From 4debc58a83377b18be81ae1e5969a300736b2fac Mon Sep 17 00:00:00 2001 From: Harsh Vardhan Gupta Date: Fri, 7 Aug 2026 19:04:33 +0530 Subject: [PATCH] fix(security): patch 8 HIGH + 18 MEDIUM Vanta vulnerabilities across 4 pnpm workspaces (#6847) --- integrations/openclaw/package.json | 2 +- integrations/openclaw/pnpm-lock.yaml | 10 +++--- integrations/openclaw/pnpm-workspace.yaml | 2 +- integrations/pi-agent-plugin/package.json | 4 +-- integrations/pi-agent-plugin/pnpm-lock.yaml | 20 +++++------ .../pi-agent-plugin/pnpm-workspace.yaml | 4 +-- integrations/zapier-mem0/package.json | 18 +++++++--- integrations/zapier-mem0/pnpm-lock.yaml | 14 ++++---- integrations/zapier-mem0/pnpm-workspace.yaml | 5 +-- mem0-ts/package.json | 7 ++-- mem0-ts/pnpm-lock.yaml | 33 ++++++++++--------- mem0-ts/pnpm-workspace.yaml | 5 +-- 12 files changed, 69 insertions(+), 55 deletions(-) diff --git a/integrations/openclaw/package.json b/integrations/openclaw/package.json index 26276a15c..1a997e3b7 100644 --- a/integrations/openclaw/package.json +++ b/integrations/openclaw/package.json @@ -72,7 +72,7 @@ "@qdrant/js-client-rest": "^1.18.0", "uuid@<11.1.1": ">=11.1.1", "esbuild": ">=0.28.1", - "undici@<6.27.0": ">=6.27.0 <8.0.0", + "undici@<7.29.0": ">=7.29.0 <8.0.0", "axios@<1.18.0": ">=1.18.0 <2.0.0", "postcss@<8.5.18": ">=8.5.18 <9.0.0", "mongoose@>=9.0.0 <9.7.2": ">=9.7.2 <10.0.0" diff --git a/integrations/openclaw/pnpm-lock.yaml b/integrations/openclaw/pnpm-lock.yaml index 3b3d3b18d..f0d26cfa7 100644 --- a/integrations/openclaw/pnpm-lock.yaml +++ b/integrations/openclaw/pnpm-lock.yaml @@ -13,7 +13,7 @@ overrides: '@qdrant/js-client-rest': ^1.18.0 uuid@<11.1.1: '>=11.1.1' esbuild: '>=0.28.1' - undici@<6.27.0: '>=6.27.0 <8.0.0' + undici@<7.29.0: '>=7.29.0 <8.0.0' axios@<1.18.0: '>=1.18.0 <2.0.0' postcss@<8.5.18: '>=8.5.18 <9.0.0' mongoose@>=9.0.0 <9.7.2: '>=9.7.2 <10.0.0' @@ -2036,8 +2036,8 @@ packages: undici-types@6.21.0: resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==} - undici@7.28.0: - resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} + undici@7.29.0: + resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} engines: {node: '>=20.18.1'} util-deprecate@1.0.2: @@ -2547,7 +2547,7 @@ snapshots: dependencies: '@qdrant/openapi-typescript-fetch': 1.2.6 typescript: 5.9.3 - undici: 7.28.0 + undici: 7.29.0 '@qdrant/openapi-typescript-fetch@1.2.6': {} @@ -4121,7 +4121,7 @@ snapshots: undici-types@6.21.0: {} - undici@7.28.0: {} + undici@7.29.0: {} util-deprecate@1.0.2: {} diff --git a/integrations/openclaw/pnpm-workspace.yaml b/integrations/openclaw/pnpm-workspace.yaml index e36ad00fc..0f9f833bc 100644 --- a/integrations/openclaw/pnpm-workspace.yaml +++ b/integrations/openclaw/pnpm-workspace.yaml @@ -21,7 +21,7 @@ overrides: "@qdrant/js-client-rest": "^1.18.0" "uuid@<11.1.1": ">=11.1.1" "esbuild": ">=0.28.1" - "undici@<6.27.0": ">=6.27.0 <8.0.0" + "undici@<7.29.0": ">=7.29.0 <8.0.0" "axios@<1.18.0": ">=1.18.0 <2.0.0" "postcss@<8.5.18": ">=8.5.18 <9.0.0" "mongoose@>=9.0.0 <9.7.2": ">=9.7.2 <10.0.0" diff --git a/integrations/pi-agent-plugin/package.json b/integrations/pi-agent-plugin/package.json index 8f6951672..ce03543b5 100644 --- a/integrations/pi-agent-plugin/package.json +++ b/integrations/pi-agent-plugin/package.json @@ -73,8 +73,8 @@ "form-data@<4.0.6": ">=4.0.6", "uuid@<11.1.1": ">=11.1.1", "esbuild": ">=0.28.1", - "undici@<6.27.0": ">=6.27.0 <8.0.0", - "undici@>=8.0.0 <8.5.0": ">=8.5.0", + "undici@<7.29.0": ">=7.29.0 <8.0.0", + "undici@>=8.0.0 <8.9.0": ">=8.9.0 <9.0.0", "axios@<1.18.0": ">=1.18.0 <2.0.0", "brace-expansion@>=3.0.0 <5.0.8": ">=5.0.8 <6.0.0", "postcss@<8.5.18": ">=8.5.18 <9.0.0", diff --git a/integrations/pi-agent-plugin/pnpm-lock.yaml b/integrations/pi-agent-plugin/pnpm-lock.yaml index 341014c2b..87a5d4004 100644 --- a/integrations/pi-agent-plugin/pnpm-lock.yaml +++ b/integrations/pi-agent-plugin/pnpm-lock.yaml @@ -8,8 +8,8 @@ overrides: form-data@<4.0.6: '>=4.0.6' uuid@<11.1.1: '>=11.1.1' esbuild: '>=0.28.1' - undici@<6.27.0: '>=6.27.0 <8.0.0' - undici@>=8.0.0 <8.5.0: '>=8.5.0' + undici@<7.29.0: '>=7.29.0 <8.0.0' + undici@>=8.0.0 <8.9.0: '>=8.9.0 <9.0.0' axios@<1.18.0: '>=1.18.0 <2.0.0' brace-expansion@>=3.0.0 <5.0.8: '>=5.0.8 <6.0.0' postcss@<8.5.18: '>=8.5.18 <9.0.0' @@ -2354,12 +2354,12 @@ packages: undici-types@7.24.6: resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==} - undici@7.28.0: - resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} + undici@7.29.0: + resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} engines: {node: '>=20.18.1'} - undici@8.5.0: - resolution: {integrity: sha512-xamtWoB1EshgjpmlXd7GGm2VfdDtw1+rD8uhry8pSNW3If6S8E0m2T2+orSKeZXEn/aPJMviCpDBA65WJt8zhg==} + undici@8.10.0: + resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==} engines: {node: '>=22.19.0'} util-deprecate@1.0.2: @@ -2942,7 +2942,7 @@ snapshots: minimatch: 10.2.5 proper-lockfile: 4.1.2 typebox: 1.1.38 - undici: 8.5.0 + undici: 8.10.0 yaml: 2.9.0 optionalDependencies: '@mariozechner/clipboard': 0.3.9 @@ -3203,7 +3203,7 @@ snapshots: dependencies: '@qdrant/openapi-typescript-fetch': 1.2.6 typescript: 6.0.3 - undici: 7.28.0 + undici: 7.29.0 '@qdrant/openapi-typescript-fetch@1.2.6': {} @@ -4895,9 +4895,9 @@ snapshots: undici-types@7.24.6: {} - undici@7.28.0: {} + undici@7.29.0: {} - undici@8.5.0: {} + undici@8.10.0: {} util-deprecate@1.0.2: {} diff --git a/integrations/pi-agent-plugin/pnpm-workspace.yaml b/integrations/pi-agent-plugin/pnpm-workspace.yaml index c9f6dc722..283b117cc 100644 --- a/integrations/pi-agent-plugin/pnpm-workspace.yaml +++ b/integrations/pi-agent-plugin/pnpm-workspace.yaml @@ -5,8 +5,8 @@ overrides: "form-data@<4.0.6": ">=4.0.6" "uuid@<11.1.1": ">=11.1.1" "esbuild": ">=0.28.1" - "undici@<6.27.0": ">=6.27.0 <8.0.0" - "undici@>=8.0.0 <8.5.0": ">=8.5.0" + "undici@<7.29.0": ">=7.29.0 <8.0.0" + "undici@>=8.0.0 <8.9.0": ">=8.9.0 <9.0.0" "axios@<1.18.0": ">=1.18.0 <2.0.0" "brace-expansion@>=3.0.0 <5.0.8": ">=5.0.8 <6.0.0" "postcss@<8.5.18": ">=8.5.18 <9.0.0" diff --git a/integrations/zapier-mem0/package.json b/integrations/zapier-mem0/package.json index 1ebef892c..b095818d3 100644 --- a/integrations/zapier-mem0/package.json +++ b/integrations/zapier-mem0/package.json @@ -41,10 +41,17 @@ ], "jest": { "testEnvironment": "node", - "testMatch": ["**/test/**/*.test.ts"], - "setupFiles": ["/test/setup.ts"], + "testMatch": [ + "**/test/**/*.test.ts" + ], + "setupFiles": [ + "/test/setup.ts" + ], "transform": { - "^.+\\.tsx?$": ["ts-jest", {}] + "^.+\\.tsx?$": [ + "ts-jest", + {} + ] } }, "dependencies": { @@ -62,8 +69,9 @@ "form-data@<4.0.6": ">=4.0.6", "uuid@<11.1.1": ">=11.1.1", "esbuild": ">=0.28.1", - "undici@<6.27.0": ">=6.27.0 <8.0.0", - "undici@>=8.0.0 <8.5.0": ">=8.5.0" + "undici@<7.29.0": ">=7.29.0 <8.0.0", + "undici@>=8.0.0 <8.9.0": ">=8.9.0 <9.0.0", + "brace-expansion@<1.1.16": ">=1.1.16 <2.0.0" } } } diff --git a/integrations/zapier-mem0/pnpm-lock.yaml b/integrations/zapier-mem0/pnpm-lock.yaml index a6bd643b1..796da544a 100644 --- a/integrations/zapier-mem0/pnpm-lock.yaml +++ b/integrations/zapier-mem0/pnpm-lock.yaml @@ -8,8 +8,9 @@ overrides: form-data@<4.0.6: '>=4.0.6' uuid@<11.1.1: '>=11.1.1' esbuild: '>=0.28.1' - undici@<6.27.0: '>=6.27.0 <8.0.0' - undici@>=8.0.0 <8.5.0: '>=8.5.0' + undici@<7.29.0: '>=7.29.0 <8.0.0' + undici@>=8.0.0 <8.9.0: '>=8.9.0 <9.0.0' + brace-expansion@<1.1.16: '>=1.1.16 <2.0.0' importers: @@ -413,8 +414,8 @@ packages: engines: {node: '>=6.0.0'} hasBin: true - brace-expansion@1.1.15: - resolution: {integrity: sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==} + brace-expansion@1.1.18: + resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==} braces@3.0.3: resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==} @@ -530,6 +531,7 @@ packages: crypto-js@4.2.0: resolution: {integrity: sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q==} + deprecated: Active development of CryptoJS has been discontinued. This library is no longer maintained. debug@4.4.3: resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==} @@ -1995,7 +1997,7 @@ snapshots: baseline-browser-mapping@2.10.41: {} - brace-expansion@1.1.15: + brace-expansion@1.1.18: dependencies: balanced-match: 1.0.2 concat-map: 0.0.1 @@ -2792,7 +2794,7 @@ snapshots: minimatch@3.1.5: dependencies: - brace-expansion: 1.1.15 + brace-expansion: 1.1.18 minimist@1.2.8: {} diff --git a/integrations/zapier-mem0/pnpm-workspace.yaml