v0.2.23 v1.16.22
web-infra-dev/midsceneSep 24, 2026 → Sep 28, 20264 days between releases
What's New
Web server now enforces host-based access control and requires approval for repository worktree hooks.
Breaking Changes
- Web server rejects requests to unlisted hosts (HTTP 421).
- Repository worktree hooks previously run without approval now require explicit approval.
New Features
- Host-based web access control via [web] allowed_hosts.
- Trust hooks command for script approval.
- Cookies are now HttpOnly and SameSite=Strict.
- Hardened input validation for CLI arguments.
Improvements
- Security hardening for web server and CLI input validation.
- Fixed CI test flakes related to daemon stream goroutines.
Bug Fixes
- Fixed input validation for CLI JSON and tmux arguments.
- Fixed CI test flakes related to daemon stream goroutines.
Upgrade Notes
If using a reverse proxy or Tailscale, add the host name to [web] allowed_hosts to prevent 421 errors. Additionally, repository worktree hooks approved in versions prior to 1.16.22 may require re-approval as they now bind approval to script SHA256 and path.
The Two Releases
v0.2.23
Sep 24, 2026· 27 days ago
Adds Zep and Hindsight migration sources to the Memanto CLI and web UI, along with community-contributed OKF migration showcases. Unfiltered recall queries are optimized to prevent over-fetching.
Full release notesv1.16.22
Sep 28, 2026· 24 days ago
Focuses on security and web server configuration. Introduces host-based access control and requires approval for repository worktree hooks based on script identity. Hardens input validation and fixes CI test flakes.
Full release notes