fix(deps): update dependency nodemailer to v10.1.4 [security] by renovate[bot] · Pull Request #18046 · misskey-dev/misskey

renovate · 2026-10-23T23:36:06Z

This PR contains the following updates:

Package	Change	Age	Confidence
nodemailer (source)	`10.1.1` → `10.1.4`

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

GHSA-85x2-q946-cp5h

More information

Details

Vulnerability summary

addressparser ends an angle-addr at the first > it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that >. <"[email protected]>"@good.com> is the mailbox "[email protected]>"@good.com under RFC 5322, and Nodemailer read it as an address at evil.com. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3.

Attacker capabilities

The attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.

Realistic exploitation scenario

An application lets users send invitations or notifications only to addresses at an allowed domain and validates the submitted value with a conformant parser or by checking its domain. The attacker submits <"[email protected]>"@good.com>, which validates as a good.com mailbox. Nodemailer then parses the same value, issues RCPT TO:<"\"a"@evil.com> and the message, with whatever content the application puts into it, is delivered to the attacker's domain. The security boundary crossed is the application's recipient allow list. In the inbound direction, mailparser reports a different address than a conformant reader of the same header, so a display or policy layer built on the two disagrees.

Proof of concept

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("<\"[email protected]>\"@good.com>"));
// [ { address: '"a@evil.com', name: '@good.com>' } ]

Python's email._header_value_parser.get_address_list reads the same value as "[email protected]>"@good.com, with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "<\"[email protected]>\"@good.com>" }) issues the RCPT TO shown above.

Security impact

Mail that an application intends for an allowed domain is delivered to a domain chosen by the attacker, which discloses its content. It is a security vulnerability rather than a parsing bug because the misreading only occurs for values that a conformant validator approves, so validation done the right way is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.

The fix tracks quoted strings, comments and domain literals inside an angle-addr and reads only a > outside them.

Found in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

GHSA-m943-m63m-w62w

More information

Details

Vulnerability summary

addressparser ends an RFC 5322 group at the first ;, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. G: (a; <[email protected]>) <[email protected]>; names only [email protected], and Nodemailer read it as the single recipient [email protected]. Affected: 3.0.0 through 10.1.3.

Attacker capabilities

The attacker controls the text of an address field that an application passes to Nodemailer, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 group that conformant parsers accept without defects.

Realistic exploitation scenario

An application validates the recipients of a submitted address list with a conformant parser and only allows addresses at its own domain. The attacker submits G: (a; <[email protected]>) <[email protected]>;. The validator sees one mailbox, [email protected], and approves it. Nodemailer delivers to [email protected] only. The same works through a quoted display name, G: "a;" "<[email protected]>" <[email protected]>;. The boundary crossed is the application's recipient allow list.

Proof of concept

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("G: (a; <[email protected]>) <[email protected]>;"));
// [ { name: 'G', group: [ [Object] ] }, { address: 'evil@evil.com', name: ') [email protected]' } ]

Python's email._header_value_parser.get_address_list reads the same value as the single mailbox [email protected], with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "G: (a; <[email protected]>) <[email protected]>;" }) issues the RCPT TO shown above.

Security impact

Mail that an application intends for an approved recipient goes to a recipient chosen by the attacker, which discloses its content, and the intended recipient never receives it. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed, which makes it a security issue rather than a parsing bug. Affected are applications that pass user influenced address lists to Nodemailer and consumers of the standalone parser such as mailparser.

The fix tracks quoted strings and comments inside a group and reads only a ; outside them.

Found in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

GHSA-8c8m-p3m8-cjg8

More information

Details

Vulnerability summary

RFC 5322 comments nest. addressparser ended a comment at the first ), including the one that closes a nested comment, and parsed the rest of the outer comment as header text. Victim (x(y) <[email protected]>) <[email protected]> names [email protected] with x(y) <[email protected]> as a comment, and Nodemailer read it as the address [email protected]. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3.

Attacker capabilities

The attacker controls the text of an address that an application passes to Nodemailer, or the From or To header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.

Realistic exploitation scenario

An application validates a submitted address with a conformant parser and allows only its own domain. The attacker submits Victim (x(y) <[email protected]>) <[email protected]>, which validates as [email protected]. Nodemailer delivers to [email protected]. In the inbound direction, a DMARC or display layer built on a conformant parser and a mail client built on mailparser disagree on the author of the same message, which is the setting for sender spoofing. The boundary crossed is the application's recipient allow list, or the author check of the receiving side.

