fix(deps): update dependency nodemailer to v9

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
nodemailer (source)	^8.0.0 → ^9.0.0

---

Release Notes

nodemailer/nodemailer (nodemailer)

v9.0.3

Compare Source

Bug Fixes

• smtp-connection: harden STARTTLS upgrade and secure socket handling (#​1835) (07d8253)

v9.0.2

Compare Source

Bug Fixes

• addressparser: keep operator chars inside an address-literal as text (#​1829) (9ba1064)
• harden smtp-connection low-severity issues (22ddcea)
• harden smtp-connection response parsing and socket lifecycle (68860b9)
• prevent SES transport callback double-invocation and hang on sync errors (#​1831) (9517bc5)
• reject CRLF in HTTP proxy CONNECT destination to prevent request injection (6347b47)

v9.0.1

Compare Source

Bug Fixes

• enforce disableFileAccess/disableUrlAccess for raw message option (a82e060)

v9.0.0

Compare Source

⚠ BREAKING CHANGES

• HTTPS requests made while fetching remote content (attachment href/path URLs, OAuth2 token endpoints, HTTP/HTTPS proxy CONNECT) now validate the server's TLS certificate by default. Requests to hosts with self-signed, expired, or hostname-mismatched certificates that previously succeeded will now fail. Opt back out per request with tls.rejectUnauthorized=false (transport options, or a per-attachment tls option).

Bug Fixes

• replace deprecated url.parse with a WHATWG URL wrapper (0c080fb)
• validate TLS certificates by default when fetching remote content (6a947ac)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pathogen-platform	Ready	Preview, Comment	Jun 30, 2026 1:52pm