[dependabot]

Bumps mem0ai from 2.0.5 to 2.0.18.

Release notes

Sourced from mem0ai's releases.

Mem0 Python SDK (v2.0.18)

Bug Fixes:

• Core: Percent-escape %, &, and = in user_id, agent_id, and run_id when building the session scope key for the recent-conversation buffer, so the key stays unambiguous for ids containing those characters. Ordinary ids keep their existing key; an id already containing %, &, or = maps to a new key, so its buffer starts empty once and refills on the next add(). Stored memories are unaffected. Reported by @​OfficialAbhinavSingh (#6892)
• Vector Stores: Raise ValueError when a PGVector in/nin filter value is not a list. A string value was previously iterated character by character into the generated = ANY(...) array (so {"user_id": {"in": "alice"}} matched a, l, i, c, e), and a non-iterable value raised a bare TypeError from deep inside filter building (#6879)
• Vector Stores: Reject index_accuracy=0 in the Oracle AI Vector Search config. The range check sat behind a truthiness test, so 0 skipped validation entirely and was passed through to WITH TARGET ACCURACY 0 instead of raising (#6848)
• Vector Stores: Close the Oracle connection or pool that Mem0 opened when initialization fails. A client version check, a database version check, or a create_col() error previously propagated with the connection still open, leaking it for the life of the process. A caller-supplied client is left untouched (#6839)

Mem0 Python SDK (v2.0.17)

New Features:

• Client: Add agent_custom_instructions to project.update()/update_project() (sync and async) and to the ProjectUpdateOptions and AddMemoryOptions typed models. It sets a second extraction instruction set that applies only to agent-scoped memories: an add passing agent_id without user_id uses it, one passing both splits by attribution, and while it is unset custom_instructions continues to apply to every memory (#6809)

Mem0 Python SDK (v2.0.16)

New Features:

• Client: Add reference_date, latest_only, and keyword_search to SearchMemoryOptions, and latest_only to GetAllMemoryOptions, keeping the Python client's typed options in sync with the Platform API and the CLIs (#6696)

Bug Fixes:

• Core: Stop add() metadata from setting a memory's identity scope. _build_filters_and_metadata() now strips user_id, agent_id, run_id, and actor_id from caller-supplied metadata before building the creation template, so metadata can no longer place a memory into a scope that was never passed through the entity params (#6656)
• Vector Stores: Validate Upstash filter keys and values in search(), keyword_search(), and list(). Filter keys must match a safe identifier pattern, values must be str/int/float/bool, and string values containing a double quote or backslash are now rejected instead of being interpolated unescaped into the generated query string (#5981)
• Embeddings: FastEmbedEmbedding.embed() now converts its result with .tolist() before returning, so callers get a plain List[float] instead of a numpy array (#6770)
• Embeddings: HuggingFaceEmbedding now passes api_key to the OpenAI-compatible client when huggingface_base_url is set. The configured key was previously dropped, so the client fell back to OPENAI_API_KEY from the environment or raised OpenAIError at construction when that was unset (#6770)
• Embeddings: Replace Ollama's interactive pip install prompt on import with a plain ImportError. Importing mem0.embeddings.ollama without the ollama package previously blocked on stdin and then called sys.exit(1), killing the host process instead of raising (#6770)
• Core: remove_code_blocks() now returns an empty string for None input instead of raising AttributeError (#6770)
• Core: parse_vision_messages() now chains the original exception (raise ... from e) when an image download fails, so the root cause is preserved in the traceback (#6770)
• Core: process_telemetry_filters(None) now returns ([], {}), matching the two-value tuple every caller unpacks, instead of {} (#6770)
• Core: LlmFactory.create() no longer mutates the caller's config dict in place via .update(kwargs); the merge now builds a new dict (#6770)
• Rerankers: The Cohere, HuggingFace, SentenceTransformer, and Zero Entropy rerankers' failure-fallback path no longer mutates the caller's document dicts in place when stamping rerank_score; it now falls back on copies (#6770)
• Vector Stores: Remove logging.basicConfig() calls from the MongoDB and Vertex AI Vector Search providers, so selecting either provider no longer reconfigures the host application's root logger as a side effect (#6770)

