fix(security): patch 8 HIGH + 18 MEDIUM Vanta vulnerabilities

Bumps three transitive packages across four pnpm workspaces via overrides.
Manifests and lockfiles only; no source changes.

  undici           7.28.0 -> 7.29.0   mem0-ts, openclaw, pi-agent-plugin
                   8.5.0  -> 8.10.0   pi-agent-plugin      (GHSA-4cwx-7wf7-3272 +4)
  ip-address       10.2.0 -> 10.4.0   mem0-ts              (GHSA-mwp4-54f8-5fhr +2)
  brace-expansion  2.1.2  -> 2.1.4    mem0-ts              (GHSA-rgw5-rvv9-x895,
                                                            GHSA-mh99-v99m-4gvg)
                   1.1.15 -> 1.1.18   zapier-mem0          (GHSA-3jxr-9vmj-r5cp)

Existing override keys were replaced in place rather than added alongside:
pnpm applies only the first override matching a bare package name, so a
stale broader key (e.g. undici@<6.27.0) would have shadowed a new narrower
one and silently held the vulnerable version.

Overrides are written to both package.json and pnpm-workspace.yaml because
openclaw, pi-agent-plugin and zapier-mem0 run pnpm 9 in CI, which reads
overrides only from package.json.

Verified: 26/41 open alerts clear against the regenerated lockfiles;
frozen-lockfile passes under each workspace's CI pnpm major; runtime API
smoke 7/7; mem0-ts 1505/1505, openclaw 446/446, pi-agent 100/100, zapier 17/17.

Fixes: https://app.vanta.com/c/mem0.ai/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-critical?tab=results
Fixes: https://app.vanta.com/c/mem0.ai/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-high?tab=results

integrations/openclaw/package.json

@@ -72,7 +72,7 @@
       "@qdrant/js-client-rest": "^1.18.0",
       "uuid@<11.1.1": ">=11.1.1",
       "esbuild": ">=0.28.1",
-      "undici@<6.27.0": ">=6.27.0 <8.0.0",
+      "undici@<7.29.0": ">=7.29.0 <8.0.0",
       "axios@<1.18.0": ">=1.18.0 <2.0.0",
       "postcss@<8.5.18": ">=8.5.18 <9.0.0",
       "mongoose@>=9.0.0 <9.7.2": ">=9.7.2 <10.0.0"

integrations/openclaw/pnpm-lock.yaml

@@ -13,7 +13,7 @@ overrides:
   '@qdrant/js-client-rest': ^1.18.0
   uuid@<11.1.1: '>=11.1.1'
   esbuild: '>=0.28.1'
-  undici@<6.27.0: '>=6.27.0 <8.0.0'
+  undici@<7.29.0: '>=7.29.0 <8.0.0'
   axios@<1.18.0: '>=1.18.0 <2.0.0'
   postcss@<8.5.18: '>=8.5.18 <9.0.0'
   mongoose@>=9.0.0 <9.7.2: '>=9.7.2 <10.0.0'
@@ -2036,8 +2036,8 @@ packages:
   undici-types@6.21.0:
     resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
 
-  undici@7.28.0:
+  undici@7.29.0:
-    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
+    resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==}
     engines: {node: '>=20.18.1'}
 
   util-deprecate@1.0.2:
@@ -2547,7 +2547,7 @@ snapshots:
     dependencies:
       '@qdrant/openapi-typescript-fetch': 1.2.6
       typescript: 5.9.3
-      undici: 7.28.0
+      undici: 7.29.0
 
