chore(deps): bump the production-dependencies group across 1 directory with 2 updates by dependabot[bot] · Pull Request #208 · klodr/gmail-mcp

dependabot · 2026-05-25T09:40:15Z

Bumps the production-dependencies group with 2 updates in the / directory: googleapis and nodemailer.

Updates googleapis from 171.4.0 to 173.0.0

Release notes

googleapis: v173.0.0

173.0.0 (2026-05-28)

⚠ BREAKING CHANGES

This release has breaking changes.

Features

run the generator (#3920) (08443b4)

Commits

9e92f53 chore: release main (#3923)
08443b4 feat: run the generator (#3920)
cf35f69 chore: release main (#3922)
dec51bf fix: update release-please-config.json to remove non-existent package (#3921)
b385d3f feat: run the generator (#3919)
7fa3d49 feat: regenerate index files
9fd8b53 feat(walletobjects): update the API
45054a1 feat(servicecontrol): update the API
0538d74 fix(orgpolicy): update the API
efe33ba feat(dataflow): update the API
Additional commits viewable in compare view

Updates nodemailer from 8.0.7 to 8.0.10

Release notes

Sourced from nodemailer's releases.

v8.0.10

8.0.10 (2026-05-29)

Bug Fixes

fall back to lower-severity handler when custom logger lacks a level method (6d849df)

v8.0.9

8.0.9 (2026-05-26)

Bug Fixes

two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

v8.0.8

8.0.8 (2026-05-23)

Bug Fixes

enforce strict TLS for OAuth2 and Ethereal credential requests (#1818) (833d6e5)

four listener/stream leaks in SMTP transport, connection, pool (#1817) (850bb91)

Changelog

Sourced from nodemailer's changelog.

8.0.10 (2026-05-29)

Bug Fixes

fall back to lower-severity handler when custom logger lacks a level method (6d849df)

8.0.9 (2026-05-26)

Bug Fixes

two pending security advisories (jsonTransport access bypass, List-* CRLF injection) (#1820) (5f69497)

8.0.8 (2026-05-23)

Bug Fixes

enforce strict TLS for OAuth2 and Ethereal credential requests (#1818) (833d6e5)

four listener/stream leaks in SMTP transport, connection, pool (#1817) (850bb91)

Commits

948ae3f chore(master): release 8.0.10 (#1823)
9eedad9 docs: add SECURITY.md policy (#1824)
6d849df fix: fall back to lower-severity handler when custom logger lacks a level method
07303cb chore(master): release 8.0.9 (#1821)
5f69497 fix: two pending security advisories (jsonTransport access bypass, List-* CRL...
15138a8 chore(master): release 8.0.8 (#1819)
850bb91 fix: four listener/stream leaks in SMTP transport, connection, pool (#1817)
833d6e5 fix: enforce strict TLS for OAuth2 and Ethereal credential requests (#1818)
See full diff in compare view

socket-security · 2026-05-25T09:40:42Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	googleapis@171.4.0 ⏵ 173.0.0	^-3		⁺¹
	nodemailer@8.0.7 ⏵ 8.0.10			⁺¹

View full report

socket-security · 2026-05-25T09:40:43Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

codecov · 2026-05-25T09:40:56Z

Bundle Report

Bundle size has no change ✅

codecov · 2026-05-25T09:41:36Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.40%. Comparing base (1a42785) to head (caf6e7b).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #208   +/-   ##
=======================================
  Coverage   99.40%   99.40%           
=======================================
  Files          33       33           
  Lines        1859     1859           
  Branches      513      513           
=======================================
  Hits         1848     1848           
  Misses          9        9           
  Partials        2        2

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1a42785...caf6e7b. Read the comment docs.

klodr · 2026-05-25T18:57:44Z

@coderabbitai review

coderabbitai · 2026-05-25T18:57:50Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai · 2026-05-25T18:57:56Z

📝 Walkthrough

Walkthrough

This PR updates the googleapis dependency in package.json from ^171.4.0 to ^173.0.0. No other files or package metadata were changed.

