From 553eb12d2ee1163e99ff0243195011e9338e9978 Mon Sep 17 00:00:00 2001 From: harshgupta-mem0 Date: Sun, 31 May 2026 01:07:25 +0530 Subject: [PATCH] fix(deps): bump axios to ^1.16.0 to remediate high-severity CVEs Addresses Dependabot alerts #986-992: prototype pollution in axios <1.16.0 enabling credential theft, MITM, and DoS. Updates mem0-ts, openmemory/ui, and server/dashboard. Co-Authored-By: Claude Sonnet 4.6 --- mem0-ts/package.json | 2 +- mem0-ts/pnpm-lock.yaml | 8 ++++++-- openmemory/ui/package.json | 2 +- openmemory/ui/pnpm-lock.yaml | 3 ++- server/dashboard/package.json | 2 +- server/dashboard/pnpm-lock.yaml | 3 ++- 6 files changed, 13 insertions(+), 7 deletions(-) diff --git a/mem0-ts/package.json b/mem0-ts/package.json index 13eec656e..4a19b4f7c 100644 --- a/mem0-ts/package.json +++ b/mem0-ts/package.json @@ -100,7 +100,7 @@ "typescript": "5.5.4" }, "dependencies": { - "axios": "^1.15.2", + "axios": "^1.16.0", "openai": "^4.93.0", "uuid": "9.0.1", "zod": "^3.24.1" diff --git a/mem0-ts/pnpm-lock.yaml b/mem0-ts/pnpm-lock.yaml index f34f6c5a6..c812ef531 100644 --- a/mem0-ts/pnpm-lock.yaml +++ b/mem0-ts/pnpm-lock.yaml @@ -55,7 +55,7 @@ importers: specifier: 8.11.0 version: 8.11.0 axios: - specifier: ^1.15.2 + specifier: ^1.16.0 version: 1.16.1 better-sqlite3: specifier: ^12.6.2 @@ -1620,7 +1620,7 @@ packages: glob@7.2.3: resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==} - deprecated: Glob versions prior to v9 are no longer supported + deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me globals@11.12.0: resolution: {integrity: sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==} @@ -2220,6 +2220,7 @@ packages: node-domexception@1.0.0: resolution: {integrity: sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==} engines: {node: '>=10.5.0'} + deprecated: Use your platform's native DOMException instead node-fetch@2.7.0: resolution: {integrity: sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==} @@ -2682,6 +2683,7 @@ packages: source-map@0.8.0-beta.0: resolution: {integrity: sha512-2ymg6oRBpebeZi9UUNsgQ89bhx01TcTkmNTGnNO88imTmbSgy4nfujrgVEFKWpMTEGA11EDkTt7mqObTPdigIA==} engines: {node: '>= 8'} + deprecated: The work that was done in this beta branch won't be included in future versions sparse-bitfield@3.0.3: resolution: {integrity: sha512-kvzhi7vqKTfkh0PZU+2D2PIllw2ymqJKujUcyPMd9Y75Nv4nPbGJZXNhxsgdQab2BmlDct1YnfQCguEvHr7VsQ==} @@ -2948,10 +2950,12 @@ packages: uuid@8.3.2: resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==} + deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). hasBin: true uuid@9.0.1: resolution: {integrity: sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==} + deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). hasBin: true v8-compile-cache-lib@3.0.1: diff --git a/openmemory/ui/package.json b/openmemory/ui/package.json index 53cb79e2d..fded949c6 100644 --- a/openmemory/ui/package.json +++ b/openmemory/ui/package.json @@ -39,7 +39,7 @@ "@radix-ui/react-tooltip": "^1.1.6", "@reduxjs/toolkit": "^2.7.0", "autoprefixer": "^10.4.20", - "axios": "^1.15.2", + "axios": "^1.16.0", "class-variance-authority": "^0.7.1", "clsx": "^2.1.1", "cmdk": "1.0.4", diff --git a/openmemory/ui/pnpm-lock.yaml b/openmemory/ui/pnpm-lock.yaml index ce035bbca..25ebcb8ba 100644 --- a/openmemory/ui/pnpm-lock.yaml +++ b/openmemory/ui/pnpm-lock.yaml @@ -105,7 +105,7 @@ importers: specifier: ^10.4.20 version: 10.4.20(postcss@8.0.0) axios: - specifier: ^1.15.2 + specifier: ^1.16.0 version: 1.16.1 class-variance-authority: specifier: ^0.7.1 @@ -1986,6 +1986,7 @@ packages: recharts@2.15.0: resolution: {integrity: sha512-cIvMxDfpAmqAmVgc4yb7pgm/O1tmmkl/CjrvXuW+62/+7jj/iF9Ykm+hb/UJt42TREHMyd3gb+pkgoa2MxgDIw==} engines: {node: '>=14'} + deprecated: 1.x and 2.x branches are no longer active. Bump to Recharts v3 to receive latest features and bugfixes. See https://github.com/recharts/recharts/wiki/3.0-migration-guide peerDependencies: react: ^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 react-dom: ^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 diff --git a/server/dashboard/package.json b/server/dashboard/package.json index 1d9b63660..9d85ce160 100644 --- a/server/dashboard/package.json +++ b/server/dashboard/package.json @@ -36,7 +36,7 @@ "@radix-ui/react-tooltip": "^1.0.7", "@reduxjs/toolkit": "^2.3.0", "@tanstack/react-table": "^8.17.3", - "axios": "^1.15.2", + "axios": "^1.16.0", "class-variance-authority": "^0.7.1", "clsx": "^2.1.0", "cmdk": "^1.0.0", diff --git a/server/dashboard/pnpm-lock.yaml b/server/dashboard/pnpm-lock.yaml index db8bcdae2..a77323829 100644 --- a/server/dashboard/pnpm-lock.yaml +++ b/server/dashboard/pnpm-lock.yaml @@ -84,7 +84,7 @@ importers: specifier: ^8.17.3 version: 8.21.3(react-dom@19.2.5(react@19.2.5))(react@19.2.5) axios: - specifier: ^1.15.2 + specifier: ^1.16.0 version: 1.16.1 class-variance-authority: specifier: ^0.7.1 @@ -2725,6 +2725,7 @@ packages: recharts@2.15.4: resolution: {integrity: sha512-UT/q6fwS3c1dHbXv2uFgYJ9BMFHu3fwnd7AYZaEQhXuYQ4hgsxLvsUXzGdKeZrW5xopzDCvuA2N41WJ88I7zIw==} engines: {node: '>=14'} + deprecated: 1.x and 2.x branches are no longer active. Bump to Recharts v3 to receive latest features and bugfixes. See https://github.com/recharts/recharts/wiki/3.0-migration-guide peerDependencies: react: ^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 react-dom: ^16.0.0 || ^17.0.0 || ^18.0.0 || ^19.0.0