LocalAI 4.9.0 makes authentication deny-by-default after unprefixed routes were found bypassing the protected-prefix list

GitHub·high signalXBlueskyLinkedInCopy link

LocalAI shipped 4.9.0 on 2026-08-20 after 146 pull requests in 13 days. Every HTTP route now requires credentials unless it appears in an explicit public registry, closing a bypass class where unprefixed aliases such as /moderations, /models, /backends and /mcp/chat/completions fell outside the old protected-prefix check. The release credits Naor Yaacov for the report and also adds opt-in chat context compression that returns compression ratio and duration as response metadata.