RepoJournal
Local LLMs

Local LLMs

Ollama, llama.cpp, vLLM, and SGLang - running and serving open models locally

Keep up with Local LLMs in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

One email a day. Unsubscribe in one click.

Pick a date

  1. Thu 23 jul
  2. Fri 24 jul
  3. Sat 25 jul
  4. Sun 26 jul
  5. Mon 27 jul
  6. Tue 28 jul
  7. Wed 29 jul
  8. Thu 30 jul
  9. Fri 31 jul
  10. Sat 1 aug
  11. Sun 2 aug
  12. Mon 3 aug
  13. Tue 4 aug
  14. Wed 5 aug
  15. Thu 6 aug
  16. Fri 7 aug
  17. Sat 8 aug
  18. Sun 9 aug
  19. Mon 10 aug
  20. Tue 11 aug
  21. Wed 12 aug
  22. Thu 13 aug
  23. Today 14 aug
Topics: Local LLMs AI / ML Full archive →

The Wire · Showcase

OLLAMA PATCHES CRITICAL SSRF VULNERABILITY IN MANIFEST HANDLING

By RepoJournal · Filed · About Local LLMs

ParthSareen Vignesh parabelboi Chipmunk Daniel Bevenius yifjiang Akashcodes732
17 people shipped this
ParthSareen @ParthSareen 2 cited Vignesh @vigneshakaviki 1 cited parabelboi @parabelboi 1 cited Chipmunk @CHIPMUNK-T0T 1 cited Daniel Bevenius @danbev 1 cited yifjiang @yifjiang 1 cited Akashcodes732 @Akashcodes732 1 cited bigPYJ1151 @bigPYJ1151 1 cited yctseng0211 @yctseng0211 1 cited mmangkad @mmangkad 1 cited michaelzhang-ai @michaelzhang-ai 1 cited jthomson04 @jthomson04 1 cited Eve @netrunnereve Aleksander Grygier @allozaur ovidiusm @ovidiusm yewentao256 @yewentao256 ajith-sirra-amd @ajith-sirra-amd

A rogue OCI registry could exploit duplicate digest collisions in Ollama's blob verification to exfiltrate data from internal endpoints.

Ollama shipped a critical fix [1] addressing a skipVerify map collision that skips hash verification when a manifest's config and layer share the same digest. The vulnerability allows an attacker to serve a malicious manifest and redirect blob downloads to internal endpoints, bypassing Ollama's verification entirely. This is a production-grade SSRF risk that demands immediate patching.

On the feature front, Ollama's agent tools got a major upgrade [2] with support for multiple edits per call, letting models apply batch file replacements against the original content with indexed error reporting for self-correction. The OpenAI Responses API now supports web search [3], enabling Codex and other models to execute searches through Ollama and receive results inline. Llama.cpp added a read_media tool [4] that lets vision models analyze server-side images, and shipped multimodal slot state save/restore [5] so you can persist and restore sessions with image inputs intact. Semantic versioning is now live [6], bringing stability to release tracking and CI workflows.

vLLM fixed KV cache reporting to correctly identify FULL_ATTENTION specs [7] instead of marking them UNKNOWN, added PowerPC/VSX unquantized MoE support [8], and rolled out registry-based layer caching for x86 CPU image builds [9] to eliminate redundant recompilation. SGLang swapped AMD's PR gate to ROCm 7.2 [10], demoting 7.0 to shadow testing, reverted a Kimi K3 fusion that broke CI [11], fixed multimodal partition failures on 2-GPU AMD shards [12], and shipped cache salt support for KV events [13] to prevent external routers from colliding with caller-defined namespaces. Activity: 123 commits, 122 PRs, 4 releases across the stack.

One email a day. Unsubscribe in one click.

Action items

References

  1. [1] server/images: prevent skipVerify map collision with duplicate digests (#15504) ollama/ollama
  2. [2] agent: allow multiple edits per edit tool call ↗ ollama/ollama
  3. [3] openai: support web search in Responses API ↗ ollama/ollama
  4. [4] ui: add read_media tool (#25877) ggml-org/llama.cpp
  5. [5] server : support slot save/restore with media inputs (#26640) ggml-org/llama.cpp
  6. [6] cmake : introduce semantic versioning (#26839) ggml-org/llama.cpp
  7. [7] [Bugfix] Report FULL_ATTENTION for uniform-base UniformTypeKVCacheSpecs groups instead of UNKNOWN ↗ vllm-project/vllm
  8. [8] [Hardware][Power] Unqualized MoE Backend for Power (VSX) ↗ vllm-project/vllm
  9. [9] [CI] Add registry layer cache to x86 CPU image build ↗ vllm-project/vllm
  10. [10] [AMD][CI] Swap the AMD PR gate to ROCm 7.2 and demote ROCm 7.0 to a daily shadow ↗ sgl-project/sglang
  11. [11] Revert "[Kimi K3] Fuse MLA gate projection into QKV-A GEMM" ↗ sgl-project/sglang
  12. [12] [AMD][CI] CI: fix AMD 2-GPU multimodal-gen partition-count abort ↗ sgl-project/sglang
  13. [13] feat: add cache salt support to KV cache events ↗ sgl-project/sglang

