Maximum call stack size exceeded with nodemailer transport

Provider type

Email

Environment

System:
OS: macOS 13.5.1
CPU: (10) arm64 Apple M1 Max
Memory: 5.23 GB / 32.00 GB
Shell: 5.9 - /bin/zsh
Binaries:
Node: 18.17.1 - ~/.local/share/rtx/installs/node/18.17.1/bin/node
npm: 9.6.7 - ~/.local/share/rtx/installs/node/18.17.1/bin/npm
pnpm: 8.7.4 - ~/.local/share/rtx/installs/node/18.17.1/bin/pnpm
Browsers:
Safari: 16.6
npmPackages:
next: 13.4.19 => 13.4.19
next-auth: 4.23.1 => 4.23.1
react: 18.2.0 => 18.2.0

(note the command given to run to get the versions doesn't actually get npm packages I think the @ breaks it)

Reproduction URL

https://github.com/reconbot/next-auth-merge-bug

Describe the issue

If you use a nodemailer transport you get one of two errors (one I get in my app and one I'm getting in the reproduction) and they both stem from a circular references in nodemailer.

if you just run npm run dev

- error TypeError: Converting circular structure to JSON
    --> starting at object with constructor 'Mail'
    |     property 'transporter' -> object with constructor 'JSONTransport'
    --- property 'mailer' closes the circle
    at JSON.stringify (<anonymous>)
    at createSecret (webpack-internal:///(rsc)/./node_modules/next-auth/core/lib/utils.js:20:168)
    at init (webpack-internal:///(rsc)/./node_modules/next-auth/core/init.js:60:44)
    at AuthHandler (webpack-internal:///(rsc)/./node_modules/next-auth/core/index.js:138:55)

Turns out if you define NEXTAUTH_SECRET you get a more informative error.

NEXTAUTH_SECRET=asdf npm run dev

- error RangeError: Maximum call stack size exceeded
    at Function.assign (<anonymous>)
    at merge (webpack-internal:///(rsc)/./node_modules/next-auth/utils/merge.js:20:24)
    at merge (webpack-internal:///(rsc)/./node_modules/next-auth/utils/merge.js:18:17)
    at merge (webpack-internal:///(rsc)/./node_modules/next-auth/utils/merge.js:18:17)

It's trying to deep merge a circular reference when it should be leaving it alone.

How to reproduce

navigate to http://localhost:3000/api/auth/login and look at the terminal output

Expected behavior

It doesn't crash

Start with the reproduction repository and run npm run dev, then visit /api/auth/login while using the nodemailer transport. Read the stack traces around next-auth/utils/merge.js and createSecret; done means the circular transport reference no longer crashes the application.