fix(security): patch 8 HIGH + 18 MEDIUM Vanta vulnerabilities

Bumps three transitive packages across four pnpm workspaces via overrides. Manifests and lockfiles only; no source changes. undici 7.28.0 -> 7.29.0 mem0-ts, openclaw, pi-agent-plugin 8.5.0 -> 8.10.0 pi-agent-plugin (GHSA-4cwx-7wf7-3272 +4) ip-address 10.2.0 -> 10.4.0 mem0-ts (GHSA-mwp4-54f8-5fhr +2) brace-expansion 2.1.2 -> 2.1.4 mem0-ts (GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg) 1.1.15 -> 1.1.18 zapier-mem0 (GHSA-3jxr-9vmj-r5cp) Existing override keys were replaced in place rather than added alongside: pnpm applies only the first override matching a bare package name, so a stale broader key (e.g. undici@<6.27.0) would have shadowed a new narrower one and silently held the vulnerable version. Overrides are written to both package.json and pnpm-workspace.yaml because openclaw, pi-agent-plugin and zapier-mem0 run pnpm 9 in CI, which reads overrides only from package.json. Verified: 26/41 open alerts clear against the regenerated lockfiles; frozen-lockfile passes under each workspace's CI pnpm major; runtime API smoke 7/7; mem0-ts 1505/1505, openclaw 446/446, pi-agent 100/100, zapier 17/17. Fixes: https://app.vanta.com/c/mem0.ai/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-critical?tab=results Fixes: https://app.vanta.com/c/mem0.ai/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-high?tab=results
docs(memory): note filters-based scoping for search/get_all on add() (#6758 )
2026-08-07 17:22:49 +05:30 · 2026-08-07 14:03:09 +05:30 · 2026-08-06 18:16:25 +05:30 · 2026-08-06 15:12:14 +05:30 · 2026-08-06 00:00:13 +05:30
22 changed files with 360 additions and 307 deletions
@@ -2815,6 +2815,14 @@ Existing memories written by the previous versions are not rewritten. If your me

 <Tab title="n8n">

+<Update label="2026-08-05" description="n8n-nodes-mem0 v0.1.3">
+
+**Changes:**
+- **License changed to MIT:** The published `@mem0/n8n-nodes-mem0` package is now MIT (was Apache-2.0). n8n's Creator Portal requires verified community nodes to be MIT, and the failing license check was the blocker for verification. The rest of the mem0 repo stays Apache-2.0 ([#6804](https://github.com/mem0ai/mem0/pull/6804))
+- **Themed icons:** The node and credential icons now declare `{ light, dark }` variants instead of a single icon, clearing the remaining `icon-prefer-themed-variants` warnings from the Creator Portal scan. No functional changes ([#6804](https://github.com/mem0ai/mem0/pull/6804))
+
+</Update>
+
 <Update label="2026-08-04" description="n8n-nodes-mem0 v0.1.2">

 **Changes:**
@@ -1,201 +1,21 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
+MIT License

-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+Copyright (c) 2023-2026 Taranjeet Singh

-   1. Definitions.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:

-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.

-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright [2026] [Taranjeet Singh]
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -11,7 +11,7 @@ export class Mem0Api implements ICredentialType {

 	displayName = 'Mem0 API';

-	icon: Icon = 'file:mem0.svg';
+	icon: Icon = { light: 'file:mem0.svg', dark: 'file:mem0.svg' };

 	documentationUrl = 'https://docs.mem0.ai/platform/quickstart';

@@ -21,7 +21,7 @@ export class Mem0 implements INodeType {
 	description: INodeTypeDescription = {
 		displayName: 'Mem0',
 		name: 'mem0',
-		icon: 'file:mem0.svg',
+		icon: { light: 'file:mem0.svg', dark: 'file:mem0.svg' },
 		group: ['transform'],
 		version: 1,
 		subtitle: '={{$parameter["operation"] + ": " + $parameter["resource"]}}',
@@ -1,6 +1,6 @@
 {
  "name": "@mem0/n8n-nodes-mem0",
-  "version": "0.1.2",
+  "version": "0.1.3",
  "description": "n8n community node for Mem0 — the memory layer for AI agents. Add, search, get, update, and delete long-term memories.",
  "keywords": [
    "n8n-community-node-package",
@@ -10,7 +10,7 @@
    "agents",
    "llm"
  ],
-  "license": "Apache-2.0",
+  "license": "MIT",
  "homepage": "https://mem0.ai",
  "author": {
    "name": "Mem0",
@@ -72,7 +72,7 @@
      "@qdrant/js-client-rest": "^1.18.0",
      "uuid@<11.1.1": ">=11.1.1",
      "esbuild": ">=0.28.1",
-      "undici@<6.27.0": ">=6.27.0 <8.0.0",
+      "undici@<7.29.0": ">=7.29.0 <8.0.0",
      "axios@<1.18.0": ">=1.18.0 <2.0.0",
      "postcss@<8.5.18": ">=8.5.18 <9.0.0",
      "mongoose@>=9.0.0 <9.7.2": ">=9.7.2 <10.0.0"
@@ -13,7 +13,7 @@ overrides:
  '@qdrant/js-client-rest': ^1.18.0
  uuid@<11.1.1: '>=11.1.1'
  esbuild: '>=0.28.1'
-  undici@<6.27.0: '>=6.27.0 <8.0.0'
+  undici@<7.29.0: '>=7.29.0 <8.0.0'
  axios@<1.18.0: '>=1.18.0 <2.0.0'
  postcss@<8.5.18: '>=8.5.18 <9.0.0'
  mongoose@>=9.0.0 <9.7.2: '>=9.7.2 <10.0.0'
@@ -2036,8 +2036,8 @@ packages:
  undici-types@6.21.0:
    resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}

