security: pin/override nodemailer past 4 GHSAs pulled in via mailauth (high)

[schmug]

Task

mailauth@4.13.3 (latest, already at floor ^4.13.3 in package.json) pins its own nodemailer dependency at 8.0.7, which is within the vulnerable range for four advisories: GHSA-268h-hp4c-crq3 (CRLF header injection), GHSA-wqvq-jvpq-h66f (jsonTransport bypasses disableFileAccess/disableUrlAccess), GHSA-r7g4-qg5f-qqm2 (improper TLS cert validation in OAuth2 token fetch), and GHSA-p6gq-j5cr-w38f (raw option bypasses file-access/URL-access guards, arbitrary file read + SSRF). Patched nodemailer is >=9.0.3. Bumping mailauth alone will not fix this — no newer mailauth release exists yet that pulls a patched nodemailer.

Pointers

package.json:113 ("mailauth": "^4.13.3"), package-lock.json (nested nodemailer@8.0.7 under mailauth).

Constraints

Since this repo doesn't send mail via nodemailer directly (it's an internal dependency of mailauth's own send/verify helpers), the safest fix is an overrides entry in package.json forcing nodemailer to >=9.0.3, verified against mailauth's actual usage surface in this codebase (mailauth is used for DKIM/DMARC/ARC parsing — confirm at code-review time whether mailauth's nodemailer usage is even reachable here, since PhishSOC may only use its verification/parsing exports, not its mail-sending exports). Run the full test/typecheck/lint gate and keep it green. This touches a risk path (mail-handling dependency), so the merge routine will escalate it to human review — that's expected.

Acceptance

npm audit no longer reports GHSA-268h-hp4c-crq3, GHSA-wqvq-jvpq-h66f, GHSA-r7g4-qg5f-qqm2, or GHSA-p6gq-j5cr-w38f; full test suite green; mailauth-dependent functionality (DKIM/DMARC/ARC checks) verified unaffected.

Out of scope

Any other Dependabot/npm-audit findings not listed above — track separately.