MiroShark logo
Changelog · 26 entries

What shipped

A weekly log of every MiroShark change: features, bug fixes, i18n, and tooling shipped since launch, with linked commits.

5 PRs

MCP security patch and dependency upkeep

The MCP dependency was bumped to 1.30.0 to close a Dependabot alert about unbounded session buildup in its StreamableHTTP transport. Four routine backend and frontend dependency updates also landed.

  • Bumped mcp to 1.30.0, fixing unbounded session accumulation in the StreamableHTTP transport (Dependabot alert #94). (#342)
  • Maintenance: 4 dependency bumps (backend uv groups, frontend packages, follow-redirects). (#341, #340, #339, #338)
#342

9 PRs

Simulation resume and report-lookup fixes, security patch

Four open Dependabot security alerts (including one critical) were patched, and three simulation bugs got fixed: resuming now survives existing databases without losing progress, report lookups return the newest result instead of the first folder match, and the Claude Code LLM client gained the same truncated-JSON repair path as the other client. Ecosystem doc links were also cleaned up, and CI picked up a ruff lint gate.

  • Patched 4 open Dependabot security alerts, including one critical shell-quote denial-of-service bug. (#320)
  • Resuming a simulation no longer breaks on existing databases, and failed resumes keep their progress. (#326)
  • Report lookups now return the newest report, not the first match in folder order. (#325)
  • Claude Code LLM client now repairs truncated JSON responses, matching the other LLM client's behavior. (#324)
  • Sparkleware ecosystem links now point at the working www host instead of a redirect chain. (#328)
  • Fixed a wrong ecosystem logo and removed dead project links from ECOSYSTEM.md. (#327)
  • Install docs now recommend Claude Haiku 5.5 instead of the older Haiku 4.5 model. (#317)
  • Added ruff linting to CI, catching undefined names and unused imports going forward. (#318)
  • Maintenance: 1 dependency bump (frontend vite). (#316)
#328#327#325#324#326#320#318#317

4 PRs

x402aff ecosystem listing and dependency bumps

ECOSYSTEM.md and the live ecosystem API gained a new entry for x402aff, the open-source affiliate kit behind MiroShark's builder-code revenue split. Three Dependabot bumps (Python backend, frontend) rounded out the week.

  • ECOSYSTEM.md and /api/ecosystem.json now list x402aff, the affiliate kit powering MiroShark's builder-code split. (#313)
  • Maintenance: 3 dependency bumps (backend: sentence-transformers, tornado, urllib3, pyjwt; frontend group). (#315, #314, #312)
#313

2 PRs

Hugging Face dataset badge and dependency bump

The README now links to the public MiroShark simulation dataset on Hugging Face - 8,201 agent decisions from 16 simulations, covering social feed actions and prediction-market trades. One frontend dependency bump rounded out the week.

  • README now links to the public Hugging Face simulation dataset (8,201 agent decisions from 16 simulations). (#311)
  • Maintenance: 1 dependency bump (frontend group: marked, vue, @vitejs/plugin-vue). (#308)
#311

4 PRs

Backend and frontend dependency upkeep

A quiet week on the public engine repo - no user-facing changes landed, just four Dependabot bumps. Three in the Python backend (anyio, soupsieve, mcp) and one frontend group update (dompurify, marked, vite).

  • Maintenance: 4 dependency bumps (anyio, soupsieve, mcp backend; dompurify/marked/vite frontend group). (#307, #306, #303, #302)

3 PRs

Graph ingestion locale fix + dependency upkeep

A recurring locale bug is fixed at its last remaining site: NER extraction during graph ingestion ran in English regardless of the caller's locale because ContextVar-based locale doesn't cross the ThreadPoolExecutor boundary. Two dependency bumps (pywebpush, vue-router) rounded out the week.

  • Fixed graph ingestion running NER extraction in English regardless of locale - locale now threads through the ThreadPoolExecutor in add_text_batches, same pattern as the two prior fixes to this class of bug. (#301)
  • Maintenance: 2 dependency bumps (pywebpush, vue-router). (#299, #298)
#301

3 PRs

Mistune DoS security patch + dependency upkeep

A high-severity Dependabot alert on the backend's markdown parser (mistune) is patched - a RecursionError denial-of-service affecting versions before 3.3.3. The rest of the week was backend dependency upkeep.

