v1.43.0 v2.3.2

Name: LongMemory
Author: CaviraOSS

high risk

CaviraOSS/LongMemoryAug 31, 2026 → Aug 31, 20260 days between releases

What's New

Critical BOLA vulnerability patched in vendor API with major version upgrade to v2.3.2

New Features

Attribute edits now go through product-change diff pipeline
CLI builds admin dashboard extensions with custom entry points
Microsoft Azure AD connector now supports `disableEmailSync` option
Pinned generated projects to CLI release channel

Improvements

SSRF protection for webhooks and enterprise SSO
Token exchange validation ensures JWTs are actual access tokens
Vendor API handlers scoped to authenticated sellers
Member-management routes bind member_id to caller's seller
Vendor stores query has selectable fields restricted

Bug Fixes

Fixes critical broken-access-control (BOLA) vulnerability in vendor API
Fixes list formatter placeholders and untranslated MFA message in Spanish locales

Upgrade Notes

Upgrade immediately to patch a critical BOLA vulnerability affecting the vendor API. Attribute edit workflows now utilize a new product-change diff pipeline. CLI-generated projects are pinned to the release channel.

The Two Releases

v1.43.0

Aug 31, 2026· 2 months ago

A major security-focused release that adds Spanish (Mexico) support, hardens SSRF protection for webhooks and enterprise SSO, and restricts third-party applications from mutating account data.

Full release notes

v2.3.2

Aug 31, 2026· 2 months ago

A security and hardening release fixing a critical broken-access-control vulnerability in the vendor API and adding attribute edit pipelines.

Full release notes