fix(deps): update module github.com/ollama/ollama to v0.17.1 [security]#92
Open
renovate[bot] wants to merge 1 commit into
Open
fix(deps): update module github.com/ollama/ollama to v0.17.1 [security]#92renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Contributor
Author
ℹ️ Artifact update noticeFile name: go.modIn order to perform the update(s) described in the table above, Renovate ran the
Details:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.3.6→v0.17.1Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loader
CVE-2026-7482 / GHSA-x8qc-fggm-mpqg
More information
Details
Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file in which the declared tensor offset and size exceed the file's actual length; during quantization in fs/ggml/gguf.go and server/quantization.go (WriteTo()), the server reads past the allocated heap buffer. The leaked memory contents may include environment variables, API keys, system prompts, and concurrent users' conversation data, and can be exfiltrated by uploading the resulting model artifact through the /api/push endpoint to an attacker-controlled registry. The /api/create and /api/push endpoints have no authentication in the upstream distribution. Default deployments bind to 127.0.0.1, but the documented OLLAMA_HOST=0.0.0.0 configuration is widely used in practice (large public-internet exposure observed).
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y/R:A/V:D/RE:L/U:RedReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
ollama/ollama (github.com/ollama/ollama)
v0.17.1Compare Source
What's Changed
ollama createwill no longer default to affine quantization for unquantized models when using the MLX engineFull Changelog: ollama/ollama@v0.17.0...v0.17.1
v0.17.0Compare Source
OpenClaw
OpenClaw can now be installed and configured automatically via Ollama, making it the easiest way to get up and running with OpenClaw with open models like Kimi-K2.5, GLM-5, and Minimax-M2.5.
Get started
ollama launch openclawWeb search in OpenClaw
When using cloud models, websearch is enabled - allowing OpenClaw to search the internet.
What's Changed
New Contributors
Full Changelog: ollama/ollama@v0.16.3...v0.17.0
v0.16.3Compare Source
What's Changed
ollama launch clineadded for the Cline CLIollama launch <integration>will now always show the model pickerNew Contributors
Full Changelog: ollama/ollama@v0.16.2...v0.16.3
v0.16.2Compare Source
What's Changed
ollama launch claudenow supports searching the web when using:cloudmodelsollamain PowerShellollama servemanually, setOLLAMA_NO_CLOUD=1.Full Changelog: ollama/ollama@v0.16.1...v0.16.2-rc0
v0.16.1Compare Source
What's Changed
curlinstall script on macOS will now only prompt for your password if its requiredieminstall script in Windows will now show progressOLLAMA_LOAD_TIMEOUTvariableFull Changelog: ollama/ollama@v0.16.0...v0.16.1
v0.16.0Compare Source
New models
New
ollamaThe new
ollamacommand makes it easy to launch your favorite apps with models using OllamaWhat's Changed
ollama launch piFull Changelog: ollama/ollama@v0.15.6...v0.16.0
v0.15.6Compare Source
What's Changed
ollama launch droidollama launchwill now download missing models instead of erroringollama launch claudewould cause context compaction when providing imagesFull Changelog: ollama/ollama@v0.15.5...v0.15.6
v0.15.5Compare Source
New models
Improvements to
ollama launchollama launchcan now be provided arguments, for exampleollama launch claude -- --resumeollama launchwill now work run subagents when usingollama launch claudeollama launch opencodeWhat's Changed
ollama launchfor planning, deep research, and similar tasksollama signinwill now open a browser window to make signing in easierollama signinwill now open the browser to the connect pagenum_predictin the APInum_predictNew Contributors
Full Changelog: ollama/ollama@v0.15.4...v0.15.5
v0.15.4Compare Source
What's Changed
ollama launch openclawwill now enter the standard OpenClaw onboarding flow if this has not yet been completed.Full Changelog: ollama/ollama@v0.15.3...v0.15.4
v0.15.3Compare Source
What's Changed
ollama launch clawdbottoollama launch openclawto reflect the project's new nameollama launchwill now use the value ofOLLAMA_HOSTwhen running itNew Contributors
Full Changelog: ollama/ollama@v0.15.2...v0.15.3
v0.15.2Compare Source
What's Changed
ollama launch clawdbotcommand for launching Clawdbot using Ollama modelsFull Changelog: ollama/ollama@v0.15.1...v0.15.2