Changes

Dependency Update

Layer / File(s)	Summary
googleapis dependency version bump `package.json`	The `googleapis` library dependency is bumped from ^171.4.0 to ^173.0.0 in the `dependencies` section of the package manifest.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

klodr/gmail-mcp#75: Updates package.json dependencies to modify Google API client tooling.

Suggested labels

Review effort 2/5

Suggested reviewers

klodr

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

Ignore (reviewers only)

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Title check	❌ Error	Title exceeds 72-character limit (85 characters) and uses vague language ('bump the production-dependencies group') that doesn't specify the main changes.	Revise title to follow Conventional Commits: stay within 72 characters and be more specific (e.g., 'chore(deps): update googleapis and nodemailer').

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The PR description clearly describes a dependency update for googleapis and nodemailer with detailed release notes and commit history.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

klodr · 2026-05-26T03:34:24Z

@dependabot rebase

klodr · 2026-05-26T03:45:37Z

@coderabbitai review

coderabbitai · 2026-05-26T03:45:42Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

## Summary Three sanitizer test files (`test/hardening.test.ts`, `test/sanitize.test.ts`, `test/utl-attachment-sanitize.test.ts`) embed invisible/control Unicode codepoints (zero-width spaces, bidi overrides, word-joiner, BOM, NEL) as **literal bytes** to exercise the sanitizer. The `editorconfig-checker` action — recently auto-bumped on the GitHub-hosted runner — now classifies these files as `Wrong character encoding ("binary" instead of "utf-8")` and fails the **required** `EditorConfig check`, blocking Dependabot PRs #205–#208. This replaces the 35 invisible literals with `\uXXXX` escape sequences. **Runtime codepoints are identical** (the TS parser decodes the escapes), so the sanitizer assertions are unchanged — **784 tests still pass**. The files are now pure ASCII. Visible characters (em/en dashes, arrows, emoji, CJK, accented letters) are intentionally left as-is — valid UTF-8, never the cause. ## Type of change - [ ] Bug fix (non-breaking) - [ ] New feature - [ ] Breaking change - [ ] Documentation - [ ] Refactor / chore - [x] Test / CI ## Checklist - [x] Tests pass locally (784/784 vitest) - [x] No behavior change — escapes decode to identical runtime codepoints - [x] No secrets/tokens committed ## Related issues Unblocks #205, #206, #207, #208 (all gated on the same EditorConfig check).

klodr · 2026-05-28T17:38:37Z

@dependabot rebase

klodr · 2026-05-28T17:45:13Z

@coderabbitai review

coderabbitai · 2026-05-28T17:45:18Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai · 2026-05-28T17:49:47Z

Actionable comments posted: 0

klodr

Reviewed dependency bump, auto-merge enabled — letting CI + CodeRabbit + Scorecard gate the merge.

…y with 2 updates Bumps the production-dependencies group with 2 updates in the / directory: [googleapis](https://github.com/googleapis/google-api-nodejs-client) and [nodemailer](https://github.com/nodemailer/nodemailer). Updates `googleapis` from 171.4.0 to 173.0.0 - [Release notes](https://github.com/googleapis/google-api-nodejs-client/releases) - [Commits](googleapis/google-api-nodejs-client@googleapis-v171.4.0...googleapis-v173.0.0) Updates `nodemailer` from 8.0.7 to 8.0.10 - [Release notes](https://github.com/nodemailer/nodemailer/releases) - [Changelog](https://github.com/nodemailer/nodemailer/blob/master/CHANGELOG.md) - [Commits](nodemailer/nodemailer@v8.0.7...v8.0.10) --- updated-dependencies: - dependency-name: googleapis dependency-version: 172.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: production-dependencies - dependency-name: nodemailer dependency-version: 8.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

klodr · 2026-06-02T18:22:00Z

@dependabot rebase

dependabot · 2026-06-02T18:22:05Z

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

klodr · 2026-06-03T14:29:22Z

@coderabbitai review

coderabbitai · 2026-06-03T14:29:37Z

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

dependabot · 2026-06-08T06:44:36Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 25, 2026

