fix(email): upgrade Nodemailer and validate recipients

[ephraimduncan]

The SMTP email path used Nodemailer 6.10.1, affected by GHSA-v53p-9fqp-m79j. Upgrade it to 10.0.15 and reject invalid or oversized notification recipients before they reach an email transport.

• Remove the obsolete @types/nodemailer package and use Nodemailer’s bundled types. All unrelated locked dependency resolutions remain unchanged.
• Share a single-address schema between form.update and sendMail, with a 254-character bound checked before email validation. Existing invalid recipients fail notification delivery without failing submission storage.
• Add SMTP, auth-email, deferred submission-notification, and Cloudflare regressions, plus a bounded parser fixture using a local custom transport. Cloudflare continues to bypass Nodemailer.

Validation:

• Node 24.21.0 / Bun 1.4.0: 144/144 tests and full lint pass.
• Node 20.20.2: 34/34 mail/auth/notification/Cloudflare regressions and an actual ESM/offline transport check pass.
• Root, email, API, and auth typechecks pass.
• Production Next.js build and Cloudflare worker build pass with a local test database and no email sends. The repository’s existing Next configuration skips build-time typechecking.
• Focused email/auth coverage: 97.9% lines, 93.18% branches, 100% functions. Existing default coverage globs collect no files; these figures use a scoped collector override.
• Broader web and tests typechecks retain the same 12 and 14 errors reproduced on clean main; no new diagnostics.

Node compatibility is checked against the existing Next.js requirement of Node >=20.9 and Nodemailer’s Node >=20 requirement. Deployment’s active email transport has not been verified. This PR does not merge or deploy.

Advisory: GHSA-v53p-9fqp-m79j
Patched release: https://github.com/nodemailer/nodemailer/releases/tag/v10.0.15

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	formbase-web	c6191dd	Commit Preview URL Branch Preview URL	Oct 06 2026, 02:45 AM