fix(form-data): upgrade to >=4.0.6 across pnpm workspaces (CVE-2026-12143)

Adds a pnpm override forcing form-data >=4.0.6 in all five workspaces that resolved the vulnerable transitive
  form-data@4.0.5 (CVE-2026-12143, GHSA-hmw2-7cc7-3qxx — CRLF injection via unescaped multipart field names/filenames). Override added to pnpm-workspace.yaml everywhere, and also to package.json pnpm.overrides for the workspaces whose CI pnpm version reads it (mem0-ts,
  openmemory/ui, pi-agent-plugin, openclaw). Lockfiles regenerated with each workspace's CI pnpm version; only form-data changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

openmemory/ui/package.json

@@ -81,6 +81,7 @@
       "sharp"
     ],
     "overrides": {
+      "form-data@<4.0.6": ">=4.0.6",
       "immutable@>=5.0.0 <5.1.5": "^5.1.5",
       "picomatch@<2.3.2": "^2.3.2",
       "minimatch@>=9.0.0 <9.0.7": "^9.0.7",

openmemory/ui/pnpm-lock.yaml

@@ -5,6 +5,7 @@ settings:
   excludeLinksFromLockfile: false
 
 overrides:
+  form-data@<4.0.6: '>=4.0.6'
   immutable@>=5.0.0 <5.1.5: ^5.1.5
   picomatch@<2.3.2: ^2.3.2
   minimatch@>=9.0.0 <9.0.7: ^9.0.7
@@ -1476,8 +1477,8 @@ packages:
       debug:
         optional: true
 
-  form-data@4.0.5:
-    resolution: {integrity: sha512-8RipRLol37bNs2bhoV67fiTEvdTrbMUYcFTiy3+wuuOnUog2QBHCZWXDRijWQfAkhBj2Uf5UnVaiWwA5vdd82w==}
+  form-data@4.0.6:
+    resolution: {integrity: sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==}
     engines: {node: '>= 6'}
 
   fraction.js@5.3.4:
@@ -3032,7 +3033,7 @@ snapshots:
   axios@1.17.0:
     dependencies:
       follow-redirects: 1.16.0
-      form-data: 4.0.5
+      form-data: 4.0.6
       https-proxy-agent: 5.0.1
       proxy-from-env: 2.1.0
     transitivePeerDependencies:
@@ -3235,7 +3236,7 @@ snapshots:
 
   follow-redirects@1.16.0: {}
 
-  form-data@4.0.5:
+  form-data@4.0.6:
     dependencies:
       asynckit: 0.4.0
       combined-stream: 1.0.8

openmemory/ui/pnpm-workspace.yaml

@@ -6,6 +6,7 @@ onlyBuiltDependencies:
   - sharp
 
 overrides:
+  "form-data@<4.0.6": ">=4.0.6"
   "immutable@>=5.0.0 <5.1.5": "^5.1.5"
   "picomatch@<2.3.2": "^2.3.2"
   "minimatch@>=9.0.0 <9.0.7": "^9.0.7"