-  undici@7.28.0:
-    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
+  undici@7.29.0:
+    resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==}
    engines: {node: '>=20.18.1'}

  util-deprecate@1.0.2:
@@ -2547,7 +2547,7 @@ snapshots:
    dependencies:
      '@qdrant/openapi-typescript-fetch': 1.2.6
      typescript: 5.9.3
-      undici: 7.28.0
+      undici: 7.29.0

  '@qdrant/openapi-typescript-fetch@1.2.6': {}

@@ -4121,7 +4121,7 @@ snapshots:

  undici-types@6.21.0: {}

-  undici@7.28.0: {}
+  undici@7.29.0: {}

  util-deprecate@1.0.2: {}

@@ -21,7 +21,7 @@ overrides:
  "@qdrant/js-client-rest": "^1.18.0"
  "uuid@<11.1.1": ">=11.1.1"
  "esbuild": ">=0.28.1"
-  "undici@<6.27.0": ">=6.27.0 <8.0.0"
+  "undici@<7.29.0": ">=7.29.0 <8.0.0"
  "axios@<1.18.0": ">=1.18.0 <2.0.0"
  "postcss@<8.5.18": ">=8.5.18 <9.0.0"
  "mongoose@>=9.0.0 <9.7.2": ">=9.7.2 <10.0.0"
@@ -73,8 +73,8 @@
      "form-data@<4.0.6": ">=4.0.6",
      "uuid@<11.1.1": ">=11.1.1",
      "esbuild": ">=0.28.1",
-      "undici@<6.27.0": ">=6.27.0 <8.0.0",
-      "undici@>=8.0.0 <8.5.0": ">=8.5.0",
+      "undici@<7.29.0": ">=7.29.0 <8.0.0",
+      "undici@>=8.0.0 <8.9.0": ">=8.9.0 <9.0.0",
      "axios@<1.18.0": ">=1.18.0 <2.0.0",
      "brace-expansion@>=3.0.0 <5.0.8": ">=5.0.8 <6.0.0",
      "postcss@<8.5.18": ">=8.5.18 <9.0.0",
@@ -8,8 +8,8 @@ overrides:
  form-data@<4.0.6: '>=4.0.6'
  uuid@<11.1.1: '>=11.1.1'
  esbuild: '>=0.28.1'
-  undici@<6.27.0: '>=6.27.0 <8.0.0'
-  undici@>=8.0.0 <8.5.0: '>=8.5.0'
+  undici@<7.29.0: '>=7.29.0 <8.0.0'
+  undici@>=8.0.0 <8.9.0: '>=8.9.0 <9.0.0'
  axios@<1.18.0: '>=1.18.0 <2.0.0'
  brace-expansion@>=3.0.0 <5.0.8: '>=5.0.8 <6.0.0'
  postcss@<8.5.18: '>=8.5.18 <9.0.0'
@@ -2354,12 +2354,12 @@ packages:
  undici-types@7.24.6:
    resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}

-  undici@7.28.0:
-    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
+  undici@7.29.0:
+    resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==}
    engines: {node: '>=20.18.1'}

-  undici@8.5.0:
-    resolution: {integrity: sha512-xamtWoB1EshgjpmlXd7GGm2VfdDtw1+rD8uhry8pSNW3If6S8E0m2T2+orSKeZXEn/aPJMviCpDBA65WJt8zhg==}
+  undici@8.10.0:
+    resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==}
    engines: {node: '>=22.19.0'}

  util-deprecate@1.0.2:
@@ -2942,7 +2942,7 @@ snapshots:
      minimatch: 10.2.5
      proper-lockfile: 4.1.2
      typebox: 1.1.38
-      undici: 8.5.0
+      undici: 8.10.0
      yaml: 2.9.0
    optionalDependencies:
      '@mariozechner/clipboard': 0.3.9
@@ -3203,7 +3203,7 @@ snapshots:
    dependencies:
      '@qdrant/openapi-typescript-fetch': 1.2.6
      typescript: 6.0.3
-      undici: 7.28.0
+      undici: 7.29.0

  '@qdrant/openapi-typescript-fetch@1.2.6': {}

@@ -4895,9 +4895,9 @@ snapshots:

