Security: nodemailer 8.x has 4 high-severity advisories; fix requires a major upgrade

[GuyunLuke]

Hi, running npm audit on the current dependency tree reports 13 vulnerabilities (1 critical, 8 high, 4 moderate). Most transitive deps are already covered by Dependabot PRs, but one needs manual attention:

nodemailer ^8.0.5 is affected by 4 advisories requiring 9.0.5:

• GHSA-268h-hp4c-crq3: CRLF injection in List-* headers
• GHSA-wqvq-jvpq-h66f: jsonTransport bypasses disableFileAccess/UrlAccess
• GHSA-r7g4-qg5f-qqm2: improper TLS validation in OAuth2 token fetch
• GHSA-p6gq-j5cr-w38f: arbitrary file read + full-response SSRF via raw option

Since 9.0.0 is a major bump, Dependabot won't open it automatically. The core API (createTransport + sendMail) is unchanged in 9.x — I upgraded a fork and it works with no code changes (see GuyunLuke@5fbbbc3).

Suggest bumping to ^9.0.5. Happy to open a PR if that helps.