Skip to content

chore: release v10.36.7 — security: bump pygments to 2.20.0 (CVE-2026-4539) #699

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
doobidoo merged 2 commits into from
Apr 14, 2026
Merged

chore: release v10.36.7 — security: bump pygments to 2.20.0 (CVE-2026-4539) #699

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6ebd716
fix(deps): bump pygments to 2.20.0 (CVE-2026-4539)
doobidoo Apr 14, 2026
d026049
chore: release v10.36.7
doobidoo Apr 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),

## [Unreleased]

## [10.36.7] - 2026-04-14

### Security

- **[#698] Bumped pygments to 2.20.0**: Resolves CVE-2026-4539 (GHSA-5239-wwwm-4pmq, ReDoS via inefficient regex for GUID matching). Transitive dependency via rich. (PR #698)

## [10.36.6] - 2026-04-14

### Security
Expand Down
2 changes: 1 addition & 1 deletion CLAUDE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ Before merging or releasing:

MCP Memory Service is a semantic memory layer for AI applications, accessible via REST API and MCP transport. It provides persistent storage for 14+ AI clients including Claude Desktop, OpenCode, LangGraph, CrewAI, and any HTTP client. It uses vector embeddings for semantic search, supports multiple storage backends (SQLite-vec, Cloudflare, Hybrid), and includes advanced features like memory consolidation, quality scoring, and OAuth 2.1 team collaboration.

**Current Version:** v10.36.6 - security: bump cryptography to 46.0.7 to fix CVE-2026-39892 (PR #690) — 1,537 tests — see [CHANGELOG.md](CHANGELOG.md) for details
**Current Version:** v10.36.7 - security: bump pygments to 2.20.0 to fix CVE-2026-4539/GHSA-5239-wwwm-4pmq (PR #698) — 1,537 tests — see [CHANGELOG.md](CHANGELOG.md) for details

> **🎯 v10.0.0 Milestone**: This major release represents a complete API consolidation - 34 tools unified into 12 with enhanced capabilities. All deprecated tools continue working with warnings until v11.0. See `docs/MIGRATION.md` for migration guide.

Expand Down
7 changes: 4 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -434,17 +434,18 @@ Export memories from mcp-memory-service → Import to shodh-cloudflare → Sync
---


## Latest Release: **v10.36.6** (April 14, 2026)
## Latest Release: **v10.36.7** (April 14, 2026)

**security: Bump cryptography to 46.0.7 (CVE-2026-39892)**
**security: Bump pygments to 2.20.0 (CVE-2026-4539)**

**What's Fixed:**
- **CVE-2026-39892**: Bumped `cryptography` to 46.0.7 to fix a buffer overflow in non-contiguous buffer handling. (PR #690)
- **CVE-2026-4539** (GHSA-5239-wwwm-4pmq): Bumped `pygments` to 2.20.0 to fix a ReDoS vulnerability via inefficient regex for GUID matching. Transitive dependency via rich. (PR #698)
- **1,537 tests** passing.

---

**Previous Releases**:
- **v10.36.6** - security: bump cryptography to 46.0.7 (CVE-2026-39892) — buffer overflow fix in non-contiguous buffer handling (PR #690, 1,537 tests)
- **v10.36.5** - fix: Cloudflare Vectorize API v1 to v2 + test script fixes — fixed error 1010 "incorrect_api_version", content_hash arg, sys.path correction (PR #689, @mychaelgo, 1,537 tests)
- **v10.36.4** - fix(windows): hotfix for Get-McpApiKey returning first char instead of full API key — PowerShell array-enumeration trap fixed (PR #687, 1,537 tests)
- **v10.36.3** - fix(dashboard): restore version badge after v10.21.0 security hardening — Settings modal version row fixed, `manage_service.ps1 status` shows real Version/Backend (PR #685, 1,537 tests)
Expand Down
2 changes: 1 addition & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ build-backend = "hatchling.build"

[project]
name = "mcp-memory-service"
version = "10.36.6"
version = "10.36.7"
Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist bot Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-medium medium

While updating the lock file addresses the security vulnerability for environments using it, pygments is a transitive dependency (via rich). To ensure that all users—including those installing via pip without the lock file—are protected from CVE-2026-4539, consider adding an explicit version constraint for pygments (e.g., pygments>=2.20.0) to the dependencies section of pyproject.toml.

description = "Semantic memory layer for AI applications. REST API + MCP transport + knowledge graph + autonomous consolidation. Works with 14+ AI clients. Self-host, zero cloud cost."
readme = "README.md"
requires-python = ">=3.10"
Expand Down
2 changes: 1 addition & 1 deletion src/mcp_memory_service/_version.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
"""Version information for MCP Memory Service."""

__version__ = "10.36.6"
__version__ = "10.36.7"
8 changes: 4 additions & 4 deletions uv.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading