JDSS/mem0
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(form-data): upgrade to >=4.0.6 across pnpm workspaces (CVE-2026-12143)

Browse Source 
Adds a pnpm override forcing form-data >=4.0.6 in all five workspaces that resolved the vulnerable transitive
  form-data@4.0.5 (CVE-2026-12143, GHSA-hmw2-7cc7-3qxx — CRLF injection via unescaped multipart field names/filenames). Override added to pnpm-workspace.yaml everywhere, and also to package.json pnpm.overrides for the workspaces whose CI pnpm version reads it (mem0-ts,
  openmemory/ui, pi-agent-plugin, openclaw). Lockfiles regenerated with each workspace's CI pnpm version; only form-data changes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
harshgupta-mem0
2026-06-18 00:21:34 +05:30
co-authored by Claude Opus 4.8
parent 158e9111cb
commit ff5b0e778b
14 changed files with 37 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
openmemory/ui/pnpm-workspace.yaml
+1
View File
@@ -6,6 +6,7 @@ onlyBuiltDependencies:
- sharp
overrides:
"form-data@<4.0.6": ">=4.0.6"
"immutable@>=5.0.0 <5.1.5": "^5.1.5"
"picomatch@<2.3.2": "^2.3.2"
"minimatch@>=9.0.0 <9.0.7": "^9.0.7"