fix(form-data): upgrade to >=4.0.6 across pnpm workspaces (CVE-2026-12143)

Adds a pnpm override forcing form-data >=4.0.6 in all five workspaces that resolved the vulnerable transitive
  form-data@4.0.5 (CVE-2026-12143, GHSA-hmw2-7cc7-3qxx — CRLF injection via unescaped multipart field names/filenames). Override added to pnpm-workspace.yaml everywhere, and also to package.json pnpm.overrides for the workspaces whose CI pnpm version reads it (mem0-ts,
  openmemory/ui, pi-agent-plugin, openclaw). Lockfiles regenerated with each workspace's CI pnpm version; only form-data changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

integrations/openclaw/package.json

@@ -64,6 +64,7 @@
   },
   "pnpm": {
     "overrides": {
+      "form-data@<4.0.6": ">=4.0.6",
       "protobufjs@<7.5.5": "^7.5.5",
       "vite": "^8.0.5",
       "langsmith@<0.6.0": "^0.6.0",

integrations/openclaw/pnpm-lock.yaml

@@ -5,6 +5,7 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
+  form-data@<4.0.6: '>=4.0.6'
   protobufjs@<7.5.5: ^7.5.5
   vite: ^8.0.5
   langsmith@<0.6.0: ^0.6.0
@@ -1109,8 +1110,8 @@ packages:
   form-data-encoder@1.7.2:
     resolution: {integrity: sha512-qfqtYan3rxrnCk1VYaA4H+Ms9xdpPqvLZa6xmMgFvhO32x7/3J/ExcTd6qpxM0vH2GdMI+poehyBZvqfMTto8A==}
 
-  form-data@4.0.5:
-    resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==}
+  form-data@4.0.6:
+    resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==}
     engines: {node: '>= 6'}
 
   formdata-node@4.4.1:
@@ -2728,7 +2729,7 @@ snapshots:
   '@types/node-fetch@2.6.13':
     dependencies:
       '@types/node': 22.19.20
-      form-data: 4.0.5
+      form-data: 4.0.6
 
   '@types/node@18.19.130':
     dependencies:
@@ -2870,7 +2871,7 @@ snapshots:
   axios@1.17.0:
     dependencies:
       follow-redirects: 1.16.0
-      form-data: 4.0.5
+      form-data: 4.0.6
       https-proxy-agent: 5.0.1
       proxy-from-env: 2.1.0
     transitivePeerDependencies:
@@ -3131,7 +3132,7 @@ snapshots:
 
   form-data-encoder@1.7.2: {}
 
-  form-data@4.0.5:
+  form-data@4.0.6:
     dependencies:
       asynckit: 0.4.0
       combined-stream: 1.0.8

integrations/openclaw/pnpm-workspace.yaml

@@ -13,6 +13,7 @@ onlyBuiltDependencies:
   - protobufjs
 
 overrides:
+  "form-data@<4.0.6": ">=4.0.6"
   "protobufjs@<7.5.5": "^7.5.5"
   "vite": "^8.0.5"
   "langsmith@<0.6.0": "^0.6.0"