  undici-types@7.24.6: {}

-  undici@7.28.0: {}
+  undici@7.29.0: {}

-  undici@8.5.0: {}
+  undici@8.10.0: {}

  util-deprecate@1.0.2: {}

@@ -5,8 +5,8 @@ overrides:
  "form-data@<4.0.6": ">=4.0.6"
  "uuid@<11.1.1": ">=11.1.1"
  "esbuild": ">=0.28.1"
-  "undici@<6.27.0": ">=6.27.0 <8.0.0"
-  "undici@>=8.0.0 <8.5.0": ">=8.5.0"
+  "undici@<7.29.0": ">=7.29.0 <8.0.0"
+  "undici@>=8.0.0 <8.9.0": ">=8.9.0 <9.0.0"
  "axios@<1.18.0": ">=1.18.0 <2.0.0"
  "brace-expansion@>=3.0.0 <5.0.8": ">=5.0.8 <6.0.0"
  "postcss@<8.5.18": ">=8.5.18 <9.0.0"
@@ -41,10 +41,17 @@
  ],
  "jest": {
    "testEnvironment": "node",
-    "testMatch": ["**/test/**/*.test.ts"],
-    "setupFiles": ["<rootDir>/test/setup.ts"],
+    "testMatch": [
+      "**/test/**/*.test.ts"
+    ],
+    "setupFiles": [
+      "<rootDir>/test/setup.ts"
+    ],
    "transform": {
-      "^.+\\.tsx?$": ["ts-jest", {}]
+      "^.+\\.tsx?$": [
+        "ts-jest",
+        {}
+      ]
    }
  },
  "dependencies": {
@@ -62,8 +69,9 @@
      "form-data@<4.0.6": ">=4.0.6",
      "uuid@<11.1.1": ">=11.1.1",
      "esbuild": ">=0.28.1",
-      "undici@<6.27.0": ">=6.27.0 <8.0.0",
-      "undici@>=8.0.0 <8.5.0": ">=8.5.0"
+      "undici@<7.29.0": ">=7.29.0 <8.0.0",
+      "undici@>=8.0.0 <8.9.0": ">=8.9.0 <9.0.0",
+      "brace-expansion@<1.1.16": ">=1.1.16 <2.0.0"
    }
  }
 }
@@ -8,8 +8,9 @@ overrides:
  form-data@<4.0.6: '>=4.0.6'
  uuid@<11.1.1: '>=11.1.1'
  esbuild: '>=0.28.1'
-  undici@<6.27.0: '>=6.27.0 <8.0.0'
-  undici@>=8.0.0 <8.5.0: '>=8.5.0'
+  undici@<7.29.0: '>=7.29.0 <8.0.0'
+  undici@>=8.0.0 <8.9.0: '>=8.9.0 <9.0.0'
+  brace-expansion@<1.1.16: '>=1.1.16 <2.0.0'

 importers:

@@ -413,8 +414,8 @@ packages:
    engines: {node: '>=6.0.0'}
    hasBin: true

-  brace-expansion@1.1.15:
-    resolution: {integrity: sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==}
+  brace-expansion@1.1.18:
+    resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==}

  braces@3.0.3:
    resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
@@ -530,6 +531,7 @@ packages:

  crypto-js@4.2.0:
    resolution: {integrity: sha512-KALDyEYgpY+Rlob/iriUtjV6d5Eq+Y191A5g4UqLAi8CyGP9N1+FdVbkc1SxKc2r4YAYqG8JzO2KGL+AizD70Q==}
+    deprecated: Active development of CryptoJS has been discontinued. This library is no longer maintained.

  debug@4.4.3:
    resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
@@ -1995,7 +1997,7 @@ snapshots:

  baseline-browser-mapping@2.10.41: {}

-  brace-expansion@1.1.15:
+  brace-expansion@1.1.18:
    dependencies:
      balanced-match: 1.0.2
      concat-map: 0.0.1
@@ -2792,7 +2794,7 @@ snapshots:

  minimatch@3.1.5:
    dependencies:
-      brace-expansion: 1.1.15
+      brace-expansion: 1.1.18

  minimist@1.2.8: {}

@@ -5,5 +5,6 @@ overrides:
  "form-data@<4.0.6": ">=4.0.6"
  "uuid@<11.1.1": ">=11.1.1"
  "esbuild": ">=0.28.1"
-  "undici@<6.27.0": ">=6.27.0 <8.0.0"
-  "undici@>=8.0.0 <8.5.0": ">=8.5.0"
+  "undici@<7.29.0": ">=7.29.0 <8.0.0"
+  "undici@>=8.0.0 <8.9.0": ">=8.9.0 <9.0.0"
+  "brace-expansion@<1.1.16": ">=1.1.16 <2.0.0"
@@ -292,18 +292,19 @@
      "glob@>=10.2.0 <10.5.0": "^10.5.0",
      "@modelcontextprotocol/sdk": "^1.25.4",
      "esbuild": ">=0.28.1",
-      "undici@<6.27.0": ">=6.27.0 <8.0.0",
+      "undici@<7.29.0": ">=7.29.0 <8.0.0",
      "@aws-sdk/client-bedrock-runtime": "3.967.0",
      "@aws-sdk/client-neptune-graph": "3.966.0",
      "axios@<1.18.0": ">=1.18.0 <2.0.0",
      "brace-expansion@<1.1.16": ">=1.1.16 <2.0.0",
-      "brace-expansion@>=2.0.0 <2.1.2": ">=2.1.2 <3.0.0",
+      "brace-expansion@>=2.0.0 <2.1.4": ">=2.1.4 <3.0.0",
      "brace-expansion@>=3.0.0 <5.0.8": ">=5.0.8 <6.0.0",
      "fast-xml-parser@>=5.0.0 <5.10.1": ">=5.10.1 <6.0.0",
      "tar@>=7.0.0 <7.5.21": ">=7.5.21 <8.0.0",
      "thrift@<0.23.0": "^0.23.0",
      "mongoose@>=9.0.0 <9.7.2": ">=9.7.2 <10.0.0",
-      "protobufjs@<7.6.5": ">=7.6.5 <8.0.0"
+      "protobufjs@<7.6.5": ">=7.6.5 <8.0.0",
+      "ip-address@<10.3.1": ">=10.3.1 <11.0.0"
    }
  }
 }
@@ -25,18 +25,19 @@ overrides:
  glob@>=10.2.0 <10.5.0: ^10.5.0
  '@modelcontextprotocol/sdk': ^1.25.4
  esbuild: '>=0.28.1'
-  undici@<6.27.0: '>=6.27.0 <8.0.0'
+  undici@<7.29.0: '>=7.29.0 <8.0.0'
  '@aws-sdk/client-bedrock-runtime': 3.967.0
  '@aws-sdk/client-neptune-graph': 3.966.0
  axios@<1.18.0: '>=1.18.0 <2.0.0'
  brace-expansion@<1.1.16: '>=1.1.16 <2.0.0'
-  brace-expansion@>=2.0.0 <2.1.2: '>=2.1.2 <3.0.0'
+  brace-expansion@>=2.0.0 <2.1.4: '>=2.1.4 <3.0.0'
  brace-expansion@>=3.0.0 <5.0.8: '>=5.0.8 <6.0.0'
  fast-xml-parser@>=5.0.0 <5.10.1: '>=5.10.1 <6.0.0'
  tar@>=7.0.0 <7.5.21: '>=7.5.21 <8.0.0'
  thrift@<0.23.0: ^0.23.0
  mongoose@>=9.0.0 <9.7.2: '>=9.7.2 <10.0.0'
  protobufjs@<7.6.5: '>=7.6.5 <8.0.0'
+  ip-address@<10.3.1: '>=10.3.1 <11.0.0'

