chore(deps): bump nodemailer to 10.0.10 and patch vulnerable undici copies

apps/sim/lib/internal/smtp/client.ts

@@ -1,5 +1,5 @@
 import { createLogger } from '@sim/logger'
-import nodemailer from 'nodemailer'
+import nodemailer, { type SendMailOptions, type Transporter } from 'nodemailer'
 
 const logger = createLogger('SmtpClient')
 
@@ -12,7 +12,7 @@ export interface SmtpClientConfig {
   tls: { rejectUnauthorized: boolean; servername: string }
 }
 
-function closeTransporter(transporter: nodemailer.Transporter): void {
+function closeTransporter(transporter: Transporter): void {
   try {
     transporter.close()
   } catch (error) {
@@ -22,7 +22,7 @@ function closeTransporter(transporter: nodemailer.Transporter): void {
 
 export async function sendSmtpMessage(
   config: SmtpClientConfig,
-  message: nodemailer.SendMailOptions,
+  message: SendMailOptions,
   signal?: AbortSignal
 ): Promise<{ messageId?: string }> {
   signal?.throwIfAborted()

apps/sim/lib/internal/smtp/operations.ts

@@ -1,5 +1,5 @@
 import { toError } from '@sim/utils/errors'
-import type nodemailer from 'nodemailer'
+import type { SendMailOptions } from 'nodemailer'
 import { validateDatabaseHost } from '@/lib/core/security/input-validation.server'
 import {
   MailAttachmentMaterializationError,
@@ -80,7 +80,7 @@ export async function executeSmtpSend(input: SmtpSendInput, context: SmtpOperati
 
   const from = input.fromName ? `"${input.fromName}" <${input.from}>` : input.from
   const contentType = input.contentType || 'text'
-  const message: nodemailer.SendMailOptions = {
+  const message: SendMailOptions = {
     from,
     to: input.to,
     subject: input.subject,

apps/sim/lib/messaging/email/providers/ses.ts

@@ -16,8 +16,7 @@ export function createSesProvider(): MailProvider | null {
 
   const sesClient = new SESv2Client({ region })
   const sesOptions: SESTransport.Options = {
-    // double-cast-allowed: @types/nodemailer bundles a nested @aws-sdk/client-sesv2 whose nominal class types do not unify with the top-level install
-    SES: { sesClient, SendEmailCommand } as unknown as SESTransport.Options['SES'],
+    SES: { sesClient, SendEmailCommand },
   }
   const transporter = nodemailer.createTransport(sesOptions)
 

apps/sim/package.json

@@ -215,7 +215,7 @@
     "next": "16.3.4",
     "next-mdx-remote": "^6.0.0",
     "next-themes": "^0.4.6",
-    "nodemailer": "9.1.1",
+    "nodemailer": "10.0.10",
     "nuqs": "2.8.9",
     "officeparser": "5.2.2",
     "openai": "7.0.0",
@@ -251,7 +251,7 @@
     "tldts": "7.0.30",
     "twilio": "5.9.0",
     "typebox": "1.1.38",
-    "undici": "7.29.0",
+    "undici": "7.29.1",
     "unified": "11.0.5",
     "word-extractor": "1.0.4",
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",
@@ -278,7 +278,6 @@
     "@types/micromatch": "4.0.10",
     "@types/mssql": "12.3.0",
     "@types/node": "24.2.1",
-    "@types/nodemailer": "8.0.1",
     "@types/opentype.js": "1.3.10",
     "@types/prismjs": "^1.26.5",
     "@types/react": "^19",

package.json

@@ -136,7 +136,7 @@
     "marked": "18.0.11",
     "mermaid": "11.16.1",
     "zod": "4.3.6",
-    "e2b": "2.45.0",
+    "e2b": "2.50.0",
     "@hono/node-server": "1.19.15",
     "brace-expansion": "5.0.9",
     "deepmerge-ts": "8.0.0",