Security: pin vulnerable runtime deps in email-newsletter (jsonwebtoken critical)

[canuto]

Dependabot reports 5 open alerts against email-newsletter/package.json, including 1 critical. Both flagged packages (jsonwebtoken, zod) are real runtime dependencies here — index.ts calls jwt.verify/jwt.sign for admin auth and lib/validation.ts uses zod for input schemas.

Root cause

The template declares these as unpinned "latest":

"dependencies": {
  "codehooks-js": "latest",
  "jsonwebtoken": "latest",
  "zod": "latest"
}

With no version floor and no lockfile, Dependabot treats the whole vulnerable range as in-scope, and a fresh npm install could in principle resolve anything. There's no reproducible pin protecting deploys.

Alerts

Severity	Package	Vulnerable range	Advisory	Patched
critical	jsonwebtoken	< 4.2.2	Verification bypass	4.2.2
high	jsonwebtoken	<= 8.5.1	Unrestricted key type → legacy key usage	9.0.0
medium	jsonwebtoken	< 9.0.0	Signature bypass via insecure default alg in jwt.verify()	9.0.0
medium	jsonwebtoken	<= 8.5.1	Forgeable tokens (RSA→HMAC key retrieval)	9.0.0
medium	zod	<= 3.22.2	Denial of service	3.22.3

Proposed fix

Pin to patched floors and commit a lockfile:

"dependencies": {
  "codehooks-js": "^1.0.0",
  "jsonwebtoken": "^9.0.2",
  "zod": "^3.23.8"
}

• jsonwebtoken ^9.0.2 clears all four JWT alerts (the 9.x line covers the critical, high, and both mediums).
• zod ^3.23.8 clears the DoS alert.
• Run npm install and commit package-lock.json so deploys are reproducible and Dependabot can track transitive deps.

Priority

Highest of the current alert set — it's a runtime auth dependency in a template people deploy as-is.