Skip to content

n24q02m/mnemo-mcp

v1.20.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

ai-agents ai-coding ai-memory claude claude-code cursor
+8 more
docker hybrid-search mcp mcp-server model-context-protocol python rclone sqlite

Affected surfaces

rce_ssrf deps

Summary

AI summary

Migrate from mcp-relay-core to mcp-core, which changes the runtime dependency.

Full changelog

v1.20.0 (2026-04-13)

This release is published under the MIT License.

Bug Fixes

  • Add tests for GPU detection error path (#426, e4cc498)

  • Add tests for link_memory_entities error path (#417, 359485c)

  • Auto-open default browser at Google device-code URL (b754afe)

  • Bump n24q02m-mcp-core to >=1.0.0 stable (a563432)

  • Correct README config tool actions list (e8f1d75)

  • Cover _init_schema vec0 branch without requiring sqlite-vec (dc9a5e3)

  • Cover vec-enabled db branches on runners lacking sqlite-vec (4154e8c)

  • Cover vec-enabled search branch with connection proxy (cd5361e)

  • Do not auto-open browser from background sync loop (711e3c4)

  • Drop local uv.sources override for n24q02m-mcp-core (b5dfc70)

  • Lock file maintenance (da6e544)

  • Log non-blocking exceptions in server search/add handlers (3731e96)

  • Make sqlite-vec tests robust to runners lacking enable_load_extension (5e360d0)

  • Optimize graph traversal via semi-join (fc313d9)

  • Prevent SQL injection in MemoryDB.update method (703455a)

  • Retry GDrive folder search before creating to prevent duplicates (e3e24f8)

  • Update dependency cohere to v6 (a4e36a9)

  • Update docker/build-push-action digest to bcafcac (f0495c3)

  • Update Pygments to 2.20.0 to fix ReDoS vulnerability (dacfdd6)

  • Update python:3.13-slim-bookworm docker digest to 061b6e5 (0605066)

  • Validate embedding_dims bounds before SQL interpolation (4477a4a)

  • Wrap _conn and enforce vec dims for SQL testing (f6fe46f)

  • db: Enhance vector search mocking and dimension detection (f6fe46f)

  • db: Finalize security refactor with ruff formatting (#395, 6219d97)

  • db: Prevent SQL injection via dynamic query construction (#395, 6219d97)

  • db: Robust vector search testing and dimension management (f6fe46f)

  • db: Wrap vec_db._conn to fix the vec SQL for testing (f6fe46f)

  • deps: Update non-major dependencies (#405, cb2d014)

  • server: Log non-blocking exceptions in search and add handlers (3731e96)

  • tests: Resolve linting issues in security tests (#395, 6219d97)

Chores

  • deps: Bump cryptography in the uv group across 1 directory (#407, 6550b8c)

  • deps: Lock file maintenance (#406, c42c4f8)

  • deps: Update python:3.13-slim-bookworm docker digest to f13a6b7 (#404, c7989ec)

  • deps: Update step-security/harden-runner digest to f808768 (#411, cb5f6e1)

Features

  • Add cross-OS CI matrix (ubuntu/windows/macos) (f57103e)

  • Add GDrive device code flow and setup_complete_hook wiring (4717c7c)

  • Add HTTP+OAuth transport, default to HTTP with --stdio fallback (2f76239)

  • Migrate from mcp-relay-core to mcp-core (9839a2b)

Performance Improvements

  • db: Implement FTS5 deferred join pattern in search (#403, eed40e5)

  • graph: Replace inner join with semi-join for graph traversal (fc313d9)


Detailed Changes: v1.19.0...v1.20.0

Breaking Changes

  • Removed dependency `n24q02m/mcp-relay-core`; replaced with `n24q02m/mcp-core`.

Security Fixes

  • Updated Pygments to v2.20.0 – fixes ReDoS vulnerability (CVE not explicitly listed).

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track n24q02m/mnemo-mcp

Get notified when new releases ship.

Sign up free

About n24q02m/mnemo-mcp

Persistent AI memory with SQLite hybrid search (FTS5 + semantic). Built-in Qwen3 embedding, rclone sync across machines. Zero config, no cloud, no limits.

All releases →

Beta — feedback welcome: [email protected]