 importers:

@@ -2165,8 +2166,8 @@ packages:
  brace-expansion@1.1.16:
    resolution: {integrity: sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==}

-  brace-expansion@2.1.2:
-    resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==}
+  brace-expansion@2.1.4:
+    resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==}

  brace-expansion@5.0.8:
    resolution: {integrity: sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==}
@@ -3027,8 +3028,8 @@ packages:
    resolution: {integrity: sha512-4rTJX6Q5wTYEvxboXi8DsEiUo+OvqJGtLYOSGm37KpdRXsG5XJjbVtYKGJpPSWP+QT7rWscA4vsrdmzbEbenpw==}
    engines: {node: '>=18.12.0'}

-  ip-address@10.2.0:
-    resolution: {integrity: sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==}
+  ip-address@10.4.0:
+    resolution: {integrity: sha512-oSK96Grm3aP6OrS263xVxbNDGVL7rzBtYdpGqlDG8iQdoenDoTs/nkki+DflYbAEE8Xl6o5YxhxlrKvI3nqKXQ==}
    engines: {node: '>= 12'}

  is-arrayish@0.2.1:
@@ -4626,8 +4627,8 @@ packages:
  undici-types@7.24.6:
    resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}

-  undici@7.28.0:
-    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
+  undici@7.29.0:
+    resolution: {integrity: sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==}
    engines: {node: '>=20.18.1'}

  update-browserslist-db@1.2.3:
@@ -6155,7 +6156,7 @@ snapshots:
      ms: 2.1.3
      secure-json-parse: 4.1.0
      tslib: 2.8.1
-      undici: 7.28.0
+      undici: 7.29.0
    transitivePeerDependencies:
      - supports-color

@@ -6711,7 +6712,7 @@ snapshots:
    dependencies:
      '@qdrant/openapi-typescript-fetch': 1.2.6
      typescript: 5.5.4
-      undici: 7.28.0
+      undici: 7.29.0

  '@qdrant/openapi-typescript-fetch@1.2.6': {}

@@ -7183,7 +7184,7 @@ snapshots:
  '@turbopuffer/turbopuffer@2.5.0':
    dependencies:
      pako: 2.2.0
-      undici: 7.28.0
+      undici: 7.29.0

  '@types/babel__core@7.20.5':
    dependencies:
@@ -7542,7 +7543,7 @@ snapshots:
      balanced-match: 1.0.2
      concat-map: 0.0.1

-  brace-expansion@2.1.2:
+  brace-expansion@2.1.4:
    dependencies:
      balanced-match: 1.0.2

@@ -8448,7 +8449,7 @@ snapshots:
    transitivePeerDependencies:
      - supports-color

-  ip-address@10.2.0: {}
+  ip-address@10.4.0: {}

  is-arrayish@0.2.1: {}

@@ -9076,7 +9077,7 @@ snapshots:

  minimatch@9.0.9:
    dependencies:
-      brace-expansion: 2.1.2
+      brace-expansion: 2.1.4

  minimist@1.2.8: {}

@@ -9886,7 +9887,7 @@ snapshots:

  socks@2.8.9:
    dependencies:
-      ip-address: 10.2.0
+      ip-address: 10.4.0
      smart-buffer: 4.2.0

  source-map-support@0.5.13:
@@ -10232,7 +10233,7 @@ snapshots:

  undici-types@7.24.6: {}

-  undici@7.28.0: {}
+  undici@7.29.0: {}

  update-browserslist-db@1.2.3(browserslist@4.28.2):
    dependencies:
@@ -25,13 +25,14 @@ overrides:
  "glob@>=10.2.0 <10.5.0": "^10.5.0"
  "@modelcontextprotocol/sdk": "^1.25.4"
  "esbuild": ">=0.28.1"
-  "undici@<6.27.0": ">=6.27.0 <8.0.0"
+  "undici@<7.29.0": ">=7.29.0 <8.0.0"
  "axios@<1.18.0": ">=1.18.0 <2.0.0"
  "brace-expansion@<1.1.16": ">=1.1.16 <2.0.0"
-  "brace-expansion@>=2.0.0 <2.1.2": ">=2.1.2 <3.0.0"
+  "brace-expansion@>=2.0.0 <2.1.4": ">=2.1.4 <3.0.0"
  "brace-expansion@>=3.0.0 <5.0.8": ">=5.0.8 <6.0.0"
  "fast-xml-parser@>=5.0.0 <5.10.1": ">=5.10.1 <6.0.0"
  "tar@>=7.0.0 <7.5.21": ">=7.5.21 <8.0.0"
  "thrift@<0.23.0": "^0.23.0"
  "mongoose@>=9.0.0 <9.7.2": ">=9.7.2 <10.0.0"
  "protobufjs@<7.6.5": ">=7.6.5 <8.0.0"
+  "ip-address@<10.3.1": ">=10.3.1 <11.0.0"
@@ -1,4 +1,4 @@
-import type { Connection, Pool } from "oracledb";
+import type { BindParameters, Connection, Pool } from "oracledb";
 import { v4 as uuidv4 } from "uuid";
 import { VectorStore } from "./base";
 import { SearchFilters, VectorStoreConfig, VectorStoreResult } from "../types";
@@ -401,7 +401,15 @@ export class OracleAIVectorSearch implements VectorStore {

  async initialize(): Promise<void> {
    if (!this._initPromise) {
-      this._initPromise = this._doInitialize();
+      this._initPromise = this._doInitialize().catch(async (error) => {
+        if (this.ownsClient && this.client) {
+          await Promise.resolve(this.client.close()).catch(() => {});
+          this.client = undefined;
+          this.ownsClient = false;
+        }
+        this._initPromise = undefined;
+        throw error;
+      });
    }
    return this._initPromise;
  }
@@ -565,19 +573,33 @@ export class OracleAIVectorSearch implements VectorStore {
    ids: string[],
    payloads: Record<string, any>[],
  ): Promise<void> {
+    if (ids.length !== vectors.length) {
+      throw new Error("ids and vectors must have the same length");
+    }
+    if (payloads.length !== vectors.length) {
+      throw new Error("payloads and vectors must have the same length");
+    }
+
+    if (vectors.length === 0) return;
+
    await this.initialize();

    await this.withConnection(async (connection) => {
-      for (let i = 0; i < vectors.length; i++) {
-        await connection.execute(
-          `INSERT INTO ${this.collectionName} (id, vector, payload) VALUES (:id, :vector, :payload)`,
-          {
-            id: ids[i],
-            vector: this.vectorBind(vectors[i]),
-            payload: this.payloadBind(payloads[i] ?? {}),
+      await connection.executeMany(
+        `INSERT INTO ${this.collectionName} (id, vector, payload) VALUES (:id, :vector, :payload)`,
+        vectors.map((vector, i) => ({
+          id: ids[i],
+          vector: new Float32Array(vector),
+          payload: payloads[i] ?? {},
+        })) as BindParameters[],
+        {
+          bindDefs: {
+            id: { type: this.oracledb.DB_TYPE_VARCHAR, maxSize: 36 },
+            vector: { type: this.oracledb.DB_TYPE_VECTOR },
+            payload: { type: this.oracledb.DB_TYPE_JSON },
          },
-        );
-      }
+        },
+      );
    }, true);
  }

@@ -589,8 +611,12 @@ export class OracleAIVectorSearch implements VectorStore {
    await this.initialize();

    const [whereClause, filterBinds] = buildWhereClause(filters);
+    const hasFilter = whereClause.length > 0;
+    const selectClause = hasFilter
+      ? "SELECT"
+      : `SELECT /*+ VECTOR_INDEX_TRANSFORM(${this.collectionName}) */`;
    const sql =
-      `SELECT id, payload, VECTOR_DISTANCE(vector, :query_vec, ${this.distanceMetric}) distance ` +
+      `${selectClause} id, payload, VECTOR_DISTANCE(vector, :query_vec, ${this.distanceMetric}) distance ` +
      `FROM ${this.collectionName} ${whereClause} ORDER BY distance FETCH APPROX FIRST :max_rows ROWS ONLY`;

    const rows = await this.withConnection(async (connection) => {
@@ -687,20 +713,17 @@ export class OracleAIVectorSearch implements VectorStore {

    return this.withConnection(async (connection) => {
      const listResult = await connection.execute<any[]>(
-        `SELECT id, payload FROM ${this.collectionName} ${whereClause} FETCH FIRST :max_rows ROWS ONLY`,
+        `SELECT id, payload, COUNT(*) OVER () total FROM ${this.collectionName} ${whereClause} FETCH FIRST :max_rows ROWS ONLY`,
        { ...filterBinds, max_rows: topK },
      );
-      const countResult = await connection.execute<any[]>(
-        `SELECT COUNT(*) FROM ${this.collectionName} ${whereClause}`,
-        filterBinds,
-      );

-      const results = (listResult.rows ?? []).map((row) => ({
+      const rows = listResult.rows ?? [];
+      const results = rows.map((row) => ({
        id: row[0],
        payload: this.loadPayload(row[1]),
      }));

-      return [results, Number(countResult.rows?.[0]?.[0] ?? 0)];
+      return [results, Number(rows[0]?.[2] ?? 0)];
    });
  }

@@ -2,10 +2,21 @@
 /** Oracle AI Vector Search filter, config and SQL tests. The driver is mocked, so no database is needed. */
 const DB_TYPE_VECTOR = { name: "DB_TYPE_VECTOR" };
 const DB_TYPE_JSON = { name: "DB_TYPE_JSON" };
+const DB_TYPE_VARCHAR = { name: "DB_TYPE_VARCHAR" };

