Bump SMTP and IMAP block dependencies to fix vulnerabilities

[ravikiranvm]

Fixes OPS-4836.

Bump imapflow, mailparser and nodemailer to fix Snyk high-severity findings in transitive nodemailer versions.

Additional Notes

• send-email.ts: nodemailer 10 ships its own type declarations and no longer exports Attachment and Headers as named types from nodemailer/lib/mailer. Import Attachment and Mail from the nodemailer root instead and use Mail.Headers. @types/nodemailer removed as redundant.
• connection-error-handler.ts: add an explicit EAUTH case. A wrong password now returns "Check the username and password." instead of the generic code-only message. Test added.

Testing Checklist

• I tested the feature thoroughly, including edge cases
• I verified all affected areas still work as expected
• Automated tests were added/updated if necessary
• Changes are backwards compatible with any existing data, otherwise a migration script is provided

Manual tests against Gmail:

• SMTP Send Email with HTML body, custom header and URL attachment → delivered.
• IMAP New Email trigger → mailbox list populated, message fetched and parsed with header and attachment.
• SMTP with wrong app password → fast, readable EAUTH error.

[linear]

OPS-4836

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

🟡 Changes recommended

Align the EAUTH message with the behavior stated in the pull request description.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Updates SMTP/IMAP dependencies to address Nodemailer vulnerabilities and adapt SMTP code for Nodemailer 10.

Changes:

• Bumps imapflow, mailparser, and nodemailer.
• Updates Nodemailer type imports and adds EAUTH handling.
• Refreshes lockfile and license metadata.

File summaries

File	Description
THIRD_PARTY_LICENSES.txt	Refreshes dependency license metadata.
packages/blocks/smtp/test/connection-error-handler.test.ts	Adds EAUTH handling coverage.
packages/blocks/smtp/src/lib/connection-error-handler.ts	Adds explicit EAUTH handling.
packages/blocks/smtp/src/lib/actions/send-email.ts	Updates Nodemailer 10 type imports.
package.json	Updates dependencies and removes redundant Nodemailer types.
package-lock.json	Locks updated dependency versions.

Review details

• Files reviewed: 5/6 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.