Skip to content

chore(deps): bump mailparser, nodemailer, and undici #41039

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
julio-rocketchat wants to merge 2 commits into
base: develop
Choose a base branch
from
+27 −41
Open

chore(deps): bump mailparser, nodemailer, and undici #41039

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6a0c403
chore(deps): bump mailparser, nodemailer, and undici
julio-rocketchat Jun 22, 2026
990d121
Merge branch 'develop' into bump-dependencies-mailparser-nodemailer-u…
julio-rocketchat Jun 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 4 additions & 15 deletions .github/actions/update-version-durability/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions .github/actions/update-version-durability/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,5 +17,8 @@
"diff": "^5.1.0",
"semver": "^7.5.4",
"@xmldom/xmldom": "^0.8.13"
},
"overrides": {
"undici": "6.27.0"
}
}
4 changes: 2 additions & 2 deletions apps/meteor/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -241,7 +241,7 @@
"lodash.debounce": "^4.0.8",
"lodash.escape": "^4.0.1",
"lodash.get": "^4.4.2",
"mailparser": "~3.9.10",
"mailparser": "~3.9.11",
"marked": "^4.3.0",
"mem": "^8.1.1",
"meteor-node-stubs": "~1.2.27",
Expand All @@ -257,7 +257,7 @@
"node-dogstatsd": "^0.0.7",
"node-fetch": "2.7.0",
"node-rsa": "^1.1.1",
"nodemailer": "^8.0.8",
"nodemailer": "^9.0.1",

@coderabbitai coderabbitai Bot Jun 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== Declared nodemailer deps in apps/meteor/package.json =="
python - <<'PY'
import json
p=json.load(open("apps/meteor/package.json"))
print("dependencies.nodemailer =", p.get("dependencies", {}).get("nodemailer"))
print("devDependencies.@types/nodemailer =", p.get("devDependencies", {}).get("`@types/nodemailer`"))
PY

echo
echo "== npm metadata check =="
npm view nodemailer@9.0.1 version types typings
npm view `@types/nodemailer` version

echo
echo "== Nodemailer usage points in email flow =="
rg -nP --type=ts -C2 '\bcreateTransport\b|\bsendMail\b'

Repository: RocketChat/Rocket.Chat

Length of output: 4319

🌐 Web query:

nodemailer v9.0.1 breaking changes release notes

💡 Result:

Nodemailer version 9.0.1 was released on June 17, 2026 [1][2][3]. There are no breaking changes associated with this specific patch release; it is categorized as a bug fix release [1][2]. The release primarily addresses the following issue: - Enforces disableFileAccess and disableUrlAccess for the raw message option [1][2]. For users upgrading from version 9.0.0, this release is a maintenance update intended to improve security and handling of raw message access [1][2]. Users upgrading from earlier versions (e.g., v8.x) should review the migration path to v9.0.0, as breaking changes may have been introduced in the major version transition [4].

Citations:

🏁 Script executed:

# Check the specific lines in package.json to confirm versions
sed -n '258,262p' apps/meteor/package.json
sed -n '379,383p' apps/meteor/package.json

# Check if there are TypeScript errors by examining the actual type imports/usage
rg -A5 -B5 'import.*nodemailer' apps/meteor/server/features/EmailInbox/

Repository: RocketChat/Rocket.Chat

Length of output: 2638

🌐 Web query:

nodemailer v8 to v9 breaking changes migration guide

💡 Result:

As of June 22, 2026, Nodemailer v9.0.0 was released on June 14, 2026 [1][2]. This version introduces a single, critical breaking change related to TLS security [3][2]. Breaking Change: TLS Certificate Validation HTTPS requests made by Nodemailer when fetching remote content now validate TLS certificates by default [3][2]. This affects operations such as fetching remote attachments (via href or path URLs), OAuth2 token endpoints, and HTTP/HTTPS proxy connections [3][2]. Impact: Previously, Nodemailer did not strictly validate TLS certificates for these remote requests, which allowed connections to hosts with self-signed, expired, or hostname-mismatched certificates to succeed [3][2]. Under v9.0.0 and later, these connections will fail by default [3][2]. Migration/Action Required: If your application depends on fetching content from servers that use self-signed certificates or have invalid/expired TLS configurations, you must explicitly opt out of strict validation for those specific requests [3][2]. You can disable certificate validation by setting tls.rejectUnauthorized = false [3][2]. This can be configured in two ways: 1. Transport Options: Set it globally in the transport configuration. 2. Per-Attachment: Set it within the tls option of a specific attachment. Example: If you have a remote attachment failing due to this change, you can update your attachment definition: { path: 'https://example.com/some-file.pdf', tls: { rejectUnauthorized: false } } No other significant breaking changes were introduced in the v9.0.0 release [3][2].

