This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+14 more
Affected surfaces
Summary
AI summaryUpdates Privacy, Tests, and https://docs.claude-mem.ai/telemetry across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Adds regression test ensuring PostHog client constructed with `disableGeoip: false`. Adds regression test ensuring PostHog client constructed with `disableGeoip: false`. Source: llm_adapter@2026-06-10 Confidence: high |
— |
| Bugfix | Medium |
Telemetry geolocation: disables default $geoip_disable to allow coarse location inference. Telemetry geolocation: disables default $geoip_disable to allow coarse location inference. Source: llm_adapter@2026-06-10 Confidence: high |
— |
Full changelog
Fixed
- Telemetry geolocation: closed the ~98.5% "unknown location" gap. The posthog-node SDK assumes server deployments and stamps
$geoip_disable: trueon every event by default. claude-mem's worker runs on the user's own machine, so this needlessly suppressed PostHog's ingest-side GeoIP on all worker events (worker_started,session_compressed,context_injected, …). The client now passesdisableGeoip: false, letting PostHog derive coarse location (country / region / city) at ingestion — from the request IP, which is then discarded. CLI events (install_*) were already unaffected.
Privacy
- No change to the IP promise: raw IP addresses are still never attached to events by the client and never stored — the sender IP is used transiently at ingest for the coarse-location lookup, then discarded.
- The telemetry docs (https://docs.claude-mem.ai/telemetry) and the
npx claude-mem telemetry enableconsent screen now disclose the ingest-derived coarse location.
Tests
- New regression test asserts the PostHog client is constructed with
disableGeoip: false(telemetry suite now 58 tests, all passing).
🤖 Generated with Claude Code
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About claude-mem
A Claude Code plugin that automatically captures everything Claude does during your coding sessions, compresses it with AI (using Claude's agent-sdk), and injects relevant context back into future sessions.
Related context
Related tools
Earlier breaking changes
- v13.11.0 Retires the standalone `cloud-sync.mjs` daemon.
Beta — feedback welcome: [email protected]