@mastra/memory 1.16.0-alpha.2 → 1.16.0-alpha.3

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # @mastra/memory
 
+## 1.16.0-alpha.3
+
+### Patch Changes
+
+- Fixed a security issue where several parsing and tracing paths could slow down on malformed or attacker-crafted input. Normal behavior is unchanged, and these packages now handle pathological input in linear time. ([#15566](https://github.com/mastra-ai/mastra/pull/15566))
+
+- Updated dependencies [[`aba393e`](https://github.com/mastra-ai/mastra/commit/aba393e2da7390c69b80e516a4f153cda6f09376), [`0a5fa1d`](https://github.com/mastra-ai/mastra/commit/0a5fa1d3cb0583889d06687155f26fd7d2edc76c), [`ea43e64`](https://github.com/mastra-ai/mastra/commit/ea43e646dd95d507694b6112b0bf1df22ad552b2), [`00d1b16`](https://github.com/mastra-ai/mastra/commit/00d1b16b401199cb294fa23f43336547db4dca9b), [`af8a57e`](https://github.com/mastra-ai/mastra/commit/af8a57ed9ba9685ad8601d5b71ae3706da6222f9)]:
+  - @mastra/core@1.26.0-alpha.10
+
 ## 1.16.0-alpha.2
 
 ### Minor Changes

package/dist/_types/@internal_ai-sdk-v4/dist/index.d.ts

@@ -195,6 +195,8 @@ export declare interface Attachment {
  * Attributes is a map from string to attribute values.
  *
  * Note: only the own enumerable keys are counted as valid attribute keys.
+ *
+ * @since 1.3.0
  */
 declare interface Attributes {
     [attributeKey: string]: AttributeValue | undefined;
@@ -204,6 +206,8 @@ declare interface Attributes {
  * Attribute values may be any non-nullish primitive value except an object.
  *
  * null or undefined attribute values are invalid and will result in undefined behavior.
+ *
+ * @since 1.3.0
  */
 declare type AttributeValue = string | number | boolean | Array<null | undefined | string> | Array<null | undefined | number> | Array<null | undefined | boolean>;
 
@@ -1057,6 +1061,9 @@ declare type ConsumeStreamOptions = {
     onError?: (error: unknown) => void;
 };
 
+/**
+ * @since 1.0.0
+ */
 declare interface Context {
     /**
      * Get a value from the context.
@@ -1735,6 +1742,8 @@ declare const errorStreamPart: AssistantStreamPart<'3', 'error', string>;
  * Defines Exception.
  *
  * string or an object with one of (message or name or code) and optional stack
+ *
+ * @since 1.0.0
  */
 declare type Exception = ExceptionWithCode | ExceptionWithMessage | ExceptionWithName | string;
 
@@ -2770,6 +2779,8 @@ export declare interface GenerateTextResult<TOOLS extends ToolSet, OUTPUT> {
  * The second number is calculated by converting the digits after the decimal point of the subtraction, (1609504210150 / 1000) - HrTime[0], to nanoseconds:
  * HrTime[1] = Number((1609504210.150 - HrTime[0]).toFixed(9)) * 1e9 = 150000000.
  * This is represented in HrTime format as [1609504210, 150000000].
+ *
+ * @since 1.0.0
  */
 declare type HrTime = [number, number];
 
@@ -4420,6 +4431,8 @@ declare interface LanguageModelV1ToolResultPart {
  *    However, it is desirable to associate incoming SpanContext to new trace
  *    initiated on service provider side so two traces (from Client and from
  *    Service Provider) can be correlated.
+ *
+ * @since 1.0.0
  */
 declare interface Link {
     /** The {@link SpanContext} of a linked span. */
@@ -5289,6 +5302,8 @@ declare type SourceUIPart = {
  * may have children.
  *
  * Spans are created by the {@link Tracer.startSpan} method.
+ *
+ * @since 1.0.0
  */
 declare interface Span {
     /**
@@ -5348,11 +5363,21 @@ declare interface Span {
      */
     addLinks(links: Link[]): this;
     /**
-     * Sets a status to the span. If used, this will override the default Span
-     * status. Default is {@link SpanStatusCode.UNSET}. SetStatus overrides the value
-     * of previous calls to SetStatus on the Span.
+     * Sets the status of the span.
+     *
+     * By default, a span has status {@link SpanStatusCode.UNSET}.
+     * Calling this method overrides that default.
+     *
+     * The status codes have a total order: `OK > ERROR > UNSET`.
+     *
+     * - Once {@link SpanStatusCode.OK} is set, any further attempts to change
+     *   the status are ignored.
+     * - Any attempt to set {@link SpanStatusCode.UNSET} is always ignored.
+     *
+     * The `message` field is only used when {@link SpanStatusCode.ERROR} is set.
+     * For all other status codes, `message` is ignored.
      *
-     * @param status the SpanStatus to set.
+     * @param status The {@link SpanStatus} to set.
      */
     setStatus(status: SpanStatus): this;
     /**
@@ -5397,17 +5422,21 @@ declare interface Span {
 
