Upgrade nodemailer to latest major for audit compliance.

This removes the remaining SMTP command injection advisories by moving to nodemailer 8.0.5 and refreshing the lockfile accordingly.

Made-with: Cursor

package.json

@@ -5,16 +5,16 @@
   "private": true,
   "type": "module",
   "scripts": {
-  "dev": "nuxt dev --port 3100",
+    "dev": "nuxt dev --port 3100",
     "build": "nuxt build",
     "generate": "nuxt generate",
     "preview": "nuxt preview --port 3100",
     "start": "nuxt start --port 3100",
     "postinstall": "nuxt prepare",
-  "test": "vitest run",
-  "check-security": "node scripts/verify-no-public-writes.js",
-  "smoke-local": "BASE_URL=http://127.0.0.1:3100 node scripts/smoke-tests.js",
-  "sync-public-data": "node scripts/sync-public-data.js",
+    "test": "vitest run",
+    "check-security": "node scripts/verify-no-public-writes.js",
+    "smoke-local": "BASE_URL=http://127.0.0.1:3100 node scripts/smoke-tests.js",
+    "sync-public-data": "node scripts/sync-public-data.js",
     "test:watch": "vitest watch",
     "lint": "eslint . --fix"
   },
@@ -27,7 +27,7 @@
     "dompurify": "^3.3.1",
     "jsonwebtoken": "^9.0.2",
     "multer": "^2.0.2",
-    "nodemailer": "^7.0.9",
+    "nodemailer": "^8.0.5",
     "nuxt": "^4.1.3",
     "pdf-lib": "^1.17.1",
     "pdf-parse": "^2.4.5",