memory-journal-mcp 3.1.4 → 3.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/.github/workflows/docker-publish.yml +2 -2
  2. package/.scout-ignore +4 -4
  3. package/.trivyignore +4 -9
  4. package/DOCKER_README.md +3 -3
  5. package/Dockerfile +4 -6
  6. package/README.md +2 -2
  7. package/VERSION +1 -1
  8. package/dist/cli.js +1 -1
  9. package/dist/server/McpServer.js +1 -1
  10. package/package.json +1 -1
  11. package/releases/v3.1.5.md +40 -0
  12. package/server.json +3 -3
  13. package/src/cli.ts +1 -1
  14. package/src/server/McpServer.ts +1 -1
package/.github/workflows/docker-publish.yml CHANGED
@@ -186,8 +186,8 @@ jobs:
186
186
 
187
187
  # Define CVEs to ignore (upstream issues with NO fix available)
188
188
  # CVE-2026-22184: Alpine zlib - no fix version released yet
189
- # CVE-2019-10790: protobufjs taffydb - unmaintained/abandoned package
190
- IGNORE_CVES="CVE-2026-22184|CVE-2019-10790"
189
+ # CVE-2025-60876: Alpine busybox wget - patch not in release yet
190
+ IGNORE_CVES="CVE-2026-22184|CVE-2025-60876"
191
191
 
192
192
  echo "⏱️ Running Docker Scout scan (max 8 minutes)..."
193
193
  if timeout 480 docker scout cves local-scan:latest > scout_output.txt 2>&1; then
package/.scout-ignore CHANGED
@@ -4,9 +4,9 @@
4
4
  # Only include CVEs with NO upstream fix available
5
5
 
6
6
  # Alpine zlib - Critical severity, but NO FIX VERSION RELEASED by Alpine yet
7
- # We run `apk upgrade --no-cache` but there's nothing to upgrade to
7
+ # zlib 1.3.1.3 contains the fix but Alpine hasn't packaged it
8
8
  CVE-2026-22184
9
9
 
10
- # protobufjs bundled taffydb - 6+ year old unmaintained package
11
- # No fix version exists - package is abandoned
12
- CVE-2019-10790
10
+ # Alpine busybox - wget CRLF injection (MEDIUM)
11
+ # Patch submitted to busybox upstream but not in a release yet
12
+ CVE-2025-60876
package/.trivyignore CHANGED
@@ -6,14 +6,9 @@
6
6
  # ============================================================================
7
7
 
8
8
  # CVE-2026-22184: zlib vulnerability (CRITICAL)
9
- # No fix version released by Alpine yet - `apk upgrade` has nothing to update to
9
+ # No fix version released by Alpine yet - zlib 1.3.1.3 not packaged
10
10
  CVE-2026-22184
11
11
 
12
- # ============================================================================
13
- # protobufjs Bundled CLI - in /app/node_modules/protobufjs/cli/node_modules/
14
- # taffydb is 6+ years unmaintained with no fix available
15
- # ============================================================================
16
-
17
- # CVE-2019-10790: taffydb prototype pollution (HIGH)
18
- # No fix version exists - package is abandoned
19
- CVE-2019-10790
12
+ # CVE-2025-60876: busybox wget CRLF injection (MEDIUM)
13
+ # Patch submitted to busybox upstream but not in a release yet
14
+ CVE-2025-60876
package/DOCKER_README.md CHANGED
@@ -1,11 +1,11 @@
1
1
  # Memory Journal MCP Server
2
2
 
3
- Last Updated January 11, 2026 - v3.1.4
3
+ Last Updated January 11, 2026 - v3.1.5
4
4
 
5
5
  [![GitHub](https://img.shields.io/badge/GitHub-neverinfamous/memory--journal--mcp-blue?logo=github)](https://github.com/neverinfamous/memory-journal-mcp)
6
6
  [![Docker Pulls](https://img.shields.io/docker/pulls/writenotenow/memory-journal-mcp)](https://hub.docker.com/r/writenotenow/memory-journal-mcp)
7
7
  [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
8
- ![Version](https://img.shields.io/badge/version-v3.1.4-green)
8
+ ![Version](https://img.shields.io/badge/version-v3.1.5-green)
9
9
  ![Status](https://img.shields.io/badge/status-Production%2FStable-brightgreen)
10
10
  [![npm](https://img.shields.io/npm/v/memory-journal-mcp)](https://www.npmjs.com/package/memory-journal-mcp)
11
11
  [![Security](https://img.shields.io/badge/Security-Enhanced-green.svg)](https://github.com/neverinfamous/memory-journal-mcp/blob/main/SECURITY.md)
@@ -342,7 +342,7 @@ docker run -i --rm \
342
342
  - 📋 **SBOM Available** - Complete software bill of materials
343
343
 