-jest.mock("oracledb", () => ({ thin: true, DB_TYPE_VECTOR, DB_TYPE_JSON }), {
-  virtual: true,
-});
+const mockCreatePool = jest.fn();
+
+jest.mock(
+  "oracledb",
+  () => ({
+    thin: true,
+    DB_TYPE_VECTOR,
+    DB_TYPE_JSON,
+    DB_TYPE_VARCHAR,
+    createPool: mockCreatePool,
+  }),
+  { virtual: true },
+);

 import {
  OracleAIVectorSearch,
@@ -13,7 +24,7 @@ import {
  quoteIdentifier,
 } from "../src/vector_stores/oracledb";

-type Call = { sql: string; binds: any };
+type Call = { sql: string; binds: any; options?: any };

 function fakeConnection(calls: Call[], resultsBySql: Array<any[][]>) {
  let selectIndex = 0;
@@ -26,6 +37,10 @@ function fakeConnection(calls: Call[], resultsBySql: Array<any[][]>) {
      }
      return { rows: [] };
    },
+    async executeMany(sql: string, binds: any[], options: any = {}) {
+      calls.push({ sql: sql.replace(/\s+/g, " ").trim(), binds, options });
+      return { rows: [] };
+    },
    async commit() {},
    async rollback() {},
    async close() {},
@@ -249,13 +264,56 @@ describe("OracleAIVectorSearch SQL", () => {
    await makeStore(calls).insert([[1, 2, 3]], ["id-1"], [{ data: "hello" }]);

    const insert = calls.find((c) => c.sql.startsWith("INSERT INTO"))!;
-    expect(insert.binds.id).toBe("id-1");
-    expect(insert.binds.vector.type).toBe(DB_TYPE_VECTOR);
-    expect(insert.binds.vector.val).toEqual(new Float32Array([1, 2, 3]));
-    expect(insert.binds.payload).toEqual({
-      type: DB_TYPE_JSON,
-      val: { data: "hello" },
+    expect(insert.binds).toEqual([
+      {
+        id: "id-1",
+        vector: new Float32Array([1, 2, 3]),
+        payload: { data: "hello" },
+      },
+    ]);
+    expect(insert.options.bindDefs.id).toEqual({
+      type: DB_TYPE_VARCHAR,
+      maxSize: 36,
    });
+    expect(insert.options.bindDefs.vector.type).toBe(DB_TYPE_VECTOR);
+    expect(insert.options.bindDefs.payload.type).toBe(DB_TYPE_JSON);
+  });
+
+  it("issues a single executeMany call with one bind row per vector on a multi-row insert", async () => {
+    const calls: Call[] = [];
+    await makeStore(calls).insert(
+      [
+        [1, 2, 3],
+        [4, 5, 6],
+      ],
+      ["id-1", "id-2"],
+      [{ a: 1 }, { b: 2 }],
+    );
+
+    const inserts = calls.filter((c) => c.sql.startsWith("INSERT INTO"));
+    expect(inserts).toHaveLength(1);
+    expect(inserts[0].binds).toHaveLength(2);
+    expect(inserts[0].binds[0].id).toBe("id-1");
+    expect(inserts[0].binds[1].id).toBe("id-2");
+  });
+
+  it("issues no insert statement when inserting an empty batch", async () => {
+    const calls: Call[] = [];
+    await makeStore(calls).insert([], [], []);
+    expect(calls.filter((c) => c.sql.startsWith("INSERT INTO"))).toHaveLength(
+      0,
+    );
+  });
+
+  it("rejects insert batches whose IDs or payloads do not match vectors", async () => {
+    const store = makeStore([]);
+
+    await expect(store.insert([[1, 2, 3]], [], [{}])).rejects.toThrow(
+      "ids and vectors must have the same length",
+    );
+    await expect(store.insert([[1, 2, 3]], ["id-1"], [])).rejects.toThrow(
+      "payloads and vectors must have the same length",
+    );
  });

  it("converts cosine distance to a similarity score", async () => {
@@ -266,7 +324,7 @@ describe("OracleAIVectorSearch SQL", () => {
    expect(results).toEqual([
      { id: "id-1", payload: { data: "hello" }, score: 0.75 },
    ]);
-    const select = calls.find((c) => c.sql.startsWith("SELECT id, payload,"))!;
+    const select = calls.find((c) => c.sql.includes("VECTOR_DISTANCE"))!;
    expect(select.sql).toContain(
      "VECTOR_DISTANCE(vector, :query_vec, COSINE) distance",
    );
@@ -282,6 +340,24 @@ describe("OracleAIVectorSearch SQL", () => {
    expect(result.score).toBeCloseTo(0.4);
  });

+  it("adds the VECTOR_INDEX_TRANSFORM hint when searching without filters", async () => {
+    const calls: Call[] = [];
+    const store = makeStore(calls, [[["id-1", {}, 0.1]]]);
+    await store.search([1, 2, 3], 5);
+
+    const select = calls.find((c) => c.sql.includes("VECTOR_DISTANCE"))!;
+    expect(select.sql).toContain('/*+ VECTOR_INDEX_TRANSFORM("mem0") */');
+  });
+
+  it("omits the VECTOR_INDEX_TRANSFORM hint when searching with filters", async () => {
+    const calls: Call[] = [];
+    const store = makeStore(calls, [[["id-1", {}, 0.1]]]);
+    await store.search([1, 2, 3], 5, { user_id: "alice" });
+
+    const select = calls.find((c) => c.sql.includes("VECTOR_DISTANCE"))!;
+    expect(select.sql).not.toContain("VECTOR_INDEX_TRANSFORM");
+  });
+
  it("parses a payload returned as a JSON string", async () => {
    const store = makeStore([], [[["id-1", '{"data":"hello"}']]]);
    expect(await store.get("id-1")).toEqual({
@@ -313,16 +389,87 @@ describe("OracleAIVectorSearch SQL", () => {

  it("returns rows and the total count from list", async () => {
    const calls: Call[] = [];
-    const store = makeStore(calls, [[["id-1", { data: "hello" }]], [[7]]]);
+    const store = makeStore(calls, [[["id-1", { data: "hello" }, 7]]]);
    const [results, count] = await store.list({ user_id: "alice" }, 10);

    expect(results).toEqual([{ id: "id-1", payload: { data: "hello" } }]);
    expect(count).toBe(7);