Proof of concept

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("Victim (x(y) <[email protected]>) <[email protected]>"));
// [ { address: 'evil@evil.com', name: 'Victim) [email protected]' } ]

Python's email._header_value_parser.get_address_list reads the same value as [email protected] with the display name Victim, with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "Victim (x(y) <[email protected]>) <[email protected]>" }) issues the RCPT TO shown above.

Security impact

Mail intended for an approved recipient is delivered to an attacker chosen domain, disclosing its content, and parsers built on this module report a different author than conformant ones. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.

The fix counts comment depth and ends a comment only at the ) that closes the outermost one.

Found in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

GHSA-85x2-q946-cp5h

More information

Details

Vulnerability summary

addressparser ends an angle-addr at the first > it sees, including one inside a quoted local part, a comment or a domain literal. The domain is then read off the text in front of that >. <"[email protected]>"@good.com> is the mailbox "[email protected]>"@good.com under RFC 5322, and Nodemailer read it as an address at evil.com. The unbracketed spelling of the same value was already read correctly. Affected: 3.0.0 through 10.1.3.

Attacker capabilities

The attacker controls the text of a recipient or sender address that an application passes to Nodemailer, for example a To value entered in a contact or invite form, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.

Realistic exploitation scenario

An application lets users send invitations or notifications only to addresses at an allowed domain and validates the submitted value with a conformant parser or by checking its domain. The attacker submits <"[email protected]>"@good.com>, which validates as a good.com mailbox. Nodemailer then parses the same value, issues RCPT TO:<"\"a"@evil.com> and the message, with whatever content the application puts into it, is delivered to the attacker's domain. The security boundary crossed is the application's recipient allow list. In the inbound direction, mailparser reports a different address than a conformant reader of the same header, so a display or policy layer built on the two disagrees.

Proof of concept

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("<\"[email protected]>\"@good.com>"));
// [ { address: '"a@evil.com', name: '@good.com>' } ]

Python's email._header_value_parser.get_address_list reads the same value as "[email protected]>"@good.com, with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "<\"[email protected]>\"@good.com>" }) issues the RCPT TO shown above.

Security impact

Mail that an application intends for an allowed domain is delivered to a domain chosen by the attacker, which discloses its content. It is a security vulnerability rather than a parsing bug because the misreading only occurs for values that a conformant validator approves, so validation done the right way is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.

The fix tracks quoted strings, comments and domain literals inside an angle-addr and reads only a > outside them.

Found in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

GHSA-8c8m-p3m8-cjg8

More information

Details

Vulnerability summary

RFC 5322 comments nest. addressparser ended a comment at the first ), including the one that closes a nested comment, and parsed the rest of the outer comment as header text. Victim (x(y) <[email protected]>) <[email protected]> names [email protected] with x(y) <[email protected]> as a comment, and Nodemailer read it as the address [email protected]. This is the same shape as the escaped parenthesis fixed in 10.1.2, reached through nesting instead of a quoted-pair. Affected: 3.0.0 through 10.1.3.

Attacker capabilities

The attacker controls the text of an address that an application passes to Nodemailer, or the From or To header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 address that conformant parsers accept without defects.

Realistic exploitation scenario

An application validates a submitted address with a conformant parser and allows only its own domain. The attacker submits Victim (x(y) <[email protected]>) <[email protected]>, which validates as [email protected]. Nodemailer delivers to [email protected]. In the inbound direction, a DMARC or display layer built on a conformant parser and a mail client built on mailparser disagree on the author of the same message, which is the setting for sender spoofing. The boundary crossed is the application's recipient allow list, or the author check of the receiving side.

Proof of concept

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("Victim (x(y) <[email protected]>) <[email protected]>"));
// [ { address: 'evil@evil.com', name: 'Victim) [email protected]' } ]

Python's email._header_value_parser.get_address_list reads the same value as [email protected] with the display name Victim, with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "Victim (x(y) <[email protected]>) <[email protected]>" }) issues the RCPT TO shown above.

Security impact

Mail intended for an approved recipient is delivered to an attacker chosen domain, disclosing its content, and parsers built on this module report a different author than conformant ones. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed. Affected are applications that pass user influenced addresses to Nodemailer and consumers of the standalone parser such as mailparser.

The fix counts comment depth and ends a comment only at the ) that closes the outermost one.

Found in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

GHSA-m943-m63m-w62w

More information

Details

Vulnerability summary

addressparser ends an RFC 5322 group at the first ;, including one inside a quoted display name or a comment. The text after it is parsed again as top level recipients with the quoting flipped, so text that every conformant parser reads as a display name or comment becomes a live address. G: (a; <[email protected]>) <[email protected]>; names only [email protected], and Nodemailer read it as the single recipient [email protected]. Affected: 3.0.0 through 10.1.3.

