@lenne.tech/nest-server 11.41.5 → 11.41.6

package/.claude/rules/testing.md

@@ -680,6 +680,22 @@ copy: its models' `securityCheck()` **records its own invocation** (`checkedFor`
 narrowing fields, so "the response looks redacted" — which a `@Restricted` rule, `prepareOutput` or
 a typo in the fixture would produce too — becomes "the hook ran, with this user, on this object".
 
+## Mail: one real SMTP round trip
+
+Every other mail test runs on `jsonTransport`, so the mail library could change its wire behaviour and
+every suite would stay green. That stopped being acceptable when 11.41.5 moved nodemailer across a
+major (9 → 10, a TypeScript rewrite) with no test that had ever sent a message through a real
+handshake. `tests/unit/email-smtp-roundtrip.spec.ts` closes that: an in-process `smtp-server`
+(devDependency, no Docker, hence the unit runner) on 127.0.0.1 with STARTTLS and AUTH-over-TLS-only,
+and `EmailService.sendMail()` against it — delivered, upgraded, authenticated, attachment intact,
+paired with refusals (wrong password; `requireTLS` against a server that cannot do STARTTLS).
+
+One trap worth knowing before you extend it: `smtp-server`'s `hideSTARTTLS` only removes the
+capability from the EHLO reply — the command still works, and nodemailer with `requireTLS` issues it
+anyway and upgrades. So `hideSTARTTLS` simulates a STRIPPED capability line (and the spec asserts the
+upgrade there), while a server that genuinely cannot encrypt needs `disabledCommands: ['STARTTLS']`.
+A refusal test written against `hideSTARTTLS` fails for the right reason: the mail went out encrypted.
+
 ## Structural invariants over `src/`
 
 Some properties cannot be observed by running the code, only by reading it — and a runtime guard

package/FRAMEWORK-API.md

@@ -1,6 +1,6 @@
 # @lenne.tech/nest-server — Framework API Reference
 
-> Auto-generated from source code as of 2026-10-01 (v11.41.5)
+> Auto-generated from source code as of 2026-10-02 (v11.41.6)
 > File: `FRAMEWORK-API.md` — compact, machine-readable API surface for Claude Code
 