-    const list = calls.find((c) =>
-      c.sql.startsWith("SELECT id, payload FROM"),
-    )!;
+    const selects = calls.filter((c) => /^SELECT/i.test(c.sql));
+    expect(selects).toHaveLength(1);
+    const [list] = selects;
+    expect(list.sql).toContain(
+      "SELECT id, payload, COUNT(*) OVER () total FROM",
+    );
    expect(list.sql).toContain("WHERE JSON_EXISTS(payload,");
    expect(list.binds).toEqual({ f_0: "alice", max_rows: 10 });
  });
+
+  it("returns a total of 0 from list when no rows match", async () => {
+    const store = makeStore([], [[]]);
+    const [results, count] = await store.list();
+    expect(results).toEqual([]);
+    expect(count).toBe(0);
+  });
+});
+
+describe("OracleAIVectorSearch initialization failure", () => {
+  beforeEach(() => mockCreatePool.mockReset());
+
+  function fakePool(serverVersion: string) {
+    const connection = {
+      ...fakeConnection([], []),
+      oracleServerVersionString: serverVersion,
+    };
+    return {
+      close: jest.fn(async () => {}),
+      getConnection: jest.fn(async () => connection),
+    };
+  }
+
+  function makePoolStore() {
+    return new OracleAIVectorSearch({
+      connectionParams: { user: "u", password: "p", connectString: "d" },
+      collectionName: "mem0",
+      embeddingModelDims: 3,
+    } as any);
+  }
+
+  it("closes the pool it owns when initialization fails", async () => {
+    const pool = fakePool("23.3.0.24.05");
+    mockCreatePool.mockResolvedValue(pool);
+
+    await expect(makePoolStore().initialize()).rejects.toThrow(
+      "Oracle DB version 23.3.0.24.05 not supported",
+    );
+    expect(pool.close).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not cache the rejection, so a later attempt can succeed", async () => {
+    const failing = fakePool("23.3.0.24.05");
+    const working = fakePool("23.4.0.24.05");
+    mockCreatePool
+      .mockResolvedValueOnce(failing)
+      .mockResolvedValueOnce(working);
+
+    const store = makePoolStore();
+    await expect(store.initialize()).rejects.toThrow("not supported");
+    await expect(store.initialize()).resolves.toBeUndefined();
+    expect(mockCreatePool).toHaveBeenCalledTimes(2);
+  });
+
+  it("leaves a caller-supplied client open when initialization fails", async () => {
+    const client = fakeConnection([], []);
+    client.oracleServerVersionString = "23.3.0.24.05";
+    const close = jest.spyOn(client, "close");
+
+    const store = new OracleAIVectorSearch({
+      client: client as any,
+      collectionName: "mem0",
+      embeddingModelDims: 3,
+    } as any);
+
+    await expect(store.initialize()).rejects.toThrow("not supported");
+    expect(close).not.toHaveBeenCalled();
+  });
 });
@@ -791,6 +791,11 @@ class Memory(MemoryBase):
                are treated as general conversational/factual memories.
            prompt (str, optional): Prompt to use for the memory creation. Defaults to None.

+        Note:
+            `search()` and `get_all()` scope queries via `filters={"user_id": "...", "agent_id": "...", "run_id": "..."}` —
+            they reject top-level `user_id`/`agent_id`/`run_id` arguments. `add()` accepts them top-level, but passing
+            the same arguments to `search()`/`get_all()` raises a `ValueError`; use the `filters` form there instead.
+

        Returns:
            dict: A dictionary containing the result of the memory addition operation, typically
@@ -2447,6 +2452,12 @@ class AsyncMemory(MemoryBase):
                                         Pass "procedural_memory" to create procedural memories.
            prompt (str, optional): Prompt to use for the memory creation. Defaults to None.
            llm (BaseChatModel, optional): LLM class to use for generating procedural memories. Defaults to None. Useful when user is using LangChain ChatModel.
+
+        Note:
+            `search()` and `get_all()` scope queries via `filters={"user_id": "...", "agent_id": "...", "run_id": "..."}` —
+            they reject top-level `user_id`/`agent_id`/`run_id` arguments. `add()` accepts them top-level, but passing
+            the same arguments to `search()`/`get_all()` raises a `ValueError`; use the `filters` form there instead.
+
        Returns:
            dict: A dictionary containing the result of the memory addition operation.
        """
@@ -245,25 +245,34 @@ class OracleAIVectorSearch(VectorStoreBase):
            self.client = oracledb.connect(**self.config.connection_params)
            self._owns_client = True

-        if not (hasattr(self.client, "thin") and self.client.thin):
-            if oracledb.clientversion()[:2] < (23, 4):
-                raise RuntimeError(
-                    f"Oracle DB client driver version {'.'.join(map(str, oracledb.clientversion()))} "
-                    "not supported, must be >=23.4 for vector support"
+        try:
+            if not (hasattr(self.client, "thin") and self.client.thin):
+                if oracledb.clientversion()[:2] < (23, 4):
+                    raise RuntimeError(
+                        f"Oracle DB client driver version {'.'.join(map(str, oracledb.clientversion()))} "
+                        "not supported, must be >=23.4 for vector support"
+                    )
+
+            if isinstance(self.client, oracledb.Connection):
+                db_version = tuple([int(v) for v in self.client.version.split(".")])
+            else:
+                with self.client.acquire() as conn:
+                    db_version = tuple([int(v) for v in conn.version.split(".")])
+
+            if db_version < (23, 4):
+                raise ValueError(
+                    f"Oracle DB version {'.'.join(map(str, db_version))} not supported, "
+                    "must be >=23.4 for vector support"
                )

-        if isinstance(self.client, oracledb.Connection):
-            db_version = tuple([int(v) for v in self.client.version.split(".")])
-        else:
-            with self.client.acquire() as conn:
-                db_version = tuple([int(v) for v in conn.version.split(".")])
-
-        if db_version < (23, 4):
-            raise ValueError(
-                f"Oracle DB version {'.'.join(map(str, db_version))} not supported, must be >=23.4 for vector support"
-            )
-
-        self.create_col()
+            self.create_col()
+        except Exception:
+            if self._owns_client:
+                try:
+                    self.client.close()
+                except Exception:
+                    pass
+            raise

    @contextmanager
    def _get_cursor(self, commit: bool = False):
@@ -331,6 +331,27 @@ def test_config_rejects_none_for_non_optional_fields(field, value):
        OracleAIVectorSearchConfig(client=object(), **{field: value})


+def test_init_closes_owned_client_when_post_connect_setup_fails(monkeypatch):
+    fake_connection = MagicMock(spec=oracledb.Connection)
+    fake_connection.thin = True
+    fake_connection.version = "23.4.0.0"
+
+    monkeypatch.setattr(oracledb, "connect", MagicMock(return_value=fake_connection))
+    monkeypatch.setattr(OracleAIVectorSearch, "create_col", MagicMock(side_effect=RuntimeError("boom")))
+    monkeypatch.setattr(OracleAIVectorSearch, "__del__", lambda self: None)
+
+    with pytest.raises(RuntimeError, match="boom"):
+        OracleAIVectorSearch(
+            collection_name=_unique_collection_name(),
+            embedding_model_dims=DIM,
+            connection_params={"user": "u", "password": "p", "dsn": "d"},
+            use_connection_pool=False,
+            do_create_index=False,
+        )
+
+    fake_connection.close.assert_called_once()
+
+
@pytest.mark.parametrize(
    ("metric", "distance", "expected_score"),
    [
Author	SHA1	Message	Date
harshgupta-mem0	d3d9cc9e26	fix(security): patch 8 HIGH + 18 MEDIUM Vanta vulnerabilities Bumps three transitive packages across four pnpm workspaces via overrides. Manifests and lockfiles only; no source changes. undici 7.28.0 -> 7.29.0 mem0-ts, openclaw, pi-agent-plugin 8.5.0 -> 8.10.0 pi-agent-plugin (GHSA-4cwx-7wf7-3272 +4) ip-address 10.2.0 -> 10.4.0 mem0-ts (GHSA-mwp4-54f8-5fhr +2) brace-expansion 2.1.2 -> 2.1.4 mem0-ts (GHSA-rgw5-rvv9-x895, GHSA-mh99-v99m-4gvg) 1.1.15 -> 1.1.18 zapier-mem0 (GHSA-3jxr-9vmj-r5cp) Existing override keys were replaced in place rather than added alongside: pnpm applies only the first override matching a bare package name, so a stale broader key (e.g. undici@<6.27.0) would have shadowed a new narrower one and silently held the vulnerable version. Overrides are written to both package.json and pnpm-workspace.yaml because openclaw, pi-agent-plugin and zapier-mem0 run pnpm 9 in CI, which reads overrides only from package.json. Verified: 26/41 open alerts clear against the regenerated lockfiles; frozen-lockfile passes under each workspace's CI pnpm major; runtime API smoke 7/7; mem0-ts 1505/1505, openclaw 446/446, pi-agent 100/100, zapier 17/17. Fixes: https://app.vanta.com/c/mem0.ai/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-critical?tab=results Fixes: https://app.vanta.com/c/mem0.ai/tests/packages-checked-for-vulnerabilities-v2-records-closed-github-dependabot-high?tab=results	2026-08-07 17:22:49 +05:30
Diwakar Ray YadavandGitHub	b05dc2740f	docs(memory): note filters-based scoping for search/get_all on add() (#6758 )	2026-08-07 14:03:09 +05:30
KartikandGitHub	4a0a9a92a6	fix(ts-oss, py): release Oracle client on init failure, validate insert batches (#6839 )	2026-08-06 18:16:25 +05:30
KartikandGitHub	beea626f0a	perf(ts-oss): cut Oracle vector store round trips per review feedback (#6835 )	2026-08-06 15:12:14 +05:30
Himanshu GitHub kartik-mem0	3f39fba28f	fix(n8n): MIT license + themed icons for verified-node vetting (#6804 ) Co-authored-by: kartik-mem0 <kartik.labhshetwar@mem0.ai>	2026-08-06 00:00:13 +05:30