Attacker capabilities

The attacker controls the text of an address field that an application passes to Nodemailer, or the header of an inbound message parsed with mailparser. No access to the application, its configuration or its credentials is needed. The value is a syntactically valid RFC 5322 group that conformant parsers accept without defects.

Realistic exploitation scenario

An application validates the recipients of a submitted address list with a conformant parser and only allows addresses at its own domain. The attacker submits G: (a; <[email protected]>) <[email protected]>;. The validator sees one mailbox, [email protected], and approves it. Nodemailer delivers to [email protected] only. The same works through a quoted display name, G: "a;" "<[email protected]>" <[email protected]>;. The boundary crossed is the application's recipient allow list.

Proof of concept

const addressparser = require('nodemailer/lib/addressparser');
console.log(addressparser("G: (a; <[email protected]>) <[email protected]>;"));
// [ { name: 'G', group: [ [Object] ] }, { address: 'evil@evil.com', name: ') [email protected]' } ]

Python's email._header_value_parser.get_address_list reads the same value as the single mailbox [email protected], with no defects reported.

The envelope a message gets is built from the same parse, so sendMail({ to: "G: (a; <[email protected]>) <[email protected]>;" }) issues the RCPT TO shown above.

Security impact

Mail that an application intends for an approved recipient goes to a recipient chosen by the attacker, which discloses its content, and the intended recipient never receives it. The misreading only occurs on values a conformant validator approves, so correct validation is bypassed, which makes it a security issue rather than a parsing bug. Affected are applications that pass user influenced address lists to Nodemailer and consumers of the standalone parser such as mailparser.

The fix tracks quoted strings and comments inside a group and reads only a ; outside them.

Found in an internal review of addressparser on 2026-10-18. Verified on 3.0.0, 6.9.16 and 10.1.3.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

nodemailer/nodemailer (nodemailer)

`v10.1.4`

Compare Source

Bug Fixes

addressparser: apply the unexpected "<" rule outside quotes and comments (ee35f57)
addressparser: bound group nesting at ten levels (ce63303)
addressparser: drop the obsolete route from an angle-addr (3dbc730)
addressparser: end a comment only at the ")" that closes the outermost one (0a87617)
addressparser: honour quoted strings and comments inside an angle-addr and a group (1cd57d2)
addressparser: never read a mailbox out of a comment (a1538ea)
addressparser: read CFWS beside the "@" of an addr-spec as nothing (ba3c095)
addressparser: read the first addr-spec of the display text (038940a)
split a domain literal off at the "@" in front of it (d5983b0)

`v10.1.3`

Compare Source

Bug Fixes

format References and strip URLs in linear time, release any number of streams (2f18641)

`v10.1.2`

Compare Source

Bug Fixes

bound the work a message can make the mailer do and keep per-message auth off the transport's token endpoint (e347fa2)

Configuration

📅 Schedule: (in timezone Asia/Tokyo)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

codecov · 2026-10-23T23:38:30Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 26.74%. Comparing base (78435dc) to head (87c9a32).
⚠️ Report is 892 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff              @@
##           develop   #18046       +/-   ##
============================================
+ Coverage    13.97%   26.74%   +12.77%     
============================================
  Files          237     1162      +925     
  Lines        11273    39864    +28591     
  Branches      3728    10976     +7248     
============================================
+ Hits          1575    10663     +9088     
- Misses        7578    23429    +15851     
- Partials      2120     5772     +3652

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

github-actions · 2026-10-23T23:39:15Z

このPRによるapi.jsonの差分
差分はありません。
Get diff files from Workflow Page

github-actions · 2026-10-23T23:43:24Z

🖥 Frontend Diagnostics Report

(No significant changes)

View details

Requests by resource type

Type	Requests			Encoded bytes
Type	Base	Head	Δ	Base	Head	Δ
Document	2	2	0	33 KB	33 KB	0 B
Script	148	148	0	2.1 MB	2.1 MB	0 B
Stylesheet	58	58	0	284 KB	284 KB	0 B
Fetch	20	20	0	46 KB	46 KB	0 B
Image	10	10	0	254 KB	254 KB	0 B
Font	2	2	0	118 KB	118 KB	0 B
Other	9	9	0	421 KB	421 KB	$\color{orange}{\text{+2 B}}$

V8 heap snapshot statistics

Metric	@ Base	@ Head	Δ	MAD
$\color{gray}{\rule{8pt}{8pt}}$ Total	11 MB ± 2.7 KB	11 MB ± 6.4 KB	$\text{-1.7 KB}$ $\text{-0\%}$	7 KB