Mem0 Python SDK (v2.0.15)

Bug Fixes:

• Core: delete_all() now paginates through the vector store in batches of 1000 instead of listing once, so accounts with more memories than a single page (most vector stores default to ~100) had the remainder silently left behind (#6636)
• Vector Stores: Cap Supabase search()/list() top_k at the vecs query limit of 1000 instead of erroring, and fix a col_info() crash by reading collection attributes directly instead of calling the removed describe() method (#6695)
• Vector Stores: Set size on Elasticsearch KNN search queries, so results respect top_k instead of being capped at Elasticsearch's default of 10 hits (#5910)

Changes:

• Rerankers: LLMReranker's default model is now gpt-5-mini (was gpt-4o-mini) (#6703)

Mem0 Python SDK (v2.0.14)

New Features:

• Vector Stores: Add an Oracle AI Vector Search provider (oracledb) with connection pooling, HNSW/IVF indexes, JSON metadata filtering, and six selectable distance metrics (#5358)

Bug Fixes:

• Vector Stores: Translate a "*" filter value in OpenSearch into an exists query for every key, not just identity keys. It was previously ignored or matched literally against the string "*", so a wildcard filter returned nothing (#6522)
• Vector Stores: Re-raise errors from OpenSearch search() instead of returning [], so a transport, auth, or index misconfiguration surfaces instead of looking like zero matches. keyword_search() still degrades on failure, since it is a best-effort BM25 signal (#6519)
• Vector Stores: Guard the text field in Milvus update() behind the _has_bm25_schema check, matching insert(), so updating a memory in a collection without the BM25 text/sparse schema no longer fails (#5705)

Mem0 Python SDK (v2.0.13)

Bug Fixes:

• Vector Stores: Fix reset() silently leaving stale vectors behind on local (on-disk) Qdrant when the old collection directory could not be removed, for example an open file handle on Windows or NFS (#6412)

... (truncated)

Commits

• c427a45 docs(changelog): backfill Python v2.0.18 and TypeScript v3.1.6 SDK entries (#...
• f5b4300 docs: redirect deprecated OSS graph memory page to platform graph memory (#6914)
• 71f2ebe fix(memory): escape delimiters when building the session scope key (#6892)
• 35a1255 fix(pgvector): raise ValueError when 'in'/'nin' filter value is not a list (#...
• 4debc58 fix(security): patch 8 HIGH + 18 MEDIUM Vanta vulnerabilities across 4 pnpm w...
• b42cfdd Fix broken links: unblock link check in oracledb.mdx (#6849)
• 6fe6140 fix(vector-stores/oracledb): Fix accuracy bug (#6848)
• b05dc27 docs(memory): note filters-based scoping for search/get_all on add() (#6758)
• 4a0a9a9 fix(ts-oss, py): release Oracle client on init failure, validate insert batch...
• beea626 perf(ts-oss): cut Oracle vector store round trips per review feedback (#6835)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Paulo Lacerda (placerda)]

Retargeted this dependency update from main to develop per CONTRIBUTING.md. Reopening immediately to emit the normal pull_request reopened event and run the complete CI matrix on the correct integration base. The existing CLA-only status is not sufficient merge evidence.

[Paulo Lacerda (placerda)]

Reviewed head 906cd86 against develop. The only change is the E2E sample mem0ai pin from 2.0.5 to 2.0.18. Verified the upstream release/tag and non-yanked PyPI artifacts, Python 3.12 compatibility, and the tightened httpx/posthog requirements. The sample does not currently import mem0. Fresh CI run 42301137446 passed on the develop base, including all six OS/Python jobs, lint/mypy, coverage and VSIX packaging. Existing focused E2E config tests also pass. Limitation: whole sample dependency resolution hits an existing agent-framework==1.8.1 optional-package conflict, reproduced unchanged on develop with mem0ai 2.0.5. This PR does not introduce that conflict or claim a successful live container deployment.