build(deps): bump @mastra/memory from 1.26.2 to 1.28.0

[dependabot]

Bumps @mastra/memory from 1.26.2 to 1.28.0.

Release notes

Sourced from @​mastra/memory's releases.

April 24, 2026

Highlights

Modal Cloud Sandbox Provider (@mastra/modal)

New @mastra/modal adds a Modal-backed ModalSandbox for running workspace commands in an isolated cloud environment with pause/resume support—expanding Mastra’s deployment/execution options beyond local sandboxes.

Per-request Workspace Filesystem Resolver (Multi-tenant Routing)

Workspace’s filesystem option now supports a resolver function, enabling per-request filesystem selection/routing from a single Workspace instance—useful for multi-tenant setups and scoped permissions without spinning up multiple Workspaces.

Custom Language Server Registration in LSPConfig

You can now register additional language servers via lsp.servers (and override built-ins by ID), unlocking LSP-based inspection for languages beyond the default set (e.g., PHP, Ruby, Java, Kotlin, Swift, Elixir).

Vector Search “Works Out of the Box” (Indexing + Large File Chunking)

Workspace file indexing now auto-creates vector indices where required (e.g., LibSQL) and splits large files into overlapping chunks instead of skipping them—preventing empty vector stores and making search reliable with autoIndexPaths.

Streaming & Observational Memory Reliability + Better Usage Introspection

Multiple fixes prevent duplicated/replayed messages and tool outputs when observational memory is enabled (including disabling savePerStep in Harness in this mode), and agent.stream() callbacks now preserve provider-specific usage.raw so you can access cache metrics without wrapping streams.

Breaking Changes

• None noted in this changelog.

Changelog

@​mastra/core@1.28.0

Minor Changes

• The Workspace filesystem option now accepts a resolver function in addition to a static instance. (#13150)

  Before: filesystem: WorkspaceFilesystem (static, same filesystem for every request) After: filesystem: WorkspaceFilesystem | (({ requestContext }) => WorkspaceFilesystem) (static or per-request)

  This enables per-request filesystem routing from a single Workspace — useful for multi-tenant setups, role-based access (e.g. admin vs user directories), and scoped filesystem permissions without creating separate Workspace instances.

• Added support for custom language server registration with the servers field in LSPConfig. Previously, LSP inspection only worked with built-in server definitions for TypeScript, JavaScript, Python, Go, and Rust. You can now register additional language servers, such as PHP, Ruby, Java, Kotlin, Swift, or Elixir, by providing a CustomLSPServer definition. (#14969)

  Example:

  const workspace = new Workspace({
    lsp: {
      servers: {
        phpactor: {
          id: 'phpactor',
          name: 'Phpactor Language Server',
          languageIds: ['php'],
          extensions: ['.php'],
          markers: ['composer.json'],
          command: 'phpactor language-server',
        },
      },

... (truncated)

Changelog

Sourced from @​mastra/memory's changelog.

1.28.0

Minor Changes

• Added opt-in awaited Observational Memory hooks for synchronous cycles. (#22147)

  Set hookExecution: "await" to await lifecycle hooks, stop the observer or reflector when a start hook fails, and receive one paired end callback after cleanup. Async-buffer cycles remain fire-and-forget.

  const memory = new Memory({
    options: {
      observationalMemory: {
        hookExecution: 'await',
        hooks: {
          onObservationStart: async context => {
            await authorizeObservation(context);
          },
        },
      },
    },
  });

Patch Changes

• Observational memory now detects observer/reflector output where a multi-line block repeats many times (a model repetition loop). Previously such output could slip past the degenerate-output check and balloon stored observations, causing constant synchronous reflection churn; it is now rejected and retried like other degenerate output. (#22072)

• Fixed observational memory reflection to keep retrying with stronger compression when a result remains above the token threshold. (#22232)

• Fixed Observational Memory tracing spans (om.observer, om.observer.multi-thread, om.reflector) never being ended. Unended spans kept their traces retained in exporters that hold a trace open until every span in it finishes — a memory leak with the Datadog bridge, which retains full LLM Observability payloads — and meant Observational Memory tracing never reached any exporter. The spans now end when the observer/reflector run completes, and record the error before ending when it fails. (#22117)

• Fixed observational memory being silently wiped when every reflection attempt produced empty or degenerate output. Failed reflections now throw and leave existing observations intact. (#22074)

  Threshold-triggered synchronous reflections are no longer re-run against unchanged observations after an attempt that failed or finished still over the reflection threshold. Reflection retries as soon as observations change.

• Fixed observational memory re-observing stored working memory and overwriting existing values. (#22247)

• Improved agent turn latency by reusing run-scoped memory reads (#22076)

• Fix continuationHints being silently dropped when Observational Memory is configured through Memory. Memory._initOMEngine forwards the observation/reflection configs to the OM engine via explicit field lists, and continuationHints (added in #21302) was missing from both — so continuationHints: { suggestedResponse: false } had no effect unless ObservationalMemory was constructed directly. The Observer/Reflector prompts kept requesting the disabled sections and the injection gate kept admitting them. (#22235)

• Updated dependencies [79f04a7, 65edab1, 1e47b75, ab20a38, fd4d5fe, ae8790c, 2c85f42, 11bbeb9, 48ef1f1, aa3a85d, d29d06f, e6516df, 1a485f3, 0d37487, 8661d7d, dbbfeb8, 575e343, 0b2a3d1, 6bb5d71, 3cc9d00, cacb839, 57de7d6, c8e4cea, ed01e9a, b47b26e, 0d37487, 733a537, e8e299c, edfc548, b05f486, a8a4871, eb9ecaa, 4ff3ee2, 9207dfa, 5165cdc, e737014, 6bb5d71, f591643, 63796ba, b1ad324, 61c566d, c24754c, 12c61d2, c46eb09, 9ee8120, d975e92, 45dd6ee, 4e9a228, d6ce34a, f95f468, 30ed33e, 04a815f, 1cfa878, 9a12ef3, 32d3583, 7960688, 91ad69d, 8dc408d, c92def1, 63041eb, c118318, c5eaec5, fc07c64, cced745, 542dee2, 3c19dce, aca2869, a58483c, a58483c, e6f8450, 895e9df, e66b2ba, 3e8727e]:

  • @​mastra/core@​1.62.0

1.28.0-alpha.4

Patch Changes

• Fixed observational memory re-observing stored working memory and overwriting existing values. (#22247)

... (truncated)

Commits

• 3cd96a3 chore: version - exit prerelease mode
• 73fa1ab chore: version packages (alpha) (#22320)
• cd7683d fix(memory): prevent observational memory from re-observing working memory (#...
• 3086f23 chore: version packages (alpha) (#22241)
• 9c984f9 fix(memory): stop empty reflections wiping memory and back off unproductive s...
• c118318 fix(core): restore output processing for canceled agent streams (#22243)
• 8dcd635 fix(memory): forward continuationHints from Memory to the OM engine (#22235)
• 6eb8bd3 chore: version packages (alpha) (#22100)
• ee0c1a0 fix(memory): detect long-period multi-line repetition loops in observer outpu...
• befbfc2 fix(memory): restore reflector compression retries (#22232)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)