 ## CoreModule.forRoot()

package/migration-guides/11.41.5-to-11.41.6.md

@@ -0,0 +1,105 @@
+# Migration Guide: 11.41.5 → 11.41.6
+
+## Overview
+
+| Category              | Details                                                                                   |
+| --------------------- | ----------------------------------------------------------------------------------------- |
+| **Breaking Changes**  | None                                                                                      |
+| **Dependencies**      | `@types/nodemailer` dropped (nodemailer 10 ships its own declarations)                    |
+| **Security**          | Two critical advisories in the SWC dev tooling (`piscina`, `@xhmikosr/decompress`) (§2)   |
+| **Migration Effort**  | No code changes; a lockfile refresh, and one override key to widen in starter-based projects |
+
+## Quick Migration
+
+```bash
+pnpm update @lenne.tech/nest-server
+pnpm update piscina --depth Infinity   # only if `pnpm audit` reports GHSA-67c8-pqhq-4rmx (§2)
+# starter-based projects: widen the @xhmikosr/decompress override key (§2)
+pnpm run build && pnpm test
+```
+
+Vendor-mode projects have nothing to pick up from `src/core/` in this release.
+
+## What's New in 11.41.6
+
+### 1. `@types/nodemailer` is gone
+
+nodemailer 10 (since 11.41.5) is a TypeScript rewrite that ships its own declarations, so the
+separate `@types/nodemailer` package is no longer read. This repository dropped it from its
+devDependencies. If your project lists it, you can remove it as well:
+
+```bash
+pnpm remove @types/nodemailer
+```
+
+Keeping it does no harm — TypeScript resolves the declarations bundled with `nodemailer` first —
+but it is a package to keep updated that nothing uses.
+
+### 2. Two critical advisories in the SWC dev tooling — fix them in YOUR project
+
+Both reach a project through `@swc/cli` (which `@nestjs/cli` uses for SWC builds), and neither
+can be fixed from here: this repository's lockfile and overrides do not reach your project.
+
+#### `piscina`
+
+`piscina` < 4.9.4 is covered by **GHSA-67c8-pqhq-4rmx** (critical, prototype-pollution gadget in
+`ThreadPool.options`). `@swc/cli` depends on `piscina@^4.3.1`, and the fixed 4.9.4 is inside
+that range, so no override is needed — only a lockfile refresh:
+
+```bash
+pnpm update piscina --depth Infinity
+pnpm audit
+```
+
+nest-server-starter 11.41.6 already resolves 4.9.4.
+
+#### `@xhmikosr/decompress`
+
+**GHSA-hrh2-vp3x-79xf** (critical, path traversal via a symlink chain) covers
+`@xhmikosr/decompress >= 11.0.0, <= 11.1.3`; 11.1.4 is fixed. Projects created from
+nest-server-starter carry this override in `pnpm-workspace.yaml`:
+
+```yaml
+'@xhmikosr/decompress@>=11.0.0 <11.1.3': 11.1.4
+```
+
+Its key stops one patch short: 11.1.3 is vulnerable too, and a project that resolves it is not
+caught. Widen the key and refresh:
+
+```yaml
+'@xhmikosr/decompress@>=11.0.0 <11.1.4': 11.1.4
+```
+
+```bash
+pnpm install
+pnpm audit
+```
+
+nest-server-starter 11.41.6 ships the widened key.
+
+### 3. Under the hood
+
+`EmailService` is now covered by a test that sends through a real SMTP handshake (STARTTLS,
+authentication, attachment, `requireTLS` refusing a server without STARTTLS) instead of only
+`jsonTransport`. No behaviour changed.
+
+## Compatibility Notes
+
+| Pattern | Status |
+| ------- | ------ |
+| `@types/nodemailer` in your devDependencies | Unused; safe to remove |
+| Code typing `nodemailer/lib/…` transports as `X.default` (11.41.5) | Unchanged |
+| A lockfile resolving `piscina@4.9.3` | Vulnerable — refresh it (§2) |
+| Override `'@xhmikosr/decompress@>=11.0.0 <11.1.3': 11.1.4` | Misses 11.1.3 — widen the key to `<11.1.4` (§2) |
+
+## Troubleshooting
+
+| Symptom | Cause | Fix |
+| ------- | ----- | --- |
+| `pnpm audit` reports GHSA-67c8-pqhq-4rmx (`piscina`) | Lockfile still resolves 4.9.3 | `pnpm update piscina --depth Infinity` |
+| `pnpm update piscina` changes nothing | An override pins `piscina` | Raise or remove the override to `4.9.4` |
+| `pnpm audit` reports GHSA-hrh2-vp3x-79xf (`@xhmikosr/decompress`) | Override key `<11.1.3` misses 11.1.3 | Widen the key to `<11.1.4` |
+
+## Module Documentation
+
+- [Migration guide 11.41.4 → 11.41.5](./11.41.4-to-11.41.5.md) — the nodemailer 10 upgrade this release builds on

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nest-server",
-  "version": "11.41.5",
+  "version": "11.41.6",
   "description": "Modern, fast, powerful Node.js web framework in TypeScript based on Nest with a GraphQL API and a connection to MongoDB (or other databases).",
   "keywords": [
     "node",
@@ -196,7 +196,6 @@
     "@types/lodash": "4.17.25",
     "@types/multer": "2.3.0",
     "@types/node": "26.6.3",
-    "@types/nodemailer": "8.0.2",
     "@types/passport": "1.0.17",
     "@vitest/coverage-v8": "4.1.11",
     "ansi-colors": "4.1.3",
@@ -212,6 +211,7 @@
     "oxfmt": "0.71.0",
     "oxlint": "1.86.0",
     "rimraf": "6.1.3",
+    "smtp-server": "3.19.16",
     "ts-node": "10.9.2",
     "tsconfig-paths": "4.2.0",
     "tsx": "4.23.15",