b/integrations/zapier-mem0/pnpm-workspace.yaml index b9f73a8e9..4147ae103 100644 --- a/integrations/zapier-mem0/pnpm-workspace.yaml +++ b/integrations/zapier-mem0/pnpm-workspace.yaml @@ -5,5 +5,6 @@ overrides: "form-data@<4.0.6": ">=4.0.6" "uuid@<11.1.1": ">=11.1.1" "esbuild": ">=0.28.1" - "undici@<6.27.0": ">=6.27.0 <8.0.0" - "undici@>=8.0.0 <8.5.0": ">=8.5.0" + "undici@<7.29.0": ">=7.29.0 <8.0.0" + "undici@>=8.0.0 <8.9.0": ">=8.9.0 <9.0.0" + "brace-expansion@<1.1.16": ">=1.1.16 <2.0.0" diff --git a/mem0-ts/package.json b/mem0-ts/package.json index 20cba8de7..6a0540f6e 100644 --- a/mem0-ts/package.json +++ b/mem0-ts/package.json @@ -292,18 +292,19 @@ "glob@>=10.2.0 <10.5.0": "^10.5.0", "@modelcontextprotocol/sdk": "^1.25.4", "esbuild": ">=0.28.1", - "undici@<6.27.0": ">=6.27.0 <8.0.0", + "undici@<7.29.0": ">=7.29.0 <8.0.0", "@aws-sdk/client-bedrock-runtime": "3.967.0", "@aws-sdk/client-neptune-graph": "3.966.0", "axios@<1.18.0": ">=1.18.0 <2.0.0", "brace-expansion@<1.1.16": ">=1.1.16 <2.0.0", - "brace-expansion@>=2.0.0 <2.1.2": ">=2.1.2 <3.0.0", + "brace-expansion@>=2.0.0 <2.1.4": ">=2.1.4 <3.0.0", "brace-expansion@>=3.0.0 <5.0.8": ">=5.0.8 <6.0.0", "fast-xml-parser@>=5.0.0 <5.10.1": ">=5.10.1 <6.0.0", "tar@>=7.0.0 <7.5.21": ">=7.5.21 <8.0.0", "thrift@<0.23.0": "^0.23.0", "mongoose@>=9.0.0 <9.7.2": ">=9.7.2 <10.0.0", - "protobufjs@<7.6.5": ">=7.6.5 <8.0.0" + "protobufjs@<7.6.5": ">=7.6.5 <8.0.0", + "ip-address@<10.3.1": ">=10.3.1 <11.0.0" } } } diff --git a/mem0-ts/pnpm-lock.yaml b/mem0-ts/pnpm-lock.yaml index bafe9be1a..d0ed3d2bb 100644 --- a/mem0-ts/pnpm-lock.yaml +++ b/mem0-ts/pnpm-lock.yaml @@ -25,18 +25,19 @@ overrides: glob@>=10.2.0 <10.5.0: ^10.5.0 '@modelcontextprotocol/sdk': ^1.25.4 esbuild: '>=0.28.1' - undici@<6.27.0: '>=6.27.0 <8.0.0' + undici@<7.29.0: '>=7.29.0 <8.0.0' '@aws-sdk/client-bedrock-runtime': 3.967.0 '@aws-sdk/client-neptune-graph': 3.966.0 axios@<1.18.0: '>=1.18.0 <2.0.0' brace-expansion@<1.1.16: '>=1.1.16 <2.0.0' - brace-expansion@>=2.0.0 <2.1.2: '>=2.1.2 <3.0.0' + brace-expansion@>=2.0.0 <2.1.4: '>=2.1.4 <3.0.0' brace-expansion@>=3.0.0 <5.0.8: '>=5.0.8 <6.0.0' fast-xml-parser@>=5.0.0 <5.10.1: '>=5.10.1 <6.0.0' tar@>=7.0.0 <7.5.21: '>=7.5.21 <8.0.0' thrift@<0.23.0: ^0.23.0 mongoose@>=9.0.0 <9.7.2: '>=9.7.2 <10.0.0' protobufjs@<7.6.5: '>=7.6.5 <8.0.0' + ip-address@<10.3.1: '>=10.3.1 <11.0.0' importers: @@ -2165,8 +2166,8 @@ packages: brace-expansion@1.1.16: resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==} - brace-expansion@2.1.2: - resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==} + brace-expansion@2.1.4: + resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==} brace-expansion@5.0.8: resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==} @@ -3027,8 +3028,8 @@ packages: resolution: {integrity: