Mem0

Changes:

• License changed to MIT: The published @mem0/n8n-nodes-mem0 package is now MIT (was Apache-2.0). n8n's Creator Portal requires verified community nodes to be MIT, and the failing license check was the blocker for verification. The rest of the mem0 repo stays Apache-2.0 (#6804)
• Themed icons: The node and credential icons now declare { light, dark } variants instead of a single icon, clearing the remaining icon-prefer-themed-variants warnings from the Creator Portal scan. No functional changes (#6804)

New Features:

• Client: Add agentCustomInstructions to PromptUpdatePayload, AddMemoryOptions, and ProjectResponse. It sets a second extraction instruction set that applies only to agent-scoped memories: an add passing agentId without userId uses it, one passing both splits by attribution, and while it is unset customInstructions continues to apply to every memory (#6809)

New Features:

• Client: Add agent_custom_instructions to project.update()/update_project() (sync and async) and to the ProjectUpdateOptions and AddMemoryOptions typed models. It sets a second extraction instruction set that applies only to agent-scoped memories: an add passing agent_id without user_id uses it, one passing both splits by attribution, and while it is unset custom_instructions continues to apply to every memory (#6809)

New Features:

• add: New --custom-instructions, --custom-categories, --structured-data-schema, and --timestamp flags, matching the Platform /v3/memories/add/ payload fields (Python and Node #6696)
• search: New --show-expired, --reference-date, and --latest-only flags, forwarded to /v3/memories/search/ as show_expired, reference_date, and latest_only (Python and Node #6696)
• list: New --show-expired and --latest-only flags (Python and Node #6696)
• update: New --expires and --timestamp flags (Python and Node #6696)
• delete: New --delete-linked flag to also delete memories linked to the target memory (Python and Node #6696)

Bug Fixes:

• help --json: Emit JSON automatically under agent mode (--agent), not only when --json is passed explicitly. Python checks is_agent_mode() and now renders through console.print_json() instead of a plain console.print(json.dumps(...)) call; Node also checks the root --agent flag in addition to the subcommand's --json flag (Python and Node #6773)

Changes:

• add: --categories is no longer forwarded on add. The /v3/memories/add/ payload has no categories field (only custom_categories), so the CLI was sending a key the endpoint does not accept. Passing the flag now exits 1 with a message pointing to --custom-categories (Python and Node #6696)

Security:

• Dependencies (Node): Tighten the postcss pnpm override from <8.5.10 → >=8.5.10 to <8.5.18 → >=8.5.18 <9.0.0, closing a newer CVE range the previous floor didn't cover, as part of a wider dependency patch sweep across the pnpm workspaces (#6639)

New Features:

• add: New --custom-instructions, --custom-categories, --structured-data-schema, and --timestamp flags, matching the Platform /v3/memories/add/ payload fields (Python and Node #6696)
• search: New --show-expired, --reference-date, and --latest-only flags, forwarded to /v3/memories/search/ as show_expired, reference_date, and latest_only (Python and Node #6696)
• list: New --show-expired and --latest-only flags (Python and Node #6696)
• update: New --expires and --timestamp flags (Python and Node #6696)
• delete: New --delete-linked flag to also delete memories linked to the target memory (Python and Node #6696)

Bug Fixes:

• help --json: Emit JSON automatically under agent mode (--agent), not only when --json is passed explicitly. Python checks is_agent_mode() and now renders through console.print_json() instead of a plain console.print(json.dumps(...)) call; Node also checks the root --agent flag in addition to the subcommand's --json flag (Python and Node #6773)

Changes:

• add: --categories is no longer forwarded on add. The /v3/memories/add/ payload has no categories field (only custom_categories), so the CLI was sending a key the endpoint does not accept. Passing the flag now exits 1 with a message pointing to --custom-categories (Python and Node #6696)

Security:

• Dependencies (Node): Tighten the postcss pnpm override from <8.5.10 → >=8.5.10 to <8.5.18 → >=8.5.18 <9.0.0, closing a newer CVE range the previous floor didn't cover, as part of a wider dependency patch sweep across the pnpm workspaces (#6639)

New Features:

• Client: Add referenceDate and keywordSearch to SearchMemoryOptions, keeping the TypeScript client's typed search options in sync with the Platform API (#6696)

Bug Fixes:

• Client: Take the /v1/ping/ identity/telemetry call off the request critical path. Every method previously did if (this.telemetryId === "") await this.ping();, blocking the first call on each client instance on a network round trip; the ping now resolves in the background through a shared, credentials-keyed promise cache (FIFO-capped at 50 entries), so concurrent clients on the same host/API key share one ping instead of issuing one each, and a failed ping is not cached so the process can retry (#6788)
• Client: deleteUsers() now issues its per-entity DELETE requests through the shared fetch()-based helper instead of the axios instance, which defaulted to keepAlive: false. Deleting every user, agent, app, and run now reuses pooled connections instead of paying a fresh TCP/TLS handshake per entity (#6788)
• Memory (OSS): Stop add() metadata from setting or overwriting a memory's identity scope. Metadata now runs through the same stripIdentityKeys() helper as update(), so user_id/agent_id/run_id (snake_case or camelCase) and actor_id passed in metadata can no longer place a memory into a scope the caller didn't request through userId/agentId/runId/filters (#6377)
• Vector Stores: Fix Redis search() and list() building an invalid, empty RediSearch filter expression when filters was an empty object or contained only null/undefined values. The shared buildRedisFilterExpr() helper now falls back to "*" (match all) instead of joining zero conditions into "" (#6014)

