Bump mem0ai from 2.0.2 to 2.0.18

[dependabot]

Bumps mem0ai from 2.0.2 to 2.0.18.

Release notes

Sourced from mem0ai's releases.

Mem0 Python SDK (v2.0.18)

Bug Fixes:

• Core: Percent-escape %, &, and = in user_id, agent_id, and run_id when building the session scope key for the recent-conversation buffer, so the key stays unambiguous for ids containing those characters. Ordinary ids keep their existing key; an id already containing %, &, or = maps to a new key, so its buffer starts empty once and refills on the next add(). Stored memories are unaffected. Reported by @​OfficialAbhinavSingh (#6892)
• Vector Stores: Raise ValueError when a PGVector in/nin filter value is not a list. A string value was previously iterated character by character into the generated = ANY(...) array (so {"user_id": {"in": "alice"}} matched a, l, i, c, e), and a non-iterable value raised a bare TypeError from deep inside filter building (#6879)
• Vector Stores: Reject index_accuracy=0 in the Oracle AI Vector Search config. The range check sat behind a truthiness test, so 0 skipped validation entirely and was passed through to WITH TARGET ACCURACY 0 instead of raising (#6848)
• Vector Stores: Close the Oracle connection or pool that Mem0 opened when initialization fails. A client version check, a database version check, or a create_col() error previously propagated with the connection still open, leaking it for the life of the process. A caller-supplied client is left untouched (#6839)

Mem0 Python SDK (v2.0.17)

New Features:

• Client: Add agent_custom_instructions to project.update()/update_project() (sync and async) and to the ProjectUpdateOptions and AddMemoryOptions typed models. It sets a second extraction instruction set that applies only to agent-scoped memories: an add passing agent_id without user_id uses it, one passing both splits by attribution, and while it is unset custom_instructions continues to apply to every memory (#6809)

Mem0 Python SDK (v2.0.16)

New Features:

• Client: Add reference_date, latest_only, and keyword_search to SearchMemoryOptions, and latest_only to GetAllMemoryOptions, keeping the Python client's typed options in sync with the Platform API and the CLIs (#6696)

Bug Fixes:

• Core: Stop add() metadata from setting a memory's identity scope. _build_filters_and_metadata() now strips user_id, agent_id, run_id, and actor_id from caller-supplied metadata before building the creation template, so metadata can no longer place a memory into a scope that was never passed through the entity params (#6656)
• Vector Stores: Validate Upstash filter keys and values in search(), keyword_search(), and list(). Filter keys must match a safe identifier pattern, values must be str/int/float/bool, and string values containing a double quote or backslash are now rejected instead of being interpolated unescaped into the generated query string (#5981)
• Embeddings: FastEmbedEmbedding.embed() now converts its result with .tolist() before returning, so callers get a plain List[float] instead of a numpy array (#6770)
• Embeddings: HuggingFaceEmbedding now passes api_key to the OpenAI-compatible client when huggingface_base_url is set. The configured key was previously dropped, so the client fell back to OPENAI_API_KEY from the environment or raised OpenAIError at construction when that was unset (#6770)
• Embeddings: Replace Ollama's interactive pip install prompt on import with a plain ImportError. Importing mem0.embeddings.ollama without the ollama package previously blocked on stdin and then called sys.exit(1), killing the host process instead of raising (#6770)
• Core: remove_code_blocks() now returns an empty string for None input instead of raising AttributeError (#6770)
• Core: parse_vision_messages() now chains the original exception (raise ... from e) when an image download fails, so the root cause is preserved in the traceback (#6770)
• Core: process_telemetry_filters(None) now returns ([], {}), matching the two-value tuple every caller unpacks, instead of {} (#6770)
• Core: LlmFactory.create() no longer mutates the caller's config dict in place via .update(kwargs); the merge now builds a new dict (#6770)
• Rerankers: The Cohere, HuggingFace, SentenceTransformer, and Zero Entropy rerankers' failure-fallback path no longer mutates the caller's document dicts in place when stamping rerank_score; it now falls back on copies (#6770)
• Vector Stores: Remove logging.basicConfig() calls from the MongoDB and Vertex AI Vector Search providers, so selecting either provider no longer reconfigures the host application's root logger as a side effect (#6770)

Mem0 Python SDK (v2.0.15)

Bug Fixes:

• Core: delete_all() now paginates through the vector store in batches of 1000 instead of listing once, so accounts with more memories than a single page (most vector stores default to ~100) had the remainder silently left behind (#6636)
• Vector Stores: Cap Supabase search()/list() top_k at the vecs query limit of 1000 instead of erroring, and fix a col_info() crash by reading collection attributes directly instead of calling the removed describe() method (#6695)
• Vector Stores: Set size on Elasticsearch KNN search queries, so results respect top_k instead of being capped at Elasticsearch's default of 10 hits (#5910)

Changes:

• Rerankers: LLMReranker's default model is now gpt-5-mini (was gpt-4o-mini) (#6703)

Mem0 Python SDK (v2.0.14)

New Features:

• Vector Stores: Add an Oracle AI Vector Search provider (oracledb) with connection pooling, HNSW/IVF indexes, JSON metadata filtering, and six selectable distance metrics (#5358)

Bug Fixes:

• Vector Stores: Translate a "*" filter value in OpenSearch into an exists query for every key, not just identity keys. It was previously ignored or matched literally against the string "*", so a wildcard filter returned nothing (#6522)
• Vector Stores: Re-raise errors from OpenSearch search() instead of returning [], so a transport, auth, or index misconfiguration surfaces instead of looking like zero matches. keyword_search() still degrades on failure, since it is a best-effort BM25 signal (#6519)
• Vector Stores: Guard the text field in Milvus update() behind the _has_bm25_schema check, matching insert(), so updating a memory in a collection without the BM25 text/sparse schema no longer fails (#5705)

Mem0 Python SDK (v2.0.13)

Bug Fixes:

• Vector Stores: Fix reset() silently leaving stale vectors behind on local (on-disk) Qdrant when the old collection directory could not be removed, for example an open file handle on Windows or NFS (#6412)

... (truncated)

Commits

• c427a45 docs(changelog): backfill Python v2.0.18 and TypeScript v3.1.6 SDK entries (#...
• f5b4300 docs: redirect deprecated OSS graph memory page to platform graph memory (#6914)
• 71f2ebe fix(memory): escape delimiters when building the session scope key (#6892)
• 35a1255 fix(pgvector): raise ValueError when 'in'/'nin' filter value is not a list (#...
• 4debc58 fix(security): patch 8 HIGH + 18 MEDIUM Vanta vulnerabilities across 4 pnpm w...
• b42cfdd Fix broken links: unblock link check in oracledb.mdx (#6849)
• 6fe6140 fix(vector-stores/oracledb): Fix accuracy bug (#6848)
• b05dc27 docs(memory): note filters-based scoping for search/get_all on add() (#6758)
• 4a0a9a9 fix(ts-oss, py): release Oracle client on init failure, validate insert batch...
• beea626 perf(ts-oss): cut Oracle vector store round trips per review feedback (#6835)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)