What's New
Added
- feat(mistake_notes):
mistake_note_updateandmistake_note_deleteMCP tools (closes #1035, PR #1045, @filhocf): Two new tools extend the Mistake Notes system.mistake_note_updatelets you patchfailure_countorcontenton an existing note by content_hash.mistake_note_deleteremoves a note by content_hash. Both validatememory_type='mistake'before operating to prevent accidental mutations on non-mistake memories.
Fixed
- fix(ci): disable buildx provenance/sbom attestations in publish-docker job (fixes #1044):
docker/build-push-actionv4+ pushes provenance and SBOM attestation manifests to the registry by default. On ghcr.io, the multi-arch index ended up referencing these attestation entries instead of the actual platform layers, sodocker pull ghcr.io/doobidoo/mcp-memory-service:latesthit amanifest unknownerror. Fixed by settingprovenance: falseandsbom: falsein the publish-docker job.
Changed
- chore(ci): log-injection guard in pre_pr_check.sh (check 6.5): pre_pr_check.sh now scans for f-string logger calls missing
_sanitize_log_value()wrapping — catches py/log-injection patterns locally before CodeQL runs. CLAUDE.md updated with a Log Injection Guard section documenting the pattern.
Special Thanks
Huge thanks to @filhocf for continued contributions — the mistake_note_update and mistake_note_delete tools (PR #1045) round out the Mistake Notes CRUD surface.
Full Changelog
See CHANGELOG.md for the complete entry.