Skip to content

v7.7.0 - Release

Choose a tag to compare

View all tags
@neverinfamous neverinfamous released this 06 May 21:50
· 19 commits to main since this release
v7.7.0
118dfd0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release v7.7.0

Highlights

  • Adversarial Planner Skill: Added multi-pass adversarial planning and review with structured critique stages and Copilot CLI validation.
  • Dependency Updates: Updated lockfile-resolved npm package versions within the existing package.json ranges: @huggingface/transformers resolved to ^4.2.0, eslint resolved to ^10.3.0, globals resolved to ^17.6.0, jose resolved to ^6.2.3, typescript-eslint resolved to ^8.59.2, and zod resolved to ^4.4.3.
  • Security Enhancements: Resolved an XSS vulnerability in ip-address and a HIGH severity Trivy code scanning alert (CVE-2026-27135).

Security

  • Fixed XSS vulnerability in ip-address by overriding version to 10.2.0
  • Fixed HIGH severity Trivy code scanning alert (CVE-2026-27135) by explicitly upgrading nghttp2-libs from Alpine edge repository in Dockerfile

Changed

  • Updated lockfile-resolved npm package versions within the existing package.json ranges: @huggingface/transformers resolved to ^4.2.0, eslint resolved to ^10.3.0, globals resolved to ^17.6.0, jose resolved to ^6.2.3, typescript-eslint resolved to ^8.59.2, and zod resolved to ^4.4.3
  • Bumped github/gh-aw-actions to v0.71.4 in GitHub Actions workflows
  • Bumped aquasecurity/trivy-action to ed142fd0673e97e23eac54620cfb913e5ce36c25
  • Bumped github/codeql-action to 95e58e9a2cdfd71adc6e0353d5c52f41a045d225

Added

  • adversarial-planner skill: multi-pass adversarial planning and review with structured critique stages and Copilot CLI validation
  • New entry types: plan_draft, adversarial_review, plan_refinement, copilot_validation

Fixed

  • Stale version 7.6.0 in server.json (version field and OCI identifier) → updated to 7.7.0
  • Stale skill name mastering-typescript in server instructions → corrected to typescript
  • Added adversarial-planner and copilot-audit to the native skills listing in server instructions
  • Fixed assertSafeFilePath validation in buildRulesFileInfo and buildSkillsDirInfo swallowing the output of memory://briefing metadata when paths were outside explicitly allowed IO roots.
  • Fixed INTERNAL_ERROR during restore_backup in Code Mode by migrating atomic database swap from fs.rename to fs.copyFile to bypass Windows EBUSY file locks from sqlite-vec.
  • Fixed search_by_date_range omitting the source: 'personal' metadata field when skipping cross-database merging.
  • Fixed restore_backup returning a raw MCP JSON-RPC exception when called with missing required parameters by relaxing the outer schema.

Compare: v7.6.1...v7.7.0

Install via MCP:

{
  "mcpServers": {
    "memory-journal-mcp": {
      "command": "npx",
      "args": ["-y", "memory-journal-mcp@7.7.0"]
    }
  }
}
Assets 2
Loading