You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This commit was created on GitHub.com and signed with GitHub’s verified signature.
Release Notes
Changed
just check now also runs cargo audit, so it requires cargo-audit (cargo install cargo-audit --locked) and network access. See the README's Development section for the offline alternative.
The cargo audit workflow is now a daily scheduled monitor that opens an issue labelled security-advisory when the scan fails, replacing the previous weekly + per-dependency-change pull request trigger. The advisory database changes outside this repository, so a pull request check reported on main's state rather than on the pull request.
Bumped lancedb 0.30.0 → 0.37.1 and lance-index 7.0.0 → 10.0.0 in lockstep. lancedb 0.37 requires the whole lance-* ecosystem at one exact version, so neither pin can move on its own. arrow-array / arrow-schema stay on 58, which both new versions still require. The move to lancedb 0.31 had been held back because it requires lance-testing 8.0.0, which added pprof (with the flamegraph feature) as a normal dependency, and behind it inferno → quick-xml 0.26 — a version RUSTSEC-2026-0194 / 0195 affect, both patched in 0.41.0. lancedb 0.33.0 moved lance-testing to dev-dependencies, so lance-testing drops out of the tree here and pprof never enters it.
Bumped serde-saphyr 0.0.29 → 1.x (resolved at 1.1.0). Upstream adopted semver at 1.0, so the requirement is now "1" instead of an effectively exact 0.0.x pin. One upstream behaviour change can reach a hand-edited config.yml: explicit YAML core tags are enforced strictly from 1.0 on, so a scalar written as !!str 42 is no longer coerced to an integer. The config.yml mdya generates uses no explicit tags, so no action is required unless you added some yourself.
Bumped candle-core / candle-nn / candle-transformers 0.10.1 → 0.11.0 (lockstep). The historical =0.10.1 exact-pin was in place because crates.io candle-core 0.10.2 had been published without a matching git tag; upstream tagging has since caught up (0.10.2 and 0.11.0 both tagged), so we lift the hold and move all three crates in one step.
just check now verifies that cargo-audit is installed before it starts, instead of after the full test run. Missing the tool used to surface only once cargo test --workspace had finished, which on a cold cache meant waiting half an hour to be told about a one-line install.
The Development section of the README now states that just check needs the build-from-source prerequisites (Rust, just, protoc) as well as cargo-audit. CONTRIBUTING.md points here for what just check needs installed, and that list was previously incomplete.
Fixed
A fresh clone can now run cargo build, cargo clippy and cargo test across the workspace without first downloading the 16 MB Noto Sans CJK JP font. The xtask-generate-test-pdfs helper embedded the font with include_bytes!, which turned a .gitignored file into a compile-time input for a workspace member and stopped just check before a single test ran. It now reads the font at run time, so only regenerating the PDF fixtures needs the file present.
Security
Bumped rkyv (and rkyv_derive) 0.8.16 → 0.8.18 in the lockfile, clearing RUSTSEC-2026-0233, RUSTSEC-2026-0234 and RUSTSEC-2026-0235: a crafted archive could trigger a use-after-free during deserialization, and insufficient validation of archives containing hash tables or Rc/Arc could read out of bounds. rkyv reaches mdya through the tokenizer dictionaries that back full-text search (lindera-dictionary → lindera → lance-tokenizer → lancedb), so the archive it deserializes is the IPADIC dictionary compiled into the binary rather than anything a user supplies. event-listener 5.4.1 → 5.4.2 moved at the same time for RUSTSEC-2026-0221, which the advisory marks informational (unsound) rather than a vulnerability.
Bumped h2 0.4.14 → 0.4.16 in the lockfile, clearing RUSTSEC-2026-0258 (GHSA-q83h-524g-xf6h): empty HTTP/2 DATA frames were accepted and queued without limit, so a stream that is not actively drained could grow memory without bound, or panic once the length overflowed. Upstream rates it low severity, denial of service only. h2 sits on both sides of mdya's HTTP surface — the server behind mdya mcp --http, which binds to loopback (127.0.0.1:8000) unless --addr says otherwise, and the client that fetches embedding models. No manifest change was needed, because hyper already admitted the patched release.