  • Patched a high-severity mistune RecursionError DoS (Dependabot alert #74) in the backend markdown parser. (#297)
  • Maintenance: 2 dependency bumps (backend transformers, tornado). (#295, #296)
#297

5 PRs

Founder credit + dependency upkeep

The README footer now credits the founder with a link to aaronjmars.com - the reciprocal link that makes the profile ↔ project connection count. Everything else this week was dependency upkeep: frontend, backend, and root tooling packages bumped to current.

  • README footer credits the founder and links to aaronjmars.com, completing the reciprocal profile ↔ project link. (#292)
  • Maintenance: 4 dependency bumps (frontend axios, marked, vue, vue-router, dompurify, vite; backend mcp; root concurrently). (#290, #291, #293, #294)
#292

1 PRs

Backend httpx dependency bump

Dependabot raised the backend's httpx version floor to >=0.28.1,<1.0, picking up an upstream SSL fix for client certificates used with verify=False. No simulation behavior changes.

  • Maintenance: 1 dependency bump (httpx >=0.28,<1.0 → >=0.28.1,<1.0, backend). (#289)

6 PRs

OrcaRouter cloud preset + security & CI fixes

MiroShark added OrcaRouter as a new cloud preset, giving access to 190+ additional routed models through a single API key. A nanoid security advisory was patched, and a dependency conflict from the openai 3.0.0 release was fixed before it could break installs.

  • Added OrcaRouter as a new cloud preset, exposing 190+ additional routed models. (#287)
  • Patched a nanoid security advisory in the frontend dependency lockfile. (#286)
  • Pinned httpx explicitly, preventing an install break from the openai 3.0.0 release. (#288)
  • Maintenance: 3 dependency bumps (dompurify, marked, vue, vite frontend group; mcp; pywebpush). (#283, #284, #285)
#288#287#286

17 PRs

README visual rebuild + animated hero

The README was rebuilt into a visual-first layout across 13 PRs: a new animated SVG hero, self-hosted icon pill buttons for the header and docs nav, and refreshed community banner art. Two small ecosystem-catalog fixes and two dependency bumps landed in the same window.

  • README rebuilt into a visual-first layout with 11 new on-brand images across feature and community sections. (#269)
  • Header switched to self-hosted SVG pill buttons; wide community banner tiles and a new contributors section added. (#270)
  • Docs nav rebuilt as 9 self-hosted icon pill buttons; header pill alignment fixed. (#271)
  • Docs pills rebalanced into two rows; self-hosted Full-install button added; Graph memory section removed. (#272)
  • X, Bankr, and contributors banner art refreshed. (#273)
  • New value-prop line added under the header stats: "Grounded · Cross-platform · Cited." (#274)
  • X community banner image swapped. (#275)
  • Animated SVG hero added: pipeline flow, twinkling swarm, pulsing stars, chrome title glow. (#276)
  • Header pill icons now animate (star twinkle, globe spin, coin flip); hero polish tightened. (#277)
  • Feather-look mark replaced with a chrome shark dorsal fin; pipeline tile label spacing tightened. (#278)
  • Hero fin rendering fixed (was showing as a thin sliver); pipeline icons enlarged to fill their tiles. (#279)
  • Duplicate static hero image removed, keeping only the animated SVG hero; icon scale rebalanced. (#280)
  • More breathing room added between pipeline tiles and their labels. (#281)
  • Ecosystem catalog fixed to match ECOSYSTEM.md after a Noelclaw removal broke the drift test. (#267)
  • Noelclaw removed from the public ecosystem list. (#266)
  • Maintenance: 2 dependency bumps (cryptography 49.0.0 → 50.0.0 security patch, axios/vite frontend group). (#268, #264)
#281#280#279#278#277#276#275#274

2 PRs

PyTorch + setuptools security patches

Two Dependabot alerts cleared: PyTorch bumped to 2.13.0 to patch a memory corruption CVE (GHSA-rrmf-rvhw-rf47), and setuptools bumped to 83.0.0 to close a second open alert. Both are lockfile-only changes — no manifest edits, no behavior changes.

