Upgrade NestJS 10 -> 11 and nodemailer 6 -> 10 to clear npm audit findings #14

New issue

Closed

opened 2026-10-14 23:16:39 -04:00 by vmanne-poc · 0 comments

vmanne-poc commented

2026-10-14 23:16:39 -04:00

Owner

npm audit --omit=dev on v0.7.0 reports 12 vulnerabilities (4 high, 7 moderate, 1 low) in runtime dependencies:

Package	Severity	Pulled in by
multer	high	`@nestjs/platform-express` 10
lodash	high	`@nestjs/config` 3
nodemailer	high	direct (6.x)
@nestjs/core	moderate	direct (10.x)
body-parser, qs	moderate	`@nestjs/platform-express` 10 / express 4
file-type	moderate	NestJS 10
uuid	moderate	`@nestjs/schedule` 4

Plan

NestJS 10 -> 11.2.x (@nestjs/config 4, @nestjs/schedule 6, @nestjs/jwt 11, @nestjs/passport 11, @nestjs/cli 11). Express 4 -> 5 comes with it.
nodemailer 6 -> 10 (ships its own types; drop @types/nodemailer).
Not NestJS 12: it is ESM-only and would require converting the backend's module system.

Done when: npm audit --omit=dev is clean (or remaining items documented), build passes, 43 unit + 22 e2e tests pass, live smoke test passes.

Work in progress on branch phase-8.

`npm audit --omit=dev` on `v0.7.0` reports 12 vulnerabilities (4 high, 7 moderate, 1 low) in runtime dependencies: | Package | Severity | Pulled in by | |---|---|---| | multer | high | `@nestjs/platform-express` 10 | | lodash | high | `@nestjs/config` 3 | | nodemailer | high | direct (6.x) | | @nestjs/core | moderate | direct (10.x) | | body-parser, qs | moderate | `@nestjs/platform-express` 10 / express 4 | | file-type | moderate | NestJS 10 | | uuid | moderate | `@nestjs/schedule` 4 | **Plan** - NestJS 10 -> 11.2.x (`@nestjs/config` 4, `@nestjs/schedule` 6, `@nestjs/jwt` 11, `@nestjs/passport` 11, `@nestjs/cli` 11). Express 4 -> 5 comes with it. - nodemailer 6 -> 10 (ships its own types; drop `@types/nodemailer`). - Not NestJS 12: it is ESM-only and would require converting the backend's module system. **Done when:** `npm audit --omit=dev` is clean (or remaining items documented), build passes, 43 unit + 22 e2e tests pass, live smoke test passes. Work in progress on branch `phase-8`.

vmanne-poc added this to the Phase 8: Dependency security & user management (v0.8.0) milestone

2026-10-14 23:16:39 -04:00

vmanne-poc added the

dependencies

security

labels

2026-10-14 23:16:39 -04:00

vmanne-poc referenced this issue from a commit

2026-10-14 23:48:21 -04:00

Upgrade NestJS 10 -> 11, nodemailer 6 -> 10, Jest 29 -> 30

vmanne-poc referenced this issue from a pull request that will close it,

2026-10-14 23:48:49 -04:00