# Release v7.7.0

## Highlights

- **Adversarial Planner Skill**: Added multi-pass adversarial planning and review with structured critique stages and Copilot CLI validation.
- **Dependency Updates**: Updated lockfile-resolved npm package versions within the existing `package.json` ranges: `@huggingface/transformers` resolved to `^4.2.0`, `eslint` resolved to `^10.3.0`, `globals` resolved to `^17.6.0`, `jose` resolved to `^6.2.3`, `typescript-eslint` resolved to `^8.59.2`, and `zod` resolved to `^4.4.3`.
- **Security Enhancements**: Resolved an XSS vulnerability in `ip-address` and a HIGH severity Trivy code scanning alert (CVE-2026-27135).

## Security

- Fixed XSS vulnerability in `ip-address` by overriding version to `10.2.0`
- Fixed HIGH severity Trivy code scanning alert (CVE-2026-27135) by explicitly upgrading `nghttp2-libs` from Alpine edge repository in Dockerfile

## Changed

- Updated lockfile-resolved npm package versions within the existing `package.json` ranges: `@huggingface/transformers` resolved to `^4.2.0`, `eslint` resolved to `^10.3.0`, `globals` resolved to `^17.6.0`, `jose` resolved to `^6.2.3`, `typescript-eslint` resolved to `^8.59.2`, and `zod` resolved to `^4.4.3`
- Bumped `github/gh-aw-actions` to `v0.71.4` in GitHub Actions workflows
- Bumped `aquasecurity/trivy-action` to `ed142fd0673e97e23eac54620cfb913e5ce36c25`
- Bumped `github/codeql-action` to `95e58e9a2cdfd71adc6e0353d5c52f41a045d225`

## Added

- `adversarial-planner` skill: multi-pass adversarial planning and review with structured critique stages and Copilot CLI validation
- New entry types: `plan_draft`, `adversarial_review`, `plan_refinement`, `copilot_validation`

## Fixed

- Stale version `7.6.0` in `server.json` (version field and OCI identifier) → updated to `7.7.0`
- Stale skill name `mastering-typescript` in server instructions → corrected to `typescript`
- Added `adversarial-planner` and `copilot-audit` to the native skills listing in server instructions
- Fixed `assertSafeFilePath` validation in `buildRulesFileInfo` and `buildSkillsDirInfo` swallowing the output of `memory://briefing` metadata when paths were outside explicitly allowed IO roots.
- Fixed `INTERNAL_ERROR` during `restore_backup` in Code Mode by migrating atomic database swap from `fs.rename` to `fs.copyFile` to bypass Windows `EBUSY` file locks from `sqlite-vec`.
- Fixed `search_by_date_range` omitting the `source: 'personal'` metadata field when skipping cross-database merging.
- Fixed `restore_backup` returning a raw MCP JSON-RPC exception when called with missing required parameters by relaxing the outer schema.

---

**Compare:** [v7.6.1...v7.7.0](https://github.com/neverinfamous/memory-journal-mcp/compare/v7.6.1...v7.7.0)

**Install via MCP:**

```json
{
  "mcpServers": {
    "memory-journal-mcp": {
      "command": "npx",
      "args": ["-y", "memory-journal-mcp@7.7.0"]
    }
  }
}
```
