doobidoo/mcp-memory-service v10.36.3

v10.36.3 - Restore dashboard version badge after v10.21.0 security hardening

on GitHub

What Changed

PATCH release restoring user-visible functionality broken since v10.21.0 (GHSA-73hc-m4hx-79pj). That security fix correctly removed version, timestamp, and uptime_seconds from the public /api/health response — but two callers of the old contract were not updated at the time.

Fixed

Dashboard Settings modal version row (N/A for ~4 months)

SYSTEM_INFO_CONFIG.settingsVersion in app.js still pointed at api: 'health' after the security hardening. The Version row in the Settings modal displayed N/A permanently regardless of what version was running. The header version badge had been migrated to /health/detailed earlier, but the Settings modal was missed. One-line config fix: api: 'health' → 'detailedHealth'.

manage_service.ps1 status showing blank Version and Backend

Get-ServerStatus parsed version and storage_backend from /api/health — fields removed since v10.21.0. manage_service.ps1 status against a perfectly healthy server showed empty Version: and Backend: lines for ~4 months. Now fetches /api/health/detailed with Bearer auth when MCP_API_KEY is available, with a clear (unavailable - set MCP_API_KEY in .env for details) hint when the key is not configured.

New Get-McpApiKey helper in lib/server-config.ps1 robustly parses MCP_API_KEY from .env:

• Handles double-quoted, single-quoted, and unquoted values
• Keys containing # inside quotes are preserved correctly
• Trailing inline comments stripped for unquoted values
• Early exit via foreach loop once the key is found
• Returns $null gracefully when key or file is absent

Canonical backend field lookup

Show-Status now checks storage.backend first (the canonical field per DetailedHealthResponse schema) before falling back to storage.backend_type — consistent with the dashboard's app.js logic.

Documentation

• Added English-language policy to issue templates (bug, feature, performance) and CONTRIBUTING.md (PR #683)

Verification

• PowerShell syntax check: no errors on all changed .ps1 files
• JS syntax check: node --check app.js passed
• Live test against local v10.36.2 server:

  HTTP Endpoint:
    Status:  HEALTHY
    Version: 10.36.2                             (previously empty)
    Backend: Hybrid (SQLite-vec + Cloudflare)    (previously empty)
  

• 1,537 tests passing

Technical Details

• Regression source: GHSA-73hc-m4hx-79pj (v10.21.0 security hardening)
• Affected since: v10.21.0 (early 2026, ~4 months)
• Files changed: src/mcp_memory_service/web/static/app.js, scripts/service/windows/lib/server-config.ps1, scripts/service/windows/manage_service.ps1
• Landing page: not updated (PATCH release - policy is MINOR/MAJOR only)

Full changelog: https://github.com/doobidoo/mcp-memory-service/blob/main/CHANGELOG.md#10363---2026-04-10

PyPI packages publish automatically via the "Publish and Test (Tags)" workflow.