Skip to content

chore(deps): bump nodemailer from 7.0.11 to 8.0.5 in /apps/studio.giselles.ai in the npm_and_yarn group across 1 directory#2914

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/studio.giselles.ai/npm_and_yarn-2867179b1e
Open

chore(deps): bump nodemailer from 7.0.11 to 8.0.5 in /apps/studio.giselles.ai in the npm_and_yarn group across 1 directory#2914
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/studio.giselles.ai/npm_and_yarn-2867179b1e

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 12, 2026

Bumps the npm_and_yarn group with 1 update in the /apps/studio.giselles.ai directory: nodemailer.

Updates nodemailer from 7.0.11 to 8.0.5

Release notes

Sourced from nodemailer's releases.

v8.0.5

8.0.5 (2026-04-07)

Bug Fixes

  • decode SMTP server responses as UTF-8 at line boundary (95876b1)
  • sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g) (0a43876)

v8.0.4

8.0.4 (2026-03-25)

Bug Fixes

  • sanitize envelope size to prevent SMTP command injection (2d7b971)

v8.0.3

8.0.3 (2026-03-18)

Bug Fixes

  • clean up addressparser and fix group name fallback producing undefined (9d55877)
  • fix cookie bugs, remove dead code, and improve hot-path efficiency (e8c8b92)
  • refactor smtp-connection for clarity and add Node.js 6 syntax compat test (c5b48ea)
  • remove familySupportCache that broke DNS resolution tests (c803d90)

v8.0.2

8.0.2 (2026-03-09)

Bug Fixes

  • merge fragmented display names with unquoted commas in addressparser (fe27f7f)

v8.0.1

8.0.1 (2026-02-07)

Bug Fixes

  • absorb TLS errors during socket teardown (7f8dde4)
  • absorb TLS errors during socket teardown (381f628)
  • Add Gmail Workspace service configuration (#1787) (dc97ede)

v8.0.0

8.0.0 (2026-02-04)

... (truncated)

Changelog

Sourced from nodemailer's changelog.

8.0.5 (2026-04-07)

Bug Fixes

  • decode SMTP server responses as UTF-8 at line boundary (95876b1)
  • sanitize CRLF in transport name option to prevent SMTP command injection (GHSA-vvjj-xcjg-gr5g) (0a43876)

8.0.4 (2026-03-25)

Bug Fixes

  • sanitize envelope size to prevent SMTP command injection (2d7b971)

8.0.3 (2026-03-18)

Bug Fixes

  • clean up addressparser and fix group name fallback producing undefined (9d55877)
  • fix cookie bugs, remove dead code, and improve hot-path efficiency (e8c8b92)
  • refactor smtp-connection for clarity and add Node.js 6 syntax compat test (c5b48ea)
  • remove familySupportCache that broke DNS resolution tests (c803d90)

8.0.2 (2026-03-09)

Bug Fixes

  • merge fragmented display names with unquoted commas in addressparser (fe27f7f)

8.0.1 (2026-02-07)

Bug Fixes

  • absorb TLS errors during socket teardown (7f8dde4)
  • absorb TLS errors during socket teardown (381f628)
  • Add Gmail Workspace service configuration (#1787) (dc97ede)

8.0.0 (2026-02-04)

⚠ BREAKING CHANGES

  • Error code 'NoAuth' renamed to 'ENOAUTH'

Bug Fixes

... (truncated)

Commits
  • 202cfb3 chore(master): release 8.0.5 (#1809)
  • b634abf docs: add CLAUDE.md with project conventions and release process
  • 95876b1 fix: decode SMTP server responses as UTF-8 at line boundary
  • 0a43876 fix: sanitize CRLF in transport name option to prevent SMTP command injection...
  • 08e59e6 chore: update dev dependencies
  • 2d31975 chore(master): release 8.0.4 (#1806)
  • 2d7b971 fix: sanitize envelope size to prevent SMTP command injection
  • 4e702e9 chore(master): release 8.0.3 (#1804)
  • c803d90 fix: remove familySupportCache that broke DNS resolution tests
  • e8c8b92 fix: fix cookie bugs, remove dead code, and improve hot-path efficiency
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 1 update in the /apps/studio.giselles.ai directory: [nodemailer](https://github.com/nodemailer/nodemailer).


