@@ -4,7 +4,8 @@ One note per tag, in English (`.en.md`) and French (`.fr.md`). Rebuilt on 2026-1
4
4
5
5
| Version | Date | Summary | |
6
6
|---|---|---|---|
7
-| [v1.0.3](v1.0.3.en.md) | not tagged yet | `mm init` writes agents for any OpenAI-compatible service — it asks the endpoint and the API key's variable, then lists the service's models or lets you type one — and its text answers can be edited with the arrow keys. | [FR](v1.0.3.fr.md) |
7
+| [v1.0.4](v1.0.4.en.md) | not tagged yet | A security update: mm now builds with `golang.org/x/net` v0.62.0, which fixes two vulnerabilities in its HTML parser. | [FR](v1.0.4.fr.md) |
8
+| [v1.0.3](v1.0.3.en.md) | 2026-10-26 | `mm init` writes agents for any OpenAI-compatible service — it asks the endpoint and the API key's variable, then lists the service's models or lets you type one — and its text answers can be edited with the arrow keys. | [FR](v1.0.3.fr.md) |
8
9
| [v1.0.2](v1.0.2.en.md) | 2026-10-26 | Use mini-me as a library from Node.js, test what a model can do with mini-me itself, and send OpenAI models only the sampling settings you wrote. | [FR](v1.0.2.fr.md) |
9
10
| [v1.0.1](v1.0.1.en.md) | 2026-10-26 | Messages typed during an answer wait their turn, the window shows when the model struggles and how long an answer takes, models can be downloaded at start-up and take turns in memory during a hand-off, and deciders need no boilerplate. | [FR](v1.0.1.fr.md) |
10
11
| [v1.0.0](v1.0.0.en.md) | 2026-10-22 | Small decision models working for the agent — skill and tool routing, command triage, checks on what it reads — plus `/shell` in the window and `mm init` files that say where each number comes from. | [FR](v1.0.0.fr.md) |
@@ -4,7 +4,8 @@ One note per tag, in English (`.en.md`) and French (`.fr.md`). Rebuilt on 2026-1
4
4
5
| Version | Date | Summary | |
5
| Version | Date | Summary | |
6
|---|---|---|---|
6
|---|---|---|---|
7
-| [v1.0.3](v1.0.3.en.md) | not tagged yet | `mm init` writes agents for any OpenAI-compatible service — it asks the endpoint and the API key's variable, then lists the service's models or lets you type one — and its text answers can be edited with the arrow keys. | [FR](v1.0.3.fr.md) |
7
+| [v1.0.4](v1.0.4.en.md) | not tagged yet | A security update: mm now builds with `golang.org/x/net` v0.62.0, which fixes two vulnerabilities in its HTML parser. | [FR](v1.0.4.fr.md) |
8
+| [v1.0.3](v1.0.3.en.md) | 2026-10-26 | `mm init` writes agents for any OpenAI-compatible service — it asks the endpoint and the API key's variable, then lists the service's models or lets you type one — and its text answers can be edited with the arrow keys. | [FR](v1.0.3.fr.md) |
8
| [v1.0.2](v1.0.2.en.md) | 2026-10-26 | Use mini-me as a library from Node.js, test what a model can do with mini-me itself, and send OpenAI models only the sampling settings you wrote. | [FR](v1.0.2.fr.md) |
9
| [v1.0.2](v1.0.2.en.md) | 2026-10-26 | Use mini-me as a library from Node.js, test what a model can do with mini-me itself, and send OpenAI models only the sampling settings you wrote. | [FR](v1.0.2.fr.md) |
9
| [v1.0.1](v1.0.1.en.md) | 2026-10-26 | Messages typed during an answer wait their turn, the window shows when the model struggles and how long an answer takes, models can be downloaded at start-up and take turns in memory during a hand-off, and deciders need no boilerplate. | [FR](v1.0.1.fr.md) |
10
| [v1.0.1](v1.0.1.en.md) | 2026-10-26 | Messages typed during an answer wait their turn, the window shows when the model struggles and how long an answer takes, models can be downloaded at start-up and take turns in memory during a hand-off, and deciders need no boilerplate. | [FR](v1.0.1.fr.md) |
10
| [v1.0.0](v1.0.0.en.md) | 2026-10-22 | Small decision models working for the agent — skill and tool routing, command triage, checks on what it reads — plus `/shell` in the window and `mm init` files that say where each number comes from. | [FR](v1.0.0.fr.md) |
11
| [v1.0.0](v1.0.0.en.md) | 2026-10-22 | Small decision models working for the agent — skill and tool routing, command triage, checks on what it reads — plus `/shell` in the window and `mm init` files that say where each number comes from. | [FR](v1.0.0.fr.md) |
addedrelease-notes/v1.0.4.en.md+19-0
new file mode 100644
@@ -0,0 +1,19 @@
1
+# mini-me v1.0.4
2
+
3
+*[Version française](v1.0.4.fr.md)*
4
+
5
+A security update: mm now builds with `golang.org/x/net` v0.62.0, which fixes two vulnerabilities in its HTML parser.
