chore(deps): pin transitive deps and upgrade nodemailer to 9 (#4243)

Routine dependency maintenance.

- Pin a few high-fanout transitive deps to current patched versions via
`pnpm.overrides`: `form-data`, `ws`, `undici`, `hono`. Lockfile-only (no
published-package dependency changes); net shrinks via dedup.
- Upgrade `nodemailer` 8 → 9 in `internal-packages/emails` (private
package). The SES transport already uses SESv2 and the
`createTransport`/`sendMail` API is unchanged, so no code changes were
needed. `@types/nodemailer` stays at 8 (no 9.x published yet; types are
compatible).

Verified locally: `pnpm i` clean; `pnpm run typecheck --filter emails`
and `--filter webapp` both pass.

Author: nicktrn

internal-packages/emails/package.json

@@ -13,7 +13,7 @@
     "@aws-sdk/client-sesv2": "^3.716.0",
     "@react-email/components": "1.0.12",
     "@react-email/render": "^2.0.8",
-    "nodemailer": "^8.0.6",
+    "nodemailer": "^9.0.1",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
     "resend": "^3.2.0",

package.json

@@ -103,13 +103,17 @@
       "@remix-run/dev@2.17.5>tar-fs": "2.1.4",
       "tar@>=7 <7.5.11": "^7.5.11",
       "form-data@^2": "2.5.4",
-      "form-data@^3": "3.0.4",
-      "form-data@^4": "4.0.4",
+      "form-data@^3": "3.0.5",
+      "form-data@^4": "4.0.6",
+      "ws@>=7 <7.5.11": "7.5.11",
+      "ws@>=8 <8.21.0": "8.21.0",
+      "hono@>=4 <4.12.25": "4.12.25",
+      "undici@>=6 <6.27.0": "6.27.0",
+      "undici@>=7 <7.28.0": "7.28.0",
       "js-yaml@>=3.0.0 <3.14.2": "3.14.2",
       "js-yaml@>=4.0.0 <4.1.1": "4.1.1",
       "jws@<3.2.3": "3.2.3",
       "qs@>=6.0.0 <6.15.2": "^6.15.2",
-      "systeminformation@>=5.0.0 <5.31.0": "^5.31.0",
       "lodash@>=4.17 <4.18.0": "^4.18.0",
       "lodash-es@>=4.17 <4.18.0": "^4.18.0",
       "dompurify@>=3 <3.4.0": "^3.4.1",