  • PyTorch 2.12.1 → 2.13.0: patches GHSA-rrmf-rvhw-rf47 (memory corruption, vulnerable ≤ 2.12.1); lockfile-only. (#257)
  • setuptools 81.0.0 → 83.0.0: closes open Dependabot alert (vulnerable range < 83.0.0); lockfile-only. (#258)
#257#258

3 PRs

Two CVE patches + dead code sweep

Two security CVEs patched: shell-quote's quadratic-complexity DoS (CVE-2026-13311, CVSS 7.5) required a scoped package.json override because concurrently pins the dependency exactly, and mcp was bumped to close a WebSocket host/origin validation gap (CVE-2026-59950). A 53-file dead code pass removed 1,325 net lines across 8 audited dimensions with no behavior changes.

  • shell-quote patched for CVE-2026-13311 (CVSS 7.5 DoS); scoped override required — concurrently pins the dep exactly. (#256)
  • mcp bumped 1.27.2 → 1.28.1, closing CVE-2026-59950 (WebSocket host/origin validation gap, not locally exploitable). (#255)
  • Dead code sweep: 53 files, −1,325 net lines removed across 8 independently audited dimensions. (#254)
#256#255#254

6 PRs

Docs badge across all locales + badge copy polish

All four README locales (EN, FR, JA, ZH) now carry a Docs badge linking to miroshark.xyz/docs. Badge copy was tightened in the same pass: the Documentation label shortens to Docs, the X badge drops 'Follow', and Bankr reads '$miroshark on Bankr'.

  • Docs badge added to EN, FR, JA, and ZH READMEs, linking to miroshark.xyz/docs. (#252)
  • Badge copy tightened: Documentation → Docs; X badge drops 'Follow'; Bankr reads '$miroshark on Bankr'. (#253)
  • Maintenance: 4 dependency/CI bumps (mcp 1.24→1.27, setup-node 6→7, setup-python 6→7, Vue/Vite frontend group). (#248, #249, #250, #251)
#252#253

3 PRs

GitHub org migration + frontend security patches

MiroShark's repo transferred to the MiroShark org — all in-repo links, User-Agent strings, and deploy buttons now point to the canonical slug. DOMPurify, marked, and vite received frontend patches in the same window.

  • All GitHub links migrated to MiroShark org: 25 refs across 14 files updated, two stale ecosystem slugs fixed. (#247)
  • Frontend security patch: DOMPurify 3.4.12 (XSS-protection hook fix), marked, and vite bumped. (#245)
  • Maintenance: 1 dependency bump (transformers 5.3.0 → 5.5.0, Python backend). (#246)
#247

1 PRs

Python backend dependency maintenance

Dependabot bumped soupsieve from 2.8 to 2.8.4 in the Python backend, patching an inefficient attribute pattern. No simulation behavior changes.

  • Maintenance: 1 dependency bump (soupsieve 2.8 → 2.8.4, attribute pattern efficiency fix) (#244)

3 PRs

French coverage at 87%, social agent fixes

Zarbel974 pushed French UI coverage from 74% to 86.9% across 20 components, adding ~340 translation pairs including dense panels like EmbedDialog and WhatIfPanel. dan-and addressed empty-response failures in persona handling — the social agent now handles edge cases that caused blank agent outputs mid-simulation.

  • French translations completed to 86.9% (1723/1984 tr() calls), up from 74%; 20 components, ~340 new pairs (#239)
  • Social agent: empty response handling in persona tool messages fixed — reduces silent failures mid-run (#241)
  • RootAI ecosystem profile image updated to current Twitter avatar in ECOSYSTEM.md (#242)
#239#241#242

10 PRs

French i18n, CVE sweep, multi-model compatibility

External contributor Zarbel974 landed French translations for ~1,627 UI strings across all Vue components, the largest single i18n contribution since DE. A CVE sweep closed vulnerabilities in werkzeug, requests, starlette, cryptography, pyjwt, and pytest; the social agent message filter was fixed to preserve tool_calls, restoring compatibility with Gemini, Azure, and GPT-5.4.

