fix(deps): resolve all open MEDIUM Dependabot alerts (npm overrides + Python pins) (#5489)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

cli/node/pnpm-lock.yaml

@@ -9,6 +9,7 @@ overrides:
   langsmith@<0.6.0: ^0.6.0
   tar-fs@>=2.0.0 <2.1.4: ^2.1.4
   picomatch@<2.3.2: ^2.3.2
+  postcss@<8.5.10: '>=8.5.10'
 
 importers:
 
@@ -38,7 +39,7 @@ importers:
         version: 20.19.37
       tsup:
         specifier: ^8.0.0
-        version: 8.5.1(postcss@8.5.8)(tsx@4.21.0)(typescript@5.9.3)
+        version: 8.5.1(postcss@8.5.15)(tsx@4.21.0)(typescript@5.9.3)
       tsx:
         specifier: ^4.7.0
         version: 4.21.0
@@ -829,8 +830,8 @@ packages:
   mz@2.7.0:
     resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==}
 
-  nanoid@3.3.11:
+  nanoid@3.3.12:
-    resolution: {integrity: sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==}
+    resolution: {integrity: sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
@@ -871,7 +872,7 @@ packages:
     engines: {node: '>= 18'}
     peerDependencies:
       jiti: '>=1.21.0'
-      postcss: '>=8.0.9'
+      postcss: '>=8.5.10'
       tsx: ^4.8.1
       yaml: ^2.4.2
     peerDependenciesMeta:
@@ -884,8 +885,8 @@ packages:
       yaml:
         optional: true
 
-  postcss@8.5.8:
+  postcss@8.5.15:
-    resolution: {integrity: sha512-OW/rX8O/jXnm82Ey1k44pObPtdblfiuWnrd8X7GJ7emImCOstunGbXUpp7HdBrFQX6rJzn3sPT397Wp5aCwCHg==}
+    resolution: {integrity: sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==}
     engines: {node: ^10 || ^12 || >=14}
 
   readdirp@4.1.2:
@@ -997,7 +998,7 @@ packages:
     peerDependencies:
       '@microsoft/api-extractor': ^7.36.0
       '@swc/core': ^1
-      postcss: ^8.4.12
+      postcss: '>=8.5.10'
       typescript: '>=4.5.0'
     peerDependenciesMeta:
       '@microsoft/api-extractor':
@@ -1671,7 +1672,7 @@ snapshots:
       object-assign: 4.1.1
       thenify-all: 1.6.0
 
-  nanoid@3.3.11: {}
+  nanoid@3.3.12: {}
 
   object-assign@4.1.1: {}
 
@@ -1707,16 +1708,16 @@ snapshots:
       mlly: 1.8.2
       pathe: 2.0.3
 
-  postcss-load-config@6.0.1(postcss@8.5.8)(tsx@4.21.0):
+  postcss-load-config@6.0.1(postcss@8.5.15)(tsx@4.21.0):
     dependencies:
       lilconfig: 3.1.3
     optionalDependencies:
-      postcss: 8.5.8
+      postcss: 8.5.15
       tsx: 4.21.0
 
-  postcss@8.5.8:
+  postcss@8.5.15:
     dependencies:
-      nanoid: 3.3.11
+      nanoid: 3.3.12
       picocolors: 1.1.1
       source-map-js: 1.2.1
 
@@ -1837,7 +1838,7 @@ snapshots:
 
