node_modules: update (#349)

Co-authored-by: dawidd6 <9713907+dawidd6@users.noreply.github.com>

node_modules/nodemailer/dist/cjs/smtp-transport/index.js

@@ -43,6 +43,13 @@ const shared = __importStar(require("../shared/index.js"));
 const index_js_3 = __importDefault(require("../xoauth2/index.js"));
 const errors = __importStar(require("../errors.js"));
 const packageData = __importStar(require("../package-info.js"));
+// The keys a message's `auth` may set on top of the transport's auth settings: the ones that
+// say who logs in and with what. Everything else in the auth block (accessUrl, clientId,
+// clientSecret, customHeaders, customParams, tls, privateKey, serviceClient and the rest)
+// names the endpoint the credentials go to or is a secret of the application itself, and
+// a message that could set `auth.accessUrl` and force a refresh would have the transport's
+// client secret and refresh token posted to a URL of its choosing
+const MESSAGE_AUTH_KEYS = ['type', 'user', 'pass', 'accessToken', 'refreshToken', 'expires'];
 /**
  * Creates a SMTP transport object for Nodemailer
  *
@@ -102,7 +109,11 @@ class SMTPTransport extends node_events_1.EventEmitter {
             }
             return this.auth;
         }
-        const authData = Object.assign({}, this.options.auth && typeof this.options.auth === 'object' ? this.options.auth : {}, typeof authOpts === 'object' ? authOpts : {});
+        const authData = Object.assign({}, this.options.auth && typeof this.options.auth === 'object' ? this.options.auth : {});
+        if (typeof authOpts === 'object') {
+            // see MESSAGE_AUTH_KEYS
+            shared.copyOwnKeys(authData, authOpts, key => !MESSAGE_AUTH_KEYS.includes(key));
+        }
         if (Object.keys(authData).length === 0) {
             return false;
         }