Dependency bumps: published fixes available for @xmldom/xmldom, multer, nodemailer, js-yaml

Hi — we self-host nangohq/nango-server and scan the pinned image in CI. Four dependencies have published fixes upstream that Nango hasn't picked up yet. All are straightforward version bumps; none require code changes as far as we can tell.

Package	Declared in	Shipped	Fixed in	Advisories
@xmldom/xmldom	packages/shared/package.json	0.8.13	0.8.15 (or 0.9.12)	6, incl. GHSA-w2rr-34g9-rvrj, GHSA-27p8-2357-5qqv, GHSA-8344-3jmq-59r6, GHSA-93r5-fhx6-vmg9, GHSA-965w-775f-mr7g, GHSA-c7q8-3ch8-vqpv
multer	packages/server/package.json	2.2.0	2.3.0	GHSA CVE-2026-77037, CVE-2026-77078, CVE-2026-82333
nodemailer	packages/email/, packages/server/	9.0.1	9.1.0	GHSA-2x7j-588g-ccc2
js-yaml	root package.json	4.3.1	4.3.2	GHSA-2883-xcg3-v3hh

Verified against the current image

We checked whether a digest bump would resolve these before filing. The hosted-0.71.6 tag was rebuilt 2026-09-08T19:50Z and now resolves to sha256:b4ea134d8cd0a20732ec0c2dd6b29be999092b38c4043723a88acbf976dc0e10, distinct from the earlier sha256:5f7addba…. Scanned with Trivy v0.71.0: 61 CRITICAL/HIGH, carrying the same four versions above. So the rebuild doesn't pick them up.

Why xmldom is the priority

Four of the eight xmldom advisories are injection rather than denial of service — attribute injection, element-name injection, XML markup injection via DocType bypass, and XML structure injection. For a component that parses XML arriving through OAuth/SAML integrations, that class is more consequential than the DoS ones, since network isolation doesn't bound data-borne issues.

We've had to waive these locally to keep our own CI moving, which we'd much rather drop in favour of a patched image. Happy to test a pre-release build if that helps.

Thanks for the work on Nango.