JDSS/mem0
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): patch 8 HIGH + 18 MEDIUM Vanta vulnerabilities

Browse Source 
Bumps three transitive packages across four pnpm workspaces via overrides.
Manifests and lockfiles only; no source changes.

  undici           7.28.0 -> 7.29.0   mem0-ts, openclaw, pi-agent-plugin
                   8.5.0  -> 8.10.0   pi-agent-plugin      (GHSA-4cwx-7wf7-3272 +4)
  ip-address       10.2.0 -> 10.4.0   mem0-ts              (GHSA-mwp4-54f8-5fhr +2)
  brace-expansion  2.1.2  -> 2.1.4    mem0-ts              (GHSA-rgw5-rvv9-x895,
                                                            GHSA-mh99-v99m-4gvg)
                   1.1.15 -> 1.1.18   zapier-mem0          (GHSA-3jxr-9vmj-r5cp)

Existing override keys were replaced in place rather than added alongside:
pnpm applies only the first override matching a bare package name, so a
stale broader key (e.g. undici@<6.27.0) would have shadowed a new narrower
one and silently held the vulnerable version.

Overrides are written to both package.json and pnpm-workspace.yaml because
openclaw, pi-agent-plugin and zapier-mem0 run pnpm 9 in CI, which reads
overrides only from package.json.

Verified: 26/41 open alerts clear against the regenerated lockfiles;
frozen-lockfile passes under each workspace's CI pnpm major; runtime API
smoke 7/7; mem0-ts 1505/1505, openclaw 446/446, pi-agent 100/100, zapier 17/17.

Fixes: https://app.vanta.com/c/mem0.ai/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-critical?tab=results
Fixes: https://app.vanta.com/c/mem0.ai/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-high?tab=results
This commit is contained in:
harshgupta-mem0
2026-08-07 17:22:49 +05:30
parent b05dc2740f
commit d3d9cc9e26
12 changed files with 69 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/openclaw/package.json
+1 -1
View File
@@ -72,7 +72,7 @@
"@qdrant/js-client-rest": "^1.18.0",
"uuid@<11.1.1": ">=11.1.1",
"esbuild": ">=0.28.1",
"undici@<6.27.0": ">=6.27.0 <8.0.0",
"undici@<7.29.0": ">=7.29.0 <8.0.0",
"axios@<1.18.0": ">=1.18.0 <2.0.0",
"postcss@<8.5.18": ">=8.5.18 <9.0.0",
"mongoose@>=9.0.0 <9.7.2": ">=9.7.2 <10.0.0"
integrations/openclaw/pnpm-lock.yaml
Generated
+5 -5
View File
@@ -13,7 +13,7 @@ overrides:
'@qdrant/js-client-rest': ^1.18.0
uuid@<11.1.1: '>=11.1.1'
esbuild: '>=0.28.1'
undici@<6.27.0: '>=6.27.0 <8.0.0'
undici@<7.29.0: '>=7.29.0 <8.0.0'
axios@<1.18.0: '>=1.18.0 <2.0.0'
postcss@<8.5.18: '>=8.5.18 <9.0.0'
mongoose@>=9.0.0 <9.7.2: '>=9.7.2 <10.0.0'
@@ -2036,8 +2036,8 @@ packages:
undici-types@6.21.0:
resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
undici@7.28.0:
resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
undici@7.29.0:
resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==}
engines: {node: '>=20.18.1'}
util-deprecate@1.0.2:
@@ -2547,7 +2547,7 @@ snapshots:
dependencies:
'@qdrant/openapi-typescript-fetch': 1.2.6
typescript: 5.9.3
undici: 7.28.0
undici: 7.29.0
'@qdrant/openapi-typescript-fetch@1.2.6': {}
@@ -4121,7 +4121,7 @@ snapshots:
undici-types@6.21.0: {}
undici@7.28.0: {}
undici@7.29.0: {}
util-deprecate@1.0.2: {}
integrations/openclaw/pnpm-workspace.yaml
+1 -1
View File
@@ -21,7 +21,7 @@ overrides:
"@qdrant/js-client-rest": "^1.18.0"
"uuid@<11.1.1": ">=11.1.1"
"esbuild": ">=0.28.1"
"undici@<6.27.0": ">=6.27.0 <8.0.0"
"undici@<7.29.0": ">=7.29.0 <8.0.0"
"axios@<1.18.0": ">=1.18.0 <2.0.0"
"postcss@<8.5.18": ">=8.5.18 <9.0.0"
"mongoose@>=9.0.0 <9.7.2": ">=9.7.2 <10.0.0"