6
+
7
+## Security
8
+
9
+`govulncheck -mode=binary` on the v1.0.3 binary reports two vulnerabilities in `golang.org/x/net` v0.61.0, both fixed in v0.62.0:
10
+
11
+- **[GO-2026-6866](https://pkg.go.dev/vuln/GO-2026-6866)**: when rendering raw text in HTML, not every ancestor namespace transition was checked (symbol `html.Render`).
12
+- **[GO-2026-6860](https://pkg.go.dev/vuln/GO-2026-6860)**: coalescing text nodes had quadratic complexity, so a crafted page could make parsing very slow (symbols `html.Parse`, `html.ParseFragment`, `html.ParseFragmentWithOptions`, `html.ParseWithOptions`).
13
+
14
+In mm, this code reads the web pages the `fetch_content` tool downloads and turns them into Markdown. v1.0.4 updates the module to v0.62.0; mm's own code does not change.
15
+
16
+## Upgrading
17
+
18
+- **Nothing changes in how mm behaves or reads an agent file.** Replace the binary: see the install guides for [macOS](../INSTALL.MACOS.md), [Linux](../INSTALL.LINUX.md) and [Windows](../INSTALL.WINDOWS.md).
19
+- If you build mm from source, `go.mod` now requires `golang.org/x/net v0.62.0`.
new file mode 100644
@@ -0,0 +1,19 @@
1
+# mini-me v1.0.4
2
+
3
+*[Version française](v1.0.4.fr.md)*
4
+
5
+A security update: mm now builds with `golang.org/x/net` v0.62.0, which fixes two vulnerabilities in its HTML parser.
6
+
7
+## Security
8
+
9
+`govulncheck -mode=binary` on the v1.0.3 binary reports two vulnerabilities in `golang.org/x/net` v0.61.0, both fixed in v0.62.0:
10
+
11
+- **[GO-2026-6866](https://pkg.go.dev/vuln/GO-2026-6866)**: when rendering raw text in HTML, not every ancestor namespace transition was checked (symbol `html.Render`).
12
+- **[GO-2026-6860](https://pkg.go.dev/vuln/GO-2026-6860)**: coalescing text nodes had quadratic complexity, so a crafted page could make parsing very slow (symbols `html.Parse`, `html.ParseFragment`, `html.ParseFragmentWithOptions`, `html.ParseWithOptions`).
13
+
14
+In mm, this code reads the web pages the `fetch_content` tool downloads and turns them into Markdown. v1.0.4 updates the module to v0.62.0; mm's own code does not change.
15
+
16
+## Upgrading
17
+
18
+- **Nothing changes in how mm behaves or reads an agent file.** Replace the binary: see the install guides for [macOS](../INSTALL.MACOS.md), [Linux](../INSTALL.LINUX.md) and [Windows](../INSTALL.WINDOWS.md).