Citations:

🌐 Web query:

@types/nodemailer 8.0.0 compatibility nodemailer 9.0.1

💡 Result:

As of June 22, 2026, @types/nodemailer version 8.0.1 is the recommended and most up-to-date set of type definitions, which provides compatibility for Nodemailer version 9.x [1]. While you specifically asked about @types/nodemailer 8.0.0, note that this version was released on April 4, 2026 [2][3]. Shortly thereafter, @types/nodemailer 8.0.1 was released on June 10, 2026, to ensure better alignment with the latest Nodemailer releases [1][4]. Nodemailer itself reached version 9.0.1 on June 17, 2026 [5][6]. Because Nodemailer does not maintain its own TypeScript definitions—relying instead on the community-maintained DefinitelyTyped project—you should always use the latest version of @types/nodemailer available on npm to ensure full compatibility with the corresponding Nodemailer minor and patch releases [7][8]. Using @types/nodemailer 8.0.1 is the appropriate choice for Nodemailer 9.0.1 [1].

Citations:

🏁 Script executed:

# Get more context on the type imports and usage
cat -n apps/meteor/server/features/EmailInbox/EmailInbox.ts | head -100

# Check if Mail.Options is used and how
rg -n 'Mail\.Options\|Mail\.' apps/meteor/server/features/EmailInbox/

Repository: RocketChat/Rocket.Chat

Length of output: 3573

Update @types/nodemailer to ^8.0.1 for alignment with nodemailer v9.

@types/nodemailer is currently pinned at ^8.0.0, but @types/nodemailer@8.0.1 (released June 10, 2026) is the recommended version for nodemailer v9.x. While the patch difference is minor and the current types should function correctly with nodemailer v9.0.1, the versions should be aligned.

Additionally, note that nodemailer v9 introduces a breaking change unrelated to types: TLS certificate validation is now enforced by default for remote content fetching (attachments, OAuth2 endpoints, proxy connections). If your usage of nodemailer in EmailInbox.ts / EmailInbox_Outgoing.ts involves remote attachments or self-signed certificates, ensure proper TLS handling is configured.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/meteor/package.json` at line 260, Locate the `@types/nodemailer`
dependency in package.json (currently pinned at ^8.0.0) and update it to ^8.0.1
to align with the nodemailer v9.0.1 version already specified in the
dependencies. Additionally, review the files EmailInbox.ts and
EmailInbox_Outgoing.ts to ensure they properly handle TLS certificate
validation, as nodemailer v9 now enforces TLS certificate validation by default
for remote content fetching (attachments, OAuth2 endpoints, proxy connections)
and may require configuration adjustments if your code uses remote attachments
or self-signed certificates.

"object-path": "^0.11.8",
"overlayscrollbars": "~2.11.5",
"overlayscrollbars-react": "^0.5.6",
Expand Down
5 changes: 3 additions & 2 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,8 @@
"ws@npm:^8": "^8.20.1",
"ws@npm:^8.2.3": "^8.20.1",
"ws@npm:^8.18.0": "^8.20.1",
"undici@npm:^6.19.5": "^6.24.0",
"undici@npm:^6.19.5": "^6.27.0",
"undici@npm:^6.23.0": "^6.27.0",
"webpack": "~5.104.0",
"yaml@npm:^1.10.0": "^1.10.3",
"yaml@npm:^2.2.2": "^2.8.3",
Expand Down Expand Up @@ -141,7 +142,7 @@
"minimatch@npm:^3.1.1": "3.1.5",
"minimatch@npm:^9.0.4": "9.0.9",
"minimatch@npm:^10.0.0": "10.2.5",
"nodemailer@npm:^8.0.8": "8.0.8",
"nodemailer@npm:^9.0.1": "9.0.1",
"normalize-package-data@npm:2.5.0/semver": "5.7.2",
"make-dir@npm:2.1.0/semver": "5.7.2",
"utf7/semver": "5.7.2",
Expand Down
37 changes: 15 additions & 22 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10164,7 +10164,7 @@ __metadata:
lodash.debounce: "npm:^4.0.8"
lodash.escape: "npm:^4.0.1"
lodash.get: "npm:^4.4.2"
mailparser: "npm:~3.9.10"
mailparser: "npm:~3.9.11"
marked: "npm:^4.3.0"
mem: "npm:^8.1.1"
meteor-node-stubs: "npm:~1.2.27"
Expand All @@ -10181,7 +10181,7 @@ __metadata:
node-dogstatsd: "npm:^0.0.7"
node-fetch: "npm:2.7.0"
node-rsa: "npm:^1.1.1"
nodemailer: "npm:^8.0.8"
nodemailer: "npm:^9.0.1"
nyc: "npm:^17.1.0"
object-path: "npm:^0.11.8"
outdent: "npm:~0.8.0"
Expand Down Expand Up @@ -27438,9 +27438,9 @@ __metadata:
languageName: node
linkType: hard

