harshgupta-mem0andClaude Opus 4.8
ff5b0e778b
Adds a pnpm override forcing form-data >=4.0.6 in all five workspaces that resolved the vulnerable transitive form-data@4.0.5 (CVE-2026-12143, GHSA-hmw2-7cc7-3qxx — CRLF injection via unescaped multipart field names/filenames). Override added to pnpm-workspace.yaml everywhere, and also to package.json pnpm.overrides for the workspaces whose CI pnpm version reads it (mem0-ts, openmemory/ui, pi-agent-plugin, openclaw). Lockfiles regenerated with each workspace's CI pnpm version; only form-data changes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
16 lines
331 B
YAML
16 lines
331 B
YAML
packages:
|
|
- '.'
|
|
|
|
onlyBuiltDependencies:
|
|
- "@parcel/watcher"
|
|
- sharp
|
|
|
|
overrides:
|
|
"form-data@<4.0.6": ">=4.0.6"
|
|
"immutable@>=5.0.0 <5.1.5": "^5.1.5"
|
|
"picomatch@<2.3.2": "^2.3.2"
|
|
"minimatch@>=9.0.0 <9.0.7": "^9.0.7"
|
|
"glob@>=10.2.0 <10.5.0": "^10.5.0"
|
|
"postcss@<8.5.10": ">=8.5.10"
|
|
"yaml@>=2.0.0 <2.8.3": ">=2.8.3"
|