chore: upgrade nodemailer to ^10.0.2 to address GHSA-6vj9-mwq6-2f5v, GHSA-8vvx-rff5-p5rq

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 - Silenced a false-positive `MaxListenersExceededWarning` logged on every request proxied through an external rewrite. [#1697](https://github.com/sourcebot-dev/sourcebot/pull/1697)
+- Upgraded `nodemailer` to `^10.0.2`. [#1703](https://github.com/sourcebot-dev/sourcebot/pull/1703)
 
 ## [5.1.15] - 2026-09-29
 

packages/web/package.json

@@ -166,7 +166,7 @@
     "next-auth": "^5.0.0-beta.32",
     "next-navigation-guard": "^0.2.0",
     "next-themes": "^0.3.0",
-    "nodemailer": "^9.0.1",
+    "nodemailer": "^10.0.2",
     "octokit": "^4.1.3",
     "openai": "^4.98.0",
     "parse-diff": "^0.11.1",

packages/web/src/auth.ts

@@ -99,7 +99,7 @@ export const getProviders = async () => {
                         text: `Log in to Sourcebot using this code: ${token}`
                     });
 
-                    const failed = result.rejected.concat(result.pending).filter(Boolean);
+                    const failed = result.rejected.concat(result.pending ?? []).filter(Boolean);
                     if (failed.length) {
                         throw new Error(`Email(s) (${failed.join(", ")}) could not be sent`);
                     }

packages/web/src/features/membership/actions/accountRequests.ts

@@ -113,7 +113,7 @@ export const createAccountRequest = async () => sew(async () => {
                 text: `New account request for ${org.name} on Sourcebot by ${user.name ?? user.email}`,
             });
 
-            const failed = result.rejected.concat(result.pending).filter(Boolean);
+            const failed = result.rejected.concat(result.pending ?? []).filter(Boolean);
             if (failed.length > 0) {
                 logger.error(`Failed to send account request email to ${ownerEmails.join(', ')}: ${failed}`);
             }
@@ -220,7 +220,7 @@ export const approveAccountRequest = async (requestId: string) => sew(async () =
                     text: `Your request to join ${org.name} on Sourcebot has been approved. You can now access the organization at ${env.AUTH_URL}`,
                 });
 
-                const failed = result.rejected.concat(result.pending).filter(Boolean);
+                const failed = result.rejected.concat(result.pending ?? []).filter(Boolean);
                 if (failed.length > 0) {
                     logger.error(`Failed to send approval email to ${request.requestedBy.email}: ${failed}`);
                 }

packages/web/src/features/membership/actions/invites.ts

@@ -173,7 +173,7 @@ export const createInvites = async (emails: string[]): Promise<{ success: boolea
                         text: `Join ${invite.org.name} on Sourcebot by clicking here: ${inviteLink}`,
                     });
 
-                    const failed = result.rejected.concat(result.pending).filter(Boolean);
+                    const failed = result.rejected.concat(result.pending ?? []).filter(Boolean);
                     if (failed.length > 0) {
                         logger.error(`Failed to send invite email to ${email}: ${failed}`);
                     }

yarn.lock

@@ -9179,7 +9179,7 @@ __metadata:
     next-auth: "npm:^5.0.0-beta.32"
     next-navigation-guard: "npm:^0.2.0"
     next-themes: "npm:^0.3.0"
-    nodemailer: "npm:^9.0.1"
+    nodemailer: "npm:^10.0.2"
     npm-run-all: "npm:^4.1.5"
     octokit: "npm:^4.1.3"
     openai: "npm:^4.98.0"
@@ -18596,10 +18596,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"nodemailer@npm:^9.0.1":
-  version: 9.1.1
-  resolution: "nodemailer@npm:9.1.1"
-  checksum: 10c0/b213a2a906697a735f6eb21103629b7a77aeac297b6d843efd4588157999bf6d19381853ac1224e472f5a34aec2e2412444151a2c6ec6e8c52150afa3055039c
+"nodemailer@npm:^10.0.2":
+  version: 10.0.13
+  resolution: "nodemailer@npm:10.0.13"
+  checksum: 10c0/3004362415e977a3fdf2a0c0ec0ad9fd3724d5ccba3951763bd28fa13a6b87cab13e790c934ccb66b6657ca8149a7efc4cc973867760588169efd8ec3fb99908
   languageName: node
   linkType: hard