v0.15.1Compare Source
What's Changed
ollama launchwould not detectclaudeand would incorrectly updateopencodeconfigurationsNew Contributors
Full Changelog: ollama/ollama@v0.15.0...v0.15.1
v0.15.0Compare Source
ollama launchA new
ollama launchcommand to use Ollama's models with Claude Code, Codex, OpenCode, and Droid without separate configuration.What's Changed
ollama launchcommand for Claude Code, Codex, OpenCode, and Droid"""would not work when usingollama runollama runv0.14.3Compare Source
New models
What's Changed
ollama createandollama showcommands for experimental models/api/generateAPI can now be used for image generationollama rmwould only stop the first model in the list if it were runningFull Changelog: ollama/ollama@v0.14.2...v0.14.3
v0.14.2Compare Source
New models
What's Changed
/v1/responsesAPI to better confirm to OpenResponses specificationNew Contributors
Full Changelog: ollama/ollama@v0.14.1...v0.14.2
v0.14.1Compare Source
Image generation models (experimental)
Experimental image generation models are available for macOS and Linux (CUDA) in Ollama:
Available models
More models coming soon:
What's Changed
New Contributors
Full Changelog: ollama/ollama@v0.14.0...v0.14.1
v0.14.0Compare Source
What's Changed
ollama run --experimentalCLI will now open a new Ollama CLI that includes an agent loop and thebashtool/v1/messagesAPIREQUIREScommand for theModelfileallows declaring which version of Ollama is required for the modelNaNor-InfzstcompressionNew Contributors
Full Changelog: ollama/ollama@v0.13.5...v0.14.0-rc2
v0.13.5Compare Source
New Models
What's Changed
bertarchitecture models now run on Ollama's engineNew Contributors
Full Changelog: ollama/ollama@v0.13.4...v0.13.5
v0.13.4Compare Source
New Models
What's Changed
New Contributors
Full Changelog: ollama/ollama@v0.13.3...v0.13.4-rc0
v0.13.3Compare Source
New models
What's Changed
/api/embedand/v1/embeddingsFull Changelog: ollama/ollama@v0.13.2...v0.13.3
v0.13.2Compare Source
New models
What's Changed
mistral-3,gemma3,qwen3-vland more. This improves memory utilization and performance when providing images as input.deepseek-v3.1would always think even with thinking is disabled in Ollama's appNew Contributors
Full Changelog: ollama/ollama@v0.13.1...v0.13.2
v0.13.1Compare Source
New models
What's Changed
nomic-embed-textwill now use Ollama's engine by defaultcogito-v2.1Unmarshal:errorsNew Contributors
Full Changelog: ollama/ollama@v0.13.0...v0.13.1
v0.13.0Compare Source
New models
DeepSeek-OCR
DeepSeek-OCR is now available on Ollama. Example inputs:
New
benchtoolOllama's GitHub repo now includes a
benchtool that can be used to test model performance. For the time being this is a separate tool that can be built in the Ollama GitHub repository:First, install Go. Then from the root of the Ollama repository run:
For more information see the tool's documentation
What's Changed
New Contributors
Full Changelog: ollama/ollama@v0.12.11...v0.13.0
v0.12.11Compare Source
Logprobs
Ollama's API and OpenAI-compatible API now support log probabilities. Log probabilities of output tokens indicate the likelihood of each token occurring in the sequence given the context. This is useful for different use cases:
To enable Logprobs, provide
"logprobs": trueto Ollama's API:When log probabilities are requested, response chunks will now include a
"logprobs"field with the token, log probability and raw bytes (for partial unicode).{ "model": "gemma3", "created_at": "2025-11-14T22:17:56.598562Z", "response": "Okay", "done": false, "logprobs": [ { "token": "Okay", "logprob": -1.3434503078460693, "bytes": [ 79, 107, 97, 121 ] } ] }top_logprobsWhen setting
"top_logprobs", a number of most-likely tokens are also provided, making it possible to introspect alternative tokens. Below is an example request.This will generate a stream of response chunks with the following fields:
{ "model": "gemma3", "created_at": "2025-11-14T22:26:10.466324Z", "response": "The", "done": false, "logprobs": [ { "token": "The", "logprob": -0.8361086845397949, "bytes": [ 84, 104, 101 ], "top_logprobs": [ { "token": "The", "logprob": -0.8361086845397949, "bytes": [ 84, 104, 101 ] }, { "token": "Okay", "logprob": -1.2590975761413574, "bytes": [ 79, 107, 97, 121 ] }, { "token": "That", "logprob": -1.2686877250671387, "bytes": [ 84, 104, 97, 116 ] } ] } ] }Special thanks
Thank you @baptistejamin for adding Logprobs to Ollama's API.
Vulkan support (opt-in)
Ollama 0.12.11 includes support for Vulkan acceleration. Vulkan brings support for a broad range of GPUs from AMD, Intel, and iGPUs. Vulkan support is not yet enabled by default, and requires opting in by running Ollama with a custom environment variable:
On Powershell, use:
For issues or feedback on using Vulkan with Ollama, create an issue labelled Vulkan and make sure to include server logs where possible to aid in debugging.
What's Changed
"required"field in tool definitions will now be omitted if not specified"tool_call_id"would be omitted when using the OpenAI-compatible API.ollama createwould import data from bothconsolidated.safetensorsand other safetensor files.OLLAMA_VULKAN=1. For example:OLLAMA_VULKAN=1 ollama serveNew Contributors
Full Changelog: ollama/ollama@v0.12.10...v0.12.11
v0.12.10Compare Source
ollama runnow works with embedding modelsollama runcan now run embedding models to generate vector embeddings from text:Content can also be provided to
ollama runvia standard input:What's Changed
qwen3-vl:235bandqwen3-vl:235b-instruct/api/chatAPIollama runnow works with embedding modelsNew Contributors
Full Changelog: ollama/ollama@v0.12.9...v0.12.10
v0.12.9Compare Source
What's Changed
Full Changelog: ollama/ollama@v0.12.8...v0.12.9
v0.12.8Compare Source
What's Changed
qwen3-vlperformance improvements, including flash attention support by defaultqwen3-vlwill now output less leading whitespace in the response when thinkingdeepseek-v3.1thinking could not be disabled in Ollama's new appqwen3-vlwould fail to interpret images with transparent backgroundsollama rmNew Contributors
Full Changelog: ollama/ollama@v0.12.7...v0.12.8
v0.12.7Compare Source
New models
Add files and adjust thinking levels in Ollama's new app
Ollama's new app now includes a way to add one or many files when prompting the model:
For better responses, thinking levels can now be adjusted for the gpt-oss models:
New API documentation
New API documentation is available for Ollama's API: https://docs.ollama.com/api
What's Changed
embeddinggemma/v1/embeddingsendpoint now supportsencoding_formatparameter{"name": name, "arguments": args}(thanks @rick-github!)FROM <model>would not inheritRENDERERorPARSERcommandsNew Contributors
Full Changelog: ollama/ollama@v0.12.6...v0.12.7
v0.12.6Compare Source
What's Changed
qwen3-coderwould act in raw mode when using/api/generateorollama run qwen3-coder <prompt>qwen3-embeddingproviding invalid resultsnum_gpuis settool_indexwith a value of0would not be sent to the modelExperimental Vulkan Support
Experimental support for Vulkan is now available when you build locally from source. This will enable additional GPUs from AMD, and Intel which are not currently supported by Ollama. To build locally, install the Vulkan SDK and set VULKAN_SDK in your environment, then follow the developer instructions. In a future release, Vulkan support will be included in the binary release as well. Please file issues if you run into any problems.
New Contributors
Full Changelog: ollama/ollama@v0.12.5...v0.12.6
v0.12.5Compare Source
What's Changed
/api/chatAPI"think": falsewould show an error instead of being silently ignoreddeepseek-r1output issuesNew Contributors
Full Changelog: ollama/ollama@v0.12.4...v0.12.5-rc0
v0.12.4Compare Source
What's Changed
keep_alivein the API would accept different values for the/api/chatand/api/generateendpointsqwen3-coderOLLAMA_FLASH_ATTENTIONcan now be overridden to0for models that have flash attention enabled by defaultNew Contributors
Full Changelog: ollama/ollama@v0.12.3...v0.12.4-rc3
v0.12.3Compare Source
New models
DeepSeek-V3.1-Terminus: DeepSeek-V3.1-Terminus is a hybrid model that supports both thinking mode and non-thinking mode. It delivers more stable & reliable outputs across benchmarks compared to the previous version:
Run on Ollama's cloud:
Run locally (requires 500GB+ of VRAM)
Kimi-K2-Instruct-0905: Kimi K2-Instruct-0905 is the latest, most capable version of Kimi K2. It is a state-of-the-art mixture-of-experts (MoE) language model, featuring 32 billion activated parameters and a total of 1 trillion parameters.
What's Changed
ollama pushwill now provide a URL to follow to sign in/loadwould crashNew Contributors
Full Changelog: ollama/ollama@v0.12.2...v0.12.3
v0.12.2Compare Source
Web search
A new web search API is now available in Ollama. Ollama provides a generous free tier of web searches for individuals to use, and higher rate limits are available via Ollama’s cloud. This web search capability can augment models with the latest information from the web to reduce hallucinations and improve accuracy.
What's Changed
Full Changelog: ollama/ollama@v0.12.1...v0.12.2
v0.12.1Compare Source
New models
What's Changed
&characters in Qwen3-Coder would not be parsed correctly when function callingollama signinwould not work properly on LinuxFull Changelog: ollama/ollama@v0.12.0...v0.12.1
v0.12.0Compare Source
Cloud models
Cloud models are now available in preview, allowing you to run a group of larger models with fast, datacenter-grade hardware.
To run a cloud model, use:
What's Changed
ollama create<think>if provided in the prompt for /api/generate by @rick-githubNew Contributors
Full Changelog: ollama/ollama@v0.11.11...v0.12.0
v0.11.11Compare Source
What's Changed
dimensionsfield to embed requests by @mxyng in #12242New Contributors
Full Changelog: ollama/ollama@v0.11.10...v0.11.11
v0.11.10Compare Source
New models
What's Changed
Full Changelog: ollama/ollama@v0.11.9...v0.11.10
v0.11.9Compare Source
What's Changed
New Contributors
Full Changelog: ollama/ollama@v0.11.8...v0.11.9-rc0
v0.11.8Compare Source
What's Changed
gpt-ossnow has flash attention enabled by default for systems that support itgpt-ossFull Changelog: ollama/ollama@v0.11.7...v0.11.8
v0.11.7Compare Source
DeepSeek-V3.1
DeepSeek-V3.1 is now available to run via Ollama.
This model supports hybrid thinking, meaning thinking can be enabled or disabled by setting
thinkin Ollama's API:In Ollama's CLI, thinking can be enabled or disabled by running the
/set thinkor/set nothinkcommands.Turbo (in preview)
DeepSeek-V3.1 has over 671B parameters, and so a large amount of VRAM is required to run it. Ollama's Turbo mode (in preview) provides access to powerful hardware in the cloud you can use to run the model.
Turbo via Ollama's app
deepseek-v3.1:671bfrom the model selectorTurbo via Ollama's CLI and libraries
For instructions on using Turbo with Ollama's Python and JavaScript library, see the docs
What's Changed
<think>tag (e.g. DeepSeek-V3.1)<think>tag from a model{or}would not be parsed correctlyNew Contributors
Full Changelog: ollama/ollama@v0.11.6...v0.11.7
v0.11.6Compare Source
What's Changed
Full Changelog: ollama/ollama@v0.11.5...v0.11.6
v0.11.5Compare Source
What's Changed
gpt-ossmodelsOLLAMA_NEW_ESTIMATES=1 ollama serveand will soon be enabled by default.OLLAMA_FLASH_ATTENTION=1will also enable flash attention for pure-CPU modelsreasoning_effortNew Contributors
Full Changelog: <https://github.com/ollama/ollama/compare/v0.11.4.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.