diff --git a/.agents/skills/uteke-memory/SKILL.md b/.agents/skills/uteke-memory/SKILL.md index 7e36d071..eba1e4d8 100644 --- a/.agents/skills/uteke-memory/SKILL.md +++ b/.agents/skills/uteke-memory/SKILL.md @@ -5,7 +5,7 @@ description: "Persistent memory engine for AI agents via the uteke CLI — remem # Uteke Memory Skill Persistent memory engine for AI agents via the `uteke` CLI. -Version: **0.21.0** — SQLite + HNSW vector index (usearch default, or vecq) + FTS5 hybrid search (RRF k=60); `fusion` (weighted RRF of the vector and hybrid rankings) is the default recall strategy since 0.16.0. `unsafe_code = "forbid"` workspace-wide. +Version: **0.21.1** — SQLite + HNSW vector index (usearch default, or vecq) + FTS5 hybrid search (RRF k=60); `fusion` (weighted RRF of the vector and hybrid rankings) is the default recall strategy since 0.16.0. `unsafe_code = "forbid"` workspace-wide. > This skill ships with each release — its version tracks the CLI version > (a CI gate fails when they drift, see `skill-version-parity` test). diff --git a/CHANGELOG.md b/CHANGELOG.md index 210c1ddf..05a4b9f3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,9 +2,23 @@ ## [Unreleased] +## [0.21.1] - 2026-10-15 + +Patch release. Theme: **`uteke upgrade` verifies a minisign signature, Homebrew +installs keep their embeddings, and `--json` output stays clean.** 0.21.1 is the +first release whose `checksums-sha256.txt` carries a minisign signature. A +0.21.0 binary only checks the SHA-256 and never verifies the signature, so the +signature protects `uteke upgrade` from 0.21.1 on. + +### ⚠️ Behavior Change + +- **`uteke upgrade` is stricter (#1327, #1462)** - it installs only stable releases (`vX.Y.Z`), refuses to downgrade, and fails closed unless the release has a valid minisign signature for `checksums-sha256.txt`. A release without a `.minisig` cannot be installed by `uteke upgrade` until the maintainer signs it. +- **CLI log lines go to stderr (#1461, #1471)** - scripts that read log lines from stdout must read stderr instead; `--json` output is now parseable even when a warning is logged. + ### Security - **`uteke upgrade` verifies a minisign signature over `checksums-sha256.txt` (#1327)** - the release maintainer signs the checksums offline (`scripts/sign-release.sh`) and uploads `checksums-sha256.txt.minisig`; the embedded public key (`scripts/uteke-release.pub`) and the trusted comment `uteke ` are checked before any hash in the file is trusted, so a tampered file is rejected, one release's files cannot be served as another's (the signature is bound to the tag), and `uteke upgrade` now refuses to downgrade to an older release. It also installs only stable releases (`vX.Y.Z`), never a pre-release or build-metadata tag. The signature is checked by `uteke upgrade` only: `install.sh`, `install.ps1` and Homebrew do not verify it (verify manually per SECURITY.md). A missing or invalid signature is a hard failure; `UTEKE_UPGRADE_SKIP_CHECKSUM=1` skips it too. Manual steps are in SECURITY.md. +- **rustls 0.23.46 (#1455)** - fixes RUSTSEC-2026-0346 to RUSTSEC-2026-0349 in the TLS stack used by the HTTP client. ### Fixed @@ -13,6 +27,7 @@ ### Changed +- Internal: the server dispatch is split into one named handler per route group (#1344, #1458); dependabot batch for `toml`, `usearch`, `uuid` and `serde_json` (#1457). - Internal: `release-signature-reminder` workflow and script open and re-ping a `Sign release vX.Y.Z (minisign)` issue until the offline minisign signature is on the release, and close reminders for superseded releases automatically (#1327). ## [0.21.0] - 2026-10-13 diff --git a/Cargo.lock b/Cargo.lock index 32863e01..bfc9565d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -2773,7 +2773,7 @@ dependencies = [ [[package]] name = "uteke-cli" -version = "0.21.0" +version = "0.21.1" dependencies = [ "chrono", "clap", @@ -2800,7 +2800,7 @@ dependencies = [ [[package]] name = "uteke-core" -version = "0.21.0" +version = "0.21.1" dependencies = [ "chrono", "dirs", @@ -2825,7 +2825,7 @@ dependencies = [ [[package]] name = "uteke-mcp" -version = "0.21.0" +version = "0.21.1" dependencies = [ "chrono", "dirs", @@ -2837,7 +2837,7 @@ dependencies = [ [[package]] name = "uteke-server" -version = "0.21.0" +version = "0.21.1" dependencies = [ "chrono", "ctrlc", diff --git a/Cargo.toml b/Cargo.toml index ec1e2db2..9e06b787 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -9,7 +9,7 @@ members = [ ] [workspace.package] -version = "0.21.0" +version = "0.21.1" edition = "2024" license = "Apache-2.0" repository = "https://github.com/codecoradev/uteke" diff --git a/README.id.md b/README.id.md index 70600003..5a924573 100644 --- a/README.id.md +++ b/README.id.md @@ -392,7 +392,7 @@ Bisa. Uteke punya MCP server yang langsung pakai dengan Claude Code, Cursor, dan
Sudah production-ready? -Uteke sekarang v0.21.0 dengan 200+ test, CI/CD di setiap commit, dan benchmark harness. Dipakai production oleh tim CodeCora dan early adopter lain. Masih di versi 0.x, jadi mungkin ada rough edges, tapi core-nya udah stabil. +Uteke sekarang v0.21.1 dengan 200+ test, CI/CD di setiap commit, dan benchmark harness. Dipakai production oleh tim CodeCora dan early adopter lain. Masih di versi 0.x, jadi mungkin ada rough edges, tapi core-nya udah stabil.
