RomanNum3ral
/
honcho
mirror of https://github.com/plastic-labs/honcho.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

chore: (docs) v3.0.4 Release Candidate (#480)

This commit is contained in:
Vineeth Voruganti 2026-04-02 13:48:44 -04:00 committed by GitHub
parent d803c546f0
commit 29ff4653e5
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
8 changed files with 108 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
CHANGELOG.md
View File

@ -5,18 +5,29 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](http://keepachangelog.com/)
and this project adheres to [Semantic Versioning](http://semver.org/).
## [Unreleased]
### Fixed
- Memory leak in deriver: `_observation_locks` dict grew unboundedly with every unique (workspace, observer, observed) combination; replaced with `WeakValueDictionary` so locks are automatically evicted when no longer in use (DEV-1412)
- SQL injection vector in `dependencies.py`: parameterized `SET application_name` queries using `set_config()` instead of f-string interpolation (DEV-1400)
- NUL byte (`\x00`) crashes: all user-facing text inputs (message content, metadata, peer cards, queries) are now sanitized at the Pydantic schema level before reaching PostgreSQL (DEV-1400)
## [3.0.4] - 2026-04-02
### Added
- JSONB metadata validation: max 100 top-level keys and max nesting depth of 5 on all metadata input fields (DEV-1400)
- Filter recursion depth limit: `_build_filter_conditions()` now enforces a max depth of 5 to prevent stack overflow from deeply nested filter dicts (DEV-1400)
- JSONB metadata validation enforces 100 key limit and max depth of 5 (#419)
### Changed
- Schemas refactored from single `schemas.py` into `schemas/api.py`, `schemas/configuration.py`, and `schemas/internal.py` with backwards-compatible re-exports (#419)
### Fixed
- Missing `deleted_at` filter on `RepresentationManager._query_documents_recent()` and `._query_documents_most_derived()` allowed soft-deleted documents to leak into the deriver's working representation (#456)
- `CleanupStaleItemsCompletedEvent` emitted spuriously when no queue item was actually deleted (#454)
- Empty JSON file uploads caused unhandled errors; now returns normalized error responses (#434)
- Memory leak: `_observation_locks` switched to `WeakValueDictionary` to prevent unbounded growth (#419)
- SQL injection in `dependencies.py`: parameterized `set_config` calls to prevent injection via request context (#419)
- NUL byte crashes: string inputs (message content, queries, peer cards) now stripped at schema level (#419)
- Filter recursion depth capped at 5 to prevent stack overflow (#419)
- Dedup-skipped observations now correctly reflected in created counts (#477)
- External vector store support for message search — routes queries through configured external vector store with oversampling and
deduplication to handle chunked embeddings (#479)
- Dialectic agent no longer holds a DB connection during LLM calls — embeddings are pre-computed before tool execution, DB sessions isolated in `extract_preferences`, `query_documents` no longer accepts a DB session parameter (#477)
## [3.0.3] - 2026-02-25

2
README.md
View File

@ -8,7 +8,7 @@
---
![Static Badge](https://img.shields.io/badge/Version-3.0.3-blue)
![Static Badge](https://img.shields.io/badge/Version-3.0.4-blue)
[![PyPI version](https://img.shields.io/pypi/v/honcho-ai.svg)](https://pypi.org/project/honcho-ai/)
[![NPM version](https://img.shields.io/npm/v/@honcho-ai/sdk.svg)](https://npmjs.org/package/@honcho-ai/sdk)
[![Discord](https://img.shields.io/discord/1016845111637839922?style=flat&logo=discord&logoColor=23ffffff&label=Plastic%20Labs&labelColor=235865F2)](https://discord.gg/plasticlabs)

3
docs/changelog/compatibility-guide.mdx
View File

@ -30,7 +30,8 @@ This guide helps you match the right SDK version to your Honcho API version. New
| Honcho API Version | TypeScript SDK | Python SDK |
|-------------------|---------------|------------|
| v3.0.3 (Current) | v2.1.0 | v2.1.0 |
| v3.0.4 (Current) | v2.1.0 | v2.1.0 |
| v3.0.3 | v2.1.0 | v2.1.0 |
| v3.0.2 | v2.0.0+ | v2.0.0+ |
| v3.0.1 | v2.0.0+ | v2.0.0+ |
| v3.0.0 | v2.0.0+ | v2.0.0+ |

