fix(quick-261009-p0m): Abhaengigkeiten innerhalb der Hauptversionen aktualisiert, zwei unbenutzte entfernt

- Next.js 15.5.27, NestJS 11.2.7 (multer 2.4.0), nodemailer 9.1.1, undici 7.30.0 exakt, adm-zip 0.6.1, csv-parse 7.0.3, vitest (web) 4.1.11
- 15 pnpm-Overrides fuer mittelbare Bausteine, nur innerhalb derselben Hauptversion
- @nestjs-modules/mailer und ews-javascript-api entfernt (kein Import), Kommentare berichtigt
- Desktop: rustls 0.23.45 (mit rustls-webpki 0.103.15)
- pnpm audit --prod: 151 (5 kritisch, 73 hoch) -> 12 (0 kritisch, 9 hoch)
- Sicherheitsprotokoll, Entwicklungsanleitung und CHANGELOG nachgefuehrt

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

apps/api/package.json

@@ -14,33 +14,31 @@
   },
   "dependencies": {
     "@microsoft/microsoft-graph-client": "3.0.7",
-    "@nestjs-modules/mailer": "^2.3.7",
-    "@nestjs/common": "^11.0.0",
+    "@nestjs/common": "^11.2.7",
     "@nestjs/config": "^4.0.0",
-    "@nestjs/core": "^11.0.0",
+    "@nestjs/core": "^11.2.7",
     "@nestjs/jwt": "^11.0.2",
     "@nestjs/mapped-types": "^2.1.1",
     "@nestjs/passport": "^11.0.5",
-    "@nestjs/platform-express": "^11.0.0",
+    "@nestjs/platform-express": "^11.2.7",
     "@nestjs/schedule": "^6.1.3",
     "@prisma/client": "^6.0.0",
     "@tessera/shared": "workspace:*",
-    "adm-zip": "^0.6.0",
+    "adm-zip": "^0.6.1",
     "argon2": "^0.44.0",
     "cheerio": "^1.2.0",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.15.1",
     "cookie-parser": "^1.4.7",
     "cron": "4.4.0",
-    "csv-parse": "^7.0.1",
-    "ews-javascript-api": "0.15.3",
+    "csv-parse": "^7.0.3",
     "fast-xml-parser": "^5.10.1",
     "httpntlm": "^1.8.13",
     "imapflow": "^1.4.3",
     "ldapts": "^8.1.8",
     "node-forge": "^1.4.0",
     "node-ical": "0.26.1",
-    "nodemailer": "^9.0.1",
+    "nodemailer": "^9.1.1",
     "passport": "^0.7.0",
     "passport-jwt": "^4.0.1",
     "passport-local": "^1.0.0",
@@ -49,7 +47,7 @@
     "reflect-metadata": "^0.2.0",
     "rxjs": "^7.0.0",
     "tsdav": "2.2.2",
-    "undici": "7.28.0",
+    "undici": "7.30.0",
     "xlsx": "^0.18.5"
   },
   "devDependencies": {

apps/api/src/calendar/providers/exchange.provider.ts

@@ -110,7 +110,7 @@ function ntlmPost(opts: NtlmOptions): Promise<{ statusCode: number; body: string
  * Exchange calendar provider — dispatches on exchangeMode ('graph' vs 'ews').
  *
  * - 'graph': Uses @microsoft/microsoft-graph-client for Exchange Online / M365
- * - 'ews': Uses ews-javascript-api for on-premise Exchange Server
+ * - 'ews': Uses raw SOAP over NTLM (httpntlm) for on-premise Exchange Server
  *
  * Both modes gracefully degrade: on auth failure, returns empty array and
  * surfaces a generic error (no credential details — Security V7 / T-05-13).

apps/api/src/mail/mail.module.ts

@@ -21,8 +21,8 @@ import { MailService } from './mail.service';
  *   4. Final hardcoded fallback: localhost:1025 (Mailhog / dev default)
  *
  * No circular import risk: MailModule -> SettingsModule -> CalendarModule
- * (no reverse edges). `@nestjs-modules/mailer` bleibt als Paket installiert,
- * wird aber von keinem Modul mehr benutzt.
+ * (no reverse edges). Das fruehere Paket `@nestjs-modules/mailer` ist entfernt
+ * (quick-261009-p0m); versendet wird ausschliesslich ueber nodemailer.
  */
 @Module({
   imports: [SettingsModule],

apps/desktop/src-tauri/Cargo.lock

@@ -3149,9 +3149,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.41"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "once_cell",
  "ring",
@@ -3211,9 +3211,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",

apps/web/package.json

@@ -16,7 +16,7 @@
     "fflate": "^0.8.3",
     "html-to-image": "1.11.13",
     "jose": "^6.2.3",
-    "next": "^15.3.0",
+    "next": "^15.5.27",
     "next-intl": "^4.13.0",
     "next-themes": "^0.4.6",
     "react": "^19.0.0",
@@ -40,6 +40,6 @@
     "postcss": "^8.0.0",
     "tailwindcss": "^4.0.0",
     "typescript": "^5.5.0",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.11"
   }
 }