What supermemoryai/supermemory shipped

This week: patched the Next.js RCE advisory and MCP SDK advisories, fixed production deploys with OpenNext's static-assets cache, dropped DM Sans to unblock builds, moved the MCP graph tools to the v5 namespace graph feed, and synced docs with v5 cursor pagination.

This week: the web app's Next.js pin moved to 16.4.1 to patch an unauthenticated RCE advisory, a Server Actions denial of service advisory and MCP SDK advisories. Production deploys were unblocked by switching the web app to OpenNext's static-assets cache and bumping OpenNext so next 16.4.1 stops returning 500 on every page. DM Sans was dropped so builds stop fetching Google Fonts URLs that next/font/google cannot parse. The MCP graph tools now read the v5 namespace graph feed with cursor paging instead of the legacy v3 documents route. The docs were synced with cursor pagination for the v5 list endpoint, shipping in the TypeScript SDK from 5.1.1.

This week: tool responses now say when a document is accepted and memories are extracted in the background, and document tools expose dreaming status. The hosted worker moved to 1.0.1, two dependency alerts closed, and docs went through a full drift audit.

This week's changes to the project: the add memory tool now reports what actually happened, that the document was accepted and memories are extracted in the background, and the document listing and single document tools expose the existing dreaming status. The hosted worker was bumped to 1.0.1 to stay in sync with the earlier API-key validation change, and dependency updates moved happy-dom to 21.0.4 and the zod 4 copies to 4.6.7. On the docs side, a full drift audit compared the live code against the live docs across API and specs, concepts and guides, SDKs, coding-agent plugins, framework tools and pricing. An AGENTS.md file was added at the repo root with instructions for coding agents, and the Mem0 migration guide now names that dashboard without linking it.

Supermemory this week: forget_memory by exact ID runs in about 0.5s instead of the 30s timeout, Local 0.0.9 ships prebuilt Docker images for amd64 and arm64, and tools 2.3.1 keeps containerTag inside the configured scope.

This week in Supermemory: forget_memory now forgets memories by exact ID taken from search_memory, running in about half a second on production instead of hitting the 30s timeout. Supermemory Local 0.0.9 is out with prebuilt Docker images for Linux amd64 and arm64, improved uploads, namespace operations and API v5 support. On the tools side, 2.3.1 backports a fix that keeps model-supplied containerTag inside the configured scope, 3.1.2 bundles 8 community fixes adapted to v5, and 3.1.0 makes ai an optional peer so apps on newer SDK releases avoid a duplicate copy. Docker installation and safe upgrade instructions are now in the docs, and the v5 docs were aligned with the API across ingestion, search, connectors and self-hosting.

Tools 3.0 and the server now run on v5, with the namespace as the first argument and a separate tool for removals. Old tool names come back as deprecated aliases so cached clients stop failing. Migration guide and versioned API reference are out.

This week the MCP server moved to the v5 API and supermemory 5.0, with the namespace as the first argument on every tool, and @supermemory/tools 3.0 brings every integration onto v5 while retiring @supermemory/ai-sdk. Removals now have a separate tool with its own schemas and destructive annotations, and the pre-snake_case tool names return as deprecated aliases so cached clients stop failing. The wrapper packages pin the Python SDK below 5 so existing installs keep working. On the docs side, a versioned v5 API reference, a migration guide and rewritten snippets across 50 pages support the upgrade.

Ship day: LiveKit voice agent memory, Better Auth security patch, advanced PDF extraction docs, and dependency security fixes across the stack.

This week we shipped persistent memory for LiveKit Agents voice sessions, security patches across the dependency stack including Better Auth 1.7.6, refreshed documentation design, improved team invitation workflow, and PostHog analytics instrumentation for better MCP observability. We also published transparency disclosures about self-hosted security behavior and documented advanced PDF extraction capabilities on Scale and Enterprise plans.

This week: memory graph 0.2.4 with theme and layout fixes, MCP tools now using snake_case, and 35 doc redirects for stale URLs. Billing docs updated with Max plan details.

Weekly update: memory graph 0.2.4 shipped with theme restoration, automatic node settling, and improved initial layout. MCP tools refactored to snake_case naming and search_memory optimized to reduce unnecessary data fetching. Documentation expanded with Muse Code plugin guide, updated billing information for Max plan, and 35 redirects addressing stale URLs from GSC audit.