[waleedlatif1]

Summary

• nodemailer 10.1.0 → 10.1.7: fixes three addressparser advisories (GHSA-85x2-q946-cp5h, GHSA-8c8m-p3m8-cjg8, GHSA-m943-m63m-w62w) where a quoted >, a nested comment, or a ; inside a group made a message deliver to an address the header doesn't name. Reachable through the SMTP tool's to/cc/bcc/replyTo and workspace invitations
• undici 7.30.0 → 7.30.1: fixes GHSA-xjj6-f33q-929c, GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472. Sim's own undici use (request/Agent/Client for guarded fetch) doesn't hit fetch content-coding, EventSource, or SRI, so this is hygiene; it also fixes the hoisted copy cheerio and e2b resolve to
• No root undici override: node-gyp (6.x, dev only) and pi-coding-agent (exact 8.10.2) need their own major lines
• Both versions are past the 7-day release age; the lockfile diff is only these two entries

Type of Change

• Bug fix

Testing

• 22 normal address forms (display names, lists, groups, IDN, plus-addressing, comments, encoded words) parse and send identically on 10.1.0 and 10.1.7; the advisory PoCs deliver only to the header's address on 10.1.7
• undici 7.30.0 → 7.30.1 package diff reviewed: patch-only, no export changes
• bun run test on lib/core/network, guarded/pinned/secure fetch, lib/internal/smtp, lib/mcp/pinned-fetch, lib/messaging/email: 24 files, 207 tests pass

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 26, 2026 10:46pm UTC

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Heads up: you’ve reached your flex budget. Increase your flex budget or wait for usage to reset.

Turn on auto-fix | Re-trigger cubic</sub>

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable defects were found.

Summary

Updates nodemailer from 10.1.0 to 10.1.7 and undici from 7.30.0 to 7.30.1.

• Mail sends use Nodemailer 10.1.7 to keep recipient headers aligned with delivery.
• App network calls use Undici 7.30.1 for outbound requests.

_{Reviews (1) · Last reviewed commit: "fix(deps): update nodemailer to 10.1.7 a..." · Reviewed by Greptile}