$\color{orange}{\rule{8pt}{8pt}}$ Code	2.8 MB	2.8 MB	$\text{-2 KB}$	1.8 KB
$\color{red}{\rule{8pt}{8pt}}$ Strings	1.3 MB	1.3 MB	$\text{-224 B}$	148 B
$\color{cyan}{\rule{8pt}{8pt}}$ JS arrays	112 KB	112 KB	0 B	56 B
$\color{green}{\rule{8pt}{8pt}}$ Typed arrays	0 B	0 B	0 B	0 B
$\color{yellow}{\rule{8pt}{8pt}}$ System objects	0 B	0 B	0 B	0 B
$\color{violet}{\rule{8pt}{8pt}}$ Other JS objs	2 MB	2 MB	$\text{+1.4 KB}$	1.2 KB
$\color{pink}{\rule{8pt}{8pt}}$ Other non-JS objs	5 MB	5 MB	$\text{-2.2 KB}$	4.9 KB

Download representative heap snapshot: base / head

📦 Bundle Stats

Chunk size diff (0 updated, 0 added, 0 removed)

Chunk	Base	Head	Δ	Δ (%)
(total)	5.9 MB	5.9 MB	0 B	0%

(other generated chunks)	2 MB	2 MB	0 B	0%

Startup chunk size (0 updated, 0 added, 0 removed)

Chunk	Base	Head	Δ	Δ (%)
(total)	1 MB	1 MB	0 B	0%

(other generated chunks)	759 KB	759 KB	0 B	0%
(other)	284 KB	284 KB	0 B	0%

Startup chunks are the Vite entry for src/_boot_.ts and its static imports.

	Bundles	Modules	Entries	Imports		Size
	Bundles	Modules	Entries	Static	Dynamic	Rendered	Gzip	Brotli
Base	469	2,857	21	10,347	333	10 MB	2.8 MB	2.4 MB
Head	469	2,857	21	10,347	333	10 MB	2.8 MB	2.4 MB

Δ	0	0	0	0	0	0 B	$\text{-10 B}$	$\text{-32 B}$
Δ (%)	0%	0%	0%	0%	0%	0%	$\text{-0\%}$	$\text{-0\%}$

Open treemap HTML

github-actions · 2026-10-23T23:44:47Z

⚙️ Backend Diagnostics Report

Memory: After GC

(No significant changes)

V8 Heap Snapshot Statistics

Metric	@ Base	@ Head	Δ	MAD
$\color{gray}{\rule{8pt}{8pt}}$ Total	86 MB ± 3.2 KB	86 MB ± 12 KB	$\text{-21 KB}$ $\text{-0\%}$	12 KB

$\color{orange}{\rule{8pt}{8pt}}$ Code	24 MB	24 MB	$\text{-36 KB}$	2.4 KB
$\color{red}{\rule{8pt}{8pt}}$ Strings	30 MB	30 MB	$\text{+11 KB}$	2.4 KB
$\color{cyan}{\rule{8pt}{8pt}}$ JS arrays	5.4 MB	5.4 MB	$\text{+32 B}$	0 B
$\color{green}{\rule{8pt}{8pt}}$ Typed arrays	610 KB	610 KB	0 B	0 B
$\color{yellow}{\rule{8pt}{8pt}}$ System objects	2.1 MB	2.1 MB	$\text{-400 B}$	2.7 KB
$\color{violet}{\rule{8pt}{8pt}}$ Other JS objs	23 MB	23 MB	$\text{+3.6 KB}$	477 B
$\color{pink}{\rule{8pt}{8pt}}$ Other non-JS objs	40 KB	40 KB	0 B	0 B

