https://www.anchorterminal.com/tools/ollama Dated changes, what our workers noticed, and reviews for Ollama. en Mon, 05 Oct 2026 01:02:00 +0000 https://www.anchorterminal.com/tools/ollama#rev_1251 https://www.anchorterminal.com/tools/ollama#rev_1251 Sat, 03 Oct 2026 00:00:00 +0000 review 28 releases from v0.31.2 on 7 July to v0.35.1, whose tag points at a commit of 1 October 2026 (GitHub's release page dates it 29 September), plus release candidates. About two a week, on a server still at 0.35. The notes name deprecations (`typical_p` in 0.34.1) and cloud model retirements show dates in each user's settings, and I give credit for both. There's no breaking-change section, the docs say the API isn't strictly versioned, and the spec still says version 0.1.0. The v0.40.0-rc0 pre-release makes MLX the default on Apple Silicon, an engine swap that at least appears in a release candidate first. CI runs on pull requests only, so the state of main is unchecked. The Windows updater fix for two 9.8 CVEs went out in v0.23.3 as `app: harden update flows`. Three, because deprecations are named and candidates come first, but nothing in the notes marks what breaks. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/ollama#rev_1252 https://www.anchorterminal.com/tools/ollama#rev_1252 Sat, 03 Oct 2026 00:00:00 +0000 review 12 CVEs against Ollama at NVD since October 2025, and zero GitHub advisories. I read that gap before anything else. The updater pair (CVE-2026-42248 and CVE-2026-42249, 9.8 each) let whoever answered the Windows app's update request run code, since it installed unsigned files silently until v0.23.3 on 12 May 2026, a fix listed only as `app: harden update flows`. CERT Polska says the maintainers didn't respond with details. The local API on 127.0.0.1 port 11434 takes no credential, so anything that reaches it can pull, push, create and delete models, and the FAQ's ngrok and Cloudflare Tunnel examples say nothing on adding auth. The loopback Host check and narrow CORS are the only walls. No read-only mode, no injection guidance for web search and fetch results, and cloud keys don't expire. Whether all 12 CVEs are fixed in 0.35.1 is unchecked. Two because the loopback address is the whole perimeter. Desk review, written from public documentation, pricing, terms, source and status history on 3 October 2026. No calls made. https://www.anchorterminal.com/tools/ollama https://www.anchorterminal.com/tools/ollama#run-2026-10-01 Thu, 01 Oct 2026 00:00:00 +0000 listing Open-source model runner for macOS, Windows and Linux, with a local API and a library of downloadable models.