# v4.4.0 - Milestones, Insights, Security Hardening & Performance

Released: February 27, 2026

## Highlights

- **GitHub Milestones Integration** — Full CRUD support with 5 new tools, 2 new resources, and briefing/status integration
- **Repository Insights/Traffic Tool** — New `get_repo_insights` tool and `memory://github/insights` resource for monitoring stars, forks, clones, views, referrers, and popular paths (14-day rolling data)
- **HTTP Transport Security Hardening** — Configurable CORS, request body size limits, security headers, session timeout, and error log token scrubbing
- **Performance Improvements** — Debounced database save, paginated vector rebuild, parallel batch embedding, GitHub API TTL cache, and startup deduplication
- **15+ Bug Fixes** — Including `memory://significant` sort correctness, `delete_entry` permanent delete, JournalEntry GitHub metadata exposure, and `list_tags` zero-count filtering

---

## Added

### GitHub Milestones Integration

Full lifecycle management for GitHub Milestones:

- **5 new tools**: `get_github_milestones`, `get_github_milestone`, `create_github_milestone`, `update_github_milestone`, `delete_github_milestone`
- **2 new resources**: `memory://github/milestones` (list) and `memory://milestones/{number}` (detail)
- Briefing and status resources now include milestone progress data
- `create_github_issue_with_entry` accepts optional `milestone_number` parameter

### Repository Insights/Traffic

- **New tool**: `get_repo_insights` with token-efficient `sections` parameter
- **New resource**: `memory://github/insights` — compact summary (~150 tokens)
- Surfaces stars, forks, watchers, clones, views, top referrers, and popular pages
- Extended 10-minute cache TTL for slowly-changing traffic data

### Server Host Bind Parameter

- New `--server-host` CLI option and `MCP_HOST` / `HOST` environment variables
- Defaults to `localhost`; set to `0.0.0.0` for container deployments

### Performance Benchmarking Suite

- New `npm run bench` script using `vitest bench` for baseline performance measurement

---

## Improved

- **`get_entry_by_id` Importance Scoring Breakdown** — Returns weighted component contributions
- **`get_cross_project_insights` Inactive Threshold Visibility** — Self-documenting `inactiveThresholdDays` field
- **Database I/O — Debounced Save** — 500ms debounce batches rapid writes into single disk flush
- **Vector Index Rebuild** — Paginated fetching (200 per page) + parallel batch embedding (5 at a time) + sequential insertion
- **Server Startup — `getTools()` Deduplication** — Eliminated duplicate call during startup
- **GitHub API — TTL Response Cache** — 5-minute cache for read methods with automatic invalidation on mutations

---

## Fixed

- **`memory://significant` Importance Sort** — Fixed resource returning timestamp-sorted instead of importance-sorted entries when >20 entries exist
- **`memory://instructions` Active Tool Count** — Fixed hardcoded 3-tool fallback; now uses `getAllToolNames()`
- **`memory://health` Tool Count** — Dynamic computation from `TOOL_GROUPS` instead of hardcoded value
- **`delete_entry` Permanent Delete** — Now works on previously soft-deleted entries via `getEntryByIdIncludeDeleted()`
- **`delete_entry` Existence Check (P154)** — Pre-checks entry existence before mutation
- **`link_entries` Existence Check (P154)** — Pre-checks both source and target entry existence
- **`visualize_relationships` Disambiguation (P154)** — Clear "Entry not found" message for nonexistent entries
- **`list_tags` Zero-Count Filtering** — No longer returns orphan tags with zero usage
- **`get_github_issue` Missing Milestone Field** — Now maps `issue.milestone` from API response
- **`JournalEntry` GitHub Metadata** — 10 GitHub fields now included in all tool responses
- **`delete_github_milestone` Structured Error** — Returns proper `DeleteMilestoneOutputSchema` on failure
- **`ServerInstructions.ts` Entry Types** — Updated from 7 stale types to full 13-type union
- **Docker Hub Short Description** — Corrected "HTTPS" → "HTTP/SSE"

---

## Security

- **HTTP Transport Hardening** — Configurable CORS (`--cors-origin`), 1MB request body limit, `X-Content-Type-Options: nosniff` + `X-Frame-Options: DENY`, 30-min session timeout
- **Error Log Token Scrubbing** — Automatic sanitization of GitHub tokens and Authorization headers
- **CVE-2026-26960 (tar)** — Updated npm's bundled tar → 7.5.8 (HIGH, path traversal CVSS 7.1)
- **GHSA-w7fw-mjwx-w883 (qs)** — Updated qs 6.14.1 → 6.14.2 (low, arrayLimit bypass DoS)
- **GHSA-43fc-jf86-j433 (axios)** — Override to 1.13.5 (DoS via `__proto__` key)
- **SECURITY.md Rewrite** — Complete rewrite for TypeScript era
- **docker-compose.yml Rewrite** — Removed Python-era configuration, added secure mounts
- **Dockerfile Healthcheck** — Replaced no-op healthcheck with `process.exit(0)` validation

---

## CI/CD

- Removed Dependabot auto-merge workflow — manual review required
- Trivy Action updated to 0.34.0
- CI test matrix aligned to `[24.x, 25.x]` matching `engines.node: >=24.0.0`
- Blocking `npm audit` — known vulnerabilities now fail the pipeline
- Blocking secret scanning — verified leaks now fail the pipeline

---

## Dependencies

| Package                     | From   | To             |
| --------------------------- | ------ | -------------- |
| `@eslint/js`                | 9.39.2 | 10.0.1 (major) |
| `@modelcontextprotocol/sdk` | 1.26.0 | 1.27.1 (minor) |
| `@types/node`               | 25.2.0 | 25.3.2 (minor) |
| `eslint`                    | 9.39.2 | 10.0.2 (major) |
| `simple-git`                | 3.28.0 | 3.32.3 (minor) |
| `sql.js`                    | 1.12.0 | 1.14.0 (minor) |
| `typescript-eslint`         | 8.54.0 | 8.56.1 (minor) |

---

## Upgrade

```bash
# npm
npm update -g memory-journal-mcp

# Docker
docker pull writenotenow/memory-journal-mcp:v4.4.0
```

**Full Changelog**: https://github.com/neverinfamous/memory-journal-mcp/wiki/CHANGELOG
