fix(firestore-send-email): kit/extension parity – kit ships nodemailer 7 instead of the extension's nodemailer 9 #3294

firestore-send-email kit/extension parity. Priority: medium. The kit ships nodemailer 7. That drops the certificate checks and address-parsing fixes that extension 0.2.10 shipped with nodemailer 9.

Difference

• Extension: 0.2.10's only change was "bump nodemailer to v9" (resolves 9.0.1).
• Kit: depends on nodemailer ^7.0.5 (shrinkwrap 7.0.13), yet the README describes it as "version 0.2.10 of the extension repackaged".

Reproduced

Extension and kit deployed side by side, sending through an Ethereal SMTP sink.

From the code and changelogs only, nodemailer 7 also:

• fetches the OAuth2 token without checking certificates, which exposes the client secret and refresh token to a man-in-the-middle;
• lacks the CRLF-injection fixes for headers and the envelope (8.0.4, 8.0.5, 8.0.9);
• doesn't fall back to a host's other IP addresses when one is unreachable (8.0.0);
• handles non-ASCII addresses differently (8.0.7).

Code

• Extension: functions/package.json#L31, CHANGELOG.md#L1-L3
• Kit: package.json#L40

Resolution

Bump the kit to nodemailer ^9.0.1 (regenerate the shrinkwrap) and re-run the kit tests.