[Dhravya]

API v5 without rekeying existing installations

Release 2.1.19 uses pinned official supermemory@5.0.1 for the hosted API. Existing container tags become namespace paths, customId becomes the document id, and extraction context becomes supportingContext. Six-hour shared capture/manual-save IDs, metadata, last-turn capture, tool aliases, configuration/env/key precedence, and processing defaults remain. Saves use POST append/diff with memory/dynamic processing; malformed, failed, or unknown-state acknowledgments are rejected.

Search explicitly retains memories mode, threshold 0.6, no reranking/rewrite, and existing tool limits. Queried profiles request profile and search concurrently; object facts become text and search timestamps come from system. Exact forgetting requires documented arrays/match fields and checks the v5 per-ID outcome. Wipe validates stable pagination totals, exact page cardinality and complete unique root document enumeration before any DELETE, then checks partial batch outcomes rather than claiming full success. No semantic bulk forget or document PATCH replacement is introduced.

Custom-server compatibility and delivery

Custom endpoints default to the pinned official v4 SDK through the external supermemory-legacy dependency. apiVersion / SUPERMEMORY_API_VERSION allow explicit v5 opt-in or legacy rollback; configuration takes precedence. Equivalent hosted root spellings normalize to v5. Custom URL prefixes and bearer/source headers are preserved, with no failed-write negotiation or hosted fallback.

Both source and runtime host entrypoints are retained. The build externalizes both declared runtime SDKs, the Bun lock is updated, and prepack rebuilds the shipped runtime. Configuration files are not rewritten; the changelog warns against rerunning setup, which replaces advanced options. PRs #25, #62, #66 and #67 remain separate: no capture-management skip, metadata stamping, publishing or CI changes, and legacy forget behavior is unchanged.

Verification and limits

• TypeScript, Biome 2.3.8, build, diff checks and CI's Bun 1.2.17 frozen install pass; no test files were added or changed (main has no test suite).
• Eleven scratch-only local-sink groups pass on Node 24.18.0 and 22.14.0: real SDK routes/bodies/auth/options, six legacy operation request parity against fresh main, capture/recall rendering, namespace identity, retries/errors, acceptance and destructive partial failures.
• All 18 independent reviewer fault fixtures pass on both Node versions: truncated/oversized pages, missing/negative/changing totals, duplicate IDs within/across pages and malformed forget arrays are rejected. Every inconsistent list issues zero DELETE; partial batch failure stops after one DELETE.
• A cold production-only npm install contains both pinned SDKs without developer dependencies. Source/jiti and built entrypoints register eight tools and perform ten local-sink requests on both Node versions. Actual OpenClaw 2026.5.7 loader accepts the packed plugin under both artifact preferences; no gateway or services were started.
• Published 2.1.18 → packed 2.1.19 upgrade preserves fixture config, credential and existing SQLite bytes, advanced options, disabled capture/recall, env precedence and tool aliases. Rebuilt runtime hashes are identical across repeated builds.

No hosted memory API, real credentials, backend migration, live publish, tag or merge was used. Historical backend data/ranking/processing and server-upgrade rollback are unverified. Split profile search uses an explicit ten-result limit; the legacy profile endpoint's undocumented search limit/ranking cannot be proved equivalent offline. Existing SDK policy stays 60 seconds per attempt and two retries, not exactly-once billing; SDK timeout bounds headers, not stalled response bodies, and v5 surfaces 409 without retrying.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	supermemory@​5.0.1

View full report