Updates `nodemailer` from 7.0.11 to 8.0.5
- [Release notes](https://github.com/nodemailer/nodemailer/releases)
- [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md)
- [Commits](nodemailer/nodemailer@v7.0.11...v8.0.5)

---
updated-dependencies:
- dependency-name: nodemailer
  dependency-version: 8.0.5
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label May 12, 2026
@dependabot dependabot Bot requested a review from shige as a code owner May 12, 2026 11:42
@dependabot dependabot Bot added javascript Pull requests that update javascript code dependencies Pull requests that update a dependency file labels May 12, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented May 12, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
giselle Error Error May 12, 2026 11:42am

Request Review

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented May 12, 2026

⚠️ No Changeset found

Latest commit: ed02ce8

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

💥 An error occurred when fetching the changed packages and changesets in this PR
Some errors occurred when validating the changesets config:
The package or glob expression "giselles-ai" is specified in the `ignore` option but it is not found in the project. You may have misspelled the package name or provided an invalid glob expression. Note that glob expressions must be defined according to https://www.npmjs.com/package/micromatch.

@giselles-ai
Copy link
Copy Markdown

giselles-ai Bot commented May 12, 2026

Finished running flow.

Step 1
🟢
On Pull Request OpenedStatus: Success Updated: May 12, 2026 11:42am
Step 2
🟢
Manual QAStatus: Success Updated: May 12, 2026 11:44am
🟢
Prompt for AI AgentsStatus: Success Updated: May 12, 2026 11:44am
Step 3
🟢
Create a Comment for PRStatus: Success Updated: May 12, 2026 11:45am
Step 4
🟢
Create Pull Request CommentStatus: Success Updated: May 12, 2026 11:45am

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ed02ce890e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

"next": "catalog:",
"next-themes": "0.3.0",
"nodemailer": "7.0.11",
"nodemailer": "8.0.5",
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Update the pnpm lockfile with nodemailer

In CI/deploy environments that install with the committed pnpm lockfile, this package.json bump is not actually installable because pnpm-lock.yaml was not updated: the apps/studio.giselles.ai importer still records nodemailer with specifier/version 7.0.11 at pnpm-lock.yaml:495-497, and the package entry is still nodemailer@7.0.11. Please regenerate and commit the lockfile so frozen/reproducible installs resolve 8.0.5 instead of failing on the manifest/lockfile mismatch or keeping the old package.

Useful? React with 👍 / 👎.

@giselles-ai
Copy link
Copy Markdown

giselles-ai Bot commented May 12, 2026

  • [Email Sending]: Trigger a test email from the "Contact Us" form and verify it is received by the admin inbox.
  • [Email Content]: Open the received "Contact Us" email and verify sender, recipient, subject, and all body content (including dynamic fields) are accurate.
  • [Email Formatting]: Ensure the HTML formatting, styling, and any included images in the "Contact Us" email render correctly.
  • [Password Reset]: Initiate a password reset for a test user and verify they receive the reset email.
  • [Password Reset Content]: Check the password reset email for correct recipient, subject, and that the reset link is functional and correctly formatted.
  • [Special Characters]: If possible, trigger an email with non-ASCII characters in the body (e.g., a user's name) and verify they render correctly in the received email.
  • [Error Handling - UI]: Attempt an action that is known to cause an email sending failure (e.g., invalid SMTP credentials in a test environment) and verify the UI displays a user-friendly error message.
📝 E2E Test Generation Prompt
# **Prompt for AI Code Assistant: Generate E2E Tests for Nodemailer Dependency Bump**

Hello! I need you to act as an expert QA engineer and generate E2E tests using Playwright.

This PR involves a major version bump of `nodemailer`, a critical dependency for sending emails in our `studio.giselles.ai` application. We need to ensure that no regressions have been introduced and that all email-related functionalities are working as expected. Pay close attention to potential breaking changes noted in the release logs.

### 1. Context Summary

*   **PR Description:** The PR updates `nodemailer` from `v7.0.11` to `v8.0.5`. This is a major version bump that includes security patches, bug fixes, and a significant breaking change.
*   **Key Change Impact:** This change exclusively affects the backend logic for sending emails. All user flows that trigger an email are at risk of regression.
*   **Breaking Change:** The `nodemailer` v8.0.0 release notes mention a breaking change: `Error code 'NoAuth' renamed to 'ENOAUTH'`. Our backend error handling might be affected. While we can't test the backend code directly with Playwright, we must verify that the UI handles any potential email-sending failures gracefully.
*   **Critical Paths for Testing:**
    1.  **User Registration:** The flow where a new user signs up and should receive a welcome or verification email.
    2.  **Password Reset:** The "Forgot Password" flow where a user requests a password reset link via email.
    3.  **Contact/Feedback Forms:** Any forms that send an email notification to administrators or a confirmation to the user upon submission.

### 2. Test Scenarios

Please generate tests covering the following scenarios. Assume the application has standard "Sign Up," "Login," and "Forgot Password" pages.

*   **Test File:** Create a new test file named `e2e/email-flows.spec.ts`.

