[fix] nodemailer vulnerable version

[CharlesArea]

nodemailer 4.0.1 有兩個比較嚴重的vulnerabilities,

1. Command Injection CVE-2020-7769
   例如 -

[email protected] (-bi Initialize the alias database.)
[email protected] (The option -d0.1 prints the version of Sendmail and the options it was compiled with.)
[email protected] (Debug output file)

2. HTTP Header Injection CVE-2021-23400
   例如 -

const userEmail = '[email protected]: foobar'; // imagine this comes from e.g. HTTP request params or is otherwise user-controllable
await transporter.sendMail({
from: '...',
to: '...',
replyTo: {
name: 'Customer',
address: userEmail,
},
subject: 'My Subject',
text: message,
});

建議從 4.0.1 升級到 6.7.2 / 6.6.1 (暫時沒有發現相容性的問題)

[CLAassistant]

All committers have signed the CLA.