build(deps): bump @mastra/memory from 1.23.1 to 1.26.2

[dependabot]

Bumps @mastra/memory from 1.23.1 to 1.26.2.

Release notes

Sourced from @​mastra/memory's releases.

April 22, 2026

Highlights

Background Tasks (Async Tool Execution + APIs + Storage Support)

Agents can now dispatch slow tool calls as background tasks while the main conversation keeps streaming, then inject results back into the loop when they finish. This comes with new /api/background-tasks endpoints (list/get/SSE stream), client methods (listBackgroundTasks, getBackgroundTask, streamBackgroundTasks), and new BackgroundTasksStorage domain implementations across major storage adapters.

New Redis Storage Adapter (@mastra/redis)

Introduces @mastra/redis, a Redis-backed Mastra storage provider (memory/workflows/scores) using the official node-redis client, with flexible connection options including connection strings or injected preconfigured clients.

Netlify Edge Deployment Target

NetlifyDeployer adds a target: 'edge' option to deploy as Netlify Edge Functions (Deno at the edge) with CPU-time limits instead of hard wall-clock timeouts—better suited for longer-running AI workflows than 60s serverless limits.

Observability: RAG Runs in Traces + Lightweight Trace/Span Fetching

RAG ingestion runs now appear in observability traces alongside agents/workflows, and traces can be filtered by traceId. New lightweight schemas and endpoints (including GET /observability/traces/:traceId/light and storage getTraceLight) reduce timeline payloads dramatically by omitting heavy span fields until details are requested.

Security & Governance for Telemetry (Credential Leak Fix + Per-request Redaction/Tags)

Span serialization is hardened to prevent LLM/API credentials and auth headers from leaking into telemetry across routers, gateways, and model wrappers. Additionally, server calls can now set tracingOptions (tags, hideInput, hideOutput) per request to control span labeling and redaction.

Breaking Changes

• None called out in the provided changelog (no consolidated breaking-change section for these versions).

Changelog

@​mastra/core@1.26.0

Minor Changes

• RAG ingestion runs now appear in observability traces, next to your agents, workflows, and scorers. (#15512)

  You can now filter traces by traceId when listing them.

  Added lightweight span and trace schemas (LightSpanRecord, GetTraceLightResponse) that exclude heavy fields like input, output, attributes, and metadata — reducing per-span payload by ~97% for timeline rendering.

• Fixed potential credential leakage in observability spans. LLM API keys, authentication headers, and gateway tokens could previously appear in span input or output data sent to telemetry backends. (#15489)

  What's fixed

  The model router, AI SDK model wrappers (v4 legacy, v5, v6), built-in gateways (Mastra, Netlify, Models.dev, Azure OpenAI), and the voice provider base class now restrict what they expose to spans. Only public identity fields — model ID, provider, gateway ID, voice name — are included. Private configuration such as API keys, Authorization headers, OAuth tokens, and proxy credentials is no longer serialized into spans.

  Legacy AI SDK v4 models passed to resolveModelConfig were previously returned unwrapped. They are now wrapped in AISDKV4LegacyLanguageModel, which applies the same serializeForSpan() safety as the v5/v6 wrappers while preserving the LanguageModelV1 interface so existing consumers continue to work.

  The SensitiveDataFilter span output processor already redacted values under common field names (apiKey, token, authorization, etc.) when enabled. This fix closes the gap for users who did not have it configured, and for cases where credentials were nested under custom field names that the filter's exact-match list did not cover.

  Recommended action

  • Review existing telemetry data for leaked credentials and rotate any keys that may have been captured.
  • Custom gateways extending MastraModelGateway and custom voice providers extending MastraVoice are automatically covered — they inherit the new safe default. Override serializeForSpan() only if you want to expose additional non-sensitive fields.
  • For any other class you pass into a span (e.g. as input, output, attributes, or metadata) that holds enumerable fields with credentials or other sensitive state, add a serializeForSpan() method. TypeScript-private properties are still walked by span serialization because private is compile-time only.

  class MyServiceClient {
    constructor(private config: { apiKey: string; endpoint: string }) {}

... (truncated)

Changelog

Sourced from @​mastra/memory's changelog.

