Skip to content

cdeust/Cortex

v3.18.4 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo MCP Data & Storage
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

agent-memory-system anthropic causal-inference claude claude-code claude-code-plugin
+14 more
cognitive-architecture cognitive-science episodic-memory hopfield-network llm-memory long-term-memory mcp-server memory model-context-protocol neuroscience persistent-memory predictive-coding retrieval-augmented-generation vector-db

Affected surfaces

rce_ssrf deps

Summary

AI summary

Fixes in graph, setup, security, ingestion, CI, AP bridge, viz modules; marketplace feature added.

Full changelog
  • fix(graph): use _node_order length for bounded-discard cursor
  • fix(setup): per-user DATABASE_URL config + three-way DB diagnostics (#58)
  • fix(sec): resolve CodeQL CWE-22 path-injection (#90,#86) and weak-hash (#84) (#57)
  • chore(deps): bump the uv group across 1 directory with 2 updates (#56)
  • refactor(ingestion): prune vendored dirs in source walk (no rglob descent) (#55)
  • feat(marketplace): list zetetic-team-subagents alongside cortex (#54)
  • fix(ci+sec): idempotent relationship upsert, I2 line drift, inline CWE-22 sanitisers (#53)
  • Release 3.18.4
  • fix(ingest): stop writing symbol memory rows — entities only, cap at 50k symbols
  • fix(ci): catch LocalEntryNotFoundError for HF cache miss on newer huggingface_hub
  • fix(ci): ruff format the repo green + exclude transient agent worktrees
  • release(3.18.4): progressive graph build, any-file git diff/AST, self-healing AP bridge
  • fix(ap): self-healing MCP bridge — kill the handshake flakiness root causes
  • fix(viz+sec): legend counts rendered graph; CodeQL path-injection sanitisers; drop dead lod.js
  • fix(ingest): prune precedent code-graphs on re-index ("update a version → remove the precedent")
  • fix(viz): legend counts the RENDERED graph, not server meta (fixes 0-discussions + mismatch)
  • fix(viz): AP impact diagram — normalize absolute paths to AP's repo-relative File.id
  • fix(viz): progressive graph build — bounded memory, keyset streaming, no migration storm

What's Changed

  • fix(ci+sec): idempotent relationship upsert, I2 line drift, inline CWE-22 sanitisers by @cdeust in https://github.com/cdeust/Cortex/pull/53
  • feat(marketplace): list zetetic-team-subagents alongside cortex by @cdeust in https://github.com/cdeust/Cortex/pull/54
  • refactor(ingestion): prune vendored dirs in source walk (no rglob descent) by @cdeust in https://github.com/cdeust/Cortex/pull/55
  • chore(deps): bump the uv group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/cdeust/Cortex/pull/56
  • fix(sec): resolve CodeQL CWE-22 path-injection (#90,#86) and weak-hash (#84) by @cdeust in https://github.com/cdeust/Cortex/pull/57
  • fix(setup): per-user DATABASE_URL config + three-way DB diagnostics by @cdeust in https://github.com/cdeust/Cortex/pull/58

Full Changelog: https://github.com/cdeust/Cortex/compare/v3.18.3...v3.18.4

Security Fixes

  • Resolve CodeQL CWE-22 path-injection and weak-hash vulnerabilities
  • Inline CWE-22 sanitizers in CI+sec fix (#53)
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track cdeust/Cortex

Get notified when new releases ship.

Sign up free

About cdeust/Cortex

Persistent memory for Claude Code grounded in computational neuroscience (41 cited papers)

All releases →

Related context

Beta — feedback welcome: [email protected]