This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Summary
AI summaryUpdates Highlights, Validation, and Provider Runtime across a mixed release.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Provider instance names normalize dots to hyphens for Docker Compose‑safe project names. Provider instance names normalize dots to hyphens for Docker Compose‑safe project names. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Feature | Low |
Added regression coverage for dotted worktree names and Compose project‑name validity. Added regression coverage for dotted worktree names and Compose project‑name validity. Source: llm_adapter@2026-06-05 Confidence: high |
— |
| Bugfix | Medium |
Runtime reinstalls now stop and restart provider watchers to rebind after dependency refresh. Runtime reinstalls now stop and restart provider watchers to rebind after dependency refresh. Source: llm_adapter@2026-06-05 Confidence: low |
— |
| Bugfix | Medium |
Watcher recovery handles managed dependency replacement path more cleanly after `install_provider_deps=True`. Watcher recovery handles managed dependency replacement path more cleanly after `install_provider_deps=True`. Source: llm_adapter@2026-06-05 Confidence: low |
— |
| Bugfix | Medium |
Runtime surfaces watcher failure for developer follow-up instead of leaving stale state silently. Runtime surfaces watcher failure for developer follow-up instead of leaving stale state silently. Source: llm_adapter@2026-06-05 Confidence: low |
— |
Full changelog
Agents Remember 2.3.3
This release hardens provider runtime refreshes and worktree-scoped provider setup, keeping GrepAI/CGC watchers bound to the right runtime state after reinstall and making dotted worktree names safe for Docker Compose.
Highlights
- Runtime reinstalls that refresh managed provider dependencies now stop and restart affected provider watchers so they rebind to the refreshed runner files.
- Provider instance names now normalize dots to hyphens, so worktree names such as
release-mcp-2.3.3produce Docker Compose-safe project names. - Added regression coverage for dotted worktree names and Compose project-name validity.
Provider Runtime
- GrepAI and CGC watcher recovery now handles the managed dependency replacement path more cleanly after
install_provider_deps=True. - If a watcher still fails after the restart attempt, the runtime surfaces that failure for developer follow-up instead of silently leaving stale state.
Validation
- Local quality wrapper passed with Ruff clean, Pyright clean,
428 passed, 3 skipped, coverage82%, and CRAP over-threshold rows0. - PR #34 passed the CI quality matrix on Python 3.11, 3.12, and 3.13.
- PyPI publish workflow completed successfully for
mcp-v2.3.3.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Agents Remember
All releases →Related context
Related tools
Earlier breaking changes
- vmcp-v2.9.0 Removed tools direct_closeout_preview and direct_closeout_apply.
- vmcp-v2.0.0 `WorkflowKind` enum drops `heavy` and `heavy-task` values.
- vmcp-v2.0.0 `skills_install` no longer accepts a `layout` input; installer performs flat copy.
- vmcp-v2.0.0 Removed workflows W-01-heavy-task-workflow and W-03-chat-task-workflow.
Beta — feedback welcome: [email protected]