The n8n node was the only integration without a `pnpm.overrides` block,
so its tree carried 9 advisories (7 high, 2 moderate) that
pi-agent-plugin, openclaw, and vercel-ai-sdk already pin out. Adds the
same block, scoped to the packages actually present in this tree
(`esbuild` and `undici` are not, so their sibling entries are omitted
rather than carried over as dead config).
Down to 2 from 9. Both remaining are GHSA-mh99-v99m-4gvg on the 1.x and
2.x brace-expansion lines, whose fix shipped only in 5.0.8 with no
backport. Forcing those lines to 5.x does clear the audit but breaks
`gulp build`: rimraf -> glob -> minimatch@9 imports brace-expansion as a
default export, which the 5.x ESM build does not provide.
Replacement ranges are capped per major rather than left open like the
siblings'. An unbounded `uuid >=11.1.1` resolves to 14.x, which is
pure ESM and cannot be required by n8n-workflow under Jest's CJS
runtime.
All dev-only: the published package still declares zero runtime
dependencies, so none of this reaches an installed node. lint, build,
and the 5 tests pass; `pnpm install --frozen-lockfile` is clean.
The unscoped `n8n-nodes-mem0` name is already taken on npm by an
unrelated publisher, so the CD workflow could never publish it. Move to
the `@mem0` scope, matching `@mem0/pi-agent-plugin` and
`@mem0/openclaw-mem0`, and add `publishConfig.access: public` since
scoped packages default to restricted.
n8n accepts scoped community packages: it strips the scope before
enforcing the `n8n-nodes-` prefix, the same shape as n8n's own
`@n8n/n8n-nodes-langchain`. Verified end to end on n8n 2.22.6 by
installing the packed tarball into the community-packages directory and
executing a workflow against node type `@mem0/n8n-nodes-mem0.mem0`.
The directory, workflow filenames, and the `n8n-nodes-mem0-v*` tag
prefix are unchanged. pnpm-lock.yaml needs no update: the pnpm v9 root
importer is anonymous and never recorded the package name.
- Telemetry: replace client-side PostHog (which read process.env, banned in
verified nodes) with first-party `source: "N8N"` attribution on API requests,
mirroring OpenClaw. Removes the undisclosed-collection concern entirely.
- Verification-scanner fixes: add credential icon, use NodeConnectionTypes.Main
instead of the 'main' literal, wrap error paths in NodeApiError, stop shipping
.d.ts / tsbuildinfo, and align the local eslint config with the scanner.
- Add offline unit tests (jest): entity-id guard, JSON-parse errors, poll-timeout
loop, source attribution, and Return All pagination.
- Get Many: add a Return All option that pages through all memories.
- Docs: README telemetry note and an AGENTS.md Key Directories row.
Verified: build + tsc + eslint + 5 unit tests + live E2E against api.mem0.ai, and
the packed tarball passes @n8n/scan-community-package with zero violations.
kartik-mem0