chore(n8n): add pnpm security overrides and refresh the lockfile

The n8n node was the only integration without a `pnpm.overrides` block,
so its tree carried 9 advisories (7 high, 2 moderate) that
pi-agent-plugin, openclaw, and vercel-ai-sdk already pin out. Adds the
same block, scoped to the packages actually present in this tree
(`esbuild` and `undici` are not, so their sibling entries are omitted
rather than carried over as dead config).

Down to 2 from 9. Both remaining are GHSA-mh99-v99m-4gvg on the 1.x and
2.x brace-expansion lines, whose fix shipped only in 5.0.8 with no
backport. Forcing those lines to 5.x does clear the audit but breaks
`gulp build`: rimraf -> glob -> minimatch@9 imports brace-expansion as a
default export, which the 5.x ESM build does not provide.

Replacement ranges are capped per major rather than left open like the
siblings'. An unbounded `uuid >=11.1.1` resolves to 14.x, which is
pure ESM and cannot be required by n8n-workflow under Jest's CJS
runtime.

All dev-only: the published package still declares zero runtime
dependencies, so none of this reaches an installed node. lint, build,
and the 5 tests pass; `pnpm install --frozen-lockfile` is clean.
This commit is contained in:
kartik-mem0
2026-07-29 18:20:12 +05:30
parent a618939f00
commit 7495ab67ad
2 changed files with 44 additions and 27 deletions
+10
View File
@@ -65,5 +65,15 @@
},
"peerDependencies": {
"n8n-workflow": "*"
},
"pnpm": {
"overrides": {
"form-data@<4.0.6": ">=4.0.6",
"uuid@<11.1.1": ">=11.1.1 <12.0.0",
"lodash@<=4.17.23": ">=4.18.0",
"brace-expansion@<1.1.16": ">=1.1.16 <2.0.0",
"brace-expansion@>=2.0.0 <2.1.2": ">=2.1.2 <3.0.0",
"brace-expansion@>=5.0.0 <5.0.8": ">=5.0.8"
}
}
}