1.26.2

Patch Changes

• Corrected the observation.blockAfter and reflection.blockAfter configuration documentation shown in editors. Crossing observation.blockAfter lets buffered activation overshoot the retention target; it does not force a blocking observation. The documented value ranges now match the runtime: values from 1 up to (but not including) 100 multiply the base threshold, and values of 100 or more are absolute token counts that must be greater than the base threshold. (#21215)

• Added continuation support to the Observational Memory recall tool. When a single message part is larger than the result budget, the result now includes nextCharOffset and a note explaining how to fetch the next chunk, so oversized parts can be read across multiple calls instead of returning the same truncated prefix every time. (#19821)

  { "mode": "messages", "cursor": "<message-id>", "partIndex": 0, "detail": "high", "charOffset": 8000 }

  Fixes #19817.

• Updated dependencies [088e41e, aa3e7be, d118873, b2f0013, 3b541ae, 79dd7c2, 90822db, 898bba4, b9a28ec, f9aab1c, 3700208, e31421b, 8b7131e, 161258b, aece0e7, ae79e34, 59d8898, a6c4399, cf418b6, a40f915, 8ea8038, be31796, 79c4f82, 7dafa4f]:

  • @​mastra/core@​1.59.0
  • @​mastra/schema-compat@​1.3.7

1.26.2-alpha.1

Patch Changes

• Corrected the observation.blockAfter and reflection.blockAfter configuration documentation shown in editors. Crossing observation.blockAfter lets buffered activation overshoot the retention target; it does not force a blocking observation. The documented value ranges now match the runtime: values from 1 up to (but not including) 100 multiply the base threshold, and values of 100 or more are absolute token counts that must be greater than the base threshold. (#21215)

• Added continuation support to the Observational Memory recall tool. When a single message part is larger than the result budget, the result now includes nextCharOffset and a note explaining how to fetch the next chunk, so oversized parts can be read across multiple calls instead of returning the same truncated prefix every time. (#19821)

  { "mode": "messages", "cursor": "<message-id>", "partIndex": 0, "detail": "high", "charOffset": 8000 }

  Fixes #19817.

• Updated dependencies [898bba4, f9aab1c, e31421b, aece0e7]:

  • @​mastra/core@​1.59.0-alpha.2

1.26.2-alpha.0

Patch Changes

• Updated dependencies [aa3e7be, 90822db, 3700208, 8b7131e, cf418b6, 79c4f82]:
  • @​mastra/core@​1.59.0-alpha.1
  • @​mastra/schema-compat@​1.3.7-alpha.0

1.26.1

Patch Changes

• Fixed a crash in Observational Memory token counting for tool calls that wait for approval. Threads that hold a tool invocation in the approval-requested or approval-responded state no longer throw Unhandled tool-invocation state, so memory extraction keeps running on approval-gated conversations. (#20985)

  The counter also no longer stops on a tool-invocation state it does not know. A message that a different @mastra/core version wrote now gets an estimate instead of an error.

... (truncated)

Commits

• c5702d3 chore: version - exit prerelease mode
• bc29a0f chore: version packages (alpha) (#21307)
• f9aab1c docs(memory): correct what observation.blockAfter does (#21215)
• f82f22f fix(memory): support continuation within truncated recall message parts (#19821)
• 1ac97b4 chore: version packages
• 387c6b7 chore: version - exit prerelease mode
• 7723ab9 chore: version packages (alpha) (#21274)
• dc4a25d fix(core): make partial thread updates backward compatible with older storage...
• 79896ae chore: version packages (alpha) (#21103)
• 361c421 chore: version packages
• Additional commits viewable in compare view

[github-actions]

Coverage Report for server

Status	Category	Percentage	Covered / Total
🟢	Lines	98.38% (🎯 97%)	3173 / 3225
🟢	Statements	97.7% (🎯 96%)	3322 / 3400
🟢	Functions	98.74% (🎯 97%)	551 / 558
🟢	Branches	89.1% (🎯 87%)	1300 / 1459

File Coverage

No changed files found.