  • French frontend translations from Zarbel974 — ~1,627 tr() calls across all Vue components (~74% coverage) (#222)
  • Social agent now preserves tool_calls when filtering empty LLM messages; fixes Gemini, Azure, and GPT-5.4 compatibility (#232)
  • Nemotron datasets now persist across container recreates; bind-mount added to all three compose files (#238)
  • CVE sweep (patch/minor): werkzeug CVE-2026-21860/-27199, requests CVE-2026-25645, and 8 other packages (#229)
  • Major CVE fixes behind camel-ai MCP: starlette 1.x, cryptography 49.x, pyjwt 2.13 (#230)
  • pytest bumped to 9.1.1 + pytest-asyncio 1.4.0, closing CVE-2025-71176 (#231)
  • SECURITY.md + CONTRIBUTING.md added; community health files consolidated under .github/ (#235)
  • FUNDING.yml added: Sponsor button wired to miroshark.xyz, Bankr, DexScreener, BaseScan (#237)
  • LICENSE moved back to repo root so GitHub license detection works (#236)
  • Maintenance: 1 dependency bump (uv group, 6 packages) (#233)
#222#229#230#231#232#235#236#237

2 PRs

New default models across all agent slots

The default model lineup is replaced: base agent work moves to inception/mercury-2:nitro, smart reasoning and NER to google/gemini-3-flash-preview, Wonderwall to deepseek/deepseek-v4-flash:nitro, and web search to deepseek/deepseek-v4-flash:online. Fresh installs pick these up automatically; existing deployments can override per-slot via env.

  • Default models rotated across all slots: base → mercury-2:nitro, smart/NER → gemini-3-flash-preview, Wonderwall → deepseek-v4-flash:nitro, web search → deepseek-v4-flash:online (#223)
  • Maintenance: 1 dependency bump (vite 8.1.3) (#225)
#223

4 PRs

Docker, Actions, and frontend dependency bumps

Four maintenance bumps cleared the queue: the frontend locked in axios 1.18.1 (HTTP adapter fixes), vue, and vite; GitHub Actions moved to actions/checkout v7 and Node 24-based docker/login-action v4 and docker/setup-buildx-action v4.

  • Maintenance: 4 dependency/CI bumps (axios 1.18.1, vue, vite, actions/checkout 7, docker/login-action 4, docker/setup-buildx-action 4) (#218–#221)

5 PRs

Stop subcommand, interview hang fixes, locale hardening

The CLI now has a stop subcommand to cancel running simulations, completing the cost/wait/stop scriptable pipeline. dan-and contributed three engine fixes in the same batch: persona interviews no longer hang silently on slow or thinking models, non-English locale no longer drifts mid-run, and local LLM config tuning prevents JSON truncation and timeout failures.

  • stop subcommand added: cancels a running simulation, exits 0 on success or 1 on error (#216)
  • Non-English locale now held across per-round agent actions and report sections, not just at session start (#213)
  • Persona and batch interviews no longer hang on slow/thinking models; errors surface with a message instead of dying silently (#214)
  • Local LLM tuning: AGENTS_PER_BATCH halved to 7, summary lengths raised to 500 for richer context, name-based agent matching added (#212)
  • --json flag placement clarified in stop CLI docs: must precede the subcommand, not trail it (#217)
#217#216#214#213#212

1 PRs

Wait subcommand: block until simulation finishes

The CLI can now block on a running simulation and exit with a machine-readable code: 0 for completed, 1 for failed/stopped, 2 for timeout. Progress lines print to stderr so stdout stays clean for --json piping, making wait → cost → report pipelines scriptable without polling.

  • wait subcommand added to CLI: polls run-status until terminal state, exits 0/1/2, progress to stderr (#215)
#215

4 PRs

Thinking model robustness, JSON repair, and cost CLI

The LLM pipeline got a hardening pass from external contributor dan-and: thinking-model budget, <think> block stripping, and JSON repair so truncated or malformed reasoning output no longer silently breaks runs. The cost CLI subcommand also shipped, letting scripts read per-run spend with `python cli.py cost <id>` without touching the API.