19
+- If you build mm from source, `go.mod` now requires `golang.org/x/net v0.62.0`.
addedrelease-notes/v1.0.4.fr.md+19-0
new file mode 100644
@@ -0,0 +1,19 @@
1
+# mini-me v1.0.4
2
+
3
+*[English version](v1.0.4.en.md)*
4
+
5
+Une mise à jour de sécurité : mm est maintenant compilé avec `golang.org/x/net` v0.62.0, qui corrige deux vulnérabilités de son analyseur HTML.
6
+
7
+## Sécurité
8
+
9
+`govulncheck -mode=binary` sur le binaire v1.0.3 signale deux vulnérabilités dans `golang.org/x/net` v0.61.0, toutes deux corrigées en v0.62.0 :
10
+
11
+- **[GO-2026-6866](https://pkg.go.dev/vuln/GO-2026-6866)** : au rendu du texte brut en HTML, toutes les transitions d'espace de noms des ancêtres n'étaient pas vérifiées (symbole `html.Render`).
12
+- **[GO-2026-6860](https://pkg.go.dev/vuln/GO-2026-6860)** : la fusion des nœuds de texte avait une complexité quadratique, si bien qu'une page fabriquée pour cela pouvait rendre l'analyse très lente (symboles `html.Parse`, `html.ParseFragment`, `html.ParseFragmentWithOptions`, `html.ParseWithOptions`).
13
+
14
+Dans mm, ce code lit les pages web que télécharge l'outil `fetch_content` et les convertit en Markdown. v1.0.4 passe le module en v0.62.0 ; le code de mm lui-même ne change pas.
15
+
16
+## Mise à jour
17
+
18
+- **Rien ne change dans le comportement de mm ni dans la lecture d'un fichier d'agent.** Remplacez le binaire : voir les guides d'installation pour [macOS](../INSTALL.MACOS.md), [Linux](../INSTALL.LINUX.md) et [Windows](../INSTALL.WINDOWS.md).
19
+- Si vous compilez mm depuis les sources, `go.mod` demande maintenant `golang.org/x/net v0.62.0`.
new file mode 100644
@@ -0,0 +1,19 @@
1
+# mini-me v1.0.4
2
+
3
+*[English version](v1.0.4.en.md)*
4
+
5
+Une mise à jour de sécurité : mm est maintenant compilé avec `golang.org/x/net` v0.62.0, qui corrige deux vulnérabilités de son analyseur HTML.
6
+
7
+## Sécurité
8
+
9
+`govulncheck -mode=binary` sur le binaire v1.0.3 signale deux vulnérabilités dans `golang.org/x/net` v0.61.0, toutes deux corrigées en v0.62.0 :
10
+
11
+- **[GO-2026-6866](https://pkg.go.dev/vuln/GO-2026-6866)** : au rendu du texte brut en HTML, toutes les transitions d'espace de noms des ancêtres n'étaient pas vérifiées (symbole `html.Render`).
12
+- **[GO-2026-6860](https://pkg.go.dev/vuln/GO-2026-6860)** : la fusion des nœuds de texte avait une complexité quadratique, si bien qu'une page fabriquée pour cela pouvait rendre l'analyse très lente (symboles `html.Parse`, `html.ParseFragment`, `html.ParseFragmentWithOptions`, `html.ParseWithOptions`).
13
+
14
+Dans mm, ce code lit les pages web que télécharge l'outil `fetch_content` et les convertit en Markdown. v1.0.4 passe le module en v0.62.0 ; le code de mm lui-même ne change pas.
15
+
16
+## Mise à jour
17
+
18
+- **Rien ne change dans le comportement de mm ni dans la lecture d'un fichier d'agent.** Remplacez le binaire : voir les guides d'installation pour [macOS](../INSTALL.MACOS.md), [Linux](../INSTALL.LINUX.md) et [Windows](../INSTALL.WINDOWS.md).
19
+- Si vous compilez mm depuis les sources, `go.mod` demande maintenant `golang.org/x/net v0.62.0`.
One first-party cookie so a repeat visit isn't counted twice. No cross-site tracking, nothing stored until you accept. Cookie Policy.