Skip to content

v0.7.0 — Security Hardening, Docs Overhaul, Unified Versioning

Latest
Latest

Choose a tag to compare

View all tags
@lktiep lktiep released this 11 Apr 09:02
v0.7.0
4fc2700

What's New in v0.7.0

Security Hardening

  • Removed hardcoded passwords from source code — MANAGEMENT_PASSWORD now required via env var
  • Purged SQLite database from entire git history (contained API keys from dev)
  • Removed Docker socket mount from cortex-api container (root access risk)
  • Restricted CORS on Dashboard API to localhost + configured DASHBOARD_URL
  • Removed all private project names from codebase — only generic examples remain
  • Cleaned tracked artifacts — removed 8 .vsix binaries, 16 compiled .js/.d.ts, dead .gitmodules

Docs Overhaul

  • Rewrote database docs — ERD now covers all 25 SQLite tables + 3 Qdrant collections (was 7 fictional tables)
  • Rewrote MCP reference — all 25 tools documented with correct cortex_* names (was wrong code.query format)
  • Removed STATE.md — all state tracking via cortex memory + knowledge (26 references cleaned across 13 files)
  • Rewrote CLAUDE.md (137 → 65 lines) and AGENTS.md (347 → 105 lines) — concise, natural tool guidance
  • Updated all workflow skills (/cs v0.7.0, /ce v0.7.0) and agent configs for all IDEs

Backend Fixes

  • session_end auto-memory — session summary automatically saved as searchable memory (safety net)
  • mem9 LLM routing — now routes through Dashboard API with DB credentials (was failing via CLIProxy)
  • mem9 respects EMBEDDING_PROVIDER — local/gemini switch works correctly
  • Fixed invalid LLM model — replaced non-existent gemini-3.1-flash-lite-preview with gemini-2.5-flash
  • Local embedding as default — free, fast (~10-50ms), no API key needed, 96.7% R@5
  • Fixed local embedding UI — dropdown no longer flickers when selecting "Local"

Unified Versioning

All components now share 0.7.x version family:

  • version.json, all package.json files, Docker images, skills, workflows, install scripts
  • Future: patch bumps (0.7.1) for individual changes, minor bump (0.8.0) syncs everything

Breaking Changes

  • MANAGEMENT_PASSWORD environment variable is now required — Docker Compose will fail without it
  • CORS on Dashboard API is no longer wildcard — set DASHBOARD_URL env var for your domain

Full Changelog: v0.3.0...v0.7.0

Assets 2
Loading