From 8b11e0787ad3d22efd4a85666d019eaf3e339116 Mon Sep 17 00:00:00 2001 From: Harsh Vardhan Gupta Date: Fri, 22 May 2026 01:18:41 +0530 Subject: [PATCH 1/2] fix(deps): address additional CVEs in langchain, starlette, mcp, cryptography, and lodash (#5219) --- mem0-ts/package.json | 2 +- mem0-ts/pnpm-lock.yaml | 27 ++++++--------------------- openmemory/api/requirements.txt | 3 ++- openmemory/ui/package.json | 2 +- openmemory/ui/pnpm-lock.yaml | 12 ++++++------ pyproject.toml | 4 ++-- server/dashboard/package.json | 2 +- server/dashboard/pnpm-lock.yaml | 2 +- server/requirements.txt | 1 + 9 files changed, 21 insertions(+), 34 deletions(-) diff --git a/mem0-ts/package.json b/mem0-ts/package.json index e6d17ba1b..e4cd60851 100644 --- a/mem0-ts/package.json +++ b/mem0-ts/package.json @@ -111,7 +111,7 @@ "@azure/search-documents": "^12.0.0", "@cloudflare/workers-types": "^4.20250504.0", "@google/genai": "^1.2.0", - "@langchain/core": "^1.0.0", + "@langchain/core": "^1.1.47", "@mistralai/mistralai": "^1.5.2", "@qdrant/js-client-rest": "1.13.0", "@supabase/supabase-js": "^2.49.1", diff --git a/mem0-ts/pnpm-lock.yaml b/mem0-ts/pnpm-lock.yaml index b029bf8d8..1ff198998 100644 --- a/mem0-ts/pnpm-lock.yaml +++ b/mem0-ts/pnpm-lock.yaml @@ -24,8 +24,8 @@ importers: specifier: ^1.2.0 version: 1.2.0(@modelcontextprotocol/sdk@1.12.1)(encoding@0.1.13) '@langchain/core': - specifier: ^1.0.0 - version: 1.1.32(openai@4.93.0(encoding@0.1.13)(ws@8.18.1)(zod@3.24.2))(ws@8.18.1) + specifier: ^1.1.47 + version: 1.1.47(openai@4.93.0(encoding@0.1.13)(ws@8.18.1)(zod@3.24.2))(ws@8.18.1) '@mistralai/mistralai': specifier: ^1.5.2 version: 1.5.2(zod@3.24.2) @@ -613,8 +613,8 @@ packages: '@jridgewell/trace-mapping@0.3.9': resolution: {integrity: sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==} - '@langchain/core@1.1.32': - resolution: {integrity: sha512-ZZNiER5tceFXqZOghfrxNHzM60gcQL5XK/8Ow5+o4OuKHrP1p/RUQBDM9Y1nddi/VmKQj+ncaXXM5KovXTEGGQ==} + '@langchain/core@1.1.47': + resolution: {integrity: sha512-+fiPu6ZFnJMrZyKeM77OIVPoMPAY6OKWacnPlojHtXTbMMzb2cEOKAJV0U07cDl86NHSCIYYa0i4CyKZzXbHQQ==} engines: {node: '>=20'} '@mistralai/mistralai@1.5.2': @@ -1296,10 +1296,6 @@ packages: supports-color: optional: true - decamelize@1.2.0: - resolution: {integrity: sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==} - engines: {node: '>=0.10.0'} - decompress-response@6.0.0: resolution: {integrity: sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==} engines: {node: '>=10'} @@ -3083,10 +3079,7 @@ packages: uuid@10.0.0: resolution: {integrity: sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==} - hasBin: true - - uuid@11.1.0: - resolution: {integrity: sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==} + deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). hasBin: true uuid@13.0.0: @@ -3847,18 +3840,14 @@ snapshots: '@jridgewell/resolve-uri': 3.1.2 '@jridgewell/sourcemap-codec': 1.5.0 - '@langchain/core@1.1.32(openai@4.93.0(encoding@0.1.13)(ws@8.18.1)(zod@3.24.2))(ws@8.18.1)': + '@langchain/core@1.1.47(openai@4.93.0(encoding@0.1.13)(ws@8.18.1)(zod@3.24.2))(ws@8.18.1)': dependencies: '@cfworker/json-schema': 4.1.1 '@standard-schema/spec': 1.1.0 - ansi-styles: 5.2.0 - camelcase: 6.3.0 - decamelize: 1.2.0 js-tiktoken: 1.0.19 langsmith: 0.5.10(openai@4.93.0(encoding@0.1.13)(ws@8.18.1)(zod@3.24.2))(ws@8.18.1) mustache: 4.2.0 p-queue: 6.6.2 - uuid: 11.1.0 zod: 3.25.76 transitivePeerDependencies: - '@opentelemetry/api' @@ -4567,8 +4556,6 @@ snapshots: optionalDependencies: supports-color: 5.5.0 - decamelize@1.2.0: {} - decompress-response@6.0.0: dependencies: mimic-response: 3.1.0 @@ -6552,8 +6539,6 @@ snapshots: uuid@10.0.0: {} - uuid@11.1.0: {} - uuid@13.0.0: {} uuid@8.3.2: {} diff --git a/openmemory/api/requirements.txt b/openmemory/api/requirements.txt index ad60aed2e..187495724 100644 --- a/openmemory/api/requirements.txt +++ b/openmemory/api/requirements.txt @@ -9,7 +9,8 @@ urllib3>=2.7.0 fastapi-pagination>=0.12.0 mem0ai>=0.1.92 openai>=1.40.0 -mcp[cli]>=1.3.0 +mcp[cli]>=1.25.4 +starlette>=0.40.0 pytest>=7.0.0 pytest-asyncio>=0.21.0 httpx>=0.24.0 diff --git a/openmemory/ui/package.json b/openmemory/ui/package.json index 7a2a57e6a..96a850099 100644 --- a/openmemory/ui/package.json +++ b/openmemory/ui/package.json @@ -46,7 +46,7 @@ "date-fns": "4.1.0", "embla-carousel-react": "8.5.1", "input-otp": "1.4.1", - "lodash": "^4.17.21", + "lodash": "^4.18.1", "lucide-react": "^0.454.0", "next": "15.5.18", "next-themes": "^0.4.4", diff --git a/openmemory/ui/pnpm-lock.yaml b/openmemory/ui/pnpm-lock.yaml index 08cc86a49..63043f3a0 100644 --- a/openmemory/ui/pnpm-lock.yaml +++ b/openmemory/ui/pnpm-lock.yaml @@ -120,8 +120,8 @@ importers: specifier: 1.4.1 version: 1.4.1(react-dom@19.0.0(react@19.0.0))(react@19.0.0) lodash: - specifier: ^4.17.21 - version: 4.17.21 + specifier: ^4.18.1 + version: 4.18.1 lucide-react: specifier: ^0.454.0 version: 0.454.0(react@19.0.0) @@ -1679,8 +1679,8 @@ packages: lines-and-columns@1.2.4: resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==} - lodash@4.17.21: - resolution: {integrity: sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==} + lodash@4.18.1: + resolution: {integrity: sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==} loose-envify@1.4.0: resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==} @@ -3607,7 +3607,7 @@ snapshots: lines-and-columns@1.2.4: {} - lodash@4.17.21: {} + lodash@4.18.1: {} loose-envify@1.4.0: dependencies: @@ -3871,7 +3871,7 @@ snapshots: dependencies: clsx: 2.1.1 eventemitter3: 4.0.7 - lodash: 4.17.21 + lodash: 4.18.1 react: 19.0.0 react-dom: 19.0.0(react@19.0.0) react-is: 18.3.1 diff --git a/pyproject.toml b/pyproject.toml index 81fa78b2c..a2517b5ad 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -64,8 +64,8 @@ llms = [ ] extras = [ "boto3>=1.34.0", - "langchain>=0.3.0,<1.0.0", - "langchain-community>=0.3.0,<1.0.0", + "langchain>=0.3.30,<1.0.0", + "langchain-community>=0.3.27,<1.0.0", "langchain-core>=0.3.85,<1.0.0", "sentence-transformers>=5.0.0", "elasticsearch>=8.0.0,<9.0.0", diff --git a/server/dashboard/package.json b/server/dashboard/package.json index 5168933ff..1d9b63660 100644 --- a/server/dashboard/package.json +++ b/server/dashboard/package.json @@ -42,7 +42,7 @@ "cmdk": "^1.0.0", "date-fns": "^4.1.0", "framer-motion": "^12.23.12", - "lodash": "^4.17.21", + "lodash": "^4.18.1", "lucide-react": "^0.542.0", "next": "15.5.18", "next-themes": "^0.4.4", diff --git a/server/dashboard/pnpm-lock.yaml b/server/dashboard/pnpm-lock.yaml index 470c4bbca..db8bcdae2 100644 --- a/server/dashboard/pnpm-lock.yaml +++ b/server/dashboard/pnpm-lock.yaml @@ -102,7 +102,7 @@ importers: specifier: ^12.23.12 version: 12.38.0(react-dom@19.2.5(react@19.2.5))(react@19.2.5) lodash: - specifier: ^4.17.21 + specifier: ^4.18.1 version: 4.18.1 lucide-react: specifier: ^0.542.0 diff --git a/server/requirements.txt b/server/requirements.txt index 0eca7347a..3f6d0c8af 100644 --- a/server/requirements.txt +++ b/server/requirements.txt @@ -17,6 +17,7 @@ alembic>=1.13,<2.0 passlib[bcrypt]>=1.7,<2.0 bcrypt==4.0.1 python-jose[cryptography]>=3.3,<4.0 +cryptography>46.0.4 # Anonymous telemetry — on by default, opt out with MEM0_TELEMETRY=false posthog>=3.0,<8.0 From 58696e4bd407f863bc168bcd505c23a87bcd8cfc Mon Sep 17 00:00:00 2001 From: Kartik Date: Fri, 22 May 2026 12:41:55 +0530 Subject: [PATCH 2/2] fix(ci): remove deprecated embedchain CI and fix required check reporting (#5210) Co-authored-by: Saket Aryan --- .github/workflows/ci.yml | 76 ++++++++-------------------------------- 1 file changed, 15 insertions(+), 61 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 94686f614..a470bfca9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,21 +3,7 @@ name: ci on: push: branches: [main] - paths: - - 'mem0/**' - - 'tests/**' - - 'embedchain/**' - - '.github/workflows/**' - - 'pyproject.toml' pull_request: - paths: - - 'mem0/**' - - 'tests/**' - - 'embedchain/**' - - 'pyproject.toml' - - 'cli/**' - - 'docs/**' - - '.github/workflows/**' jobs: changelog_check: @@ -63,9 +49,8 @@ jobs: runs-on: ubuntu-latest outputs: mem0_changed: ${{ steps.filter.outputs.mem0 }} - embedchain_changed: ${{ steps.filter.outputs.embedchain }} steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v4 - uses: dorny/paths-filter@v2 id: filter with: @@ -73,25 +58,28 @@ jobs: mem0: - 'mem0/**' - 'tests/**' - - '.github/workflows/**' + - '.github/workflows/ci.yml' - 'pyproject.toml' - embedchain: - - 'embedchain/**' build_mem0: needs: check_changes - if: needs.check_changes.outputs.mem0_changed == 'true' runs-on: ubuntu-latest strategy: matrix: python-version: ["3.10", "3.11", "3.12"] steps: - - uses: actions/checkout@v3 + - name: Skip — no relevant changes + if: needs.check_changes.outputs.mem0_changed != 'true' + run: echo "No changes in mem0/, tests/, pyproject.toml, or ci.yml — skipping" + - uses: actions/checkout@v4 + if: needs.check_changes.outputs.mem0_changed == 'true' - name: Set up Python ${{ matrix.python-version }} + if: needs.check_changes.outputs.mem0_changed == 'true' uses: actions/setup-python@v4 with: python-version: ${{ matrix.python-version }} - name: Clean up disk space + if: needs.check_changes.outputs.mem0_changed == 'true' run: | df -h sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL @@ -99,61 +87,27 @@ jobs: sudo docker builder prune -a df -h - name: Install Hatch + if: needs.check_changes.outputs.mem0_changed == 'true' run: pip install hatch - name: Load cached venv + if: needs.check_changes.outputs.mem0_changed == 'true' id: cached-hatch-dependencies uses: actions/cache@v3 with: path: .venv key: venv-mem0-${{ runner.os }}-${{ hashFiles('**/pyproject.toml') }} - name: Install GEOS Libraries + if: needs.check_changes.outputs.mem0_changed == 'true' run: sudo apt-get update && sudo apt-get install -y libgeos-dev - name: Install dependencies + if: needs.check_changes.outputs.mem0_changed == 'true' && steps.cached-hatch-dependencies.outputs.cache-hit != 'true' run: | pip install --upgrade pip pip install -e ".[test,graph,vector_stores,llms,extras]" pip install ruff - if: steps.cached-hatch-dependencies.outputs.cache-hit != 'true' - name: Run Linting + if: needs.check_changes.outputs.mem0_changed == 'true' run: make lint - name: Run tests and generate coverage report + if: needs.check_changes.outputs.mem0_changed == 'true' run: make test - - build_embedchain: - needs: check_changes - if: needs.check_changes.outputs.embedchain_changed == 'true' - runs-on: ubuntu-latest - strategy: - matrix: - python-version: ["3.9", "3.10", "3.11", "3.12"] - steps: - - uses: actions/checkout@v3 - - name: Set up Python ${{ matrix.python-version }} - uses: actions/setup-python@v4 - with: - python-version: ${{ matrix.python-version }} - - name: Install Hatch - run: pip install hatch - - name: Load cached venv - id: cached-hatch-dependencies - uses: actions/cache@v3 - with: - path: .venv - key: venv-embedchain-${{ runner.os }}-${{ hashFiles('**/pyproject.toml') }} - - name: Install dependencies - run: cd embedchain && make install_all - if: steps.cached-hatch-dependencies.outputs.cache-hit != 'true' - - name: Run Formatting - run: | - mkdir -p embedchain/.ruff_cache && chmod -R 777 embedchain/.ruff_cache - cd embedchain && hatch run format - - name: Lint with ruff - run: cd embedchain && make lint - - name: Run tests and generate coverage report - run: cd embedchain && make coverage - - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@v3 - with: - file: coverage.xml - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}