v1.14.2 v2.8.3
vercel-labs/webreelAug 13, 2026 → Aug 16, 20263 days between releases
What's New
Adds security approval gates, MCP protocol updates, and breaking changes to update commands and output formats.
Breaking Changes
- `qmd update` now requires approval for local `.qmd/index.yml` commands.
- MCP HTTP sessionless mode no longer uses `Mcp-Session-Id` or handshake.
- `--full-path` output drops docid for resolved results.
- `search --format csv` now always emits the docid column.
New Features
- New `--format <kind>` flag for search, query, and multi-get commands.
- New `qmd trust`, `qmd trust list`, and `qmd trust revoke` commands.
- Path containment checks for `qmd://` filesystem resolution.
Improvements
- Updated MCP protocol to revision 2026-07-28.
- Dependency `node-llama-cpp` updated to version 3.20.0.
- Indexing improvements for symlink and glob handling.
Upgrade Notes
Update commands now require approval for local `.qmd/index.yml` files. MCP HTTP clients must adapt to the new sessionless handshake. Output formats for `--full-path` and CSV search have changed.
The Two Releases
1.14.2 — Hardened parsing for pathological PDFs
Aug 13, 2026· 2 months ago
Hardens the parser against malicious or malformed PDFs by implementing strict bounds on resource expansion, CID ranges, and decoding operations to prevent unbounded CPU or memory usage.
Full release notesv2.8.3
Aug 16, 2026· 2 months ago
This release prioritizes security with new approval gates for local `qmd update` commands and path traversal protections. It includes updates to the MCP protocol, new trust management commands, and fixes for indexing and CLI output behaviors.
Full release notes