Skip to content

Update dependency nodemailer to v8 [SECURITY] #8341

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
backstage-goalie wants to merge 1 commit into
base: main
Choose a base branch
from
+11 −6
Open

Update dependency nodemailer to v8 [SECURITY] #8341

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions workspaces/feedback/.changeset/renovate-ef75542.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@backstage-community/plugin-feedback-backend': patch
---

Updated dependency `nodemailer` to `^8.0.0`.
2 changes: 1 addition & 1 deletion workspaces/feedback/plugins/feedback-backend/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@
"express-promise-router": "^4.1.0",
"knex": "^3.1.0",
"node-fetch": "^2.6.7",
"nodemailer": "^7.0.7",
"nodemailer": "^8.0.0",
"short-uuid": "^4.2.2",
Comment on lines 53 to 55
Copy link

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nodemailer was bumped to v8, but the TypeScript typings are still pinned to @types/nodemailer v7.0.11. This can lead to incorrect typings or TS build failures if the v8 surface differs. Consider updating @types/nodemailer to a v8-compatible release (if available) or removing it if Nodemailer v8 ships its own types.

Copilot uses AI. Check for mistakes.
Comment on lines +54 to 55
Copy link

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nodemailer is being bumped to a new major (v8) but the package still pins @types/nodemailer at 7.0.11. If the DefinitelyTyped package tracks Nodemailer majors (or if Nodemailer now ships its own typings), this mismatch can lead to stale/incorrect types or even duplicate module declaration errors during TS builds. Please update @types/nodemailer to a v8-compatible version (or remove it if Nodemailer provides built-in types) and regenerate the lockfile accordingly.

Copilot uses AI. Check for mistakes.
"yn": "^4.0.0"
Comment on lines 52 to 56
Copy link

Copilot AI Apr 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nodemailer is being bumped to ^8.0.0, but this package still pins @types/nodemailer to 7.0.11 in devDependencies. This leaves a major-version mismatch between runtime and TypeScript typings and can lead to incorrect types or build failures; align the @types/nodemailer major version with Nodemailer v8 (or remove @types/nodemailer if Nodemailer now ships its own types for this repo’s TS setup).

Copilot uses AI. Check for mistakes.
Comment on lines 52 to 56
Copy link

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nodemailer was bumped to v8, but this package still pins @types/nodemailer to 7.0.11. That can lead to incorrect typings or TS build failures (the v7 types may not match the v8 API). Update @types/nodemailer to a compatible v8 release if available, or remove it if Nodemailer’s bundled types are being used.

Copilot uses AI. Check for mistakes.
},
Comment on lines 51 to 57
Copy link

Copilot AI Apr 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nodemailer was upgraded to v8, but the devDependency @types/nodemailer remains pinned to 7.0.11. The major-version mismatch can lead to incorrect typings (or duplicate/conflicting types if nodemailer now ships its own). Consider updating @types/nodemailer to a compatible major version or removing it if v8 provides bundled TypeScript types.

Copilot uses AI. Check for mistakes.
Expand Down
10 changes: 5 additions & 5 deletions workspaces/feedback/yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2952,7 +2952,7 @@ __metadata:
knex: "npm:^3.1.0"
msw: "npm:1.3.5"
node-fetch: "npm:^2.6.7"
nodemailer: "npm:^7.0.7"
nodemailer: "npm:^8.0.0"
react: "npm:^16.13.1 || ^17.0.0 || ^18.0.0"
react-dom: "npm:^18"
react-router-dom: "npm:^6.26.1"
Expand Down Expand Up @@ -22273,10 +22273,10 @@ __metadata:
languageName: node
linkType: hard

"nodemailer@npm:^7.0.7":
version: 7.0.11
resolution: "nodemailer@npm:7.0.11"
checksum: 10/2ad4dd56a4caf84a83aa6f4378ded26d5ef8a644ca3be09c3b4fb2255d861369e620f29be6c3c97148ac4a50aa5fdff6240b9d60805362bd99ca15f2ea62e8a2
"nodemailer@npm:^8.0.0":
version: 8.0.7
resolution: "nodemailer@npm:8.0.7"
checksum: 10/f0afea43af7f7deb55913811362b5d255e9d70c87024eb8b5161acd8a3a3c765454a52eefbfe40a5fe79ff0475b5445acafd20cb187826222b895dee15470c8f
languageName: node
linkType: hard

Expand Down
Loading