Generated in workflow #1934 for commit 3856884 by the Vitest Coverage Report Action

[github-actions]

Coverage Report for web

Status	Category	Percentage	Covered / Total
🟢	Lines	97.32% (🎯 96%)	1526 / 1568
🟢	Statements	96.24% (🎯 95%)	1613 / 1676
🟢	Functions	95.82% (🎯 95%)	643 / 671
🟢	Branches	90.77% (🎯 88%)	1013 / 1116

File Coverage

No changed files found.

Generated in workflow #1934 for commit 3856884 by the Vitest Coverage Report Action

[github-actions]

Coverage Report for shared

Status	Category	Percentage	Covered / Total
🟢	Lines	99.12% (🎯 98%)	226 / 228
🟢	Statements	81.2% (🎯 80%)	242 / 298
🟢	Functions	100% (🎯 98%)	76 / 76
🟢	Branches	63.52% (🎯 62%)	101 / 159

File Coverage

No changed files found.

Generated in workflow #1934 for commit 3856884 by the Vitest Coverage Report Action

[github-actions]

Coverage Report for widget

Status	Category	Percentage	Covered / Total
🟢	Lines	99.56% (🎯 98%)	229 / 230
🟢	Statements	99.19% (🎯 96%)	246 / 248
🟢	Functions	100% (🎯 98%)	45 / 45
🟢	Branches	95.96% (🎯 92%)	119 / 124

File Coverage

No changed files found.

Generated in workflow #1934 for commit 3856884 by the Vitest Coverage Report Action

[owk-owk130]

この PR を含む mastra 衛星 5 件（#1029 memory / #1039 mcp / #1045 observability / #995 evals / #1038 rag）は、@mastra/core を 1.52.1 に据え置いたまま上げられることをローカルで確認しました。あと 1 つのゲート（workerd 実機確認）待ちで保留にします。

core と切り離せる理由

前回「core と衛星は全部上げるか全部据え置くかの二択」と書きましたが、これは libsql / cloudflare-d1 / ai-sdk を含めた場合の話でした。新しい core のシンボルを要求するのはこの 3 つだけです。

• @mastra/libsql 1.19.0+ / @mastra/cloudflare-d1 1.2.0+ → validateStorageMetadataFilter
• @mastra/ai-sdk 1.8.0 → smoothStream

この 5 件はいずれも core 1.52.1 の公開シンボルで足ります。

検証済み（core 1.52.1 + memory 1.26.2 / mcp 1.16.0 / observability 1.17.0 / evals 1.7.0 / rag 2.5.0）

• wrangler deploy --dry-run --env development: 成功（core 1.54+ の execa 問題やシンボル不足はここで落ちる）
• pnpm lint: エラー 0
• server テスト: 131 files / 1311 tests 全通過。shared も 22 files / 175 tests 全通過
• peer 依存: 5 件とも要求 core 範囲を 1.52.1 が満たす
• workerd で問題になるパターンの dist grep: .unref() と グローバル randomUUID は新旧とも増減なし。@mastra/mcp の eval 系が 2→4 に増えるが、増分は ajv の allowsEval 特徴検出で navigator.userAgent.includes("Cloudflare") を見て呼ぶ前に false を返す実装（try/catch 付き）。既存の危険箇所は ajv の compileSchema で新旧同じ

残るゲート

@mastra/memory は過去に workerd で壊れた実績があるパッケージ（AJV / new Function 経路）なので、wrangler dev で updateWorkingMemory を発火させてローカル D1 の mastra_resources.workingMemory に載ることを確認してからマージします。ユニットテストでは検証できない領域です。

なお @mastra/core 本体（#1028）は 1.59.0 でも未修正でした。dist の getExeca() は依然 await import("execa") のリテラルで、上流 mastra-ai/mastra#20639 は open のままです。