Skip to content

mem0

vts-v3.1.0 scope: ts Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 13d AI Agents & Assistants
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agents ai ai-agents application chatbots chatgpt
+7 more
genai llm long-term-memory memory memory-management python state-management

Affected surfaces

deps

ReleasePort's take

Moderate signal
editorial:auto 12d

Patch fast‑xml-parser and tar to remediate transitive CVE vulnerabilities.

Why it matters: CVE severity is critical (severity 90); immediate patching prevents exploitation of affected dependencies.

Summary

AI summary

Patch fast‑xml‑parser and tar transitive vulnerabilities.

Changes in this release

Security Critical

Patch fast-xml-parser and tar transitive CVE vulnerabilities

Patch fast-xml-parser and tar transitive CVE vulnerabilities

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Add reranking support with four providers and per‑search `rerank` option on `search()`

Add reranking support with four providers and per‑search `rerank` option on `search()`

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Lazy‑load optional provider SDKs; importing `mem0ai/oss` no longer pulls in unused providers

Lazy‑load optional provider SDKs; importing `mem0ai/oss` no longer pulls in unused providers

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Add 17 new vector stores (Pinecone, Weaviate, Milvus, Chroma, MongoDB, Elasticsearch, OpenSearch, Databricks, AWS Neptune Analytics, S3 Vectors, Azure MySQL, Google Vertex AI Vector Search, Turbopuffer, Upstash Vector, Valkey, Cassandra, Baidu Mochow)

Add 17 new vector stores (Pinecone, Weaviate, Milvus, Chroma, MongoDB, Elasticsearch, OpenSearch, Databricks, AWS Neptune Analytics, S3 Vectors, Azure MySQL, Google Vertex AI Vector Search, Turbopuffer, Upstash Vector, Valkey, Cassandra, Baidu Mochow)

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Add 5 new LLM providers (AWS Bedrock, xAI Grok, Together, vLLM, Sarvam)

Add 5 new LLM providers (AWS Bedrock, xAI Grok, Together, vLLM, Sarvam)

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Add 4 new embedder providers (Vertex AI, HuggingFace, FastEmbed, Together)

Add 4 new embedder providers (Vertex AI, HuggingFace, FastEmbed, Together)

Source: llm_adapter@2026-07-14

Confidence: high

 —
Deprecation Low

Deprecate `data` argument in `Memory.update()`, prefer `text`

Deprecate `data` argument in `Memory.update()`, prefer `text`

Source: llm_adapter@2026-07-14

Confidence: high

 —
Bugfix Medium

Re‑raise LLM extraction transport failures instead of returning empty array

Re‑raise LLM extraction transport failures instead of returning empty array

Source: llm_adapter@2026-07-14

Confidence: high

 —
Bugfix Medium

Prevent unhandled promise rejection in Supabase and Redis vector store constructors

Prevent unhandled promise rejection in Supabase and Redis vector store constructors

Source: llm_adapter@2026-07-14

Confidence: high

 —
Bugfix Medium

Encode dynamic URL path segments to avoid malformed requests with special characters in IDs

Encode dynamic URL path segments to avoid malformed requests with special characters in IDs

Source: llm_adapter@2026-07-14

Confidence: high

 —
Full changelog

Mem0 Node SDK (v3.1.0)

The largest provider release for the TypeScript OSS SDK so far: 17 new vector stores, 5 new LLM providers, 4 new embedders, and reranking support. Importing mem0ai/oss no longer pulls in any provider SDK, so you only install what you actually configure.

New Features:

  • Rerankers: Add reranking to the OSS SDK with four providers (Cohere, ZeroEntropy, cross-encoder, and LLM-based), plus per-search rerank via a rerank option on search() (#6055)
  • Memory (OSS): Accept text in Memory.update(). data still works but is now deprecated, so prefer text in new code (#6044)
  • Vector Stores: Add Pinecone (#5802), Weaviate (#5800), Milvus (#5889), Chroma (#6145), MongoDB (#5793), Elasticsearch (#5866), and OpenSearch (#5810)
  • Vector Stores: Add Databricks (#5824), AWS Neptune Analytics (#5797), S3 Vectors (#5822), Azure MySQL (#5827), and Google Vertex AI Vector Search (#5791)
  • Vector Stores: Add Turbopuffer (#5801), Upstash Vector (#5811), Valkey (#5826), Cassandra (#5823), and Baidu Mochow (#5790)
  • LLMs: Add AWS Bedrock (#5890), xAI Grok (#6115), Together (#6049), vLLM (#5805), and Sarvam (#6130)
  • Embeddings: Add Vertex AI (#5882), HuggingFace (#6027), FastEmbed (#5862), and Together (#5989)

Improvements:

  • Packaging: Lazy-load optional provider SDKs so importing mem0ai/oss never requires them. Provider packages are now resolved on first use, so an app that only configures OpenAI and Qdrant does not need the other provider SDKs installed (#6280)

Bug Fixes:

  • Memory (OSS): Re-raise LLM extraction transport failures instead of returning [], so a network error during extraction surfaces as an error rather than a silently empty result (#6102)
  • Vector Stores: Prevent an unhandled promise rejection in the Supabase and Redis constructors (#6111)
  • Client: Encode dynamic URL path segments so IDs containing special characters no longer produce malformed requests (#5963)

Security:

  • Dependencies: Patch the fast-xml-parser and tar transitive CVEs (#6160)

Security Fixes

  • Patch CVEs in transitive dependencies `fast-xml-parser` and `tar`
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track mem0

Get notified when new releases ship.

Sign up free

About mem0

Universal memory layer for AI Agents

All releases →

Related context

Beta — feedback welcome: [email protected]