 /**
  * @deprecated please use {@link Attributes}
+ * @since 1.0.0
  */
 declare type SpanAttributes = Attributes;
 
 /**
  * @deprecated please use {@link AttributeValue}
+ * @since 1.0.0
  */
 declare type SpanAttributeValue = AttributeValue;
 
 /**
  * A SpanContext represents the portion of a {@link Span} which must be
  * serialized and propagated along side of a {@link Baggage}.
+ *
+ * @since 1.0.0
  */
 declare interface SpanContext {
     /**
@@ -5457,6 +5486,9 @@ declare interface SpanContext {
     traceState?: TraceState;
 }
 
+/**
+ * @since 1.0.0
+ */
 declare enum SpanKind {
     /** Default value. Indicates that the span is used internally. */
     INTERNAL = 0,
@@ -5486,6 +5518,8 @@ declare enum SpanKind {
 
 /**
  * Options needed for span creation
+ *
+ * @since 1.0.0
  */
 declare interface SpanOptions {
     /**
@@ -5494,7 +5528,7 @@ declare interface SpanOptions {
      */
     kind?: SpanKind;
     /** A span's attributes */
-    attributes?: SpanAttributes;
+    attributes?: Attributes;
     /** {@link Link}s span to other spans */
     links?: Link[];
     /** A manually specified start time for the created `Span` object. */
@@ -5503,6 +5537,9 @@ declare interface SpanOptions {
     root?: boolean;
 }
 
+/**
+ * @since 1.0.0
+ */
 declare interface SpanStatus {
     /** The status code of this message. */
     code: SpanStatusCode;
@@ -5512,6 +5549,8 @@ declare interface SpanStatus {
 
 /**
  * An enumeration of status codes.
+ *
+ * @since 1.0.0
  */
 declare enum SpanStatusCode {
     /**
@@ -6741,6 +6780,8 @@ declare type TextUIPart = {
  * Defines TimeInput.
  *
  * hrtime, epoch milliseconds, performance.now() or Date
+ *
+ * @since 1.0.0
  */
 declare type TimeInput = HrTime | number | Date;
 
@@ -7087,6 +7128,8 @@ declare type ToToolsWithExecute<TOOLS extends ToolSet> = {
 
 /**
  * Tracer provides an interface for creating {@link Span}s.
+ *
+ * @since 1.0.0
  */
 declare interface Tracer {
     /**
@@ -7153,6 +7196,9 @@ declare interface Tracer {
     startActiveSpan<F extends (span: Span) => unknown>(name: string, options: SpanOptions, context: Context, fn: F): ReturnType<F>;
 }
 
+/**
+ * @since 1.0.0
+ */
 declare interface TraceState {
     /**
      * Create a new TraceState which inherits from this TraceState and has the

package/dist/{chunk-MGHUIRKN.js → chunk-25XLVCFF.js}

@@ -652,7 +652,7 @@ function sortThreadsByOldestMessage(messagesByThread) {
   })).sort((a, b) => a.oldestTimestamp - b.oldestTimestamp).map((t) => t.threadId);
 }
 function stripThreadTags(observations) {
-  return observations.replace(/<thread[^>]*>|<\/thread>/gi, "").trim();
+  return observations.replace(/<\/?thread\b[^>]{0,1024}>/gi, "").trim();
 }
 
 // src/processors/observational-memory/model-by-input-tokens.ts
@@ -9074,5 +9074,5 @@ function getObservationsAsOf(activeObservations, asOf) {
 }
 
 export { ModelByInputTokens, OBSERVER_SYSTEM_PROMPT, ObservationalMemory, ObservationalMemoryProcessor, TokenCounter, buildObserverPrompt, buildObserverSystemPrompt, combineObservationGroupRanges, deriveObservationGroupProvenance, extractCurrentTask, formatMessagesForObserver, formatToolResultForObserver, getObservationsAsOf, hasCurrentTaskSection, injectAnchorIds, optimizeObservationsForContext, parseAnchorId, parseObservationGroups, parseObserverOutput, reconcileObservationGroupsFromReflection, renderObservationGroupsForReflection, resolveToolResultValue, stripEphemeralAnchorIds, stripObservationGroups, truncateStringByTokens, wrapInObservationGroup };
-//# sourceMappingURL=chunk-MGHUIRKN.js.map
-//# sourceMappingURL=chunk-MGHUIRKN.js.map
+//# sourceMappingURL=chunk-25XLVCFF.js.map
+//# sourceMappingURL=chunk-25XLVCFF.js.map