Skip to content

chore(deps): bump nodemailer from 10.0.14 to 10.1.4 - #210

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/nodemailer-10.1.4
Closed

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/nodemailer-10.1.4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026 •

Copy link
Copy Markdown
Contributor

Bumps nodemailer from 10.0.14 to 10.1.4.

Release notes

Sourced from nodemailer's releases.

v10.1.4

10.1.4 (2026-10-18)

Bug Fixes

  • addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)
  • addressparser: bound group nesting at ten levels (ce63303)
  • addressparser: drop the obsolete route from an angle-addr (3dbc730)
  • addressparser: end a comment only at the ")" that closes the outermost one (0a87617)
  • addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)
  • addressparser: never read a mailbox out of a comment (a1538ea)
  • addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)
  • addressparser: read the first addr-spec of the display text (038940a)
  • split a domain literal off at the "@" in front of it (d5983b0)

v10.1.3

10.1.3 (2026-10-18)

Bug Fixes

  • format References and strip URLs in linear time, release any number of streams (2f18641)

v10.1.2

10.1.2 (2026-10-16)

Bug Fixes

  • bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint (e347fa2)

v10.1.1

10.1.1 (2026-10-14)

Bug Fixes

  • fetch: strip credentials on any cross-origin redirect (a15360c)

v10.1.0

10.1.0 (2026-10-10)

Behaviour changes

  • Pooled connections are closed after 4 minutes without a message (new idleTimeout pool option, set it to 0 to keep them open). A message whose recipients are rejected no longer closes the pooled connection, it is reset with RSET and reused, and a message is requeued when the server dropped a reused connection before any of it was sent.
  • connectionTimeout covers setting the session up as a whole: the DNS lookup, a proxy handshake, the TCP connection, TLS, the greeting and a STARTTLS upgrade. greetingTimeout still bounds the greeting and the STARTTLS handshake within it.
  • Any 421 reply ends the SMTP session. When the server closes an idle connection, SMTPConnection emits only end, not an ECONNECTION error.
  • A content stream that was already read or destroyed fails the message with ESTREAM instead of producing an empty attachment. Content streams of a message that fails are destroyed.
  • With opportunisticTLS, authentication is skipped on the unencrypted connection after a failed STARTTLS, unless forceAuth is set.

... (truncated)

Changelog

Sourced from nodemailer's changelog.

10.1.4 (2026-10-18)

Bug Fixes

  • addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)
  • addressparser: bound group nesting at ten levels (ce63303)
  • addressparser: drop the obsolete route from an angle-addr (3dbc730)
  • addressparser: end a comment only at the ")" that closes the outermost one (0a87617)
  • addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)
  • addressparser: never read a mailbox out of a comment (a1538ea)
  • addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)
  • addressparser: read the first addr-spec of the display text (038940a)
  • split a domain literal off at the "@" in front of it (d5983b0)

10.1.3 (2026-10-18)

Bug Fixes

  • format References and strip URLs in linear time, release any number of streams (2f18641)

10.1.2 (2026-10-16)

Bug Fixes

  • bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint (e347fa2)

10.1.1 (2026-10-14)

Bug Fixes

  • fetch: strip credentials on any cross-origin redirect (a15360c)

10.1.0 (2026-10-10)

Features

  • harden message streams, SMTP connections and the connection pool (8009da6)

Bug Fixes

  • do not read the environment or the interface table on import (094179d)
  • end the SMTP session on any 421 reply and drive the envelope through one step (5638ac1)
  • keep ERR_ACCESS_DENIED from the Node.js permission model (8b33a3d)
  • let the proxy handshake and the SMTP connection share one deadline (91ed683)

... (truncated)

Commits
  • 2a7e952 chore(master): release 10.1.4 (#1897)
  • 038940a fix(addressparser): read the first addr-spec of the display text
  • ce63303 fix(addressparser): bound group nesting at ten levels
  • a1538ea fix(addressparser): never read a mailbox out of a comment
  • 3dbc730 fix(addressparser): drop the obsolete route from an angle-addr
  • ba3c095 fix(addressparser): read CFWS beside the "@" of an addr-spec as nothing
  • d5983b0 fix: split a domain literal off at the "@" in front of it
  • ee35f57 fix(addressparser): apply the unexpected "<" rule outside quotes and comments
  • 0a87617 fix(addressparser): end a comment only at the ")" that closes the outermost one
  • 1cd57d2 fix(addressparser): honour quoted strings and comments inside an angle-addr a...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [nodemailer](https://github.com/nodemailer/nodemailer) from 10.0.14 to 10.1.4.
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v10.0.14...v10.1.4)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 10.1.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions

Copy link
Copy Markdown

Manual review required. This Dependabot PR bumps a version-update:semver-minor dependency. Please review the changelog before approving.

