harshgupta-mem0andClaude Opus 4.8
ff5b0e778b
Adds a pnpm override forcing form-data >=4.0.6 in all five workspaces that resolved the vulnerable transitive form-data@4.0.5 (CVE-2026-12143, GHSA-hmw2-7cc7-3qxx — CRLF injection via unescaped multipart field names/filenames). Override added to pnpm-workspace.yaml everywhere, and also to package.json pnpm.overrides for the workspaces whose CI pnpm version reads it (mem0-ts, openmemory/ui, pi-agent-plugin, openclaw). Lockfiles regenerated with each workspace's CI pnpm version; only form-data changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
27 lines
698 B
YAML
27 lines
698 B
YAML
packages:
|
|
- "."
|
|
|
|
onlyBuiltDependencies:
|
|
- esbuild
|
|
- better-sqlite3
|
|
|
|
overrides:
|
|
"form-data@<4.0.6": ">=4.0.6"
|
|
"picomatch@<2.3.2": "^2.3.2"
|
|
"picomatch@>=4.0.0 <4.0.4": "^4.0.4"
|
|
"jws@4.0.0": "4.0.1"
|
|
"js-yaml@<3.14.2": ">=3.14.2"
|
|
"langsmith@<0.6.0": "^0.6.0"
|
|
"minimatch@<3.1.3": "^3.1.3"
|
|
"minimatch@>=5.0.0 <5.1.8": "^5.1.8"
|
|
"minimatch@>=9.0.0 <9.0.7": "^9.0.7"
|
|
"path-to-regexp@>=8.0.0 <8.4.0": "^8.4.0"
|
|
"postcss@<8.5.10": ">=8.5.10"
|
|
"uuid@<11.1.1": ">=11.1.1"
|
|
"ws@>=8.0.0 <8.20.1": ">=8.20.1"
|
|
"rollup@>=4.0.0 <4.59.0": "^4.59.0"
|
|
"tar-fs@>=2.0.0 <2.1.4": "^2.1.4"
|
|
"glob@>=10.2.0 <10.5.0": "^10.5.0"
|
|
"@modelcontextprotocol/sdk": "^1.25.4"
|
|
"esbuild": ">=0.28.1"
|