ea27ef95ec
* fix: resolve all Dependabot security vulnerabilities
npm (package-lock.json):
- fast-xml-parser: 4.5.3 → 4.5.4 (critical entity encoding bypass + DoS)
- serialize-javascript: 6.0.2 → 7.0.4 (high RCE via RegExp/Date)
- minimatch: 3.1.2 → 3.1.5, 5.1.6 → 5.1.9, 9.0.5 → 9.0.9 (high ReDoS)
- ajv: 6.12.6 → 6.14.0, 8.17.1 → 8.18.0 (medium ReDoS with $data option)
- qs: 6.14.1 → 6.15.0 (low arrayLimit bypass DoS)
- rollup: 4.57.x → 4.59.0 in ai-sdk and openclaw integrations (high path traversal)
Python (uv.lock / pyproject.toml):
- cryptography: 46.0.3 → 46.0.5 (high subgroup attack on SECT curves)
- pillow: 12.0.0 → 12.1.1 (high out-of-bounds write in PSD loading)
- langchain-core: 1.2.7 → 1.2.17 (low SSRF in ChatOpenAI token counting)
- langsmith: 0.4.42 → 0.7.11 (medium SSRF via tracing header injection)
- protobuf: 6.33.1 → 6.33.5 (high JSON recursion depth bypass)
Rust (Cargo.lock):
- bytes: 1.11.0 → 1.11.1 in hindsight-clients/rust (medium integer overflow)
Remaining unfixable: diskcache <= 5.6.3 (no patched version available)
* fix: remove over-broad schema-utils ajv override that broke docs build
The 'schema-utils': {'ajv': '^8.18.0'} override was forcing schema-utils@3.x
(used by url-loader/file-loader with ajv-keywords@3.x) to use ajv@8.18.0.
In 8.18.0, internal property _formats was renamed to formats, breaking
ajv-keywords@3.x's _formatLimit.js which accesses ajv._formats.date.
Removing the broad override: schema-utils@4.3.3 (root level) already has
ajv@8.18.0 in its nested install from the prior npm update, while
schema-utils@3.x correctly falls back to the hoisted root ajv@6.14.0.
61 lines
1.3 KiB
JSON
61 lines
1.3 KiB
JSON
{
|
|
"name": "@vectorize-io/hindsight-ai-sdk",
|
|
"version": "0.4.15",
|
|
"description": "Hindsight memory integration for Vercel AI SDK - Give your AI agents persistent, human-like memory",
|
|
"main": "dist/index.js",
|
|
"types": "dist/index.d.ts",
|
|
"type": "module",
|
|
"exports": {
|
|
".": {
|
|
"types": "./dist/index.d.ts",
|
|
"import": "./dist/index.js"
|
|
}
|
|
},
|
|
"keywords": [
|
|
"ai",
|
|
"ai-sdk",
|
|
"vercel",
|
|
"memory",
|
|
"hindsight",
|
|
"agents",
|
|
"llm",
|
|
"long-term-memory"
|
|
],
|
|
"author": "Vectorize <support@vectorize.io>",
|
|
"license": "MIT",
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "https://github.com/vectorize-io/hindsight.git",
|
|
"directory": "hindsight-integrations/ai-sdk"
|
|
},
|
|
"files": [
|
|
"dist",
|
|
"README.md"
|
|
],
|
|
"scripts": {
|
|
"build": "tsc",
|
|
"dev": "tsc --watch",
|
|
"clean": "rm -rf dist",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"prepublishOnly": "npm run clean && npm run build"
|
|
},
|
|
"peerDependencies": {
|
|
"ai": "^6.0.0",
|
|
"zod": "^3.0.0 || ^4.0.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/node": "^22.0.0",
|
|
"@vitest/ui": "^4.0.18",
|
|
"ai": "^6.0.2",
|
|
"typescript": "^5.7.0",
|
|
"vitest": "^4.0.18",
|
|
"zod": "^4.2.0"
|
|
},
|
|
"engines": {
|
|
"node": ">=22"
|
|
},
|
|
"overrides": {
|
|
"rollup": "^4.59.0"
|
|
}
|
|
}
|