harshgupta-mem0andClaude Opus 4.8
ff5b0e778b
Adds a pnpm override forcing form-data >=4.0.6 in all five workspaces that resolved the vulnerable transitive form-data@4.0.5 (CVE-2026-12143, GHSA-hmw2-7cc7-3qxx — CRLF injection via unescaped multipart field names/filenames). Override added to pnpm-workspace.yaml everywhere, and also to package.json pnpm.overrides for the workspaces whose CI pnpm version reads it (mem0-ts, openmemory/ui, pi-agent-plugin, openclaw). Lockfiles regenerated with each workspace's CI pnpm version; only form-data changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
24 lines
516 B
YAML
24 lines
516 B
YAML
packages:
|
|
- '.'
|
|
|
|
allowBuilds:
|
|
'@google/genai': set this to true or false
|
|
better-sqlite3: set this to true or false
|
|
esbuild: set this to true or false
|
|
protobufjs: set this to true or false
|
|
|
|
onlyBuiltDependencies:
|
|
- better-sqlite3
|
|
- esbuild
|
|
- protobufjs
|
|
|
|
overrides:
|
|
"form-data@<4.0.6": ">=4.0.6"
|
|
"protobufjs@<7.5.5": "^7.5.5"
|
|
"vite": "^8.0.5"
|
|
"langsmith@<0.6.0": "^0.6.0"
|
|
"picomatch@<2.3.2": "^2.3.2"
|
|
"@qdrant/js-client-rest": "^1.18.0"
|
|
"uuid@<11.1.1": ">=11.1.1"
|
|
"esbuild": ">=0.28.1"
|