From 8b11e0787ad3d22efd4a85666d019eaf3e339116 Mon Sep 17 00:00:00 2001 From: Harsh Vardhan Gupta Date: Fri, 22 May 2026 01:18:41 +0530 Subject: [PATCH] fix(deps): address additional CVEs in langchain, starlette, mcp, cryptography, and lodash (#5219) --- mem0-ts/package.json | 2 +- mem0-ts/pnpm-lock.yaml | 27 ++++++--------------------- openmemory/api/requirements.txt | 3 ++- openmemory/ui/package.json | 2 +- openmemory/ui/pnpm-lock.yaml | 12 ++++++------ pyproject.toml | 4 ++-- server/dashboard/package.json | 2 +- server/dashboard/pnpm-lock.yaml | 2 +- server/requirements.txt | 1 + 9 files changed, 21 insertions(+), 34 deletions(-) diff --git a/mem0-ts/package.json b/mem0-ts/package.json index e6d17ba1b..e4cd60851 100644 --- a/mem0-ts/package.json +++ b/mem0-ts/package.json @@ -111,7 +111,7 @@ "@azure/search-documents": "^12.0.0", "@cloudflare/workers-types": "^4.20250504.0", "@google/genai": "^1.2.0", - "@langchain/core": "^1.0.0", + "@langchain/core": "^1.1.47", "@mistralai/mistralai": "^1.5.2", "@qdrant/js-client-rest": "1.13.0", "@supabase/supabase-js": "^2.49.1", diff --git a/mem0-ts/pnpm-lock.yaml b/mem0-ts/pnpm-lock.yaml index b029bf8d8..1ff198998 100644 --- a/mem0-ts/pnpm-lock.yaml +++ b/mem0-ts/pnpm-lock.yaml @@ -24,8 +24,8 @@ importers: specifier: ^1.2.0 version: 1.2.0(@modelcontextprotocol/sdk@1.12.1)(encoding@0.1.13) '@langchain/core': - specifier: ^1.0.0 - version: 1.1.32(openai@4.93.0(encoding@0.1.13)(ws@8.18.1)(zod@3.24.2))(ws@8.18.1) + specifier: ^1.1.47 + version: 1.1.47(openai@4.93.0(encoding@0.1.13)(ws@8.18.1)(zod@3.24.2))(ws@8.18.1) '@mistralai/mistralai': specifier: ^1.5.2 version: 1.5.2(zod@3.24.2) @@ -613,8 +613,8 @@ packages: '@jridgewell/trace-mapping@0.3.9': resolution: {integrity: sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==} - '@langchain/core@1.1.32': - resolution: {integrity: sha512-ZZNiER5tceFXqZOghfrxNHzM60gcQL5XK/8Ow5+o4OuKHrP1p/RUQBDM9Y1nddi/VmKQj+ncaXXM5KovXTEGGQ==} + '@langchain/core@1.1.47': + resolution: {integrity: sha512-+fiPu6ZFnJMrZyKeM77OIVPoMPAY6OKWacnPlojHtXTbMMzb2cEOKAJV0U07cDl86NHSCIYYa0i4CyKZzXbHQQ==} engines: {node: '>=20'} '@mistralai/mistralai@1.5.2': @@ -1296,10 +1296,6 @@ packages: supports-color: optional: true - decamelize@1.2.0: - resolution: {integrity: sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==} - engines: {node: '>=0.10.0'} - decompress-response@6.0.0: resolution: {integrity: sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==} engines: {node: '>=10'} @@ -3083,10 +3079,7 @@ packages: uuid@10.0.0: resolution: {integrity: sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==} - hasBin: true - - uuid@11.1.0: - resolution: {integrity: sha512-0/A9rDy9P7cJ+8w1c9WD9V//9Wj15Ce2MPz8Ri6032usz+NfePxx5AcN3bN+r6ZL6jEo066/yNYB3tn4pQEx+A==} + deprecated: uuid@10 and below is no longer supported. For ESM codebases, update to uuid@latest. For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028). hasBin: true uuid@13.0.0: @@ -3847,18 +3840,14 @@ snapshots: '@jridgewell/resolve-uri': 3.1.2 '@jridgewell/sourcemap-codec': 1.5.0 - '@langchain/core@1.1.32(openai@4.93.0(encoding@0.1.13)(ws@8.18.1)(zod@3.24.2))(ws@8.18.1)': + '@langchain/core@1.1.47(openai@4.93.0(encoding@0.1.13)(ws@8.18.1)(zod@3.24.2))(ws@8.18.1)': dependencies: '@cfworker/json-schema': 4.1.1 '@standard-schema/spec': 1.1.0 - ansi-styles: 5.2.0 - camelcase: 6.3.0 - decamelize: 1.2.0 js-tiktoken: 1.0.19 langsmith: 0.5.10(openai@4.93.0(encoding@0.1.13)(ws@8.18.1)(zod@3.24.2))(ws@8.18.1) mustache: 4.2.0 p-queue: 6.6.2 - uuid: 11.1.0 zod: 3.25.76 transitivePeerDependencies: - '@opentelemetry/api' @@ -4567,8 +4556,6 @@ snapshots: optionalDependencies: supports-color: 5.5.0 - decamelize@1.2.0: {} - decompress-response@6.0.0: dependencies: mimic-response: 3.1.0 @@ -6552,8 +6539,6 @@ snapshots: uuid@10.0.0: {} - uuid@11.1.0: {} - uuid@13.0.0: {} uuid@8.3.2: {} diff --git a/openmemory/api/requirements.txt b/openmemory/api/requirements.txt index ad60aed2e..187495724 100644 --- a/openmemory/api/requirements.txt +++ b/openmemory/api/requirements.txt @@ -9,7 +9,8 @@ urllib3>=2.7.0 fastapi-pagination>=0.12.0 mem0ai>=0.1.92 openai>=1.40.0 -mcp[cli]>=1.3.0 +mcp[cli]>=1.25.4 +starlette>=0.40.0 pytest>=7.0.0 pytest-asyncio>=0.21.0 httpx>=0.24.0 diff --git a/openmemory/ui/package.json b/openmemory/ui/package.json index 7a2a57e6a..96a850099 100644 --- a/openmemory/ui/package.json +++ b/openmemory/ui/package.json @@ -46,7 +46,7 @@ "date-fns": "4.1.0", "embla-carousel-react": "8.5.1", "input-otp": "1.4.1", - "lodash": "^4.17.21", + "lodash": "^4.18.1", "lucide-react": "^0.454.0", "next": "15.5.18", "next-themes": "^0.4.4", diff --git a/openmemory/ui/pnpm-lock.yaml b/openmemory/ui/pnpm-lock.yaml index 08cc86a49..63043f3a0 100644 --- a/openmemory/ui/pnpm-lock.yaml +++ b/openmemory/ui/pnpm-lock.yaml @@ -120,8 +120,8 @@ importers: specifier: 1.4.1 version: 1.4.1(react-dom@19.0.0(react@19.0.0))(react@19.0.0) lodash: - specifier: ^4.17.21 - version: 4.17.21 + specifier: ^4.18.1 + version: 4.18.1 lucide-react: specifier: ^0.454.0 version: 0.454.0(react@19.0.0) @@ -1679,8 +1679,8 @@ packages: lines-and-columns@1.2.4: resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==} - lodash@4.17.21: - resolution: {integrity: sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==} + lodash@4.18.1: + resolution: {integrity: sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==} loose-envify@1.4.0: resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==} @@ -3607,7 +3607,7 @@ snapshots: lines-and-columns@1.2.4: {} - lodash@4.17.21: {} + lodash@4.18.1: {} loose-envify@1.4.0: dependencies: @@ -3871,7 +3871,7 @@ snapshots: dependencies: clsx: 2.1.1 eventemitter3: 4.0.7 - lodash: 4.17.21 + lodash: 4.18.1 react: 19.0.0 react-dom: 19.0.0(react@19.0.0) react-is: 18.3.1 diff --git a/pyproject.toml b/pyproject.toml index 81fa78b2c..a2517b5ad 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -64,8 +64,8 @@ llms = [ ] extras = [ "boto3>=1.34.0", - "langchain>=0.3.0,<1.0.0", - "langchain-community>=0.3.0,<1.0.0", + "langchain>=0.3.30,<1.0.0", + "langchain-community>=0.3.27,<1.0.0", "langchain-core>=0.3.85,<1.0.0", "sentence-transformers>=5.0.0", "elasticsearch>=8.0.0,<9.0.0", diff --git a/server/dashboard/package.json b/server/dashboard/package.json index 5168933ff..1d9b63660 100644 --- a/server/dashboard/package.json +++ b/server/dashboard/package.json @@ -42,7 +42,7 @@ "cmdk": "^1.0.0", "date-fns": "^4.1.0", "framer-motion": "^12.23.12", - "lodash": "^4.17.21", + "lodash": "^4.18.1", "lucide-react": "^0.542.0", "next": "15.5.18", "next-themes": "^0.4.4", diff --git a/server/dashboard/pnpm-lock.yaml b/server/dashboard/pnpm-lock.yaml index 470c4bbca..db8bcdae2 100644 --- a/server/dashboard/pnpm-lock.yaml +++ b/server/dashboard/pnpm-lock.yaml @@ -102,7 +102,7 @@ importers: specifier: ^12.23.12 version: 12.38.0(react-dom@19.2.5(react@19.2.5))(react@19.2.5) lodash: - specifier: ^4.17.21 + specifier: ^4.18.1 version: 4.18.1 lucide-react: specifier: ^0.542.0 diff --git a/server/requirements.txt b/server/requirements.txt index 0eca7347a..3f6d0c8af 100644 --- a/server/requirements.txt +++ b/server/requirements.txt @@ -17,6 +17,7 @@ alembic>=1.13,<2.0 passlib[bcrypt]>=1.7,<2.0 bcrypt==4.0.1 python-jose[cryptography]>=3.3,<4.0 +cryptography>46.0.4 # Anonymous telemetry — on by default, opt out with MEM0_TELEMETRY=false posthog>=3.0,<8.0