This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+8 more
Affected surfaces
Summary
AI summaryMigrate from mcp-relay-core to mcp-core, which changes the runtime dependency.
Full changelog
v1.20.0 (2026-04-13)
This release is published under the MIT License.
Bug Fixes
-
Add tests for link_memory_entities error path (#417,
359485c) -
Auto-open default browser at Google device-code URL (
b754afe) -
Bump n24q02m-mcp-core to >=1.0.0 stable (
a563432) -
Correct README config tool actions list (
e8f1d75) -
Cover _init_schema vec0 branch without requiring sqlite-vec (
dc9a5e3) -
Cover vec-enabled db branches on runners lacking sqlite-vec (
4154e8c) -
Cover vec-enabled search branch with connection proxy (
cd5361e) -
Do not auto-open browser from background sync loop (
711e3c4) -
Drop local uv.sources override for n24q02m-mcp-core (
b5dfc70) -
Lock file maintenance (
da6e544) -
Log non-blocking exceptions in server search/add handlers (
3731e96) -
Make sqlite-vec tests robust to runners lacking enable_load_extension (
5e360d0) -
Optimize graph traversal via semi-join (
fc313d9) -
Prevent SQL injection in MemoryDB.update method (
703455a) -
Retry GDrive folder search before creating to prevent duplicates (
e3e24f8) -
Update dependency cohere to v6 (
a4e36a9) -
Update docker/build-push-action digest to bcafcac (
f0495c3) -
Update Pygments to 2.20.0 to fix ReDoS vulnerability (
dacfdd6) -
Update python:3.13-slim-bookworm docker digest to 061b6e5 (
0605066) -
Validate embedding_dims bounds before SQL interpolation (
4477a4a) -
Wrap _conn and enforce vec dims for SQL testing (
f6fe46f) -
db: Enhance vector search mocking and dimension detection (
f6fe46f) -
db: Finalize security refactor with ruff formatting (#395,
6219d97) -
db: Prevent SQL injection via dynamic query construction (#395,
6219d97) -
db: Robust vector search testing and dimension management (
f6fe46f) -
db: Wrap vec_db._conn to fix the vec SQL for testing (
f6fe46f) -
server: Log non-blocking exceptions in search and add handlers (
3731e96) -
tests: Resolve linting issues in security tests (#395,
6219d97)
Chores
-
deps: Bump cryptography in the uv group across 1 directory (#407,
6550b8c) -
deps: Update python:3.13-slim-bookworm docker digest to f13a6b7 (#404,
c7989ec) -
deps: Update step-security/harden-runner digest to f808768 (#411,
cb5f6e1)
Features
-
Add cross-OS CI matrix (ubuntu/windows/macos) (
f57103e) -
Add GDrive device code flow and setup_complete_hook wiring (
4717c7c) -
Add HTTP+OAuth transport, default to HTTP with --stdio fallback (
2f76239) -
Migrate from mcp-relay-core to mcp-core (
9839a2b)
Performance Improvements
-
db: Implement FTS5 deferred join pattern in search (#403,
eed40e5) -
graph: Replace inner join with semi-join for graph traversal (
fc313d9)
Detailed Changes: v1.19.0...v1.20.0
Breaking Changes
- Removed dependency `n24q02m/mcp-relay-core`; replaced with `n24q02m/mcp-core`.
Security Fixes
- Updated Pygments to v2.20.0 – fixes ReDoS vulnerability (CVE not explicitly listed).
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About n24q02m/mnemo-mcp
Persistent AI memory with SQLite hybrid search (FTS5 + semantic). Built-in Qwen3 embedding, rclone sync across machines. Zero config, no cloud, no limits.
Related context
Beta — feedback welcome: [email protected]