   ts-interface-checker@0.1.13: {}
 
-  tsup@8.5.1(postcss@8.5.8)(tsx@4.21.0)(typescript@5.9.3):
+  tsup@8.5.1(postcss@8.5.15)(tsx@4.21.0)(typescript@5.9.3):
     dependencies:
       bundle-require: 5.1.0(esbuild@0.27.4)
       cac: 6.7.14
@@ -1848,7 +1849,7 @@ snapshots:
       fix-dts-default-cjs-exports: 1.0.1
       joycon: 3.1.1
       picocolors: 1.1.1
-      postcss-load-config: 6.0.1(postcss@8.5.8)(tsx@4.21.0)
+      postcss-load-config: 6.0.1(postcss@8.5.15)(tsx@4.21.0)
       resolve-from: 5.0.0
       rollup: 4.60.0
       source-map: 0.7.6
@@ -1857,7 +1858,7 @@ snapshots:
       tinyglobby: 0.2.15
       tree-kill: 1.2.2
     optionalDependencies:
-      postcss: 8.5.8
+      postcss: 8.5.15
       typescript: 5.9.3
     transitivePeerDependencies:
       - jiti
@@ -1885,7 +1886,7 @@ snapshots:
       esbuild: 0.25.12
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
-      postcss: 8.5.8
+      postcss: 8.5.15
       rollup: 4.60.0
       tinyglobby: 0.2.15
     optionalDependencies:

cli/node/pnpm-workspace.yaml

@@ -10,3 +10,4 @@ overrides:
   langsmith@<0.6.0: ^0.6.0
   tar-fs@>=2.0.0 <2.1.4: ^2.1.4
   picomatch@<2.3.2: ^2.3.2
+  "postcss@<8.5.10": ">=8.5.10"

integrations/openclaw/package.json

@@ -68,7 +68,8 @@
       "vite": "^8.0.5",
       "langsmith@<0.6.0": "^0.6.0",
       "picomatch@<2.3.2": "^2.3.2",
-      "@qdrant/js-client-rest": "^1.18.0"
+      "@qdrant/js-client-rest": "^1.18.0",
+      "uuid@<11.1.1": ">=11.1.1"
     }
   }
 }

integrations/openclaw/pnpm-workspace.yaml

@@ -18,3 +18,4 @@ overrides:
   "langsmith@<0.6.0": "^0.6.0"
   "picomatch@<2.3.2": "^2.3.2"
   "@qdrant/js-client-rest": "^1.18.0"
+  "uuid@<11.1.1": ">=11.1.1"

integrations/pi-agent-plugin/package.json

@@ -64,5 +64,10 @@
   },
   "dependencies": {
     "mem0ai": "^3.0.6"
+  },
+  "pnpm": {
+    "overrides": {
+      "uuid@<11.1.1": ">=11.1.1"
+    }
   }
 }

integrations/pi-agent-plugin/pnpm-workspace.yaml

@@ -0,0 +1,5 @@
+packages:
+  - '.'
+
+overrides:
+  "uuid@<11.1.1": ">=11.1.1"

mem0-ts/package.json

@@ -102,7 +102,7 @@
   "dependencies": {
     "axios": "^1.16.0",
     "openai": "^4.93.0",
-    "uuid": "9.0.1",
+    "uuid": "^11.1.1",
     "zod": "^3.24.1"
   },
   "peerDependencies": {
@@ -140,12 +140,17 @@
     ],
     "overrides": {
       "picomatch@<2.3.2": "^2.3.2",
+      "picomatch@>=4.0.0 <4.0.4": "^4.0.4",
       "jws@4.0.0": "4.0.1",
+      "js-yaml@<3.14.2": ">=3.14.2",
       "langsmith@<0.6.0": "^0.6.0",
       "minimatch@<3.1.3": "^3.1.3",
       "minimatch@>=5.0.0 <5.1.8": "^5.1.8",
       "minimatch@>=9.0.0 <9.0.7": "^9.0.7",
       "path-to-regexp@>=8.0.0 <8.4.0": "^8.4.0",
+      "postcss@<8.5.10": ">=8.5.10",
+      "uuid@<11.1.1": ">=11.1.1",
+      "ws@>=8.0.0 <8.20.1": ">=8.20.1",
       "rollup@>=4.0.0 <4.59.0": "^4.59.0",
       "tar-fs@>=2.0.0 <2.1.4": "^2.1.4",
       "glob@>=10.2.0 <10.5.0": "^10.5.0",

