chore(deps): update dependency nodemailer to v6.9.14 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
nodemailer (source)	6.9.13 -> 6.9.14

GitHub Vulnerability Alerts

GHSA-9h6g-pr28-7cqp

Summary

A ReDoS vulnerability occurs when nodemailer tries to parse img files with the parameter attachDataUrls set, causing the stuck of event loop.
Another flaw was found when nodemailer tries to parse an attachments with a embedded file, causing the stuck of event loop.

Details

Regex: /^data:((?:[^;];)(?:[^,])),(.)$/

Path: compile -> getAttachments -> _processDataUrl

Regex: /(<img\b[^>]* src\s*=[\s"']*)(data:([^;]+);[^"'>\s]+)/

Path: _convertDataImages

PoC

https://gist.github.com/francoatmega/890dd5053375333e40c6fdbcc8c58df6
https://gist.github.com/francoatmega/9aab042b0b24968d7b7039818e8b2698

Impact

ReDoS causes the event loop to stuck a specially crafted evil email can cause this problem.

---

Release Notes

nodemailer/nodemailer (nodemailer)

v6.9.14

Compare Source

Bug Fixes

• api: Added support for Ethereal authentication (56b2205)
• services.json: Add Email Services Provider Feishu Mail (CN) (#​1648) (e9e9ecc)
• services.json: update Mailtrap host and port in well known (#​1652) (fc2c9ea)
• well-known-services: Add Loopia in well known services (#​1655) (21a28a1)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

/opt/containerbase/tools/corepack/0.29.4/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:21609
    throw new Error(
          ^

Error: Error when performing the request to https://registry.npmjs.org/yarn/latest; for troubleshooting help, see https://github.com/nodejs/corepack#troubleshooting
    at fetch (/opt/containerbase/tools/corepack/0.29.4/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:21609:11)
    at async fetchAsJson (/opt/containerbase/tools/corepack/0.29.4/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:21623:20)
    ... 4 lines matching cause stack trace ...
    at async Object.runMain (/opt/containerbase/tools/corepack/0.29.4/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:23096:5) {
  [cause]: TypeError: globalThis.fetch is not a function
      at fetch (/opt/containerbase/tools/corepack/0.29.4/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:21603:33)
      at async fetchAsJson (/opt/containerbase/tools/corepack/0.29.4/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:21623:20)
      at async fetchLatestStableVersion (/opt/containerbase/tools/corepack/0.29.4/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:21550:20)
      at async fetchLatestStableVersion2 (/opt/containerbase/tools/corepack/0.29.4/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:21672:14)
      at async Engine.getDefaultVersion (/opt/containerbase/tools/corepack/0.29.4/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:22292:23)
      at async Engine.executePackageManagerRequest (/opt/containerbase/tools/corepack/0.29.4/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:22390:47)
      at async Object.runMain (/opt/containerbase/tools/corepack/0.29.4/16.20.2/node_modules/corepack/dist/lib/corepack.cjs:23096:5)
}