From 71e596b88beead1e235dd6f20b55af277f3087e7 Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 30 Sep 2026 14:36:58 +0000 Subject: [PATCH 1/2] chore: upgrade nodemailer to ^10.0.2 to address GHSA-6vj9-mwq6-2f5v, GHSA-8vvx-rff5-p5rq nodemailer 10 ships its own type declarations, where SentMessageInfo.pending is optional. Default it to an empty array before concatenating. Co-Authored-By: Claude Opus 5.5 --- packages/web/package.json | 2 +- packages/web/src/auth.ts | 2 +- .../src/features/membership/actions/accountRequests.ts | 4 ++-- .../web/src/features/membership/actions/invites.ts | 2 +- yarn.lock | 10 +++++----- 5 files changed, 10 insertions(+), 10 deletions(-) diff --git a/packages/web/package.json b/packages/web/package.json index c719057c6..3f926f5fe 100644 --- a/packages/web/package.json +++ b/packages/web/package.json @@ -166,7 +166,7 @@ "next-auth": "^5.0.0-beta.32", "next-navigation-guard": "^0.2.0", "next-themes": "^0.3.0", - "nodemailer": "^9.0.1", + "nodemailer": "^10.0.2", "octokit": "^4.1.3", "openai": "^4.98.0", "parse-diff": "^0.11.1", diff --git a/packages/web/src/auth.ts b/packages/web/src/auth.ts index b6f132b9a..0a1af78e4 100644 --- a/packages/web/src/auth.ts +++ b/packages/web/src/auth.ts @@ -99,7 +99,7 @@ export const getProviders = async () => { text: `Log in to Sourcebot using this code: ${token}` }); - const failed = result.rejected.concat(result.pending).filter(Boolean); + const failed = result.rejected.concat(result.pending ?? []).filter(Boolean); if (failed.length) { throw new Error(`Email(s) (${failed.join(", ")}) could not be sent`); } diff --git a/packages/web/src/features/membership/actions/accountRequests.ts b/packages/web/src/features/membership/actions/accountRequests.ts index 87913e549..5f1a0e222 100644 --- a/packages/web/src/features/membership/actions/accountRequests.ts +++ b/packages/web/src/features/membership/actions/accountRequests.ts @@ -113,7 +113,7 @@ export const createAccountRequest = async () => sew(async () => { text: `New account request for ${org.name} on Sourcebot by ${user.name ?? user.email}`, }); - const failed = result.rejected.concat(result.pending).filter(Boolean); + const failed = result.rejected.concat(result.pending ?? []).filter(Boolean); if (failed.length > 0) { logger.error(`Failed to send account request email to ${ownerEmails.join(', ')}: ${failed}`); } @@ -220,7 +220,7 @@ export const approveAccountRequest = async (requestId: string) => sew(async () = text: `Your request to join ${org.name} on Sourcebot has been approved. You can now access the organization at ${env.AUTH_URL}`, }); - const failed = result.rejected.concat(result.pending).filter(Boolean); + const failed = result.rejected.concat(result.pending ?? []).filter(Boolean); if (failed.length > 0) { logger.error(`Failed to send approval email to ${request.requestedBy.email}: ${failed}`); } diff --git a/packages/web/src/features/membership/actions/invites.ts b/packages/web/src/features/membership/actions/invites.ts index e6ca6bc07..1459d90b3 100644 --- a/packages/web/src/features/membership/actions/invites.ts +++ b/packages/web/src/features/membership/actions/invites.ts @@ -173,7 +173,7 @@ export const createInvites = async (emails: string[]): Promise<{ success: boolea text: `Join ${invite.org.name} on Sourcebot by clicking here: ${inviteLink}`, }); - const failed = result.rejected.concat(result.pending).filter(Boolean); + const failed = result.rejected.concat(result.pending ?? []).filter(Boolean); if (failed.length > 0) { logger.error(`Failed to send invite email to ${email}: ${failed}`); } diff --git a/yarn.lock b/yarn.lock index 16aa3ddd3..8abb9937e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -9179,7 +9179,7 @@ __metadata: next-auth: "npm:^5.0.0-beta.32" next-navigation-guard: "npm:^0.2.0" next-themes: "npm:^0.3.0" - nodemailer: "npm:^9.0.1" + nodemailer: "npm:^10.0.2" npm-run-all: "npm:^4.1.5" octokit: "npm:^4.1.3" openai: "npm:^4.98.0" @@ -18596,10 +18596,10 @@ __metadata: languageName: node linkType: hard -"nodemailer@npm:^9.0.1": - version: 9.1.1 - resolution: "nodemailer@npm:9.1.1" - checksum: 10c0/b213a2a906697a735f6eb21103629b7a77aeac297b6d843efd4588157999bf6d19381853ac1224e472f5a34aec2e2412444151a2c6ec6e8c52150afa3055039c +"nodemailer@npm:^10.0.2": + version: 10.0.13 + resolution: "nodemailer@npm:10.0.13" + checksum: 10c0/3004362415e977a3fdf2a0c0ec0ad9fd3724d5ccba3951763bd28fa13a6b87cab13e790c934ccb66b6657ca8149a7efc4cc973867760588169efd8ec3fb99908 languageName: node linkType: hard From 3a2081cbd2c2e0c1e0e4bfd60fcd8b2d8c9c2cec Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Wed, 30 Sep 2026 14:37:17 +0000 Subject: [PATCH 2/2] chore: add CHANGELOG entry for #1703 Co-Authored-By: Claude Opus 5.5 --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 21fd05b6a..072afc7d2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ### Fixed - Silenced a false-positive `MaxListenersExceededWarning` logged on every request proxied through an external rewrite. [#1697](https://github.com/sourcebot-dev/sourcebot/pull/1697) +- Upgraded `nodemailer` to `^10.0.2`. [#1703](https://github.com/sourcebot-dev/sourcebot/pull/1703) ## [5.1.15] - 2026-09-29