mem0-ts/pnpm-workspace.yaml

@@ -7,12 +7,17 @@ onlyBuiltDependencies:
 
 overrides:
   "picomatch@<2.3.2": "^2.3.2"
+  "picomatch@>=4.0.0 <4.0.4": "^4.0.4"
   "jws@4.0.0": "4.0.1"
+  "js-yaml@<3.14.2": ">=3.14.2"
   "langsmith@<0.6.0": "^0.6.0"
   "minimatch@<3.1.3": "^3.1.3"
   "minimatch@>=5.0.0 <5.1.8": "^5.1.8"
   "minimatch@>=9.0.0 <9.0.7": "^9.0.7"
   "path-to-regexp@>=8.0.0 <8.4.0": "^8.4.0"
+  "postcss@<8.5.10": ">=8.5.10"
+  "uuid@<11.1.1": ">=11.1.1"
+  "ws@>=8.0.0 <8.20.1": ">=8.20.1"
   "rollup@>=4.0.0 <4.59.0": "^4.59.0"
   "tar-fs@>=2.0.0 <2.1.4": "^2.1.4"
   "glob@>=10.2.0 <10.5.0": "^10.5.0"

mem0-ts/src/community/package.json

@@ -79,7 +79,7 @@
     "@langchain/core": "^0.3.42",
     "axios": "^1.16.0",
     "mem0ai": "^2.1.8",
-    "uuid": "9.0.1",
+    "uuid": "^11.1.1",
     "zod": "3.22.4"
   },
   "engines": {

mem0-ts/src/oss/package.json

@@ -27,7 +27,7 @@
     "pg": "^8.11.3",
     "redis": "^4.7.0",
     "better-sqlite3": "^12.6.2",
-    "uuid": "^9.0.1",
+    "uuid": "^11.1.1",
     "zod": "^3.22.4"
   },
   "devDependencies": {

openmemory/ui/package.json

@@ -84,7 +84,9 @@
       "immutable@>=5.0.0 <5.1.5": "^5.1.5",
       "picomatch@<2.3.2": "^2.3.2",
       "minimatch@>=9.0.0 <9.0.7": "^9.0.7",
-      "glob@>=10.2.0 <10.5.0": "^10.5.0"
+      "glob@>=10.2.0 <10.5.0": "^10.5.0",
+      "postcss@<8.5.10": ">=8.5.10",
+      "yaml@>=2.0.0 <2.8.3": ">=2.8.3"
     }
   }
 }

openmemory/ui/pnpm-workspace.yaml

@@ -10,3 +10,5 @@ overrides:
   "picomatch@<2.3.2": "^2.3.2"
   "minimatch@>=9.0.0 <9.0.7": "^9.0.7"
   "glob@>=10.2.0 <10.5.0": "^10.5.0"
+  "postcss@<8.5.10": ">=8.5.10"
+  "yaml@>=2.0.0 <2.8.3": ">=2.8.3"

server/dashboard/package.json

@@ -60,7 +60,7 @@
     "tailwind-merge": "^2.2.0",
     "tailwindcss-animate": "^1.0.7",
     "use-debounce": "^10.0.4",
-    "uuid": "^9.0.1",
+    "uuid": "^11.1.1",
     "vaul": "^0.9.1",
     "zod": "^3.23.8"
   },

server/dashboard/pnpm-workspace.yaml

@@ -0,0 +1,7 @@
+packages:
+  - '.'
+
+overrides:
+  "postcss@<8.5.10": ">=8.5.10"
+  "prismjs@<1.30.0": ">=1.30.0"
+  "uuid@<11.1.1": ">=11.1.1"

server/requirements.txt

@@ -2,7 +2,7 @@ fastapi==0.115.8
 uvicorn==0.34.0
 pydantic[email]==2.10.4
 mem0ai>=0.1.48
-python-dotenv==1.0.1
+python-dotenv==1.2.2
 psycopg>=3.2.8
 psycopg-pool>=3.2.6,<4.0.0