@github-actions

Copy link
Copy Markdown

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
npm/nodemailer ^10.1.4 UnknownUnknown
npm/@0no-co/graphql.web 1.3.4 UnknownUnknown
npm/@babel/helper-string-parser 7.29.11 UnknownUnknown
npm/@babel/runtime 7.29.10 🟢 7.3
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 8Found 26/30 approved changesets -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 2badge detected: InProgress
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/@babel/types 7.29.11 UnknownUnknown
npm/@bramus/specificity 2.4.3 UnknownUnknown
npm/@csstools/css-syntax-patches-for-csstree 1.1.15 🟢 7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Code-Review⚠️ 0Found 0/22 approved changesets -- score normalized to 0
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
Binary-Artifacts🟢 10no binaries found in the repo
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
npm/@exodus/bytes 1.16.0 UnknownUnknown
npm/acorn 8.19.0 🟢 4.8
Details
CheckScoreReason
Code-Review⚠️ 1Found 3/30 approved changesets -- score normalized to 1
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1026 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License⚠️ 0license file not detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/baseline-browser-mapping 2.11.32 UnknownUnknown
npm/bidi-js 1.1.0 🟢 3.4
Details
CheckScoreReason
Code-Review⚠️ 2Found 6/25 approved changesets -- score normalized to 2
Maintained⚠️ 23 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 2
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/browserslist 4.29.4 🟢 6.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 4Found 9/20 approved changesets -- score normalized to 4
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/caniuse-lite 1.0.30001819 🟢 4.2
Details
CheckScoreReason
Maintained🟢 79 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7
Code-Review⚠️ 0Found 2/27 approved changesets -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/electron-to-chromium 1.5.464 UnknownUnknown
npm/enhanced-resolve 5.26.0 🟢 5.5
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/10 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1030 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/lru-cache 11.5.3 🟢 4.1
Details
CheckScoreReason
Code-Review⚠️ 0Found 1/29 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Maintained⚠️ 22 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 2
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/node-releases 2.0.60 🟢 4
Details
CheckScoreReason
Maintained🟢 1016 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
SAST⚠️ 0no SAST tool detected
Packaging⚠️ -1packaging workflow not detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
npm/nodemailer 10.1.4 🟢 5.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Code-Review⚠️ 0Found 0/24 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
License🟢 9license file detected
Fuzzing⚠️ 0project is not fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/react-is 19.3.1 UnknownUnknown
npm/schema-utils 4.8.1 🟢 5.3
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review⚠️ 0Found 0/22 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1026 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/terser 5.51.2 🟢 5.9
Details
CheckScoreReason
Code-Review⚠️ 1Found 3/28 approved changesets -- score normalized to 1
Maintained🟢 1025 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Security-Policy🟢 10security policy file detected
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/tldts 7.4.19 🟢 4.2
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 0Found 0/13 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/tldts-core 7.4.19 🟢 4.2
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 0Found 0/13 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases⚠️ -1no releases found
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/tough-cookie 6.0.2 🟢 6.6
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Security-Policy🟢 9security policy file detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Packaging🟢 10packaging workflow detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/undici 8.12.3 🟢 7.8
Details
CheckScoreReason
Code-Review🟢 5Found 13/22 approved changesets -- score normalized to 5
Maintained🟢 1030 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
Dependency-Update-Tool🟢 10update tool detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 8binaries present in source code
License🟢 10license file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 73 existing vulnerabilities detected
Fuzzing🟢 10project is fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST🟢 10SAST tool is run on all commits
Signed-Releases⚠️ -1no releases found
CI-Tests🟢 1022 out of 22 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 58 contributing companies or organizations
npm/update-browserslist-db 1.3.4 🟢 5.6
Details
CheckScoreReason
Code-Review⚠️ 2Found 7/30 approved changesets -- score normalized to 2
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
npm/watchpack 2.6.3 🟢 5.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review⚠️ 0Found 0/6 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Packaging🟢 10packaging workflow detected
npm/webpack-sources 3.6.0 🟢 5.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
Code-Review⚠️ 0Found 0/11 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 7dependency not pinned by hash detected -- score normalized to 7
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • frontend/package.json
  • pnpm-lock.yaml

@github-actions

Copy link
Copy Markdown

Coverage after merging dependabot/npm_and_yarn/nodemailer-10.1.4 into main will be

