fix(deps): patch js-yaml, ai, python-dotenv vulnerabilities (CVE-2026-53550, CVE-2025-48985, CVE-2026-28684) (#5641)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

examples/mem0-demo/package.json

@@ -23,7 +23,7 @@
     "@types/js-cookie": "^3.0.6",
     "@types/react-syntax-highlighter": "^15.5.13",
     "@types/uuid": "^10.0.0",
-    "ai": "^4.1.46",
+    "ai": "^5.0.52",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "js-cookie": "^3.0.6",

examples/multimodal-demo/package.json

@@ -18,7 +18,7 @@
     "@radix-ui/react-scroll-area": "^1.2.0",
     "@radix-ui/react-select": "^2.1.2",
     "@radix-ui/react-slot": "^1.1.0",
-    "ai": "4.1.42",
+    "ai": "^5.0.52",
     "buffer": "^6.0.3",
     "class-variance-authority": "^0.7.0",
     "clsx": "^2.1.1",

examples/vercel-ai-sdk-chat-app/package.json

@@ -18,7 +18,7 @@
       "@radix-ui/react-scroll-area": "^1.2.0",
       "@radix-ui/react-select": "^2.1.2",
       "@radix-ui/react-slot": "^1.1.0",
-      "ai": "4.1.42",
+      "ai": "^5.0.52",
       "buffer": "^6.0.3",
       "class-variance-authority": "^0.7.0",
       "clsx": "^2.1.1",

integrations/vercel-ai-sdk/package.json

@@ -80,6 +80,7 @@
     ],
     "overrides": {
       "glob@>=10.2.0 <10.5.0": "^10.5.0",
+      "js-yaml@<=4.1.1": ">=4.2.0",
       "minimatch@<3.1.3": "^3.1.3",
       "minimatch@>=5.0.0 <5.1.8": "^5.1.8",
       "minimatch@>=9.0.0 <9.0.7": "^9.0.7",

integrations/vercel-ai-sdk/pnpm-lock.yaml

@@ -6,6 +6,7 @@ settings:
 
 overrides:
   glob@>=10.2.0 <10.5.0: ^10.5.0
+  js-yaml@<=4.1.1: '>=4.2.0'
   minimatch@<3.1.3: ^3.1.3
   minimatch@>=5.0.0 <5.1.8: ^5.1.8
   minimatch@>=9.0.0 <9.0.7: ^9.0.7
@@ -793,8 +794,8 @@ packages:
   arg@4.1.3:
     resolution: {integrity: sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA==}
 
-  argparse@1.0.10:
+  argparse@2.0.1:
-    resolution: {integrity: sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==}
+    resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
 
   babel-jest@29.7.0:
     resolution: {integrity: sha512-BrvGY3xZSwEcCzKvKsCi2GgHqDqsYkOP4/by5xCgIwGXQxIEh+8ew3gmrE1y7XRR6LHZIj6yLYnUi/mm2KXKBg==}
@@ -1025,11 +1026,6 @@ packages:
     resolution: {integrity: sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==}
     engines: {node: '>=8'}
 
-  esprima@4.0.1:
-    resolution: {integrity: sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==}
-    engines: {node: '>=4'}
-    hasBin: true
-
   eventsource-parser@3.1.0:
     resolution: {integrity: sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg==}
     engines: {node: '>=18.0.0'}
@@ -1351,8 +1347,8 @@ packages:
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
-  js-yaml@3.14.2:
+  js-yaml@4.2.0:
-    resolution: {integrity: sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==}
+    resolution: {integrity: sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==}
     hasBin: true
 
   jsesc@3.1.0:
@@ -1654,9 +1650,6 @@ packages:
     resolution: {integrity: sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==}
     engines: {node: '>= 12'}
 
-  sprintf-js@1.0.3:
-    resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==}
-
   stack-utils@2.0.6:
     resolution: {integrity: sha512-XlkWvfIm6RmsWtNJx+uqtKLS8eqFbxUg0ZzLXqY0caEy9l7hruX8IpiDnjsLavoBgqCCR71TqWO8MaXYheJ3RQ==}
     engines: {node: '>=10'}
@@ -2226,7 +2219,7 @@ snapshots:
       camelcase: 5.3.1
       find-up: 4.1.0
       get-package-type: 0.1.0
-      js-yaml: 3.14.2
+      js-yaml: 4.2.0
       resolve-from: 5.0.0
 
   '@istanbuljs/schema@0.1.6': {}
@@ -2605,9 +2598,7 @@ snapshots:
 
   arg@4.1.3: {}
 
-  argparse@1.0.10:
+  argparse@2.0.1: {}
-    dependencies:
-      sprintf-js: 1.0.3
 
   babel-jest@29.7.0(@babel/core@7.29.7):
     dependencies:
@@ -2857,8 +2848,6 @@ snapshots:
 
   escape-string-regexp@2.0.0: {}
 
-  esprima@4.0.1: {}
-
   eventsource-parser@3.1.0: {}
 
   execa@5.1.1:
@@ -3355,10 +3344,9 @@ snapshots:
 
   js-tokens@4.0.0: {}
 
-  js-yaml@3.14.2:
+  js-yaml@4.2.0:
     dependencies:
-      argparse: 1.0.10
+      argparse: 2.0.1
-      esprima: 4.0.1
 
   jsesc@3.1.0: {}
 
@@ -3628,8 +3616,6 @@ snapshots:
 
   source-map@0.7.6: {}
 
-  sprintf-js@1.0.3: {}
-
   stack-utils@2.0.6:
     dependencies:
       escape-string-regexp: 2.0.0

integrations/vercel-ai-sdk/pnpm-workspace.yaml

@@ -7,6 +7,7 @@ onlyBuiltDependencies:
 
 overrides:
   "glob@>=10.2.0 <10.5.0": "^10.5.0"
+  "js-yaml@<=4.1.1": ">=4.2.0"
   "minimatch@<3.1.3": "^3.1.3"
   "minimatch@>=5.0.0 <5.1.8": "^5.1.8"
   "minimatch@>=9.0.0 <9.0.7": "^9.0.7"

openmemory/api/requirements.txt

@@ -1,7 +1,7 @@
 fastapi>=0.68.0
 uvicorn>=0.15.0
 sqlalchemy>=1.4.0
-python-dotenv>=0.19.0
+python-dotenv>=1.2.2
 alembic>=1.7.0
 psycopg2-binary>=2.9.0
 python-multipart>=0.0.27