   '@qdrant/openapi-typescript-fetch@1.2.6': {}
 
@@ -4121,7 +4121,7 @@ snapshots:
 
   undici-types@6.21.0: {}
 
-  undici@7.28.0: {}
+  undici@7.29.0: {}
 
   util-deprecate@1.0.2: {}
 

integrations/openclaw/pnpm-workspace.yaml

@@ -21,7 +21,7 @@ overrides:
   "@qdrant/js-client-rest": "^1.18.0"
   "uuid@<11.1.1": ">=11.1.1"
   "esbuild": ">=0.28.1"
-  "undici@<6.27.0": ">=6.27.0 <8.0.0"
+  "undici@<7.29.0": ">=7.29.0 <8.0.0"
   "axios@<1.18.0": ">=1.18.0 <2.0.0"
   "postcss@<8.5.18": ">=8.5.18 <9.0.0"
   "mongoose@>=9.0.0 <9.7.2": ">=9.7.2 <10.0.0"

integrations/pi-agent-plugin/package.json

@@ -73,8 +73,8 @@
       "form-data@<4.0.6": ">=4.0.6",
       "uuid@<11.1.1": ">=11.1.1",
       "esbuild": ">=0.28.1",
-      "undici@<6.27.0": ">=6.27.0 <8.0.0",
+      "undici@<7.29.0": ">=7.29.0 <8.0.0",
-      "undici@>=8.0.0 <8.5.0": ">=8.5.0",
+      "undici@>=8.0.0 <8.9.0": ">=8.9.0 <9.0.0",
       "axios@<1.18.0": ">=1.18.0 <2.0.0",
       "brace-expansion@>=3.0.0 <5.0.8": ">=5.0.8 <6.0.0",
       "postcss@<8.5.18": ">=8.5.18 <9.0.0",

integrations/pi-agent-plugin/pnpm-lock.yaml

@@ -8,8 +8,8 @@ overrides:
   form-data@<4.0.6: '>=4.0.6'
   uuid@<11.1.1: '>=11.1.1'
   esbuild: '>=0.28.1'
-  undici@<6.27.0: '>=6.27.0 <8.0.0'
+  undici@<7.29.0: '>=7.29.0 <8.0.0'
-  undici@>=8.0.0 <8.5.0: '>=8.5.0'
+  undici@>=8.0.0 <8.9.0: '>=8.9.0 <9.0.0'
   axios@<1.18.0: '>=1.18.0 <2.0.0'
   brace-expansion@>=3.0.0 <5.0.8: '>=5.0.8 <6.0.0'
   postcss@<8.5.18: '>=8.5.18 <9.0.0'
@@ -2354,12 +2354,12 @@ packages:
   undici-types@7.24.6:
     resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}
 
-  undici@7.28.0:
+  undici@7.29.0:
-    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
+    resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==}
     engines: {node: '>=20.18.1'}
 
-  undici@8.5.0:
+  undici@8.10.0:
-    resolution: {integrity: sha512-xamtWoB1EshgjpmlXd7GGm2VfdDtw1+rD8uhry8pSNW3If6S8E0m2T2+orSKeZXEn/aPJMviCpDBA65WJt8zhg==}
+    resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==}
     engines: {node: '>=22.19.0'}
 
   util-deprecate@1.0.2:
@@ -2942,7 +2942,7 @@ snapshots:
       minimatch: 10.2.5
       proper-lockfile: 4.1.2
       typebox: 1.1.38
-      undici: 8.5.0
+      undici: 8.10.0
       yaml: 2.9.0
     optionalDependencies:
       '@mariozechner/clipboard': 0.3.9
@@ -3203,7 +3203,7 @@ snapshots:
     dependencies:
       '@qdrant/openapi-typescript-fetch': 1.2.6
       typescript: 6.0.3
-      undici: 7.28.0
+      undici: 7.29.0
 
   '@qdrant/openapi-typescript-fetch@1.2.6': {}
 
@@ -4895,9 +4895,9 @@ snapshots:
 
   undici-types@7.24.6: {}
 
-  undici@7.28.0: {}
+  undici@7.29.0: {}
 
-  undici@8.5.0: {}
+  undici@8.10.0: {}
 
   util-deprecate@1.0.2: {}
 

integrations/pi-agent-plugin/pnpm-workspace.yaml

@@ -5,8 +5,8 @@ overrides:
   "form-data@<4.0.6": ">=4.0.6"
   "uuid@<11.1.1": ">=11.1.1"
   "esbuild": ">=0.28.1"
-  "undici@<6.27.0": ">=6.27.0 <8.0.0"
+  "undici@<7.29.0": ">=7.29.0 <8.0.0"
-  "undici@>=8.0.0 <8.5.0": ">=8.5.0"
+  "undici@>=8.0.0 <8.9.0": ">=8.9.0 <9.0.0"
   "axios@<1.18.0": ">=1.18.0 <2.0.0"
   "brace-expansion@>=3.0.0 <5.0.8": ">=5.0.8 <6.0.0"
   "postcss@<8.5.18": ">=8.5.18 <9.0.0"

