Skip to content

This release includes 2 breaking changes for platform teams planning a safe upgrade.

Published 3mo MCP Data & Storage
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Affected surfaces

breaking_upgrade rce_ssrf

Summary

AI summary

Removed async-trait dependency for zero-cost async abstractions and fixed critical async starvation and TOCTOU race conditions.

Full changelog

This release is the result of a comprehensive 4-lens audit across the entire codebase, focusing on safety, concurrency, modularity, and test coverage. Every change was driven by measurable engineering principles rather than cosmetic cleanup.


Rust-Pro: Safety & Zero-Cost Abstractions

Removed async-trait dependency — All traits (StorageBackend, GraphTraverser, Component) now use native Rust 1.75+ async fn in trait syntax. The async-trait crate boxes every returned future on the heap; removing it eliminates a heap allocation on every single database call, giving true zero-cost async abstraction.

Preserved error contexts with thiserror #[source] — Database and I/O errors are now chained via #[source] rather than converted to strings with .to_string(). This preserves the full error chain for debugging and structured observability, instead of swallowing root causes.


Rust-Async-Patterns: Concurrency & Stability

Fixed P0 — Async Starvation Bug: Synchronous disk walks (scan_directory) and CPU-intensive tree-sitter AST parsing (chunk_file, parse_file) were previously blocking the Tokio async runtime thread pool. They are now wrapped in tokio::task::spawn_blocking, offloading all blocking work to a dedicated thread pool and keeping async executors responsive under heavy indexing load.

Fixed P0 — TOCTOU Race Condition: The previous design read index status from the database before starting a new index job, creating a time-of-check/time-of-use (TOCTOU) window where two concurrent requests could both pass the check and start duplicate index operations. This is now replaced by an atomic in-memory Mutex<HashSet<String>> lock — a lightning-fast, single-process lock that eliminates the race condition entirely.

Implemented P2 — Graceful Shutdown: Integrated tokio::sync::watch channels to coordinate clean shutdown of all background tasks — including the embedding completion monitor and the per-project file watcher — when the server exits. Tasks now drain cleanly instead of being killed mid-operation.


Architecture: Simplicity & Modularity

Split monolithic src/storage/surrealdb.rs (2,300+ lines) into 6 focused modules:

  • mod.rs — struct definition, constructor, GraphTraversalStorage impl
  • helpers.rs — ID generation, SurrealDB value parsing utilities
  • memory_ops.rs — all memory CRUD operations
  • graph_ops.rs — entity, relation, and graph traversal operations
  • code_ops.rs — code chunk, file hash, and project lifecycle operations
  • symbol_ops.rs — code symbol CRUD, vector search, embedding updates

Split monolithic src/server/logic/code.rs (900+ lines) into 3 focused modules:

  • indexing.rsindex_project, get_index_status, list_projects, delete_project, get_project_stats
  • search.rssearch_code, recall_code
  • symbols.rssearch_symbols, get_callers, get_callees, get_related_symbols

DRYed Personalized PageRank (PPR) logic — The identical PPR graph-ranking algorithm was duplicated in both search.rs and code.rs. It has been extracted into a single shared helper src/graph/ppr.rs::run_ppr(), eliminating the duplication and making the ranking logic a single source of truth.


TDD-Workflow: Testing

Test count increased from 91 → 105 (+14 new unit tests).

Leiden community detection (src/graph/leiden.rs) — 6 new unit tests covering: empty graph, single isolated node, two disconnected cliques, three disconnected cliques, fully connected graph, and resolution parameter sensitivity.

Code Chunker (src/codebase/chunker.rs) — 8 new unit tests covering: empty content, whitespace-only input, content at minimum size threshold, content below threshold, AST Other node skipping, large node subdivision, maximum chunk size splitting, and chunk metadata correctness. These tests enforce quality control over the RAG embedding pipeline.


Full Changelog: https://github.com/pomazanbohdan/memory-mcp-1file/compare/v0.4.10...v0.5.0

Breaking Changes

  • Removed `async-trait` dependency; all async trait methods now use native Rust 1.75+ `async fn in trait` syntax, requiring code updates to match the new zero-cost abstraction.
  • Minimum supported Rust version bumped to 1.75 due to usage of `async fn in trait`.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track pomazanbohdan/memory-mcp-1file

Get notified when new releases ship.

Sign up free

About pomazanbohdan/memory-mcp-1file

A self-contained Memory server with single-binary architecture (embedded DB & models, no dependencies). Provides persistent semantic and graph-based memory for AI agents.

All releases →

Beta — feedback welcome: [email protected]