Accepted two more upstream unmaintained advisories as WONTFIX in .cargo/audit.toml: RUSTSEC-2026-0192 (ttf-parser) and RUSTSEC-2026-0206 (rustybuzz). Both are informational rather than vulnerabilities. ttf-parser is in the released binary, reached through pdf-extract → lopdf for PDF ingest; rustybuzz is not, reaching only the xtask fixture generator through krilla. See the file header and SECURITY.md for the policy.
Install mdya 0.4.1
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/yoshihirosuzuki/mdya/releases/download/v0.4.1/mdya-installer.sh | sh
This commit was created on GitHub.com and signed with GitHub’s verified signature.
Release Notes
Added
Two more on-device embedding presets, selectable through embedding.model in config.yml alongside the default cl-nagoya/ruri-v3-30m (256-dim): sentence-transformers/all-MiniLM-L6-v2 (384-dim) and google/embeddinggemma-300m (768-dim, gated on Hugging Face — requires accepting Google's Gemma terms and supplying an access token). An unrecognized embedding.model is now rejected at startup with the list of supported values, before any indexing begins.
Published to crates.io: cargo install mdya now works alongside the prebuilt installers. This path builds from source and requires protoc.
A get section in config.yml with cli_max_bytes and mcp_max_bytes (both default 1 MiB; 0 disables) capping the size of a full document returned by mdya get and the MCP get_document tool. mdya get gained a -f / --no-size-limit flag to bypass the cap for a single run.
Changed
Markdown chunking now fills each chunk with whole blocks (paragraphs, list items, and so on) up to the target size, splitting only at block boundaries.
mdya get and the MCP get_document tool now refuse to return a full document larger than 1 MiB by default, to avoid flooding a terminal or an LLM's context budget. Restore the previous unlimited behavior by passing -f / --no-size-limit to mdya get, or by raising / disabling (0) the new get.cli_max_bytes / get.mcp_max_bytes caps in config.yml. Single-chunk reads (--chunk / the MCP chunk parameter) are not size-checked.
Fixed
mdya vector use now rebuilds a stale vector index even when config.yml already names the target model, instead of skipping the rebuild.
Install mdya 0.4.0
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/yoshihirosuzuki/mdya/releases/download/v0.4.0/mdya-installer.sh | sh
This commit was created on GitHub.com and signed with GitHub’s verified signature.
Release Notes
Changed
Breaking (MCP): Consolidated the three search tools (search_fts, search_vector, search_hybrid) into a single search tool with a mode parameter ("fts" / "vector" / "hybrid", default "hybrid"). MCP clients calling an old tool name must switch to search with the matching mode.
The default log level is now warn (was info), so dependency INFO chatter (e.g. lance's misleading status="error" dataset-load events) no longer appears on a clean run. Restore the old verbosity with --log-level info or RUST_LOG=info.
User-facing status (the init / collection add success lines and the MCP HTTP daemon's listening URL) now prints as plain text on stderr instead of as a log event, so it stays visible at the default log level.
Breaking:mdya update-all and mdya vector use print their completion summary to stderr instead of stdout; stdout is now empty for these commands (reserved for piped data).
Removed
Breaking (MCP): Removed the get_status MCP tool. Index status remains available through the mdya status CLI command.
Fixed
mdya update-all no longer corrupts its progress display (duplicated bars / accumulated spinner rows) when log lines are emitted mid-render, and no longer panics in busy non-interactive (non-TTY) sessions. The progress bar is now rendered independently of the logging layer.
Install mdya 0.3.2
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/yoshihirosuzuki/mdya/releases/download/v0.3.2/mdya-installer.sh | sh
Weekly + per-PR cargo audit workflow against the RustSec advisory database.
Changed
Bumped lancedb 0.29 → 0.30, lance-index 6.0 → 7.0, and lindera 0.44.1 → 3.0.7 (forced by lance-tokenizer 7.0's transitive switch to lindera 3.0).
The on-disk ~/.mdya/lance-models/lindera/ipadic/config.yml now uses lindera 3.0's URI dictionary scheme (segmenter.dictionary: embedded://ipadic) in place of the old nested form (segmenter.dictionary.kind: ipadic). The file is regenerated atomically on the next mdya init / mdya update-all run; no user action is required.
Security
.cargo/audit.toml with four upstream unmaintained (non-CVE) RUSTSEC IDs accepted as WONTFIX; see file header and SECURITY.md for the policy.
Install mdya 0.3.1
Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/yoshihirosuzuki/mdya/releases/download/v0.3.1/mdya-installer.sh | sh
