From 611fddd236086edef164a9f08a83c72be1d3908e Mon Sep 17 00:00:00 2001 From: Ilker Manap Date: Wed, 30 Sep 2026 00:38:55 +0200 Subject: [PATCH] Describe v0.10.3 Co-Authored-By: Claude Opus 5.5 (1M context) --- CHANGELOG.md | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 31a0910..ac8a7b1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -20,6 +20,49 @@ is only released once its **exit criterion** is met, not when its code lands. Until v1.0.0 the minor version is the breaking one: configuration formats and Go APIs change between minors without a deprecation period. +## v0.10.3 — 2026-09-30 + +Security fixes from a review of v0.10.2. Three of them were confirmed on the +live cluster before being fixed. + +### Engines demand a key only the router holds + +Engines listened on every address of their node with no key. A request from a +neighbouring node reached the model directly, past the gateway's +authentication, quotas and accounting. Each replica's engine is now started +with a key derived from the replica id and a secret in the store. The router, +its metrics scrape, the agent's readiness check and `ctl bench` send it. +llama.cpp and vLLM receive it through their environment, not their command +line. Engines started before this keep running without a key until their +replica is next started. + +### The mirror's management API answers only who it was told to + +Without `--api-allow`, the management API answered anyone who could reach it, +including every node. It now answers this machine only; the control plane is +let in with `--api-allow` or mutual TLS. **Upgrading a mirror set up by hand: +add `--api-allow ` to its unit.** Downloads started +through the API go to http and https only, and never to loopback, private or +link-local addresses (`--allow-private-sources` to permit that). Model, +version and file names can no longer be `..` or start with a dot. + +### The admin listener refuses what a browser page could send + +The admin API has no login and trusts whoever reaches it. A page open in an +operator's browser, reaching it over an ssh tunnel, could post a model +definition. The listener now requires Host to be an address or localhost, +refuses cross-site requests, and takes changes only as `application/json`. +A profile's `env` may no longer set variables that make an engine run other +code (`LD_*`, `PATH`, `PYTHON*` start-up variables, `BASH_ENV` and similar). +They are refused where a model is defined and dropped again before an engine +starts. + +### Fixes + +- The agent installs only engine versions that look like one, whatever the + control plane sent; a version of `../x` could have installed outside + `/opt/llmgw/engines`. + ## v0.10.2 — 2026-09-29 - After `server init`'s screen closes, only the administrator's password and