chore(deps): bump nodemailer from 8.0.7 to 8.0.9

[dependabot]

Bumps nodemailer from 8.0.7 to 8.0.9.

Release notes

Sourced from nodemailer's releases.

v8.0.9

8.0.9 (2026-05-26)

Bug Fixes

• two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

v8.0.8

8.0.8 (2026-05-23)

Bug Fixes

• enforce strict TLS for OAuth2 and Ethereal credential requests (#1818) (833d6e5)
• four listener/stream leaks in SMTP transport, connection, pool (#1817) (850bb91)

Changelog

Sourced from nodemailer's changelog.

8.0.9 (2026-05-26)

Bug Fixes

• two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

8.0.8 (2026-05-23)

Bug Fixes

• enforce strict TLS for OAuth2 and Ethereal credential requests (#1818) (833d6e5)
• four listener/stream leaks in SMTP transport, connection, pool (#1817) (850bb91)

Commits

• 07303cb chore(master): release 8.0.9 (#1821)
• 5f69497 fix: two pending security advisories (jsonTransport access bypass, List-* CRL...
• 15138a8 chore(master): release 8.0.8 (#1819)
• 850bb91 fix: four listener/stream leaks in SMTP transport, connection, pool (#1817)
• 833d6e5 fix: enforce strict TLS for OAuth2 and Ethereal credential requests (#1818)
• See full diff in compare view

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json, !package-lock.json and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d792f055-8627-4451-b7d8-0a2204cf8af2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Note

.coderabbit.yaml has unrecognized properties

CodeRabbit is using all valid settings from your configuration. Unrecognized properties (listed below) have been ignored and may indicate typos or deprecated fields that can be removed.

⚠️ Parsing warnings (1)

Validation error: Unrecognized key: "pre_merge_checks"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dependabot/npm_and_yarn/nodemailer-8.0.9

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

🤖 Hi @dependabot[bot], I've received your request, and I'm working on it now! You can track my progress in the logs for more details.

[github-actions]

🤖 I'm sorry @dependabot[bot], but I was unable to process your request. Please see the logs for more details.

[codescene-delta-analysis]

Our agent can fix these. Install it.

No application code in the PR — skipped Code Health checks.

Quality Gate Profile: The Bare Minimum
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

[dependabot]

Superseded by #119.