36
docs/changelog/introduction.mdx
View File

@ -27,20 +27,30 @@ Welcome to the Honcho changelog! This section documents all notable changes to t
### Honcho API and SDK Changelogs
<Tabs>
<Tab title="Honcho API">
<Update label="v3.0.4 (Unreleased)">
### Fixed
- Memory leak in deriver: `_observation_locks` dict grew unboundedly with every unique (workspace, observer, observed) combination; replaced with `WeakValueDictionary` so locks are automatically evicted when no longer in use (DEV-1412)
- SQL injection vector in `dependencies.py`: parameterized `SET application_name` queries using `set_config()` instead of f-string interpolation (DEV-1400)
- NUL byte (`\x00`) crashes: all user-facing text inputs (message content, metadata, peer cards, queries) are now sanitized at the Pydantic schema level before reaching PostgreSQL (DEV-1400)
<Update label="v3.0.4 (Current)">
### Added
- JSONB metadata validation: max 100 top-level keys and max nesting depth of 5 on all metadata input fields (DEV-1400)
- Filter recursion depth limit: `_build_filter_conditions()` now enforces a max depth of 5 to prevent stack overflow from deeply nested filter dicts (DEV-1400)
</Update>
- JSONB metadata validation enforces 100 key limit and max depth of 5 (#419)
<Update label="v3.0.3 (Current)">
### Changed
- Schemas refactored from single `schemas.py` into `schemas/api.py`, `schemas/configuration.py`, and `schemas/internal.py` with backwards-compatible re-exports (#419)
### Fixed
- Missing `deleted_at` filter on `RepresentationManager._query_documents_recent()` and `._query_documents_most_derived()` allowed soft-deleted documents to leak into the deriver's working representation (#456)
- `CleanupStaleItemsCompletedEvent` emitted spuriously when no queue item was actually deleted (#454)
- Empty JSON file uploads caused unhandled errors; now returns normalized error responses (#434)
- Memory leak: `_observation_locks` switched to `WeakValueDictionary` to prevent unbounded growth (#419)
- SQL injection in `dependencies.py`: parameterized `set_config` calls to prevent injection via request context (#419)
- NUL byte crashes: string inputs (message content, queries, peer cards) now stripped at schema level (#419)
- Filter recursion depth capped at 5 to prevent stack overflow (#419)
- Dedup-skipped observations now correctly reflected in created counts (#477)
- External vector store support for message search — routes queries through configured external vector store with oversampling and
deduplication to handle chunked embeddings (#479)
- Dialectic agent no longer holds a DB connection during LLM calls — embeddings are pre-computed before tool execution, DB sessions isolated in `extract_preferences`, `query_documents` no longer accepts a DB session parameter (#477)
</Update>
<Update label="v3.0.3">
### Added
- Consolidated session context into a single DB session with 40/60 token budget allocation between summary and messages
@ -524,7 +534,7 @@ Welcome to the Honcho changelog! This section documents all notable changes to t
<Tab title="Python SDK">
[Python SDK](https://pypi.org/project/honcho-ai/)
<Update label="v2.1.0 (Current)">
<Update label="v2.1.0">
### Added
- `created_at` property on `Peer` and `Session` objects
@ -661,7 +671,7 @@ Welcome to the Honcho changelog! This section documents all notable changes to t
<Tab title="TypeScript SDK">
[TypeScript SDK](https://www.npmjs.com/package/@honcho-ai/sdk)
<Update label="v2.1.0 (Current)">
<Update label="v2.1.0">
### Added
- `createdAt` property on `Peer` and `Session` wrapper objects