"mailparser@npm:~3.9.10":
version: 3.9.10
resolution: "mailparser@npm:3.9.10"
"mailparser@npm:~3.9.11":
version: 3.9.11
resolution: "mailparser@npm:3.9.11"
dependencies:
"@zone-eu/mailsplit": "npm:5.4.12"
encoding-japanese: "npm:2.2.0"
Expand All @@ -27449,10 +27449,10 @@ __metadata:
iconv-lite: "npm:0.7.2"
libmime: "npm:5.3.8"
linkify-it: "npm:5.0.1"
nodemailer: "npm:9.0.0"
nodemailer: "npm:9.0.1"
punycode.js: "npm:2.3.1"
tlds: "npm:1.261.0"
checksum: 10/427aefc17df534eeac22cb6ab6c87442115fbb000b173eea51e9286e00694c2b2e48e7b2920f8d312c59faf3c1d0babcb06f2e1c2552e207777991d31444649e
checksum: 10/b740f0ce62ada65c634ac5879bf9a71562b5656d4d805b0496b2e2f5aed3defa116f6adeba9120f76658da6288511c25e1e232a68e4e426c3ed8e9881e9c45bc
languageName: node
linkType: hard

Expand Down Expand Up @@ -28925,17 +28925,10 @@ __metadata:
languageName: node
linkType: hard

"nodemailer@npm:8.0.8":
version: 8.0.8
resolution: "nodemailer@npm:8.0.8"
checksum: 10/b4d2d095355751ab4baa7047c35845a05a42eec734218e69fb36d16e9efaa0804d41741e39bbe0e22dfd416a9be835b09b82df624fd5da2b5d7aa8ca5a449e55
languageName: node
linkType: hard

"nodemailer@npm:9.0.0":
version: 9.0.0
resolution: "nodemailer@npm:9.0.0"
checksum: 10/c72598e599c13e5c7d1c49e46eb6a448e615ea5abe4ba6a1c7fae1c42941689adecbdcd5b19dd6ff2d36758274832895086b0414cc6031f50a69d9e612895597
"nodemailer@npm:9.0.1":
version: 9.0.1
resolution: "nodemailer@npm:9.0.1"
checksum: 10/cc7782962def1575102039270ff3356535c614e6db420dda85dffe672e77e66b410198c284a508b3bc8193b9c34c8e7b4cf8c697e0de2cc978c5e02f9c708fed
languageName: node
linkType: hard

Expand Down Expand Up @@ -36226,10 +36219,10 @@ __metadata:
languageName: node
linkType: hard

"undici@npm:^6.23.0, undici@npm:^6.24.0":
version: 6.25.0
resolution: "undici@npm:6.25.0"
checksum: 10/a475e45da3e1d1073283bb70531666f09a432eabff2b857bd7063d469a1ee1486192ff61dc0dadbb526673ce1120fee14d66a59b6b17d1e0bd3a4d5f0a52d0a6
"undici@npm:^6.27.0":
version: 6.27.0
resolution: "undici@npm:6.27.0"
checksum: 10/30c18cdb235edf4dd36f8aa3ace1ffaf44060289a7d62ad44c33180d2d74a224015d25574812f62ce9c625b5beb1b0b766495b650fedf356aca11eed7ce2c816
languageName: node
linkType: hard

Expand Down
Loading