memory-journal-mcp 5.0.0 → 5.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/CHANGELOG.md +11 -0
  2. package/DOCKER_README.md +1 -1
  3. package/Dockerfile +9 -9
  4. package/package.json +2 -2
  5. package/releases/v5.0.1.md +25 -0
package/CHANGELOG.md CHANGED
@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
7
7
 
8
8
  ## [Unreleased]
9
9
 
10
+ ## [5.0.1] - 2026-03-06
11
+
12
+ ### Security
13
+
14
+ - **GHSA-qffp-2rhf-9h96 (tar)** — Manually patched npm's bundled `tar` → `7.5.10` in Dockerfile to fix HIGH severity path traversal vulnerability (CVSS 8.2). Also updated npm override.
15
+
16
+ ### Changed
17
+
18
+ - **Dependency Updates**
19
+ - `tar` override: 7.5.9 → 7.5.10 (patch) — npm + Docker layers
20
+
10
21
  ## [5.0.0] - 2026-03-06
11
22
 
12
23
  ### Added
package/DOCKER_README.md CHANGED
@@ -423,7 +423,7 @@ Designed for extremely low overhead: database reads in sub-millisecond, vector s
423
423
 
424
424
  **Available Tags:**
425
425
 
426
- - `5.0.0` - Specific version (recommended for production)
426
+ - `5.0.1` - Specific version (recommended for production)
427
427
  - `5.0` - Latest patch in 5.0.x series
428
428
  - `5` - Latest minor in 5.x series
429
429
  - `latest` - Always the newest version
package/Dockerfile CHANGED
@@ -23,13 +23,13 @@ RUN cd /usr/local/lib/node_modules/npm && \
23
23
  mv package node_modules/diff && \
24
24
  rm diff-8.0.3.tgz
25
25
 
26
- # Fix CVE-2026-23950, CVE-2026-24842, CVE-2026-26960: Manually update npm's bundled tar to 7.5.9
26
+ # Fix CVE-2026-23950, CVE-2026-24842, CVE-2026-26960, GHSA-qffp-2rhf-9h96: Manually update npm's bundled tar to 7.5.10
27
27
  RUN cd /usr/local/lib/node_modules/npm && \
28
- npm pack tar@7.5.9 && \
28
+ npm pack tar@7.5.10 && \
29
29
  rm -rf node_modules/tar && \
30
- tar -xzf tar-7.5.9.tgz && \
30
+ tar -xzf tar-7.5.10.tgz && \
31
31
  mv package node_modules/tar && \
32
- rm tar-7.5.9.tgz
32
+ rm tar-7.5.10.tgz
33
33
 
34
34
  # Fix CVE-2026-27903, CVE-2026-27904: Manually update npm's bundled minimatch to 10.2.4
35
35
  RUN cd /usr/local/lib/node_modules/npm && \
@@ -79,13 +79,13 @@ RUN cd /usr/local/lib/node_modules/npm && \
79
79
  mv package node_modules/diff && \
80
80
  rm diff-8.0.3.tgz
81
81
 
82
- # Fix CVE-2026-23950, CVE-2026-24842, CVE-2026-26960: Manually update npm's bundled tar to 7.5.9
82
+ # Fix CVE-2026-23950, CVE-2026-24842, CVE-2026-26960, GHSA-qffp-2rhf-9h96: Manually update npm's bundled tar to 7.5.10
83
83
  RUN cd /usr/local/lib/node_modules/npm && \
84
- npm pack tar@7.5.9 && \
84
+ npm pack tar@7.5.10 && \
85
85
  rm -rf node_modules/tar && \
86
- tar -xzf tar-7.5.9.tgz && \
86
+ tar -xzf tar-7.5.10.tgz && \
87
87
  mv package node_modules/tar && \
88
- rm tar-7.5.9.tgz
88
+ rm tar-7.5.10.tgz
89
89
 
90
90
  # Fix CVE-2026-27903, CVE-2026-27904: Manually update npm's bundled minimatch to 10.2.4
91
91
  RUN cd /usr/local/lib/node_modules/npm && \
@@ -129,6 +129,6 @@ ENTRYPOINT ["node", "dist/cli.js"]
129
129
  # Labels for Docker Hub
130
130
  LABEL maintainer="Adamic.tech"
131
131
  LABEL description="Memory Journal MCP Server - Project context management for AI-assisted development"
132
- LABEL version="5.0.0"
132
+ LABEL version="5.0.1"
133
133
  LABEL org.opencontainers.image.source="https://github.com/neverinfamous/memory-journal-mcp"
134
134
  LABEL io.modelcontextprotocol.server.name="io.github.neverinfamous/memory-journal-mcp"
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "memory-journal-mcp",
3
- "version": "5.0.0",
3
+ "version": "5.0.1",
4
4
  "description": "Project context management for AI-assisted development - Persistent knowledge graphs and intelligent context recall across fragmented AI threads",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
@@ -81,7 +81,7 @@
81
81
  "brace-expansion": "^2.0.2",
82
82
  "glob": "^11.1.0",
83
83
  "minimatch": "^10.2.4",
84
- "tar": "^7.5.9",
84
+ "tar": "^7.5.10",
85
85
  "tmp": "^0.2.4"
86
86
  }
87
87
  }
package/releases/v5.0.1.md ADDED
@@ -0,0 +1,25 @@
1
+ # v5.0.1 — Security Patch
2
+
3
+ **Release Date:** March 6, 2026
4
+
5
+ Patches a HIGH severity path traversal vulnerability in npm's bundled `tar` package discovered by Docker Scout during the v5.0.0 deployment pipeline.
6
+
7
+ ## 🔒 Security
8
+
9
+ - **GHSA-qffp-2rhf-9h96 (tar)** — Manually patched npm's bundled `tar` → `7.5.10` in Dockerfile (builder + production stages) to fix HIGH severity path traversal vulnerability (CVSS 8.2). Also updated npm override in `package.json`.
10
+
11
+ ## 🔄 Changed
12
+
13
+ - `tar` override: 7.5.9 → 7.5.10 (patch) — npm + Docker layers
14
+
15
+ ---
16
+
17
+ **Full Changelog:** [v5.0.0...v5.0.1](https://github.com/neverinfamous/memory-journal-mcp/compare/v5.0.0...v5.0.1)
18
+
19
+ **Install/Update:**
20
+
21
+ ```bash
22
+ npm install -g memory-journal-mcp@5.0.1
23
+ # or
24
+ docker pull writenotenow/memory-journal-mcp:v5.0.1
25
+ ```