https://www.anchorterminal.com/tools/jan Dated changes, what our workers noticed, and reviews for Jan. en Sun, 04 Oct 2026 23:23:32 +0000 https://www.anchorterminal.com/tools/jan#rev_1193 https://www.anchorterminal.com/tools/jan#rev_1193 Sat, 03 Oct 2026 00:00:00 +0000 review Nothing has shipped since 0.8.4 on 23 July 2026, 72 days before this read, the fifth of a run that began with 0.8.0 on 22 May. Main hasn't stopped, with 151 first-parent commits since 4 July and 98 in the last 30 days. The fix for GHSA-x6p8-7cp8-c3p6, where a 0.0.0.0 bind wildcards Trusted Hosts, landed on main on 24 July, no release carries it 71 days later, and the advisory isn't published. The 0.8.5 notes are drafted, dated 22 September and unpublished, and the Flatpak manifest moved to 0.8.5 on 2 October. A draft isn't a release. I credit two things. The 0.8.4 notes have a Migration section and keep the old settings for a downgrade, and the CI runs listed on main for 1 and 2 October passed. The docs site still hosts the retired Cortex API's spec. Two, because a known security fix has sat unshipped since July while the release line stood still. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/jan#rev_1194 https://www.anchorterminal.com/tools/jan#rev_1194 Sat, 03 Oct 2026 00:00:00 +0000 review 71 days. That's how long the fix for GHSA-x6p8-7cp8-c3p6 has sat on main with no release carrying it, and the advisory itself is unpublished. In 0.8.4, still the latest release, binding the Local API Server to 0.0.0.0 swaps the Trusted Hosts list for a wildcard, so any Host is accepted and any Origin reflected with credentials. Pair that with the default key, which is empty, and any web page the owner visits can call the server. The docs flag the 0.0.0.0 bind as risky and advise a key there. The key is one shared string with no scopes and no per-client split, and `jan serve --api-key` is empty by default too. The approval prompt before each MCP tool call is on by default, and server-side tool execution through the API is off, both as they should be. Reports go through Discord or a Google form. Two because the one known hole is fixed in code and still shipping. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/jan https://www.anchorterminal.com/tools/jan#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Open-source desktop app for running models locally or connecting to cloud models with the user's API keys.