integrations/zapier-mem0/package.json

@@ -41,10 +41,17 @@
   ],
   "jest": {
     "testEnvironment": "node",
-    "testMatch": ["**/test/**/*.test.ts"],
+    "testMatch": [
-    "setupFiles": ["<rootDir>/test/setup.ts"],
+      "**/test/**/*.test.ts"
+    ],
+    "setupFiles": [
+      "<rootDir>/test/setup.ts"
+    ],
     "transform": {
-      "^.+\\.tsx?$": ["ts-jest", {}]
+      "^.+\\.tsx?$": [
+        "ts-jest",
+        {}
+      ]
     }
   },
   "dependencies": {
@@ -62,8 +69,9 @@
       "form-data@<4.0.6": ">=4.0.6",
       "uuid@<11.1.1": ">=11.1.1",
       "esbuild": ">=0.28.1",
-      "undici@<6.27.0": ">=6.27.0 <8.0.0",
+      "undici@<7.29.0": ">=7.29.0 <8.0.0",
-      "undici@>=8.0.0 <8.5.0": ">=8.5.0"
+      "undici@>=8.0.0 <8.9.0": ">=8.9.0 <9.0.0",
+      "brace-expansion@<1.1.16": ">=1.1.16 <2.0.0"
     }
   }
 }

integrations/zapier-mem0/pnpm-lock.yaml

@@ -8,8 +8,9 @@ overrides:
   form-data@<4.0.6: '>=4.0.6'
   uuid@<11.1.1: '>=11.1.1'
   esbuild: '>=0.28.1'
-  undici@<6.27.0: '>=6.27.0 <8.0.0'
+  undici@<7.29.0: '>=7.29.0 <8.0.0'
-  undici@>=8.0.0 <8.5.0: '>=8.5.0'
+  undici@>=8.0.0 <8.9.0: '>=8.9.0 <9.0.0'
+  brace-expansion@<1.1.16: '>=1.1.16 <2.0.0'
 
 importers:
 
@@ -413,8 +414,8 @@ packages:
     engines: {node: '>=6.0.0'}
     hasBin: true
 
-  brace-expansion@1.1.15:
+  brace-expansion@1.1.18:
-    resolution: {integrity: sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==}
+    resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==}
 
   braces@3.0.3:
     resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
@@ -530,6 +531,7 @@ packages:
 
   crypto-js@4.2.0:
     resolution: {integrity: sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q==}
+    deprecated: Active development of CryptoJS has been discontinued. This library is no longer maintained.
 
   debug@4.4.3:
     resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
@@ -1995,7 +1997,7 @@ snapshots:
 
   baseline-browser-mapping@2.10.41: {}
 
-  brace-expansion@1.1.15:
+  brace-expansion@1.1.18:
     dependencies:
       balanced-match: 1.0.2
       concat-map: 0.0.1
@@ -2792,7 +2794,7 @@ snapshots:
 
   minimatch@3.1.5:
     dependencies:
-      brace-expansion: 1.1.15
+      brace-expansion: 1.1.18
 
   minimist@1.2.8: {}
 

integrations/zapier-mem0/pnpm-workspace.yaml

@@ -5,5 +5,6 @@ overrides:
   "form-data@<4.0.6": ">=4.0.6"
   "uuid@<11.1.1": ">=11.1.1"
   "esbuild": ">=0.28.1"
-  "undici@<6.27.0": ">=6.27.0 <8.0.0"
+  "undici@<7.29.0": ">=7.29.0 <8.0.0"
-  "undici@>=8.0.0 <8.5.0": ">=8.5.0"
+  "undici@>=8.0.0 <8.9.0": ">=8.9.0 <9.0.0"
+  "brace-expansion@<1.1.16": ">=1.1.16 <2.0.0"