sha512-4rTJX6Q5wTYEvxboXi8DsEiUo+OvqJGtLYOSGm37KpdRXsG5XJjbVtYKGJpPSWP+QT7rWscA4vsrdmzbEbenpw==} engines: {node: '>=18.12.0'} - ip-address@10.2.0: - resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==} + ip-address@10.4.0: + resolution: {integrity: sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==} engines: {node: '>= 12'} is-arrayish@0.2.1: @@ -4626,8 +4627,8 @@ packages: undici-types@7.24.6: resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==} - undici@7.28.0: - resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==} + undici@7.29.0: + resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==} engines: {node: '>=20.18.1'} update-browserslist-db@1.2.3: @@ -6155,7 +6156,7 @@ snapshots: ms: 2.1.3 secure-json-parse: 4.1.0 tslib: 2.8.1 - undici: 7.28.0 + undici: 7.29.0 transitivePeerDependencies: - supports-color @@ -6711,7 +6712,7 @@ snapshots: dependencies: '@qdrant/openapi-typescript-fetch': 1.2.6 typescript: 5.5.4 - undici: 7.28.0 + undici: 7.29.0 '@qdrant/openapi-typescript-fetch@1.2.6': {} @@ -7183,7 +7184,7 @@ snapshots: '@turbopuffer/turbopuffer@2.5.0': dependencies: pako: 2.2.0 - undici: 7.28.0 + undici: 7.29.0 '@types/babel__core@7.20.5': dependencies: @@ -7542,7 +7543,7 @@ snapshots: balanced-match: 1.0.2 concat-map: 0.0.1 - brace-expansion@2.1.2: + brace-expansion@2.1.4: dependencies: balanced-match: 1.0.2 @@ -8448,7 +8449,7 @@ snapshots: transitivePeerDependencies: - supports-color - ip-address@10.2.0: {} + ip-address@10.4.0: {} is-arrayish@0.2.1: {} @@ -9076,7 +9077,7 @@ snapshots: minimatch@9.0.9: dependencies: - brace-expansion: 2.1.2 + brace-expansion: 2.1.4 minimist@1.2.8: {} @@ -9886,7 +9887,7 @@ snapshots: socks@2.8.9: dependencies: - ip-address: 10.2.0 + ip-address: 10.4.0 smart-buffer: 4.2.0 source-map-support@0.5.13: @@ -10232,7 +10233,7 @@ snapshots: undici-types@7.24.6: {} - undici@7.28.0: {} + undici@7.29.0: {} update-browserslist-db@1.2.3(browserslist@4.28.2): dependencies: diff --git a/mem0-ts/pnpm-workspace.yaml b/mem0-ts/pnpm-workspace.yaml index 3d8c11a47..ca0da76cc 100644 --- a/mem0-ts/pnpm-workspace.yaml +++ b/mem0-ts/pnpm-workspace.yaml @@ -25,13 +25,14 @@ overrides: "glob@>=10.2.0 <10.5.0": "^10.5.0" "@modelcontextprotocol/sdk": "^1.25.4" "esbuild": ">=0.28.1" - "undici@<6.27.0": ">=6.27.0 <8.0.0" + "undici@<7.29.0": ">=7.29.0 <8.0.0" "axios@<1.18.0": ">=1.18.0 <2.0.0" "brace-expansion@<1.1.16": ">=1.1.16 <2.0.0" - "brace-expansion@>=2.0.0 <2.1.2": ">=2.1.2 <3.0.0" + "brace-expansion@>=2.0.0 <2.1.4": ">=2.1.4 <3.0.0" "brace-expansion@>=3.0.0 <5.0.8": ">=5.0.8 <6.0.0" "fast-xml-parser@>=5.0.0 <5.10.1": ">=5.10.1 <6.0.0" "tar@>=7.0.0 <7.5.21": ">=7.5.21 <8.0.0" "thrift@<0.23.0": "^0.23.0" "mongoose@>=9.0.0 <9.7.2": ">=9.7.2 <10.0.0" "protobufjs@<7.6.5": ">=7.6.5 <8.0.0" + "ip-address@<10.3.1": ">=10.3.1 <11.0.0"