• two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

8.0.8 (2026-05-23)

Bug Fixes

• enforce strict TLS for OAuth2 and Ethereal credential requests (#1818) (833d6e5)
• four listener/stream leaks in SMTP transport, connection, pool (#1817) (850bb91)

8.0.7 (2026-04-27)

Bug Fixes

• keep domain as UTF-8 when local part is non-ASCII (#1814) (66d4ecb)

Commits

• 07303cb chore(master): release 8.0.9 (#1821)
• 5f69497 fix: two pending security advisories (jsonTransport access bypass, List-* CRL...
• 15138a8 chore(master): release 8.0.8 (#1819)
• 850bb91 fix: four listener/stream leaks in SMTP transport, connection, pool (#1817)
• 833d6e5 fix: enforce strict TLS for OAuth2 and Ethereal credential requests (#1818)
• 1997040 chore(master): release 8.0.7 (#1815)
• 9b9c545 chore: drop nodemailer-ntlm-auth devDependency (#1816)
• 22bf90c Bumped dev deps
• 66d4ecb fix: keep domain as UTF-8 when local part is non-ASCII (#1814)
• 6a4a01e Fix/base64 wrap trailing crlf (#1813)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

This change is 

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
🔚	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
🔚	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nodemailer@​8.0.9

View full report

[changeset-bot]

⚠️ No Changeset found

Latest commit: 207162c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

This is a dependabot-generated PR that bumps nodemailer from 8.0.6 to 8.0.9. The upgrade includes important security fixes:

v8.0.9 Security Fixes:

• jsonTransport access bypass
• List-* CRLF injection

v8.0.8 Security Fixes:

• Enforced strict TLS for OAuth2 and Ethereal credential requests
• Fixed four listener/stream leaks in SMTP transport, connection, pool

v8.0.7 Fix:

• Keep domain as UTF-8 when local part is non-ASCII

Note on Lock File Changes

The pnpm-lock.yaml changes are standard lock file regeneration. Deprecation notices appearing for @ungap/structured-clone, recharts, tsconfck, and uuid are metadata updates detected by pnpm - these are transitive dependencies not directly modified by this PR. The @ungap/structured-clone CWE-502 advisory relates to deserialization of untrusted data, but this is a transitive dependency of hast-util-raw (used by @react-email/render) and recharts (used in the webapp). Addressing these would require separate dependency updates for those packages.

Files Reviewed (2 files)

• internal-packages/emails/package.json - nodemailer version bump
• pnpm-lock.yaml - lock file regeneration

---

_{Reviewed by laguna-m.1-20260312:free · 4,131,861 tokens}