v0.21.1

What's New in v0.21.1

Patch release. Theme: uteke upgrade verifies a minisign signature, Homebrew
installs keep their embeddings, and --json output stays clean. 0.21.1 is the
first release whose checksums-sha256.txt carries a minisign signature. A
0.21.0 binary only checks the SHA-256 and never verifies the signature, so the
signature protects uteke upgrade from 0.21.1 on.

⚠️ Behavior Change

• uteke upgrade is stricter (#1327, #1462) - it installs only stable releases (vX.Y.Z), refuses to downgrade, and fails closed unless the release has a valid minisign signature for checksums-sha256.txt. A release without a .minisig cannot be installed by uteke upgrade until the maintainer signs it.
• CLI log lines go to stderr (#1461, #1471) - scripts that read log lines from stdout must read stderr instead; --json output is now parseable even when a warning is logged.

Security

• uteke upgrade verifies a minisign signature over checksums-sha256.txt (#1327) - the release maintainer signs the checksums offline (scripts/sign-release.sh) and uploads checksums-sha256.txt.minisig; the embedded public key (scripts/uteke-release.pub) and the trusted comment uteke <tag> are checked before any hash in the file is trusted, so a tampered file is rejected, one release's files cannot be served as another's (the signature is bound to the tag), and uteke upgrade now refuses to downgrade to an older release. It also installs only stable releases (vX.Y.Z), never a pre-release or build-metadata tag. The signature is checked by uteke upgrade only: install.sh, install.ps1 and Homebrew do not verify it (verify manually per SECURITY.md). A missing or invalid signature is a hard failure; UTEKE_UPGRADE_SKIP_CHECKSUM=1 skips it too. Manual steps are in SECURITY.md.
• rustls 0.23.46 (#1455) - fixes RUSTSEC-2026-0346 to RUSTSEC-2026-0349 in the TLS stack used by the HTTP client.

Fixed

• ORT_LIB_PATH pointing at a directory no longer leaves uteke without embeddings (#1459) - the Homebrew shims exported the libexec directory (v0.19.0 onwards), dlopen failed on it, and every such install silently stored memories FTS5-only (embedding_written: false, uteke verify MISMATCH). A directory that holds the platform library (libonnxruntime.so, libonnxruntime.dylib or onnxruntime.dll) is now accepted with a warning; a directory without it is a clear error that says to set the library file. The tap fix is codecoradev/homebrew-tap#10 (brew update && brew reinstall codecoradev/tap/uteke). Docker and the release tarballs were not affected.
• CLI log lines no longer corrupt --json output (#1461) - the console log layer wrote to stdout, so any WARN or ERROR (for example a failed embedding) was printed in front of the command's JSON and json.loads(stdout) failed. Console logs now go to stderr; the log file and the command output are unchanged.

Changed

• Internal: the server dispatch is split into one named handler per route group (#1344, #1458); dependabot batch for toml, usearch, uuid and serde_json (#1457).
• Internal: release-signature-reminder workflow and script open and re-ping a Sign release vX.Y.Z (minisign) issue until the offline minisign signature is on the release, and close reminders for superseded releases automatically (#1327).

📦 Downloads

Each archive contains three binaries + ONNX Runtime shared library:

Binary	Description
uteke	CLI tool
uteke-serve	HTTP server daemon
uteke-mcp	MCP server (stdio + HTTP)
libonnxruntime.so* / libonnxruntime*.dylib / onnxruntime*.dll	ONNX Runtime

Platform	File
Linux x86_64 (AVX2)	uteke-x86_64-unknown-linux-gnu-v0.21.1.tar.gz
Linux x86_64 (Legacy, SSE4.2)	uteke-x86_64-unknown-linux-gnu-legacy-v0.21.1.tar.gz
Linux ARM64	uteke-aarch64-unknown-linux-gnu-v0.21.1.tar.gz
macOS Apple Silicon	uteke-aarch64-apple-darwin-v0.21.1.tar.gz
Windows x86_64	uteke-x86_64-pc-windows-msvc-v0.21.1.zip

Legacy Bundle (Linux only) — Includes a SSE4.2-only ORT sidecar (ort-legacy/) for CPUs without AVX2 (Intel Celeron J4125/N4020). Use this bundle to avoid SIGILL crashes on older hardware.

🚀 Quick Start

# Quick install (Linux / macOS)
curl -fsSL https://raw.githubusercontent.com/codecoradev/uteke/main/install.sh | sh

# Pin a specific version
UTEKE_VERSION=v0.21.1 curl -fsSL https://raw.githubusercontent.com/codecoradev/uteke/main/install.sh | sh

# Store a memory
uteke remember "Important context" --tags project

# Recall by meaning
uteke recall "what was that context?"

# Start server for fast AI agent access
uteke-serve --port 8767

Full changelog: https://github.com/codecoradev/uteke/blob/main/CHANGELOG.md

Community contributors

(No external contributions in this cycle. Full contributor list: https://github.com/codecoradev/uteke/graphs/contributors)