30.14%

Coverage Report
FileStmtsBranchesFuncsLinesUncovered Lines
src
   middleware.ts0%0%0%0%100, 100, 108, 116–117, 117–118, 122–123, 123–124, 128–129, 129–130, 133, 141, 143–144, 144, 144, 144–145, 151–152, 152–154, 154, 154, 154–156, 156–157, 157, 157, 16, 162, 164, 172, 179–181, 196, 198, 198, 198, 200, 204, 204, 21, 210, 210, 210, 210, 210, 210, 217, 217, 220, 230, 233, 236–240, 246, 246–247, 254, 256, 26, 262–263, 266, 266–267, 272–273, 278, 282, 282, 282, 282, 282, 284, 288, 290, 290–292, 295, 295–296, 303, 306, 306, 306, 306, 306, 306, 312–313, 313, 313, 317–318, 318, 318–319, 322, 322, 324, 324–325, 325, 325, 325, 325, 331–332, 334–335, 339, 339, 341, 341–345, 349, 349, 349, 349–350, 350, 352–355, 360–361, 365–366, 372, 40, 45, 50, 55, 60, 66–67, 67–68, 70, 70, 70, 78, 85, 92, 99
src/app
   error.tsx0%100%0%0%16–17, 19, 3–5
   layout.tsx0%0%0%0%10, 107, 123, 147, 150, 2, 20, 20, 20, 22, 22, 22, 226, 226, 24, 3–5, 8
   loading.tsx0%100%0%0%1, 7
   not-found.tsx0%100%0%0%1, 7
   page.tsx0%0%0%0%3, 35–38, 4, 40, 40, 40, 42–43, 43, 46, 46–48, 5, 52, 52, 52, 52, 52, 54, 54–55, 57, 6, 60–61, 65, 7, 73
src/app/(authenticated)/bookmarks
   page.tsx0%100%0%0%10–12, 14, 9
src/app/activity
   page.tsx0%0%0%0%10, 113, 113, 134, 142, 142, 147, 16, 162, 162, 162, 167, 167, 167, 17, 171, 18, 184, 186, 186, 189, 191, 191, 191, 191–193, 198, 205, 205, 210, 210, 222, 229, 229, 58, 74, 77, 80, 80–81, 9, 91–92
src/app/admin
   loading.tsx0%0%0%0%1, 104, 2–3, 38, 42, 42, 77, 9, 91
   page.tsx0%0%0%0%100–101, 103–104, 104, 104, 104, 104–105, 109–111, 111, 111, 111, 111–112, 115, 115, 115, 115, 115–116, 17–19, 199, 20–21, 239, 248, 248, 251, 251, 257, 261, 261, 28–29, 3, 30–31, 36, 39, 4, 43, 5, 52, 6–7, 90, 97–99
src/app/admin/advanced
   page.tsx0%0%0%0%106–110, 112–113, 113, 113, 113, 113–114, 118, 118, 118, 118, 118–119, 14–15, 25–26, 33–38, 392, 394, 41–45, 48, 77
src/app/admin/analytics
   page.tsx0%0%0%0%100, 100, 100, 100, 100, 103–107, 117, 124–125, 125, 130, 133, 133, 133–135, 135–137, 141, 141, 141–143, 143–145, 15, 154–159, 16, 160, 160, 163, 167–168, 168, 168–169, 169, 169, 17, 171, 171, 171, 173, 177, 18, 181–182, 182–183, 191, 193, 196, 196, 196–197, 200, 200, 208–209, 209–210, 216, 219, 219, 224–226, 226, 226–228, 228, 228, 230, 25, 256–257, 259, 26, 263, 265–266, 269, 271–279, 282, 282, 3, 313, 33, 331, 331, 34–36, 4, 41, 44, 49, 5, 52, 57, 60, 65, 68, 73, 76, 81, 84, 88, 96–98
src/app/admin/audit
   page.tsx0%0%0%0%116–117, 119–120, 123, 123, 123, 123, 123, 123, 125, 127, 129–130, 132, 134, 136, 138, 140, 143–144, 147, 149, 149, 149, 151, 151, 155, 163, 163, 171, 171, 177, 177, 189, 19, 196–198, 206, 209, 21, 211–212, 215–216, 216, 216, 216, 216–217, 22, 222–223, 225–229, 23, 233–234, 236–240, 243–244, 247–250, 252–255, 258, 258, 258, 258, 258–259, 263–267, 28, 289, 289, 291, 291, 299, 30, 303, 305, 305, 307, 307, 31, 322, 322, 43, 50, 59–60, 67, 7, 73, 79, 8, 80, 88, 9
src/app/admin/audit/security
   page.tsx0%0%0%0%10, 114, 12, 122, 13, 136, 136, 136, 140, 148, 148, 148, 15,

@github-actions

Copy link
Copy Markdown

PR Checks Summary

Check Status
Lint & Format ✅ success
Type Check ✅ success
Unit Tests ✅ success
Build ✅ success

✅ All checks passed! Ready for review.

@dependabot @github

dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown
Contributor Author

Looks like nodemailer is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 24, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/nodemailer-10.1.4 branch October 24, 2026 04:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants