ts-v3.0.6

mem0ai/mem0ts-v3.0.6Jun 1, 2026by whysosaket

AI Summary

A security update for the Mem0 Node SDK addressing prototype-pollution vulnerabilities and various CVEs.

Key Highlights

Bumped axios to fix prototype-pollution CVEs
Pinned transitive dependencies (jws, langsmith, tar-fs, etc.) to remediate CVEs

Full Release Notes

## Mem0 Node SDK (v3.0.6)

**Security:**
- **Dependencies:** Bumped `axios` to `^1.16.0` to remediate high-severity prototype-pollution CVEs (credential theft, MITM, DoS). Pinned transitive dependencies via pnpm overrides: `jws` → 4.0.1 (CVE-2025-65945), `langsmith` → ^0.6.0 (CVE-2026-45134), `tar-fs` → ^2.1.4 (CVE-2025-48387, CVE-2025-59343), `picomatch` → ^2.3.2 (CVE-2026-33671), `minimatch` → ^3.1.3 / ^5.1.8 / ^9.0.7 (CVE-2026-27903, CVE-2026-27904, CVE-2026-26996), `path-to-regexp` → ^8.4.0 (CVE-2026-4926), `rollup` → ^4.59.0 (CVE-2026-27606), `glob` → ^10.5.0 (CVE-2025-64756), `@modelcontextprotocol/sdk` → ^1.25.4 (CVE-2025-66414, CVE-2026-0621)