New Features:

• Client: Add reference_date, latest_only, and keyword_search to SearchMemoryOptions, and latest_only to GetAllMemoryOptions, keeping the Python client's typed options in sync with the Platform API and the CLIs (#6696)

Bug Fixes:

• Core: Stop add() metadata from setting a memory's identity scope. _build_filters_and_metadata() now strips user_id, agent_id, run_id, and actor_id from caller-supplied metadata before building the creation template, so metadata can no longer place a memory into a scope that was never passed through the entity params (#6656)
• Vector Stores: Validate Upstash filter keys and values in search(), keyword_search(), and list(). Filter keys must match a safe identifier pattern, values must be str/int/float/bool, and string values containing a double quote or backslash are now rejected instead of being interpolated unescaped into the generated query string (#5981)
• Embeddings: FastEmbedEmbedding.embed() now converts its result with .tolist() before returning, so callers get a plain List[float] instead of a numpy array (#6770)
• Embeddings: HuggingFaceEmbedding now passes api_key to the OpenAI-compatible client when huggingface_base_url is set. The configured key was previously dropped, so the client fell back to OPENAI_API_KEY from the environment or raised OpenAIError at construction when that was unset (#6770)
• Embeddings: Replace Ollama's interactive pip install prompt on import with a plain ImportError. Importing mem0.embeddings.ollama without the ollama package previously blocked on stdin and then called sys.exit(1), killing the host process instead of raising (#6770)
• Core: remove_code_blocks() now returns an empty string for None input instead of raising AttributeError (#6770)
• Core: parse_vision_messages() now chains the original exception (raise ... from e) when an image download fails, so the root cause is preserved in the traceback (#6770)
• Core: process_telemetry_filters(None) now returns ([], {}), matching the two-value tuple every caller unpacks, instead of {} (#6770)
• Core: LlmFactory.create() no longer mutates the caller's config dict in place via .update(kwargs); the merge now builds a new dict (#6770)
• Rerankers: The Cohere, HuggingFace, SentenceTransformer, and Zero Entropy rerankers' failure-fallback path no longer mutates the caller's document dicts in place when stamping rerank_score; it now falls back on copies (#6770)
• Vector Stores: Remove logging.basicConfig() calls from the MongoDB and Vertex AI Vector Search providers, so selecting either provider no longer reconfigures the host application's root logger as a side effect (#6770)

Security:

• Dependencies: Patched high and medium severity dependency vulnerabilities via pnpm.overrides (brace-expansion, js-yaml) (#6639)

New Features:

• Vector Stores: Add Qdrant server-side BM25 keywordSearch() (requires Qdrant >= 1.15.2) plus payload filter indexes, so keyword search runs without a client-side BM25 dependency (#5851)

Bug Fixes:

• Core: deleteAll() now paginates through the vector store in batches of 1000 instead of listing once, so accounts with more memories than a single page had the remainder silently left behind (#4872)
• Vector Stores: Supabase list() now paginates past PostgREST's 1000-row cap instead of stopping at the first page, search() warns when results may have been truncated by that same cap, and the initialization probe reads a row instead of writing a test vector, so Row Level Security policies that only grant read access no longer fail table verification (#6695)
• Embeddings: Honor TOGETHER_API_BASE in the Together embedder, matching the Together LLM provider, so a custom gateway URL is no longer silently ignored for embeddings (#6572)

Changes:

• Rerankers: RerankerFactory's default LLM reranker model is now gpt-5-mini (was gpt-4o-mini) (#6703)

Security:

• Dependencies: Patched 32 high and 57 medium severity dependency vulnerabilities across the pnpm workspace via pnpm.overrides (axios, brace-expansion, js-yaml, postcss, protobufjs, mongoose, tar, fast-xml-parser, thrift) (#6639)

Bug Fixes:

• Core: delete_all() now paginates through the vector store in batches of 1000 instead of listing once, so accounts with more memories than a single page (most vector stores default to ~100) had the remainder silently left behind (#6636)
• Vector Stores: Cap Supabase search()/list() top_k at the vecs query limit of 1000 instead of erroring, and fix a col_info() crash by reading collection attributes directly instead of calling the removed describe() method (#6695)
• Vector Stores: Set size on Elasticsearch KNN search queries, so results respect top_k instead of being capped at Elasticsearch's default of 10 hits (#5910)

Changes:

• Rerankers: LLMReranker's default model is now gpt-5-mini (was gpt-4o-mini) (#6703)