chore(deps): bump nodemailer minimum version to 8.0.5#16664
Merged
Conversation
jacobsfletch
changed the title
Contributor
📦 esbuild Bundle Analysis for payloadThis analysis was generated by esbuild-bundle-analyzer. 🤖
Largest pathsThese visualization shows top 20 largest paths in the bundle.Meta file: packages/next/meta_index.json, Out file: esbuild/index.js
Meta file: packages/payload/meta_index.json, Out file: esbuild/index.js
Meta file: packages/payload/meta_shared.json, Out file: esbuild/exports/shared.js
Meta file: packages/richtext-lexical/meta_client.json, Out file: esbuild/exports/client_optimized/index.js
Meta file: packages/ui/meta_client.json, Out file: esbuild/exports/client_optimized/index.js
Meta file: packages/ui/meta_shared.json, Out file: esbuild/exports/shared_optimized/index.js
DetailsNext to the size is how much the size has increased or decreased compared with the base branch of this PR.
|
paulpopus
approved these changes
May 18, 2026
jacobsfletch
added a commit
that referenced
this pull request
May 18, 2026
Closes #16651 Bumps `nodemailer` to ^8.0.5 and `@types/nodemailer` to ^8.0.0 throughout the monorepo. The `nodemailer@7.0.12` package has known advisories that are fixed in >= 8.0.5. - GHSA-vvjj-xcjg-gr5g - GHSA-c7w3-x93f-qmm8 ## Breaking change This is considered a breaking change due to type differences between `nodemailer` v7 and v8. Nodemailer v8 widened `Mail.Options['from']` from `string | Address` to `string | Address | Array<string | Address>`. Because Payload's `SendEmailOptions` is a direct alias of nodemailer's options type, this widening is reflected in Payload's public types. A backward-compatible variant of this fix exists in #16664 (adds a runtime normalization shim). This PR intentionally takes the breaking-change strategy to keep the type surface aligned with `nodemailer` upstream. ### Migration If you've extended Payload's email layer or written a custom `EmailAdapter`, audit any place that reads `message.from` (or other address fields if you've mirrored this pattern) and add an `Array.isArray()` branch. For example: ```ts if (Array.isArray(address)) { const first = address[0] // handle first, fall back to defaults if empty } --------- Co-authored-by: Jake Fletcher <jacobsfletch@gmail.com>
Member
|
🚀 This is included in version v3.85.0 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #16501.
Related: #16651.
Bumps
nodemailerto^8.0.5and@types/nodemailerto^8.0.0throughout the monorepo.The
nodemailer@7.0.12package has known advisories that are fixed in >= 8.0.5.Note:
nodemailerv8 widened theMail.Options['from']type to also accept an array. This is considered a breaking change in Payload'sSendEmailOptionstype, if a project code relies on the previous shape.For backwards compatibility, we pin
SendEmailOptions['from']back to v7'sstring | Addressshape, then normalize this at runtime, so email adapters and consumer code stay source-compatible.