--- diff --git a/README.md b/README.md index 1851fad2..1d16bde1 100644 --- a/README.md +++ b/README.md @@ -353,7 +353,7 @@ Yes. Uteke ships with an MCP server that works with Claude Code, Cursor, and Her
Is it production-ready? -Uteke is at v0.21.0 with 200+ tests, CI/CD on every commit, and a benchmark harness. It's used in production by the CodeCora team and other early adopters. Still in 0.x, so expect rough edges, but the core is stable. +Uteke is at v0.21.1 with 200+ tests, CI/CD on every commit, and a benchmark harness. It's used in production by the CodeCora team and other early adopters. Still in 0.x, so expect rough edges, but the core is stable.
--- diff --git a/crates/uteke-cli/Cargo.toml b/crates/uteke-cli/Cargo.toml index 7313ab69..c9916d59 100644 --- a/crates/uteke-cli/Cargo.toml +++ b/crates/uteke-cli/Cargo.toml @@ -22,7 +22,7 @@ usearch = ["uteke-core/usearch"] vecq = ["uteke-core/vecq"] [dependencies] -uteke-core = { path = "../uteke-core", version = "0.21.0", default-features = false, features = ["onnx"] } +uteke-core = { path = "../uteke-core", version = "0.21.1", default-features = false, features = ["onnx"] } clap = { version = "4", features = ["derive"] } serde_json = "1" tracing = "0.1" diff --git a/crates/uteke-cli/assets/uteke-memory-skill.md b/crates/uteke-cli/assets/uteke-memory-skill.md index 7e36d071..eba1e4d8 100644 --- a/crates/uteke-cli/assets/uteke-memory-skill.md +++ b/crates/uteke-cli/assets/uteke-memory-skill.md @@ -5,7 +5,7 @@ description: "Persistent memory engine for AI agents via the uteke CLI — remem # Uteke Memory Skill Persistent memory engine for AI agents via the `uteke` CLI. -Version: **0.21.0** — SQLite + HNSW vector index (usearch default, or vecq) + FTS5 hybrid search (RRF k=60); `fusion` (weighted RRF of the vector and hybrid rankings) is the default recall strategy since 0.16.0. `unsafe_code = "forbid"` workspace-wide. +Version: **0.21.1** — SQLite + HNSW vector index (usearch default, or vecq) + FTS5 hybrid search (RRF k=60); `fusion` (weighted RRF of the vector and hybrid rankings) is the default recall strategy since 0.16.0. `unsafe_code = "forbid"` workspace-wide. > This skill ships with each release — its version tracks the CLI version > (a CI gate fails when they drift, see `skill-version-parity` test). diff --git a/crates/uteke-mcp/Cargo.toml b/crates/uteke-mcp/Cargo.toml index 732f209c..c56ac77a 100644 --- a/crates/uteke-mcp/Cargo.toml +++ b/crates/uteke-mcp/Cargo.toml @@ -29,7 +29,7 @@ usearch = ["uteke-core/usearch"] vecq = ["uteke-core/vecq"] [dependencies] -uteke-core = { path = "../uteke-core", version = "0.21.0", default-features = false, features = ["onnx"] } +uteke-core = { path = "../uteke-core", version = "0.21.1", default-features = false, features = ["onnx"] } serde = { version = "1", features = ["derive"] } serde_json = "1" dirs = "7" diff --git a/crates/uteke-server/Cargo.toml b/crates/uteke-server/Cargo.toml index 41c10774..f13bcc40 100644 --- a/crates/uteke-server/Cargo.toml +++ b/crates/uteke-server/Cargo.toml @@ -27,8 +27,8 @@ name = "uteke-serve" path = "src/main.rs" [dependencies] -uteke-core = { path = "../uteke-core", version = "0.21.0", default-features = false, features = ["onnx"] } -uteke-mcp = { path = "../uteke-mcp", version = "0.21.0", default-features = false } +uteke-core = { path = "../uteke-core", version = "0.21.1", default-features = false, features = ["onnx"] } +uteke-mcp = { path = "../uteke-mcp", version = "0.21.1", default-features = false } serde = { version = "1", features = ["derive"] } serde_json = "1" schemars = { version = "1", optional = true } diff --git a/docs/core-contract.json b/docs/core-contract.json index 4cdd0b6a..3183bdd8 100644 --- a/docs/core-contract.json +++ b/docs/core-contract.json @@ -319,5 +319,5 @@ } ], "source_of_truth": "uteke PROD store, document tree kontrak-core-cloud", - "version": "0.21.0" + "version": "0.21.1" }