Quick answers

What shipped in Local LLMs on August 13, 2026?
A rogue OCI registry could exploit duplicate digest collisions in Ollama's blob verification to exfiltrate data from internal endpoints. In total, 123 commits, 122 pull requests, and 4 releases landed.
Who contributed to Local LLMs on August 13, 2026?
17 developers shipped this update, including Vignesh, ParthSareen, parabelboi, Chipmunk, Daniel Bevenius, Eve, Aleksander Grygier, and ovidiusm, and 9 more.
What were the notable Local LLMs updates?
server/images: prevent skipVerify map collision with duplicate digests (#15504), agent: allow multiple edits per edit tool call, and openai: support web search in Responses API.

More from Local LLMs

Local LLMs Local LLMs

OLLAMA LAUNCHES DEEPSEEK AND MUSE INTEGRATIONS WHILE VLLM SHIPS HARDWARE-AGNOSTIC MODELING

Ollama just opened its launch ecosystem to DeepSeek Harness and Meta's Muse Code, while vLLM pivots to HuggingFace transformers as a unified backend for tail models.

ParthSareen dhiltgen ngxson arthw +12
llms 261 shipped
Local LLMs Local LLMs

OLLAMA CUTS REPEAT PENALTY BLOAT, LLAMA.CPP SHIPS POCKET-TTS SUPPORT

Ollama kills a decade of default penalty cruft that was drowning every model, while llama.cpp gains multimodal audio chops and vLLM fixes ROCm speculative decoding corruption.

dhiltgen Jesse Gross hoyyeva Xuan-Son Nguyen +11
llms 258 shipped
Local LLMs Local LLMs

OLLAMA PATCHES CRITICAL PARSER BUG, NEMOTRON 3 LANDS WITH SPECULATIVE DECODING

Ollama shipped v0.32.7 with a critical fix for boundary token corruption in model invocation, while full MLX support for Nemotron 3 Nano Omni brings self-draft speculation to inference without a separate draft model.

dhiltgen Pedro Cuenca Pascal github-actions[bot] +11
llms 271 shipped
Local LLMs Local LLMs

OLLAMA SHIPS VISION SUPPORT ACROSS MLX AND QWEN3.5 AS LLAMA.CPP FIXES DISPATCH BUGS

Ollama's MLX runner now processes images natively, preserving prefix caching and speculative decoding while rejecting unsupported requests with clear errors.

jessegross Daniel Hiltgen github-actions[bot] allozaur +9
llms 157 shipped

Daily updates, in your inbox

Follow Local LLMs

Keep up with Local LLMs in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

One email a day. Unsubscribe in one click. Read a past issue →

Elsewhere on the wire

AI Agents AI Agents

LANGCHAIN SHIPS OPENAI 3.0 SUPPORT, CLINE PATCHES SANDBOX LEAKS

LangChain's openai integration now supports the OpenAI Python SDK 3.0 while maintaining backward compatibility, and Cline fixes unbounded subprocess growth in long-running deployments.

github-actions[bot] langchain-oss-model-profiles ccurme langchain-oss-model-profiles[bot] +5
ai-agents 37 shipped
CachyOS @CachyOS

CACHY AUR KEEPS PACE: FOUR MAJOR PACKAGE BUMPS OVERNIGHT

Claude, ChatGPT, and Zen Browser all shipped point releases into the AUR-derived repos while the core PKGBUILDS pipeline handled Go, Python, and OBS Studio rebuilds.

github-actions Peter Jung Vladislav Nepogodin Nico F. +1
infra 69 shipped
Elixir & Phoenix Elixir & Phoenix

ELIXIR FIXES DATE FORMATTING BUG, SPEEDS UP URI QUERIES

Date.to_iso8601/2 was silently dropping the format parameter for custom calendars, and it's fixed.

Alexander Gubarev preciz whatyouhide
elixir 6 shipped
Mobile platforms Mobile platforms

FLUTTER ANALYZER PLUGIN MIGRATION COMPLETE - LEGACY CHECKS NOW SHIP AS IDE RULES

Flutter finished migrating five major linting checks from batch analysis to real-time AST validation, meaning developers get instant IDE feedback instead of waiting for bot runs.

Victoria Ashworth Ben Konyi Navaron Bracke ktoso +6
mobile 160 shipped
Want every project, not just this one?