#### Scenario 1: Successful User Registration (Happy Path)
*   **Goal:** Verify that a user can complete the sign-up form and the UI confirms that a verification email has been sent.
*   **Steps:**
    1.  Navigate to the `/signup` page.
    2.  Fill in the registration form (e.g., name, email, password). Use a unique, dynamically generated email address to ensure test isolation (e.g., `test-user-${Date.now()}@example.com`).
    3.  Click the "Sign Up" or "Register" button.
    4.  **Assert:** The user is redirected to a confirmation page OR a success toast/message appears on the current page. The message should be similar to "Registration successful! Please check your email to verify your account."

#### Scenario 2: Successful Password Reset Request (Happy Path)
*   **Goal:** Verify that a user can request a password reset and the UI confirms that instructions have been sent.
*   **Setup:** This test requires a pre-existing user. Use a seeded test user account (e.g., `test-user@example.com`) or create one in a `test.beforeEach` block.
*   **Steps:**
    1.  Navigate to the `/forgot-password` page.
    2.  Enter the email address of the existing test user.
    3.  Click the "Send Reset Link" button.
    4.  **Assert:** A success message is displayed on the page, like "If an account with that email exists, a password reset link has been sent."

#### Scenario 3: Graceful Failure on Email Service Error (Sad Path)
*   **Goal:** Simulate a backend failure during an email-sending process and verify the UI displays a user-friendly error message. This directly tests the application's resilience to backend issues, including the `ENOAUTH` breaking change.
*   **Strategy:** Use Playwright's network mocking (`page.route()`) to intercept the API call that triggers the email (e.g., `POST /api/auth/signup`) and force a 500 Internal Server Error response.
*   **Steps:**
    1.  Define a route handler before the action: `await page.route('**/api/auth/signup', route => route.abort('failed'));` or `route => route.fulfill({ status: 500, json: { message: 'Email service unavailable' } })`.
    2.  Navigate to the `/signup` page.
    3.  Fill in the registration form with valid data.
    4.  Click the "Sign Up" button.
    5.  **Assert:** An error message or toast is displayed to the user, such as "An error occurred. Please try again later." The user should **not** be redirected to a success page.

### 3. Playwright Implementation Instructions

*   **Selectors:** Use `data-testid` attributes for robust selectors where possible. If not available, use `page.getByRole`, `page.getByLabel`, or `page.getByPlaceholderText`.
    *   Sign-up Email: `page.getByLabel('Email')` or `page.getByTestId('signup-email-input')`
    *   Sign-up Button: `page.getByRole('button', { name: /Sign Up|Register/i })`
    *   Success Message: `page.getByText(/check your email/i)`
    *   Error Message: `page.getByText(/An error occurred|Something went wrong/i)`

*   **Assertions:** Use `expect` from `@playwright/test`.
    *   `await expect(page.getByText('...')).toBeVisible();`
    *   `await expect(page).toHaveURL(/.*\/confirmation/);`

*   **Email Verification (Advanced):**
    *   For a complete test, we would ideally check if the email was actually sent and received. Add comments in the code suggesting how to integrate with an email testing service like [MailHog](https://github.com/mailhog/MailHog) or [Ethereal](https://ethereal.email/).
    *   **Example comment to add:**
        ```typescript
        // ADVANCED: To verify email receipt, an email testing service like MailHog should be used.
        // After this step, an API call would be made to the MailHog API to fetch the latest email
        // for 'test-user@example.com' and assert its contents.
        // const mailhogResponse = await request.get('http://localhost:8025/api/v2/messages');
        // const emails = await mailhogResponse.json();
        // expect(emails.items[0].Content.Headers.To[0]).toContain('test-user@example.com');
        ```

### 4. MCP Integration Guidelines

*   **Execution Command:** The generated tests can be run via Playwright MCP with the following command structure. Please add this as a comment at the top of the test file.
    ```bash
    # To run these tests via Playwright MCP:
    # mcp playwright test e2e/email-flows.spec.ts --project=chromium
    ```
*   **Environment Configuration:** These tests will require environment variables for the application to connect to the database and SMTP server. Ensure the test environment (`.env.test` or CI variables) is configured with placeholder/test credentials for the email service.

### 5. CI-Ready Code Requirements

*   **Structure:**
    *   Use `describe` blocks to group related tests: `describe('Email Sending Functionality', () => { ... });`
    *   Use `test.beforeEach` for setup logic (like navigation or user creation) to keep tests DRY.
*   **Naming Conventions:**
    *   Test file: `email-flows.spec.ts`
    *   Test descriptions: Use clear, descriptive titles like `test('should show success message after user registration', async ({ page }) => { ... });`
*   **Isolation and Parallelization:**
    *   Ensure all tests are atomic and independent.
    *   The use of dynamic data (e.g., unique emails) is critical for running tests in parallel without collisions. Avoid any shared state between test files.
*   **Code Quality:** Generate clean, readable TypeScript code with appropriate `async/await` and type annotations.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants