From 96b31c4bc07ee6dc550e7564ac79c09aedbc394b Mon Sep 17 00:00:00 2001 From: Harsh Vardhan Gupta Date: Thu, 18 Jun 2026 13:44:05 +0530 Subject: [PATCH] fix(form-data): upgrade to >=4.0.6 across pnpm workspaces (CVE-2026-12143) (#5618) Co-authored-by: Claude Opus 4.8 (1M context) --- integrations/openclaw/package.json | 1 + integrations/openclaw/pnpm-lock.yaml | 11 ++++++----- integrations/openclaw/pnpm-workspace.yaml | 1 + integrations/pi-agent-plugin/package.json | 1 + integrations/pi-agent-plugin/pnpm-lock.yaml | 11 ++++++----- integrations/pi-agent-plugin/pnpm-workspace.yaml | 1 + mem0-ts/package.json | 1 + mem0-ts/pnpm-lock.yaml | 11 ++++++----- mem0-ts/pnpm-workspace.yaml | 1 + openmemory/ui/package.json | 1 + openmemory/ui/pnpm-lock.yaml | 9 +++++---- openmemory/ui/pnpm-workspace.yaml | 1 + server/dashboard/pnpm-lock.yaml | 9 +++++---- server/dashboard/pnpm-workspace.yaml | 1 + 14 files changed, 37 insertions(+), 23 deletions(-) diff --git a/integrations/openclaw/package.json b/integrations/openclaw/package.json index 9eb571708..10b619896 100644 --- a/integrations/openclaw/package.json +++ b/integrations/openclaw/package.json @@ -64,6 +64,7 @@ }, "pnpm": { "overrides": { + "form-data@<4.0.6": ">=4.0.6", "protobufjs@<7.5.5": "^7.5.5", "vite": "^8.0.5", "langsmith@<0.6.0": "^0.6.0", diff --git a/integrations/openclaw/pnpm-lock.yaml b/integrations/openclaw/pnpm-lock.yaml index 79f7aef47..50ba8208d 100644 --- a/integrations/openclaw/pnpm-lock.yaml +++ b/integrations/openclaw/pnpm-lock.yaml @@ -5,6 +5,7 @@ settings: excludeLinksFromLockfile: false overrides: + form-data@<4.0.6: '>=4.0.6' protobufjs@<7.5.5: ^7.5.5 vite: ^8.0.5 langsmith@<0.6.0: ^0.6.0 @@ -1109,8 +1110,8 @@ packages: form-data-encoder@1.7.2: resolution: {integrity: sha512-qfqtYan3rxrnCk1VYaA4H+Ms9xdpPqvLZa6xmMgFvhO32x7/3J/ExcTd6qpxM0vH2GdMI+poehyBZvqfMTto8A==} - form-data@4.0.5: - resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==} + form-data@4.0.6: + resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==} engines: {node: '>= 6'} formdata-node@4.4.1: @@ -2728,7 +2729,7 @@ snapshots: '@types/node-fetch@2.6.13': dependencies: '@types/node': 22.19.20 - form-data: 4.0.5 + form-data: 4.0.6 '@types/node@18.19.130': dependencies: @@ -2870,7 +2871,7 @@ snapshots: axios@1.17.0: dependencies: follow-redirects: 1.16.0 - form-data: 4.0.5 + form-data: 4.0.6 https-proxy-agent: 5.0.1 proxy-from-env: 2.1.0 transitivePeerDependencies: @@ -3131,7 +3132,7 @@ snapshots: form-data-encoder@1.7.2: {} - form-data@4.0.5: + form-data@4.0.6: dependencies: asynckit: 0.4.0 combined-stream: 1.0.8 diff --git a/integrations/openclaw/pnpm-workspace.yaml b/integrations/openclaw/pnpm-workspace.yaml index e2c1cd40a..36d887e42 100644 --- a/integrations/openclaw/pnpm-workspace.yaml +++ b/integrations/openclaw/pnpm-workspace.yaml @@ -13,6 +13,7 @@ onlyBuiltDependencies: - protobufjs overrides: + "form-data@<4.0.6": ">=4.0.6" "protobufjs@<7.5.5": "^7.5.5" "vite": "^8.0.5" "langsmith@<0.6.0": "^0.6.0" diff --git a/integrations/pi-agent-plugin/package.json b/integrations/pi-agent-plugin/package.json index 37721cb09..9748245f3 100644 --- a/integrations/pi-agent-plugin/package.json +++ b/integrations/pi-agent-plugin/package.json @@ -71,6 +71,7 @@ }, "pnpm": { "overrides": { + "form-data@<4.0.6": ">=4.0.6", "uuid@<11.1.1": ">=11.1.1", "esbuild": ">=0.28.1" } diff --git a/integrations/pi-agent-plugin/pnpm-lock.yaml b/integrations/pi-agent-plugin/pnpm-lock.yaml index f9cefbb81..13d550563 100644 --- a/integrations/pi-agent-plugin/pnpm-lock.yaml +++ b/integrations/pi-agent-plugin/pnpm-lock.yaml @@ -5,6 +5,7 @@ settings: excludeLinksFromLockfile: false overrides: + form-data@<4.0.6: '>=4.0.6' uuid@<11.1.1: '>=11.1.1' esbuild: '>=0.28.1' @@ -1368,8 +1369,8 @@ packages: form-data-encoder@1.7.2: resolution: {integrity: sha512-qfqtYan3rxrnCk1VYaA4H+Ms9xdpPqvLZa6xmMgFvhO32x7/3J/ExcTd6qpxM0vH2GdMI+poehyBZvqfMTto8A==} - form-data@4.0.5: - resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==} + form-data@4.0.6: + resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==} engines: {node: '>= 6'} formdata-node@4.4.1: @@ -3474,7 +3475,7 @@ snapshots: '@types/node-fetch@2.6.13': dependencies: '@types/node': 25.9.2 - form-data: 4.0.5 + form-data: 4.0.6 '@types/node@18.19.130': dependencies: @@ -3598,7 +3599,7 @@ snapshots: axios@1.17.0: dependencies: follow-redirects: 1.16.0 - form-data: 4.0.5 + form-data: 4.0.6 https-proxy-agent: 5.0.1 proxy-from-env: 2.1.0 transitivePeerDependencies: @@ -3891,7 +3892,7 @@ snapshots: form-data-encoder@1.7.2: {} - form-data@4.0.5: + form-data@4.0.6: dependencies: asynckit: 0.4.0 combined-stream: 1.0.8 diff --git a/integrations/pi-agent-plugin/pnpm-workspace.yaml b/integrations/pi-agent-plugin/pnpm-workspace.yaml index 8cabb650c..8ade9e801 100644 --- a/integrations/pi-agent-plugin/pnpm-workspace.yaml +++ b/integrations/pi-agent-plugin/pnpm-workspace.yaml @@ -2,5 +2,6 @@ packages: - '.' overrides: + "form-data@<4.0.6": ">=4.0.6" "uuid@<11.1.1": ">=11.1.1" "esbuild": ">=0.28.1" diff --git a/mem0-ts/package.json b/mem0-ts/package.json index dbf6987a3..152cf7d92 100644 --- a/mem0-ts/package.json +++ b/mem0-ts/package.json @@ -139,6 +139,7 @@ "better-sqlite3" ], "overrides": { + "form-data@<4.0.6": ">=4.0.6", "picomatch@<2.3.2": "^2.3.2", "picomatch@>=4.0.0 <4.0.4": "^4.0.4", "jws@4.0.0": "4.0.1", diff --git a/mem0-ts/pnpm-lock.yaml b/mem0-ts/pnpm-lock.yaml index 3b9869a71..de81a63bd 100644 --- a/mem0-ts/pnpm-lock.yaml +++ b/mem0-ts/pnpm-lock.yaml @@ -5,6 +5,7 @@ settings: excludeLinksFromLockfile: false overrides: + form-data@<4.0.6: '>=4.0.6' picomatch@<2.3.2: ^2.3.2 picomatch@>=4.0.0 <4.0.4: ^4.0.4 jws@4.0.0: 4.0.1 @@ -1554,8 +1555,8 @@ packages: form-data-encoder@1.7.2: resolution: {integrity: sha512-qfqtYan3rxrnCk1VYaA4H+Ms9xdpPqvLZa6xmMgFvhO32x7/3J/ExcTd6qpxM0vH2GdMI+poehyBZvqfMTto8A==} - form-data@4.0.5: - resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==} + form-data@4.0.6: + resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==} engines: {node: '>= 6'} formdata-node@4.4.1: @@ -3972,7 +3973,7 @@ snapshots: '@types/node-fetch@2.6.13': dependencies: '@types/node': 22.19.21 - form-data: 4.0.5 + form-data: 4.0.6 '@types/node@18.19.130': dependencies: @@ -4078,7 +4079,7 @@ snapshots: axios@1.17.0: dependencies: follow-redirects: 1.16.0 - form-data: 4.0.5 + form-data: 4.0.6 https-proxy-agent: 5.0.1 proxy-from-env: 2.1.0 transitivePeerDependencies: @@ -4561,7 +4562,7 @@ snapshots: form-data-encoder@1.7.2: {} - form-data@4.0.5: + form-data@4.0.6: dependencies: asynckit: 0.4.0 combined-stream: 1.0.8 diff --git a/mem0-ts/pnpm-workspace.yaml b/mem0-ts/pnpm-workspace.yaml index 4e3b0e9df..46081328f 100644 --- a/mem0-ts/pnpm-workspace.yaml +++ b/mem0-ts/pnpm-workspace.yaml @@ -6,6 +6,7 @@ onlyBuiltDependencies: - better-sqlite3 overrides: + "form-data@<4.0.6": ">=4.0.6" "picomatch@<2.3.2": "^2.3.2" "picomatch@>=4.0.0 <4.0.4": "^4.0.4" "jws@4.0.0": "4.0.1" diff --git a/openmemory/ui/package.json b/openmemory/ui/package.json index 15f7ed5aa..ad379ddc2 100644 --- a/openmemory/ui/package.json +++ b/openmemory/ui/package.json @@ -81,6 +81,7 @@ "sharp" ], "overrides": { + "form-data@<4.0.6": ">=4.0.6", "immutable@>=5.0.0 <5.1.5": "^5.1.5", "picomatch@<2.3.2": "^2.3.2", "minimatch@>=9.0.0 <9.0.7": "^9.0.7", diff --git a/openmemory/ui/pnpm-lock.yaml b/openmemory/ui/pnpm-lock.yaml index ca7fa1323..7bef9e7a2 100644 --- a/openmemory/ui/pnpm-lock.yaml +++ b/openmemory/ui/pnpm-lock.yaml @@ -5,6 +5,7 @@ settings: excludeLinksFromLockfile: false overrides: + form-data@<4.0.6: '>=4.0.6' immutable@>=5.0.0 <5.1.5: ^5.1.5 picomatch@<2.3.2: ^2.3.2 minimatch@>=9.0.0 <9.0.7: ^9.0.7 @@ -1476,8 +1477,8 @@ packages: debug: optional: true - form-data@4.0.5: - resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==} + form-data@4.0.6: + resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==} engines: {node: '>= 6'} fraction.js@5.3.4: @@ -3032,7 +3033,7 @@ snapshots: axios@1.17.0: dependencies: follow-redirects: 1.16.0 - form-data: 4.0.5 + form-data: 4.0.6 https-proxy-agent: 5.0.1 proxy-from-env: 2.1.0 transitivePeerDependencies: @@ -3235,7 +3236,7 @@ snapshots: follow-redirects@1.16.0: {} - form-data@4.0.5: + form-data@4.0.6: dependencies: asynckit: 0.4.0 combined-stream: 1.0.8 diff --git a/openmemory/ui/pnpm-workspace.yaml b/openmemory/ui/pnpm-workspace.yaml index de1829360..367d92f14 100644 --- a/openmemory/ui/pnpm-workspace.yaml +++ b/openmemory/ui/pnpm-workspace.yaml @@ -6,6 +6,7 @@ onlyBuiltDependencies: - sharp overrides: + "form-data@<4.0.6": ">=4.0.6" "immutable@>=5.0.0 <5.1.5": "^5.1.5" "picomatch@<2.3.2": "^2.3.2" "minimatch@>=9.0.0 <9.0.7": "^9.0.7" diff --git a/server/dashboard/pnpm-lock.yaml b/server/dashboard/pnpm-lock.yaml index a16b67ed2..133711c34 100644 --- a/server/dashboard/pnpm-lock.yaml +++ b/server/dashboard/pnpm-lock.yaml @@ -5,6 +5,7 @@ settings: excludeLinksFromLockfile: false overrides: + form-data@<4.0.6: '>=4.0.6' postcss@<8.5.10: '>=8.5.10' prismjs@<1.30.0: '>=1.30.0' uuid@<11.1.1: '>=11.1.1' @@ -1961,8 +1962,8 @@ packages: resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==} engines: {node: '>= 0.4'} - form-data@4.0.5: - resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==} + form-data@4.0.6: + resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==} engines: {node: '>= 6'} format@0.2.2: @@ -4329,7 +4330,7 @@ snapshots: axios@1.17.0: dependencies: follow-redirects: 1.16.0 - form-data: 4.0.5 + form-data: 4.0.6 https-proxy-agent: 5.0.1 proxy-from-env: 2.1.0 transitivePeerDependencies: @@ -4949,7 +4950,7 @@ snapshots: dependencies: is-callable: 1.2.7 - form-data@4.0.5: + form-data@4.0.6: dependencies: asynckit: 0.4.0 combined-stream: 1.0.8 diff --git a/server/dashboard/pnpm-workspace.yaml b/server/dashboard/pnpm-workspace.yaml index 4314aa28c..8a84430bd 100644 --- a/server/dashboard/pnpm-workspace.yaml +++ b/server/dashboard/pnpm-workspace.yaml @@ -2,6 +2,7 @@ packages: - '.' overrides: + "form-data@<4.0.6": ">=4.0.6" "postcss@<8.5.10": ">=8.5.10" "prismjs@<1.30.0": ">=1.30.0" "uuid@<11.1.1": ">=11.1.1"