The n8n node was the only integration without a `pnpm.overrides` block,
so its tree carried 9 advisories (7 high, 2 moderate) that
pi-agent-plugin, openclaw, and vercel-ai-sdk already pin out. Adds the
same block, scoped to the packages actually present in this tree
(`esbuild` and `undici` are not, so their sibling entries are omitted
rather than carried over as dead config).
Down to 2 from 9. Both remaining are GHSA-mh99-v99m-4gvg on the 1.x and
2.x brace-expansion lines, whose fix shipped only in 5.0.8 with no
backport. Forcing those lines to 5.x does clear the audit but breaks
`gulp build`: rimraf -> glob -> minimatch@9 imports brace-expansion as a
default export, which the 5.x ESM build does not provide.
Replacement ranges are capped per major rather than left open like the
siblings'. An unbounded `uuid >=11.1.1` resolves to 14.x, which is
pure ESM and cannot be required by n8n-workflow under Jest's CJS
runtime.
All dev-only: the published package still declares zero runtime
dependencies, so none of this reaches an installed node. lint, build,
and the 5 tests pass; `pnpm install --frozen-lockfile` is clean.
- Telemetry: replace client-side PostHog (which read process.env, banned in
verified nodes) with first-party `source: "N8N"` attribution on API requests,
mirroring OpenClaw. Removes the undisclosed-collection concern entirely.
- Verification-scanner fixes: add credential icon, use NodeConnectionTypes.Main
instead of the 'main' literal, wrap error paths in NodeApiError, stop shipping
.d.ts / tsbuildinfo, and align the local eslint config with the scanner.
- Add offline unit tests (jest): entity-id guard, JSON-parse errors, poll-timeout
loop, source attribution, and Return All pagination.
- Get Many: add a Return All option that pages through all memories.
- Docs: README telemetry note and an AGENTS.md Key Directories row.
Verified: build + tsc + eslint + 5 unit tests + live E2E against api.mem0.ai, and
the packed tarball passes @n8n/scan-community-package with zero violations.
kartik-mem0