mem0-ts/package.json

@@ -292,18 +292,19 @@
       "glob@>=10.2.0 <10.5.0": "^10.5.0",
       "@modelcontextprotocol/sdk": "^1.25.4",
       "esbuild": ">=0.28.1",
-      "undici@<6.27.0": ">=6.27.0 <8.0.0",
+      "undici@<7.29.0": ">=7.29.0 <8.0.0",
       "@aws-sdk/client-bedrock-runtime": "3.967.0",
       "@aws-sdk/client-neptune-graph": "3.966.0",
       "axios@<1.18.0": ">=1.18.0 <2.0.0",
       "brace-expansion@<1.1.16": ">=1.1.16 <2.0.0",
-      "brace-expansion@>=2.0.0 <2.1.2": ">=2.1.2 <3.0.0",
+      "brace-expansion@>=2.0.0 <2.1.4": ">=2.1.4 <3.0.0",
       "brace-expansion@>=3.0.0 <5.0.8": ">=5.0.8 <6.0.0",
       "fast-xml-parser@>=5.0.0 <5.10.1": ">=5.10.1 <6.0.0",
       "tar@>=7.0.0 <7.5.21": ">=7.5.21 <8.0.0",
       "thrift@<0.23.0": "^0.23.0",
       "mongoose@>=9.0.0 <9.7.2": ">=9.7.2 <10.0.0",
-      "protobufjs@<7.6.5": ">=7.6.5 <8.0.0"
+      "protobufjs@<7.6.5": ">=7.6.5 <8.0.0",
+      "ip-address@<10.3.1": ">=10.3.1 <11.0.0"
     }
   }
 }

mem0-ts/pnpm-lock.yaml

@@ -25,18 +25,19 @@ overrides:
   glob@>=10.2.0 <10.5.0: ^10.5.0
   '@modelcontextprotocol/sdk': ^1.25.4
   esbuild: '>=0.28.1'
-  undici@<6.27.0: '>=6.27.0 <8.0.0'
+  undici@<7.29.0: '>=7.29.0 <8.0.0'
   '@aws-sdk/client-bedrock-runtime': 3.967.0
   '@aws-sdk/client-neptune-graph': 3.966.0
   axios@<1.18.0: '>=1.18.0 <2.0.0'
   brace-expansion@<1.1.16: '>=1.1.16 <2.0.0'
-  brace-expansion@>=2.0.0 <2.1.2: '>=2.1.2 <3.0.0'
+  brace-expansion@>=2.0.0 <2.1.4: '>=2.1.4 <3.0.0'
   brace-expansion@>=3.0.0 <5.0.8: '>=5.0.8 <6.0.0'
   fast-xml-parser@>=5.0.0 <5.10.1: '>=5.10.1 <6.0.0'
   tar@>=7.0.0 <7.5.21: '>=7.5.21 <8.0.0'
   thrift@<0.23.0: ^0.23.0
   mongoose@>=9.0.0 <9.7.2: '>=9.7.2 <10.0.0'
   protobufjs@<7.6.5: '>=7.6.5 <8.0.0'
+  ip-address@<10.3.1: '>=10.3.1 <11.0.0'
 
 importers:
 
@@ -2165,8 +2166,8 @@ packages:
   brace-expansion@1.1.16:
     resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==}
 
-  brace-expansion@2.1.2:
+  brace-expansion@2.1.4:
-    resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==}
+    resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==}
 
   brace-expansion@5.0.8:
     resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==}
@@ -3027,8 +3028,8 @@ packages:
     resolution: {integrity: sha512-4rTJX6Q5wTYEvxboXi8DsEiUo+OvqJGtLYOSGm37KpdRXsG5XJjbVtYKGJpPSWP+QT7rWscA4vsrdmzbEbenpw==}
     engines: {node: '>=18.12.0'}
 