344
344
  **Available Tags:**
345
- - `3.1.4` - Specific version (recommended for production)
345
+ - `3.1.5` - Specific version (recommended for production)
346
346
  - `3.0` - Latest patch in 3.0.x series
347
347
  - `3` - Latest minor in 3.x series
348
348
  - `latest` - Always the newest version
package/Dockerfile CHANGED
@@ -21,11 +21,9 @@ COPY package*.json .npmrc ./
21
21
  # The .npmrc has legacy-peer-deps=true to handle zod peer conflicts
22
22
  RUN npm ci
23
23
 
24
- # Clean protobufjs bundled cli dependencies and apply overrides
25
- # This ensures our brace-expansion and tmp overrides take effect
26
- RUN rm -rf node_modules/protobufjs/cli/node_modules/brace-expansion \
27
- node_modules/protobufjs/cli/node_modules/tmp && \
28
- npm dedupe
24
+ # Remove protobufjs CLI entirely - not needed at runtime
25
+ # Eliminates CVE-2019-10790 (taffydb), CVE-2025-54798 (tmp), CVE-2025-5889 (brace-expansion)
26
+ RUN rm -rf node_modules/protobufjs/cli
29
27
 
30
28
  # Copy source code
31
29
  COPY tsconfig.json ./
@@ -78,6 +76,6 @@ CMD ["node", "dist/cli.js"]
78
76
  # Labels for Docker Hub
79
77
  LABEL maintainer="Adamic.tech"
80
78
  LABEL description="Memory Journal MCP Server - Project context management for AI-assisted development"
81
- LABEL version="3.1.4"
79
+ LABEL version="3.1.5"
82
80
  LABEL org.opencontainers.image.source="https://github.com/neverinfamous/memory-journal-mcp"
83
81
  LABEL io.modelcontextprotocol.server.name="io.github.neverinfamous/memory-journal-mcp"
package/README.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # Memory Journal MCP Server
2
2
 
3
- Last Updated January 11, 2026 - v3.1.4
3
+ Last Updated January 11, 2026 - v3.1.5
4
4
 