  • Thinking model robustness: budget param, <think> stripping, JSON/control-char repair, None guards on empty content (#209)
  • Cost subcommand added to CLI: `python cli.py cost <id>` prints per-run USD estimate by phase (#208)
  • Config guard: blank LLM_MODEL_NAME= now falls back to mimo-v2.5 instead of sending an empty model string (#210)
  • Graph search fan-out restored: semantic default queries re-added after #209 narrowed the fallback to one query (#211)
#211#210#209#208

7 PRs

Model fix, rebrand, and code audit

The default model (mimo-v2-flash) was delisted by OpenRouter and is replaced with mimo-v2.5 across config, deploy templates, presets, and docs - fresh installs no longer 404. The project adopted a new tagline and a targeted 8-agent code audit removed dead classes and unused health-check stubs from the backend and frontend.

  • Default model swapped from mimo-v2-flash to mimo-v2.5 across config, presets, docs, and deploy templates (#207)
  • New tagline: "Simulate anything, for $1 & less than 10 min." + OpenRouter attribution updated to miroshark.xyz (#206)
  • Targeted 8-agent code audit removed dead classes and health-check stubs; backend and frontend trimmed (#205)
  • Maintenance: 4 dependency/CI bumps (actions/setup-node 6, docker/metadata-action 6, docker/setup-qemu-action 4, dompurify 3.4.11)
#207#206#205

28 PRs

Full DE/FR locales + engine hardening

MiroShark now runs fully in German and French - all agent prompts, persona grounding, and reports, not just UI chrome. The $1 cost claim lands as a visible pill on every public embed, a camel-ai 0.2.90 break was caught and patched the same day it merged, and a locale-threading bug in the fallback interview path is closed.

  • Locale state threaded through ThreadPoolExecutor in graph_tools fallback interview (#198)
  • CLAUDE.md added - agent-readable codebase map for Claude Code contributors (#197)
  • Camel smoke test now asserts non-empty message content, not just a non-None response (#196)
  • Report agent wired to locale registry so reports generate in the session language (#194)
  • suggest_scenarios JSON salvaged from truncated LLM responses via json_repair; no more zero-result returns (#192)
  • Cost pill (~$X) rendered on public embed view, making the $1-per-sim claim visible to visitors (#190)
  • German added to frontend UI and all agent-communication locales; locale reinforcement across DE/FR/ZH/EN (#189)
  • suggest_scenarios timeout raised 20s→40s, max_tokens 700→1500 for verbose languages and slow local LLMs (#188)
  • French prompt locale fully translated - all 7 modules filled (was empty stubs after #184) + CI coverage gate (#186)
  • French README and language-switcher entry added; FR now fully discoverable (#185)
  • Locale helpers generalized to EN/ZH/DE/FR; 199 existing call sites unchanged (#184)
  • total_actions corrected from hardcoded 0 on every successful run; first camel agent smoke test added (#183)
  • uv.lock synced to camel-ai 0.2.90, unblocking Docker builds that refused to proceed (#182)
  • camel-ai 0.2.90 agent loop break patched the same day the bump merged (#181)
  • Frontend now builds on every PR - was tag-triggered only, so breaks reached release undetected (#180)
  • Per-sim cost.json endpoint: queryable USD cost breakdown by model and phase, flagged is_estimate (#179)
  • SearXNG + Firecrawl support: self-hosted web search and scraping for local-LLM deployments (#178)
  • Maintenance: 11 dependency/CI bumps (Dependabot wave - vite, vue-router, camel-ai, python, Actions)
#198#197#196#194#192#190#189#188

6 PRs

Contributor on-ramp + same-origin API

Earlier in the same window: the contributor guide grew from a test-only stub into a full guide, two rounds of code-quality cleanup landed, same-origin API calls plus a Neo4j 5.26 bump went in, and flaky demographic-grounding tests were fixed.

  • Same-origin API calls now supported; Neo4j bumped to 5.26 for better indexing. (#159)
  • Expanded CONTRIBUTING from a test-only stub to a full contributor guide. (#162)
  • Round-2 code-quality cleanup: DRY helpers, type fixes, dead-import removal, error handling. (#163)
  • Deduped shared helpers (utc_iso8601, avg_position, public-base-url) and fixed a transcript bool bug. (#164)
  • Fixed two demographic-grounding tests that failed without an LLM_API_KEY. (#165)
  • Maintenance: concurrently bumped 9.2.1 → 10.0.3. (#167)
#159#162#163#164#165
Run one.

Everything here came from one sim at a time.

Drop your scenario in - $1, under ten minutes, dozens of agents.

Run your first simRead the docs