dependabot Bot requested a review from klodr as a code owner May 25, 2026 09:40

coderabbitai Bot added the Review effort 1/5 label May 25, 2026

coderabbitai Bot previously approved these changes May 25, 2026

View reviewed changes

klodr enabled auto-merge (squash) May 25, 2026 19:03

klodr disabled auto-merge May 25, 2026 19:04

dependabot Bot changed the title ~~chore(deps): bump the production-dependencies group with 2 updates~~ chore(deps): bump the production-dependencies group across 1 directory with 2 updates May 26, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-fd1216ba69 branch from 8c0c3c8 to 1a571c0 Compare May 26, 2026 03:35

klodr changed the title ~~chore(deps): bump the production-dependencies group across 1 directory with 2 updates~~ chore(deps): bump production-dependencies group (2 updates) May 26, 2026

klodr mentioned this pull request May 28, 2026

test: escape invisible Unicode literals to satisfy editorconfig #210

Merged

9 tasks

dependabot Bot changed the title ~~chore(deps): bump production-dependencies group (2 updates)~~ chore(deps): bump the production-dependencies group across 1 directory with 2 updates May 28, 2026

dependabot Bot dismissed coderabbitai[bot]’s stale review via 07231c1 May 28, 2026 17:40

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-fd1216ba69 branch from 1a571c0 to 07231c1 Compare May 28, 2026 17:40

klodr previously approved these changes Jun 1, 2026

View reviewed changes

klodr enabled auto-merge (squash) June 1, 2026 13:26

dependabot Bot dismissed klodr’s stale review via caf6e7b June 1, 2026 22:21

dependabot Bot force-pushed the dependabot/npm_and_yarn/production-dependencies-fd1216ba69 branch from 07231c1 to caf6e7b Compare June 1, 2026 22:21

dependabot Bot closed this Jun 8, 2026

auto-merge was automatically disabled June 8, 2026 06:44
Pull request was closed

dependabot Bot deleted the dependabot/npm_and_yarn/production-dependencies-fd1216ba69 branch June 8, 2026 06:44

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

googleapis: v173.0.0

173.0.0 (2026-05-28)

⚠ BREAKING CHANGES

Features

v8.0.10

8.0.10 (2026-05-29)

Bug Fixes

v8.0.9

8.0.9 (2026-05-26)

Bug Fixes

v8.0.8

8.0.8 (2026-05-23)

Bug Fixes

8.0.10 (2026-05-29)

Bug Fixes

8.0.9 (2026-05-26)

Bug Fixes

8.0.8 (2026-05-23)

Bug Fixes

Uh oh!

socket-security Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov Bot commented May 25, 2026

Bundle Report

Uh oh!

codecov Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

klodr commented May 25, 2026

Uh oh!

coderabbitai Bot commented May 25, 2026

Uh oh!

coderabbitai Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Pre-merge checks failed

❌ Failed checks (1 error)

Uh oh!

klodr commented May 26, 2026

Uh oh!

klodr commented May 26, 2026

Uh oh!

coderabbitai Bot commented May 26, 2026

Uh oh!

klodr commented May 28, 2026

Uh oh!

klodr commented May 28, 2026

Uh oh!

coderabbitai Bot commented May 28, 2026

Uh oh!

coderabbitai Bot commented May 28, 2026

Uh oh!

klodr left a comment

Choose a reason for hiding this comment

Uh oh!

klodr commented Jun 2, 2026

Uh oh!

dependabot Bot commented on behalf of github Jun 2, 2026

Uh oh!

klodr commented Jun 3, 2026

Uh oh!

coderabbitai Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dependabot Bot commented on behalf of github Jun 8, 2026

Uh oh!

dependabot Bot commented on behalf of github May 25, 2026 •

edited

Loading

socket-security Bot commented May 25, 2026 •

edited

Loading

socket-security Bot commented May 25, 2026 •

edited

Loading

codecov Bot commented May 25, 2026 •

edited

Loading

coderabbitai Bot commented May 25, 2026 •

edited

Loading

coderabbitai Bot commented Jun 3, 2026 •

edited

Loading