Download representative heap snapshot: base / head

…y-dev#18046) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

* [skip ci] Update CHANGELOG.md (prepend template) * chore(deps): update dependency undici [security] (misskey-dev#18055) * chore(deps): update dependency undici@^6 to v6.29.1 [security] * chore(deps): update dependency undici@^7 to v7.30.1 [security] --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(deps): update dependency nodemailer to v10.1.4 [security] (misskey-dev#18046) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(devcontainer): install the pnpm version from packageManager (misskey-dev#18060) The pnpm devcontainer feature installs pnpm 10.10.0, so pnpm switches to the packageManager version (pnpm 12) at runtime. pnpm 10 installs it with pnpm's own install script blocked, which leaves the shebang-less placeholder in place of the native binary. With shellEmulator enabled, pnpm 12 then fails to launch nested pnpm calls in scripts, and `pnpm build` in init.sh exits with "Error launching 'pnpm': Exec format error (os error 8)". Install the packageManager version globally before running pnpm, as the Dockerfile already does, so the native binary is installed and no version switch happens. * Mastodon等の Quote Note で RE: URL が付与される問題を修正 (misskey-dev#18063) * refactor: make HTML to MFM functions take options object * feat: remove quote-inline part if the Note has quote * docs: Mastodon など、Misskey以外のソフトウェアによる引用ノートの表示改善 * chore: remove only one quote-inline element * fix(frontend): プライバシー設定が検索候補から消える問題を修正 (misskey-dev#18058) * fix(frontend): プライバシー設定が検索候補から消える問題を修正設定検索の索引生成がv-for内のsetting.captionをビルド時に評価し、未定義変数として失敗するとprivacyページ全体の索引が空になっていた。グループ見出しもページ名を上書きしていた。検索マーカーには既存localeの静的な参照を渡し、ページ名と各項目の検索語句を保持する。画面の入力と保存の動作は変えない。 * Update Changelog * fix --------- Co-authored-by: KanariKanaru <[email protected]> * fix(frontend): horizontal scrolling of sticky note avatars (misskey-dev#18073) * Initial plan * Fix sticky note avatars on horizontal scroll Co-authored-by: anatawa12 <[email protected]> --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: anatawa12 <[email protected]> * deps: update dependencies (misskey-dev#18074) * deps: update dependencies * deps: update dependencies * fix(frontend): 存在しない/権限のないチャットを開いたときにエラーを表示するように (misskey-dev#18065) * fix(frontend): 存在しない/権限のないチャットを開いたときにエラーを表示するように - ルームの取得に失敗した場合、ダイアログを出したあと「まだメッセージがありません」と表示していたのをやめ、ページ内に見つからない/エラーの結果表示を出す - ユーザーとのチャットで取得に失敗した場合、ロード中表示のままになっていたのを修正 Fix misskey-dev#16120 * chore: CHANGELOG を更新 * refactor(frontend): propsのリアクティビティを引き継ぐように (misskey-dev#17954) * fix(frontend): MFMでカスタム絵文字の再描画が走る問題を修正 * Update changelog * refactor(frontend): propsのリアクティビティを引き継ぐように * fix * fix(frontend-embed): apply mfm-related refactors to embed components * fix * fix review * fix * Update CHANGELOG.md * fix(frontend): Unicode絵文字とカスタム絵文字の名前が重複したときにカスタム絵文字がオートコンプリートにサジェストされない問題を修正 (misskey-dev#13817) * fix(frontend): Unicode絵文字とカスタム絵文字の名前が重複したときにカスタム絵文字がオートコンプリートにサジェストされない問題を修正 * fix changelog * fix review --------- Co-authored-by: kakkokari-gtyih <[email protected]> * fix(frontend/aiscript): AiScriptインタープリターのリソース解放漏れを修正 (misskey-dev#18076) * fix(frontend/aiscript): AiScriptインタープリターのリソース解放漏れを修正 * Update Changelog * fix(backend): アンテナで投票済みのアンケートが未投票になる問題を修正 (misskey-dev#18056) * fix(backend): アンテナで投票済みのアンケートが未投票になる問題を修正アンテナ新着の配信では閲覧者の投票済み状態を補完しておらず、同じノートをnotes/showで取得した場合と表示が食い違っていた。ノート自身と引用・返信先のアンケートへ閲覧者の状態を補完する。共有payloadを変更せず、アンケートがない箇所のDB再取得と再packを避ける。 * Update Changelog --------- Co-authored-by: KanariKanaru <[email protected]> * fix(backend): キューの同時実行数が不正な値の場合は起動時に停止するように (misskey-dev#18081) * fix(backend): キューの同時実行数が不正な値の場合は起動時に停止するように * Update Changelog --------- Co-authored-by: syuilo <[email protected]> * fix(frontend): クリップ切替前の取得結果が現在の選択を上書きする問題を修正 (misskey-dev#18057) * fix(frontend): クリップ切替前の取得結果が現在の選択を上書きする問題を修正クリップAからBへ切り替えた後にAの取得が完了すると、Bの表示に対してAがノート操作の対象になったり、Aの失敗でBが取得失敗として表示されたりしていた。要求ごとに有効性を管理し、切替・選択解除・破棄の後は古い成功も失敗も適用しない。同じクリップへ戻る場合も以前の要求と区別する。 * Update Changelog --------- Co-authored-by: KanariKanaru <[email protected]> Co-authored-by: syuilo <[email protected]> * revert(backend): revert compile-config (misskey-dev#17411) * Revert "refactor(backend): 変換後.config.jsonに統一するように+修正など (misskey-dev#16929)" This reverts commit 24bd150. * Revert "enhance(backend): 起動前にconfigをjson化 (misskey-dev#16923)" This reverts commit 1facca1. * fix * fix * fix: update ai documents * migrate * update yaml to v5 * fix * fix * clean up * fix * deps: update minimatch [security] (misskey-dev#18083) * Bump version to 2026.10.2-alpha.0 * fix(sw): fix types (misskey-dev#18089) * fix(sw): fix types * fix * perf(frontend): フロントエンドの起動速度改善 (misskey-dev#18064) * perf(frontend): split JSON5 parser from boot chunk Co-authored-by: しろは <[email protected]> * perf(frontend): optimistic fetching for custom emojis on boot Co-authored-by: しろは <[email protected]> * perf(frontend): use native BroadcastChannel * fix * fix * fix/refactor * fix lint * fix review * perf(frontend): lazy-load visitor components to reduce chunk size for narrow screens Co-authored-by: しろは <[email protected]> * fix * revert: move optimistic custom emoji fetching to a separate branch This reverts commits d9844e1, 4173ab2 and a010612. MkCustomEmoji.vue is restored to the develop version to keep the existing url watcher. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: しろは <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]> * fix(backend): UserLiteにpackする時にもUserDetailedに必要なデータが無駄に取得されている問題を修正 (misskey-dev#18093) * fix(backend): UserLiteにpackする時にもUserDetailedに必要なデータが取得されている問題を修正 * Update Changelog * fix * chore(frontend): devモード時、言語リソースをno-cacheで取得するように (misskey-dev#18094) * chore(frontend): devモード時、言語リソースをno-cacheで取得するように * fix review * fix(frontend): use yes/no labels for cancel follow request confirmation (misskey-dev#18097) * fix(backend): delete webpush subscription on 404 (misskey-dev#18104) * Update CHANGELOG.md * Update CHANGELOG.md [ci skip] * Update CHANGELOG.md [ci skip] * refactor(frontend): 定義がないCSS Modulesクラスを削除 (misskey-dev#18107) * docs: CONTRIBUTING.mdの分割 (misskey-dev#18108) * docs: reorganize CONTRIBUTING by audience and task * security周りをSECURITY.mdに寄せる * Revert "security周りをSECURITY.mdに寄せる" This reverts commit ce23579. * perf(backend): 本番起動時にpnpmがバックグラウンドで起動したままにならないように (misskey-dev#18103) * perf(docker): 本番起動時にpnpmがバックグラウンドで起動したままにならないように * Update Changelog * fix * fix * perf(backend): identicon生成処理のパフォーマンス向上 (misskey-dev#18099) * perf(backend): identicon生成処理のパフォーマンス向上 * perf(backend): 描画アルゴリズムを変更してPNGを軽量化・処理高速化 * Update Changelog * perf(sw): アセットなどへのリクエストはService Workerを通さないように (misskey-dev#18088) Co-authored-by: しろは <[email protected]> * docs: CONTRIBUTING.mdの表記をブラッシュアップ＋一部不備を修正 (misskey-dev#18110) * docs: CONTRIBUTING.mdの表記をブラッシュアップ＋一部不備を修正 * docs: フォローアップの差分を貢献ガイドに限定 * docs: 貢献ガイドの脆弱性報告案内をSECURITY.mdに集約 * docs: 事前相談と翻訳の案内を補足 * chore(frontend): remove unused style * Bump version to 2026.11.0-alpha.0 * fix(sw): チャットのプッシュ通知をクリックしても自分に対するチャットが開いてしまう問題を修正 (misskey-dev#18119) fix(sw): チャットのプッシュ通知クリックで送信者のDMを開くように Fix misskey-dev#18118 * fix(backend): withReplies: false のローカルタイムラインのストリーミングに返信が含まれる問題を修正 (misskey-dev#18086) * fix(backend): withReplies: false のローカルタイムラインのストリーミングに返信が含まれる問題を修正 * fix(tests): 返信が含まれない場合のストリーミングテストにレスポンスステータスの検証を追加 * Update Changelog --------- Co-authored-by: kakkokari-gtyih <[email protected]> * fix(frontend): メールサーバー設定に未保存の変更がある場合は配信テストを押せないように (misskey-dev#18067) * fix(frontend): メールサーバー設定に未保存の変更がある場合は配信テストを押せないように配信テストは保存済みの設定で送信されるため、入力途中の値でテストすると原因の分かりにくいエラー (ECONNREFUSED 等) になっていた。 Fix misskey-dev#10307 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(frontend): SMTP サーバーが保存されていない間も配信テストを押せないように - 保存済みの SMTP ホストが空の間はボタンを無効にする（初期状態・設定を消して保存した場合） - null / 空文字 / 数値欄を空にしたときの NaN を同じ値として比べ、入力して消しただけで未保存扱いになるのを防ぐ Co-Authored-By: Claude Opus 5.5 <[email protected]> * chore: CHANGELOG を更新 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(frontend): メール配信が無効な間も配信テストを押せないようにメール配信が無効だと EmailService.sendEmail は送信せずに正常終了するため、 SMTP ホストが保存済みでも配信テストが成功したように見えていた。 Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: 菅野谷省吾 <[email protected]> Co-authored-by: かっこかり <[email protected]> * enhance(frontend): チャンネルタイムライン上部に投稿フォームを表示する設定をデッキのチャンネルカラムにも反映 (misskey-dev#17247) * enhance(frontend): チャンネルタイムライン上部に投稿フォームを表示する設定をデッキのチャンネルカラムにも反映 * fix * Update Changelog * Update CHANGELOG.md * fix review * fix * fix * fix --------- Co-authored-by: syuilo <[email protected]> * deps: update dependencies (misskey-dev#18116) * deps: update dependencies * chore(misskey-js): API Extractor レポートの再生成 * update deps * fix(frontend): 絵文字管理画面βの行に色が付かない問題を修正 (misskey-dev#18105) * fix(frontend): 管理画面の絵文字の一覧で、変更した行とエラーのある行に色が付かない (Elythia-Network/elythia#3958) Co-authored-by: しろは <[email protected]> * Update Changelog --------- Co-authored-by: しろは <[email protected]> Co-authored-by: syuilo <[email protected]> * fix(gh): 差分計測系ワークフローで PR 自身の変更だけを比較するように (misskey-dev#18121) * feat(frontend): URLプレビューの埋め込みプレイヤーを自動再生するかどうか設定できるように (misskey-dev#18112) * feat(frontend): URLプレビューの埋め込みプレイヤーを自動再生するかどうか設定できるように * Fix frontend autoplay unit test setup Co-authored-by: syuilo <[email protected]> * Update CHANGELOG.md * fix(frontend): Explicitly disable URL preview player autoplay when the preference is off  --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Bump version to 2026.11.0-alpha.1 * refactor(frontend): 不要な追加fetchを削減 (misskey-dev#18120) * enhance: バックエンドからQRコード生成処理を削除 (misskey-dev#18100) * enhance: バックエンドからQRコード生成処理を削除 * 🎨 * fix * fix: remove support for node 22 * fix: regenerate lockfile * perf * fix * fix changelog * Update CHANGELOG.md * Bump version to 2026.11.0-beta.0 * fix(i18n): Update locale.ts * deps: update dependencies (misskey-dev#18125) * deps: update dependencies * ✌️ * reorganize dependencies * update deps * perf(backend): バックエンドのビルドを調整 (misskey-dev#18126) * perf(backend): バックエンドのビルドを調整 * ✌️ * perf(backend): バンドルをASCIIのみで出力してソース文字列のメモリを削減 * add comment * Bump version to 2026.11.0-beta.1 * perf(backend): 開発時にしか使わないモジュールを遅延ロード (misskey-dev#18128) * fix(backend): 特定の条件下でドライブがタイムアウトして開けない問題を修正 (misskey-dev#18129) * fix(backend): 特定の条件下でドライブがタイムアウトして開けない問題を修正 * Update Changelog * docs: CHANGELOG の Note に起動スクリプト変更に伴う NODE_OPTIONS の注意を追記 (misskey-dev#18130) `pnpm start` / `pnpm migrateandstart` / Docker も内部で scripts/start.mjs を使うようになり、 NODE_OPTIONS の --require / --import などの相対パスやパッケージ名の解決基準が packages/backend から起動ディレクトリに変わったため、独自の起動スクリプト等で NODE_OPTIONS を設定しているサーバー管理者向けに告知する。あわせて、タブでインデントされていたため --migrate の項目の子として表示されていた 2 項目のインデントを揃える。 Co-authored-by: Claude Opus 5.5 <[email protected]> * docs(ai): migration 作成手順の Backend ガイドとの比較文を実態に合わせる (misskey-dev#18131) misskey-dev#18110 で Backend ガイドの Migration作成方法が `pnpm --filter backend exec typeorm` に書き換わり、`pnpm dlx typeorm` の記述は無くなったため、存在しない差異を説明していた。 Co-authored-by: Claude Opus 5.5 <[email protected]> * fix(devcontainer): devcontainer の Node.js バージョンを更新 (misskey-dev#18135) fix(devcontainer): devcontainer の Node.js バージョンを .node-version に合わせる Node.js v22 のままだと pnpm install が ERR_PNPM_UNSUPPORTED_ENGINE で失敗し、 devcontainer の構築が完了しない。 Co-authored-by: Claude Opus 5.5 <[email protected]> * fix(docs): follow-up of misskey-dev#18103 (misskey-dev#18132) * fix: fix changelog * fix indent * chore(deps): update [github actions] update dependencies (misskey-dev#18139) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix(backend): スキーマのデフォルト値をそろえる (misskey-dev#18140) fix(backend): スキーマのデフォルト値がconfigの値によって書き換えられる問題を修正 * deps: update minimum node version (misskey-dev#18141) * Bump version to 2026.11.0-rc.0 * Release: 2026.11.0 --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: かっこかり <[email protected]> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: ZerglingGo <[email protected]> Co-authored-by: KanariKanaru <[email protected]> Co-authored-by: Copilot <[email protected]> Co-authored-by: anatawa12 <[email protected]> Co-authored-by: Syogo-Suganoya <[email protected]> Co-authored-by: takaion <[email protected]> Co-authored-by: syuilo <[email protected]> Co-authored-by: しろは <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]> Co-authored-by: おさむのひと <[email protected]> Co-authored-by: poppingmoon <[email protected]> Co-authored-by: S1m <[email protected]> Co-authored-by: tamaina <[email protected]> Co-authored-by: Asuka <[email protected]> Co-authored-by: 菅野谷省吾 <[email protected]> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