5
5
  <!-- mcp-name: io.github.neverinfamous/memory-journal-mcp -->
6
6
 
@@ -8,7 +8,7 @@ Last Updated January 11, 2026 - v3.1.4
8
8
  [![npm](https://img.shields.io/npm/v/memory-journal-mcp)](https://www.npmjs.com/package/memory-journal-mcp)
9
9
  [![Docker Pulls](https://img.shields.io/docker/pulls/writenotenow/memory-journal-mcp)](https://hub.docker.com/r/writenotenow/memory-journal-mcp)
10
10
  [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
11
- ![Version](https://img.shields.io/badge/version-v3.1.4-green)
11
+ ![Version](https://img.shields.io/badge/version-v3.1.5-green)
12
12
  ![Status](https://img.shields.io/badge/status-Production%2FStable-brightgreen)
13
13
  [![MCP Registry](https://img.shields.io/badge/MCP_Registry-Published-green)](https://registry.modelcontextprotocol.io/v0/servers?search=io.github.neverinfamous/memory-journal-mcp)
14
14
  [![Security](https://img.shields.io/badge/Security-Enhanced-green.svg)](SECURITY.md)
package/VERSION CHANGED
@@ -1 +1 @@
1
- 3.1.4
1
+ 3.1.5
package/dist/cli.js CHANGED
@@ -8,7 +8,7 @@ const program = new Command();
8
8
  program
9
9
  .name('memory-journal-mcp')
10
10
  .description('Project context management for AI-assisted development')
11
- .version('3.1.4')
11
+ .version('3.1.5')
12
12
  .option('--transport <type>', 'Transport type: stdio or http', 'stdio')
13
13
  .option('--port <number>', 'HTTP port (for http transport)', '3000')
14
14
  .option('--db <path>', 'Database path', './memory_journal.db')
package/dist/server/McpServer.js CHANGED
@@ -62,7 +62,7 @@ export async function createServer(options) {
62
62
  // Create MCP server with capabilities and instructions
63
63
  const server = new McpServer({
64
64
  name: 'memory-journal-mcp',
65
- version: '3.1.4',
65
+ version: '3.1.5',
66
66
  }, {
67
67
  capabilities: {
68
68
  logging: {}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "memory-journal-mcp",
3
- "version": "3.1.4",
3
+ "version": "3.1.5",
4
4
  "description": "Project context management for AI-assisted development - Persistent knowledge graphs and intelligent context recall across fragmented AI threads",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
package/releases/v3.1.5.md ADDED
@@ -0,0 +1,40 @@
1
+ # v3.1.5 - Remove protobufjs CLI to Eliminate taffydb CVE
2
+
3
+ **Release Date:** January 11, 2026
4
+
5
+ ## Security Fixes
6
+
7
+ ### protobufjs CLI Removal
8
+
9
+ The `protobufjs` package (transitive dependency via `@xenova/transformers → onnxruntime-web → onnx-proto`) includes a `/cli/` folder for `.proto` file compilation. This CLI folder contains unmaintained dependencies with known CVEs.
10
+
11
+ **Since the CLI is not used at runtime**, we now remove it entirely from the Docker image:
12
+
13
+ ```dockerfile
14
+ RUN rm -rf node_modules/protobufjs/cli
15
+ ```
16
+
17
+ **CVEs Eliminated:**
18
+ - **CVE-2019-10790** (taffydb, HIGH) — 6+ year old unmaintained package
19
+ - **CVE-2025-54798** (tmp, LOW) — Symlink vulnerability
20
+ - **CVE-2025-5889** (brace-expansion, LOW) — ReDoS vulnerability
21
+
22
+ ### Remaining Allowlisted CVEs (No Upstream Fix)
23
+
24
+ These CVEs still have **no fix available** from Alpine:
25
+ - **CVE-2026-22184** (zlib, CRITICAL) — Alpine hasn't packaged zlib 1.3.1.3 yet
26
+ - **CVE-2025-60876** (busybox, MEDIUM) — Patch submitted to busybox but not released
27
+
28
+ ---
29
+
30
+ ## Installation
31
+
32
+ **npm:**
33
+ ```bash
34
+ npm install -g memory-journal-mcp@3.1.5
35
+ ```
36
+
37
+ **Docker:**
38
+ ```bash
39
+ docker pull writenotenow/memory-journal-mcp:3.1.5
40
+ ```
package/server.json CHANGED
@@ -3,12 +3,12 @@
3
3
  "name": "io.github.neverinfamous/memory-journal-mcp",
4
4
  "title": "Memory Journal MCP",
5
5
  "description": "MCP server– Project memory system with GitHub-aware context, knowledge graphs, and CI/PR timelines",
6
- "version": "3.1.4",
6
+ "version": "3.1.5",
7
7
  "packages": [
8
8
  {
9
9
  "registryType": "oci",
10
- "identifier": "docker.io/writenotenow/memory-journal-mcp:v3.1.4",
11
- "version": "3.1.4",
10
+ "identifier": "docker.io/writenotenow/memory-journal-mcp:v3.1.5",
11
+ "version": "3.1.5",
12
12
  "transport": {
13
13
  "type": "stdio"
14
14
  }
package/src/cli.ts CHANGED
@@ -11,7 +11,7 @@ const program = new Command();
11
11
  program
12
12
  .name('memory-journal-mcp')
13
13
  .description('Project context management for AI-assisted development')
14
- .version('3.1.4')
14
+ .version('3.1.5')
15
15
  .option('--transport <type>', 'Transport type: stdio or http', 'stdio')
16
16
  .option('--port <number>', 'HTTP port (for http transport)', '3000')
17
17
  .option('--db <path>', 'Database path', './memory_journal.db')
package/src/server/McpServer.ts CHANGED
@@ -89,7 +89,7 @@ export async function createServer(options: ServerOptions): Promise<void> {
89
89
  const server = new McpServer(
90
90
  {
91
91
  name: 'memory-journal-mcp',
92
- version: '3.1.4',
92
+ version: '3.1.5',
93
93
  },
94
94
  {
95
95
  capabilities: {