functions: bump nodemailer 10.0.10 → 10.0.13 once it clears the 7-day quarantine (on/after 2026-10-07) #87

Follow-up to #85. That fix pins nodemailer@10.0.10 because it was the newest 10.x at least 7 days old on 2026-09-30. The three releases after it are worth taking once they are old enough.

Earliest date: 2026-10-07. 10.0.13 was published 2026-09-30T04:40Z. If a newer 10.x exists by then, pick the newest one that is at least 7 days old instead.

Why bother

• 10.0.13 — "strip comments inside an angle-addr before it becomes the address". This is another fix in the address parsing that functions: nodemailer 9.0.5 fails the pre-deploy audit (high) — upgrade to 10.x #85's advisories were about, and our replyTo is user-supplied. It will likely become an advisory. Also "read the advertised SASL methods without backtracking regexes".
• 10.0.12 — settles every send on a connection error, honours requireTLS, turns a bare CR into CRLF, and bounds fetch.
• 10.0.11 — keeps the CommonJS entry point compatible with the pre-TypeScript build, and restores the @types/nodemailer layout in the bundled declarations.

Things to check

• allowSyntheticDefaultImports must stay in functions/tsconfig.json. 10.0.13's .d.ts still default-import Node builtins (TS1192 without it; checked 2026-09-30). Do not swap it for esModuleInterop, which changes the emitted JS for every import * as, or for skipLibCheck, which stops type-checking every package's declarations. defaultImportGuard.test.ts covers the check the flag removes from our own code.
• functions/src/__tests__/feedbackEmail.test.ts is the regression test for this bump. It renders the email through nodemailer's stream transport. Keep the LF normalisation in feedbackEmail.ts even though 10.0.12 fixes bare CRs upstream; it is cheap defence in depth.
• Run a requireTLS sanity check. We don't set it, so 10.0.12's change shouldn't matter, but confirm the SMTP secret port (465 → secure: true, anything else → STARTTLS) still sends.

Steps

cd functions
npm view nodemailer time --json | tail -5          # confirm age
npm ci
npm install --before=$(date -v-7d +%Y-%m-%d) nodemailer@^10.0.13
npm run build && npm test && npm run audit

Then deploy the one function that uses it: firebase deploy --only functions:onFeedbackCreated (help-a-paw-dev is prod, so confirm first). Submit one real feedback item and check that the email arrives with a working Reply-To.