Skip to content

v1.6.8 — Security & Packaging Maintenance

Choose a tag to compare

View all tags
@Lotargo Lotargo released this 24 Aug 20:40
· 55 commits to main since this release
v1.6.8
0b0c52a
logo

v1.6.8

Maintenance release focused on package security, discoverability, and npm distribution cleanup.

Security

  • Replaced the stale npm xlsx@0.18.5 dependency with SheetJS CE 0.20.3 from the official SheetJS CDN.
  • Fixed the known SheetJS prototype-pollution and ReDoS exposure in spreadsheet ingestion.
  • Documented the remaining transitive sharp / libvips advisory from @huggingface/transformers. The plugin uses Transformers only for text feature extraction and explicitly disables its image-decoding path with env.sharp = false.

Changed

  • Refreshed npm package positioning around local-first memory, hybrid RAG, agent personalization, and coding-agent integrations.
  • Expanded npm discovery keywords for agent memory, coding agents, personalization, context engineering, MCP, and supported clients.
  • Updated repository, homepage, and issue metadata after the GitHub repository rename to Lotargo/memory_plugin.
  • Fixed README asset URLs and added a crawlable text H1.
  • Updated spreadsheet parsing to use the SheetJS ESM-compatible namespace import.
  • Added regression coverage for XLSX and CSV parsing.

Packaging

  • Removed repository-only benchmark sources from the published npm tarball.
  • Benchmark and test tooling remains available in the GitHub repository for development and evaluation.
  • Reduced the npm package from approximately 222 kB to 182 kB, and from 821 kB to 681 kB unpacked.

Notes

npm audit may still report the upstream sharp advisory inherited through @huggingface/transformers. This dependency is not exercised through an image-processing path by memory_plugin.

Assets 2
Loading