🔒 security(deps): cut v1.5.0-rc.38 — undici + nodemailer CVE sweep#443
Merged
Conversation
…/9678/9679/9697/11525/12151) osv-scanner flagged eight newly-disclosed undici advisories across three workspaces. The shipped backend (app) used undici 8.3.0 as a direct dependency — bumped to 8.5.0 (the only release clearing the full set; CVE-2026-9675 is fixed solely in 8.5.0) and pinned in overrides. The dashboard build (ui) and e2e load-test harness pulled undici 7.25.0/7.26.0 transitively — an overrides entry forces 7.28.0 (patched 7.x) in each; build/test-only, not shipped. Changelog entry added to the 1.5.0-rc.38 Security section.
…gq-j5cr-w38f) nodemailer ≤9.0.0 lets a message-level raw option bypass disableFileAccess/disableUrlAccess (arbitrary file read + full-response SSRF). Fixed only in 9.0.1; bumped app's direct dependency 8.0.10 → 9.0.1. drydock's SMTP trigger uses only createTransport/sendMail with from/to/subject/text and never passes raw, so the sink isn't reachable, but it's a HIGH (CVSS 7.1) shipped-runtime advisory. tsc --noEmit clean against nodemailer 9; @types/nodemailer unchanged. Changelog entry added to 1.5.0-rc.38 Security section.
scttbnsn
requested review from
ALARGECOMPANY and
biggest-littlest
as code owners
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
biggest-littlest
approved these changes
Jun 20, 2026
biggest-littlest
left a comment
biggest-littlest
left a comment
Member
There was a problem hiding this comment.
rc.38 release-prep: changelog cut + undici/nodemailer CVE sweep. osv clean except the pre-triaged js-yaml, tsc clean against nodemailer 9, coverage 100%, build green. LGTM.
ALARGECOMPANY
approved these changes
Jun 20, 2026
ALARGECOMPANY
left a comment
ALARGECOMPANY
left a comment
Member
There was a problem hiding this comment.
Confirmed: shipped-runtime fixes (undici 8.5.0, nodemailer 9.0.1) plus build/test-only pins, all osv-verified. Changelog matches. LGTM.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release-prep branch for v1.5.0-rc.38. Cuts the CHANGELOG section and folds in a fresh CVE sweep that surfaced when prepping the cut.
Commits
📝 docs(changelog)— promote the post-rc.37[Unreleased]block to a dated## [1.5.0-rc.38]heading (startup banner ✨ feat(cli): colored startup banner from the whale logo #440, Snyk→Grype 🔧 chore(security): drop Snyk, consolidate dep/CVE scanning on Grype #441, logo 🎨 style(brand): refresh the drydock whale logo everywhere #439, image CVE batch 🔒 security(image): clear image HIGH/CRITICAL CVEs and scope the Grype gate #442, apps/web+e2e transitive CVEs 🔒 security: patch transitive CVEs in apps/web (js-yaml) and e2e (@opentelemetry/core) #438) sorelease-cut.yml's CHANGELOG validation passes.🔒 security(deps)— undici CVE batch (8 advisories: CVE-2026-6733/6734/9675/9678/9679/9697/11525/12151). Shipped backend (app)8.3.0 → 8.5.0(only release clearing CVE-2026-9675);ui/e2eforced to7.28.0via override (build/test-only).🔒 security(deps)— nodemailer GHSA-p6gq-j5cr-w38f (CVSS 7.1):rawmessage option bypassesdisableFileAccess/disableUrlAccess(file-read + SSRF).app8.0.10 → 9.0.1(fix lands only in 9.0.1). SMTP trigger uses onlycreateTransport/sendMail, neverraw.Verification
js-yaml@3.14.2(e2e/artillery, test-only, unreachable) remains, already suppressed in the gate config.tsc --noEmitclean against nodemailer 9;@types/nodemailerunchanged.After merge: dispatch
release-cut.ymlwithrelease_tag=v1.5.0-rc.38.