doobidoo/mcp-memory-service v12.2.1

on GitHub

A security patch. Please upgrade.

Security

certifi must now be at least 2026.10.19 (#1634, Dependabot alert #215, GHSA-6q48-6c7w-9gw2, critical).

certifi before 2026.10.18 trusts the emSign ECC Root CA - G3 root, under which eight intermediate CA keys were compromised. With one of those keys and an on-path position, an attacker can impersonate any host to a client that uses the certifi bundle. Every outbound HTTPS call the service makes goes through httpx or requests: Cloudflare sync, Hugging Face model downloads, external embedding endpoints, Groq and Gemini.

certifi was only a transitive dependency, so pip install --upgrade mcp-memory-service kept whatever version was already in your environment. This release declares the floor directly, so the upgrade below pulls the fixed bundle:

pip install --upgrade mcp-memory-service==12.2.1
python -c "import certifi; print(certifi.__version__)"   # should print 2026.10.19 or later

The v12.2.0 Docker images already shipped certifi 2026.10.19; the 12.2.1 images do too.

Fixed

• The on-store belief check is bounded: MCP_NLI_ON_STORE_BUDGET_S (2 s by default) and MCP_QUARANTINE_MAX_BELIEFS cap it, truncated checks are logged as WARNING, and the opt-in MCP_NLI_ON_STORE_ASYNC runs it in the background (#1633, @filhocf).

Full list in CHANGELOG.md.