-  ip-address@10.2.0:
+  ip-address@10.4.0:
-    resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==}
+    resolution: {integrity: sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==}
     engines: {node: '>= 12'}
 
   is-arrayish@0.2.1:
@@ -4626,8 +4627,8 @@ packages:
   undici-types@7.24.6:
     resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}
 
-  undici@7.28.0:
+  undici@7.29.0:
-    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
+    resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==}
     engines: {node: '>=20.18.1'}
 
   update-browserslist-db@1.2.3:
@@ -6155,7 +6156,7 @@ snapshots:
       ms: 2.1.3
       secure-json-parse: 4.1.0
       tslib: 2.8.1
-      undici: 7.28.0
+      undici: 7.29.0
     transitivePeerDependencies:
       - supports-color
 
@@ -6711,7 +6712,7 @@ snapshots:
     dependencies:
       '@qdrant/openapi-typescript-fetch': 1.2.6
       typescript: 5.5.4
-      undici: 7.28.0
+      undici: 7.29.0
 
   '@qdrant/openapi-typescript-fetch@1.2.6': {}
 
@@ -7183,7 +7184,7 @@ snapshots:
   '@turbopuffer/turbopuffer@2.5.0':
     dependencies:
       pako: 2.2.0
-      undici: 7.28.0
+      undici: 7.29.0
 
   '@types/babel__core@7.20.5':
     dependencies:
@@ -7542,7 +7543,7 @@ snapshots:
       balanced-match: 1.0.2
       concat-map: 0.0.1
 
-  brace-expansion@2.1.2:
+  brace-expansion@2.1.4:
     dependencies:
       balanced-match: 1.0.2
 
@@ -8448,7 +8449,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  ip-address@10.2.0: {}
+  ip-address@10.4.0: {}
 
   is-arrayish@0.2.1: {}
 
@@ -9076,7 +9077,7 @@ snapshots:
 
   minimatch@9.0.9:
     dependencies:
-      brace-expansion: 2.1.2
+      brace-expansion: 2.1.4
 
   minimist@1.2.8: {}
 
@@ -9886,7 +9887,7 @@ snapshots:
 
   socks@2.8.9:
     dependencies:
-      ip-address: 10.2.0
+      ip-address: 10.4.0
       smart-buffer: 4.2.0
 
   source-map-support@0.5.13:
@@ -10232,7 +10233,7 @@ snapshots:
 
   undici-types@7.24.6: {}
 
-  undici@7.28.0: {}
+  undici@7.29.0: {}
 
   update-browserslist-db@1.2.3(browserslist@4.28.2):
     dependencies:

mem0-ts/pnpm-workspace.yaml

@@ -25,13 +25,14 @@ overrides:
   "glob@>=10.2.0 <10.5.0": "^10.5.0"
   "@modelcontextprotocol/sdk": "^1.25.4"
   "esbuild": ">=0.28.1"
-  "undici@<6.27.0": ">=6.27.0 <8.0.0"
+  "undici@<7.29.0": ">=7.29.0 <8.0.0"
   "axios@<1.18.0": ">=1.18.0 <2.0.0"
   "brace-expansion@<1.1.16": ">=1.1.16 <2.0.0"
-  "brace-expansion@>=2.0.0 <2.1.2": ">=2.1.2 <3.0.0"
+  "brace-expansion@>=2.0.0 <2.1.4": ">=2.1.4 <3.0.0"
   "brace-expansion@>=3.0.0 <5.0.8": ">=5.0.8 <6.0.0"
   "fast-xml-parser@>=5.0.0 <5.10.1": ">=5.10.1 <6.0.0"
   "tar@>=7.0.0 <7.5.21": ">=7.5.21 <8.0.0"
   "thrift@<0.23.0": "^0.23.0"
   "mongoose@>=9.0.0 <9.7.2": ">=9.7.2 <10.0.0"
   "protobufjs@<7.6.5": ">=7.6.5 <8.0.0"
+  "ip-address@<10.3.1": ">=10.3.1 <11.0.0"