77
docs/docs.json
View File

@ -19,14 +19,21 @@
},
"favicon": "/favicon.svg",
"contextual": {
"options": ["copy", "view", "chatgpt", "claude"]
"options": [
"copy",
"view",
"chatgpt",
"claude"
]
},
"navigation": {
"versions": [
{
"version": "v3.0.3",
"version": "v3.0.4",
"api": {
"openapi": ["v3/openapi.json"]
"openapi": [
"v3/openapi.json"
]
},
"tabs": [
{
@ -87,7 +94,9 @@
"groups": [
{
"group": "Overview",
"pages": ["v3/guides/overview"]
"pages": [
"v3/guides/overview"
]
},
{
"group": "Integrations",
@ -120,7 +129,9 @@
},
{
"group": "Migrations",
"pages": ["v3/guides/migrations/mem0"]
"pages": [
"v3/guides/migrations/mem0"
]
}
]
},
@ -148,7 +159,9 @@
"groups": [
{
"group": "API Documentation",
"pages": ["v3/api-reference/introduction"]
"pages": [
"v3/api-reference/introduction"
]
},
{
"group": "workspaces",
@ -226,7 +239,9 @@
},
{
"group": "miscellaneous",
"pages": ["v3/api-reference/endpoint/keys/create-key"]
"pages": [
"v3/api-reference/endpoint/keys/create-key"
]
}
]
},
@ -247,7 +262,9 @@
{
"version": "v2.5.1",
"api": {
"openapi": ["v2/openapi.json"]
"openapi": [
"v2/openapi.json"
]
},
"tabs": [
{
@ -294,11 +311,15 @@
"groups": [
{
"group": "Getting Started",
"pages": ["v2/guides/overview"]
"pages": [
"v2/guides/overview"
]
},
{
"group": "Migrations",
"pages": ["v2/migrations/from-mem0"]
"pages": [
"v2/migrations/from-mem0"
]
},
{
"group": "Integrations",
@ -310,7 +331,11 @@
},
{
"group": "Application Interfaces",
"pages": ["v2/guides/discord", "v2/guides/n8n", "v2/guides/telegram"]
"pages": [
"v2/guides/discord",
"v2/guides/n8n",
"v2/guides/telegram"
]
}
]
},
@ -319,7 +344,9 @@
"groups": [
{
"group": "API Documentation",
"pages": ["v2/api-reference/introduction"]
"pages": [
"v2/api-reference/introduction"
]
},
{
"group": "workspaces",
@ -423,7 +450,9 @@
{
"version": "v1.1.0",
"api": {
"openapi": ["openapi.json"]
"openapi": [
"openapi.json"
]
},
"tabs": [
{
@ -453,15 +482,23 @@
"groups": [
{
"group": "Getting Started",
"pages": ["v1/guides/overview", "v1/guides/streaming-response"]
"pages": [
"v1/guides/overview",
"v1/guides/streaming-response"
]
},
{
"group": "Application Interfaces",
"pages": ["v1/guides/discord", "v1/guides/honcho-mcp"]
"pages": [
"v1/guides/discord",
"v1/guides/honcho-mcp"
]
},
{
"group": "Personal Memory",
"pages": ["v1/guides/dialectic-endpoint"]
"pages": [
"v1/guides/dialectic-endpoint"
]
}
]
},
@ -470,7 +507,9 @@
"groups": [
{
"group": "API Documentation",
"pages": ["v1/api-reference/introduction"]
"pages": [
"v1/api-reference/introduction"
]
},
{
"group": "apps",
@ -518,7 +557,9 @@
},
{
"group": "keys",
"pages": ["v1/api-reference/endpoint/keys/create-key"]
"pages": [
"v1/api-reference/endpoint/keys/create-key"
]
},
{
"group": "metamessages",

2
pyproject.toml
View File

@ -1,6 +1,6 @@
[project]
name = "honcho"
version = "3.0.3"
version = "3.0.4"
description = "Honcho Server"
authors = [
{name = "Plastic Labs", email = "hello@plasticlabs.ai"},

2
src/main.py
View File

@ -154,7 +154,7 @@ app = FastAPI(
title="Honcho API",
summary="The Identity Layer for the Agentic World",
description="""Honcho is a platform for giving agents user-centric memory and social cognition.""",
version="3.0.3",
version="3.0.4",
contact={
"name": "Plastic Labs",
"url": "https://honcho.dev",

2
uv.lock
View File

@ -1282,7 +1282,7 @@ wheels = [
[[package]]
name = "honcho"
version = "3.0.3"
version = "3.0.4"
source = { virtual = "." }
dependencies = [
{ name = "alembic" },