From 8acfaea3c4c24c77f27f593dab40b00d88829743 Mon Sep 17 00:00:00 2001
From: Maurice <mauriceboe@icloud.com>
Date: Wed, 9 Sep 2026 10:24:22 +0200
Subject: [PATCH] chore(deps): take the multer and nodemailer fixes for four
 HIGH CVEs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Docker Scout turned the release PR red overnight on advisories published
after the last green run:

  multer < 2.3.0      CVE-2026-82333, CVE-2026-77078, CVE-2026-77037
  nodemailer < 9.1.0  GHSA-2x7j-588g-ccc2

Both are patch-level resource-exhaustion fixes with no API change — multer
2.3.0 carries the same four dependencies as 2.2.0. multer resolves through
the root override (@nestjs/platform-express asks for 2.1.1), so the range
there has to move with it, and the server's own override list beside it.
---
 package-lock.json   | 16 ++++++++--------
 package.json        |  2 +-
 server/package.json |  4 ++--
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 5456964d1..e0494d9ae 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -27,7 +27,6 @@
       "name": "@trek/client",
       "version": "4.2.0",
       "dependencies": {
-        "@mapbox/mapbox-gl-rtl-text": "^0.4.0",
         "@fontsource/bebas-neue": "^5.3.0",
         "@fontsource/eb-garamond": "^5.3.0",
         "@fontsource/geist-sans": "^5.2.5",
@@ -36,6 +35,7 @@
         "@fontsource/museomoderno": "^5.3.0",
         "@fontsource/playfair-display": "^5.3.0",
         "@fontsource/poppins": "^5.2.7",
+        "@mapbox/mapbox-gl-rtl-text": "^0.4.0",
         "@maplibre/maplibre-gl-leaflet": "0.1.4",
         "@simplewebauthn/browser": "^13.1.2",
         "@trek/shared": "*",
@@ -15688,9 +15688,9 @@
       }
     },
     "node_modules/multer": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/multer/-/multer-2.2.0.tgz",
-      "integrity": "sha512-6rdyFg2kLrMh9Jee7/BMPuV9lEAd7lLW2YUpF9/YxR7njyoUwwQ0ZPh3TaIY50Sw6vlyD2HW3wGOkTS4P79xrQ==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/multer/-/multer-2.3.0.tgz",
+      "integrity": "sha512-cjNbm3sttszgZeGfJR124D+jFEfkXCVAsoPBmFn9X7UxmDSFHWqE2CoEj0vrmSpuAFnqWR1Szcm9QTsiHr60Xw==",
       "license": "MIT",
       "dependencies": {
         "append-field": "^1.0.0",
@@ -15824,9 +15824,9 @@
       }
     },
     "node_modules/nodemailer": {
-      "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.0.1.tgz",
-      "integrity": "sha512-Gwv8SQewT616ZM/URn0H54b8PWo/Wum7md3EW2aWy1lO27+WZCX+Xyak3J+NlmHUjDh5ME+uesJUDRbR3Ye8Bw==",
+      "version": "9.1.1",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.1.1.tgz",
+      "integrity": "sha512-izw9mVKFix6YSnC9eLgV6g1opl9DUlRio9ZNcq+Wu9Ujn2UwF+8Nl0B8nz22kEC+CTZCvinkxwJ0DeFbb6NwcQ==",
       "license": "MIT-0",
       "engines": {
         "node": ">=6.0.0"
@@ -21757,7 +21757,7 @@
         "json5": "^2.2.3",
         "jsonwebtoken": "^9.0.2",
         "nestjs-zod": "^5.5.0",
-        "nodemailer": "^9.0.1",
+        "nodemailer": "^9.1.1",
         "otplib": "^12.0.1",
         "pdf-parse": "^2.4.5",
         "qrcode": "^1.5.4",
diff --git a/package.json b/package.json
index 3417f2e49..3cf93c469 100644
--- a/package.json
+++ b/package.json
@@ -36,7 +36,7 @@
   "overrides": {
     "react": "19.2.6",
     "react-dom": "19.2.6",
-    "multer": "^2.2.0"
+    "multer": "^2.3.0"
   },
   "comment:optionalDependencies": "The lockfile is generated on glibc, so the musl builds the Alpine image needs never land in it on their own. Keep the @img/* pins on the same version as client's sharp — a mismatch nests the binary away from libvips and the image build dies in generate-icons.",
   "optionalDependencies": {
diff --git a/server/package.json b/server/package.json
index 87461ce77..58fa088ff 100644
--- a/server/package.json
+++ b/server/package.json
@@ -54,7 +54,7 @@
     "json5": "^2.2.3",
     "jsonwebtoken": "^9.0.2",
     "nestjs-zod": "^5.5.0",
-    "nodemailer": "^9.0.1",
+    "nodemailer": "^9.1.1",
     "otplib": "^12.0.1",
     "pdf-parse": "^2.4.5",
     "qrcode": "^1.5.4",
@@ -76,7 +76,7 @@
     "@hono/node-server": "^1.19.13",
     "picomatch": "^4.0.4",
     "ip-address": "^10.1.1",
-    "multer": "^2.2.0",
+    "multer": "^2.3.0",
     "ws": "^8.21.0",
     "qs": "^6.15.2",
     "file-type": "^21.3.4"