fix(deps): update dependency nodemailer to v10.1.4 [security]

87c9a32

renovate Bot added the dependencies Pull requests that update a dependency file label Oct 23, 2026

github-project-automation Bot added this to [実験中] 管理用 Oct 23, 2026

github-project-automation Bot moved this to Todo in [実験中] 管理用 Oct 23, 2026

github-actions Bot added the packages/backend Server side specific issue/PR label Oct 23, 2026

kakkokari-gtyih merged commit d9b1fc5 into develop Oct 26, 2026
41 checks passed

kakkokari-gtyih deleted the renovate/npm-nodemailer-vulnerability branch October 26, 2026 05:40

github-project-automation Bot moved this from Todo to Done in [実験中] 管理用 Oct 26, 2026

Senarin pushed a commit to aoharu-place/misskey that referenced this pull request Nov 8, 2026

fix(deps): update dependency nodemailer to v10.1.4 [security] (misske…

58a0309

…y-dev#18046) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

github-actions Bot mentioned this pull request Nov 10, 2026

Release: 9000.0.0 tamaina/misskey-a#192

Draft

Navigation Menu

Repository navigation

fix(deps): update dependency nodemailer to v10.1.4 [security] - #18046

fix(deps): update dependency nodemailer to v10.1.4 [security]#18046
kakkokari-gtyih merged 1 commit into
developfrom
renovate/npm-nodemailer-vulnerability

renovate Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

Details

Vulnerability summary

Attacker capabilities

Realistic exploitation scenario

Proof of concept

Security impact

Severity

References

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

Details

Vulnerability summary

Attacker capabilities

Realistic exploitation scenario

Proof of concept

Security impact

Severity

References

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

Details

Vulnerability summary

Attacker capabilities

Realistic exploitation scenario

Proof of concept

Security impact

Severity

References

Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name

Details

Vulnerability summary

Attacker capabilities

Realistic exploitation scenario

Proof of concept

Security impact

Severity

References

Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient

Details

Vulnerability summary

Attacker capabilities

Realistic exploitation scenario

Proof of concept

Security impact

Severity

References

Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient

Details

Vulnerability summary

Attacker capabilities

Realistic exploitation scenario

Proof of concept

Security impact

Severity

References

Release Notes

v10.1.4

Bug Fixes

v10.1.3

Bug Fixes

v10.1.2

Bug Fixes

Configuration

Uh oh!

codecov Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

🖥 Frontend Diagnostics Report

📦 Bundle Stats

Uh oh!

github-actions Bot commented Oct 23, 2026

⚙️ Backend Diagnostics Report

Memory: After GC

V8 Heap Snapshot Statistics

renovate Bot commented Oct 23, 2026 •

edited

Loading

`v10.1.4`

`v10.1.3`

`v10.1.2`

codecov Bot commented Oct 23, 2026 •

edited

Loading