LLM Harbor

v0.5.3 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 8d LLM Frameworks

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ai automation shell cli container docker

+10 more

self-hosted llm local mcp npm package pypi safetensors server tools

Affected surfaces

rbac rce_ssrf breaking_upgrade

ReleasePort's take

Moderate signal

editorial:auto 8d

Harbor v0.5.3 removes built‑in Boost workflow presets and keel/sightline modules while adding new agentic Boost modules, tightening read_url redirect validation to close an SSRF vector.

Why it matters: Severity 70 breaking change eliminates existing Boost presets; security fix (severity 80) now validates every redirect hop in Boost read_url, mitigating SSRF risk. Operators must adjust workflows and test redirect handling.

Summary

AI summary

Built‑in Boost workflow presets and keel/sightline modules were removed, requiring migration to quickhop/deephop.

Changes in this release

Type	Severity	Summary	CVE
Security	High	Boost `read_url` validates every redirect hop, closing an SSRF vector in web research modules. Boost `read_url` validates every redirect hop, closing an SSRF vector in web research modules. Source: llm_adapter@2026-07-18 Confidence: high	—
Breaking	High	Removes built-in Boost workflow presets and keel/sightline modules. Removes built-in Boost workflow presets and keel/sightline modules. Source: llm_adapter@2026-07-18 Confidence: high	—
Feature
Feature	Medium	Adds agentic Boost modules: quickhop, deephop, autocheck, diffscope, caveman, ponytail. Adds agentic Boost modules: quickhop, deephop, autocheck, diffscope, caveman, ponytail. Source: llm_adapter@2026-07-18 Confidence: high	—
Feature	Medium	`harbor launch` supports the grok CLI as a host tool. `harbor launch` supports the grok CLI as a host tool. Source: llm_adapter@2026-07-18 Confidence: high	—
Feature	Medium	HF cache scans now rescue missed models and allow removal of llamacpp IDs without a slash. HF cache scans now rescue missed models and allow removal of llamacpp IDs without a slash. Source: llm_adapter@2026-07-18 Confidence: high	—
Feature	Medium	`harbor up a b -t` now tails logs for all requested services, not just the first. `harbor up a b -t` now tails logs for all requested services, not just the first. Source: llm_adapter@2026-07-18 Confidence: high	—
Feature	Low	Host Deno runs no longer show update‑check nags or send telemetry. Host Deno runs no longer show update‑check nags or send telemetry. Source: granite4.1:30b@2026-07-18-audit Confidence: high	—
Performance	Medium	Faster Hugging Face downloads via `hf_transfer`. Faster Hugging Face downloads via `hf_transfer`. Source: llm_adapter@2026-07-18 Confidence: high	—
Performance	Low	Boost token counting no longer stalls on multi‑megabyte pathological inputs. Boost token counting no longer stalls on multi‑megabyte pathological inputs. Source: granite4.1:30b@2026-07-18-audit Confidence: high	—
Bugfix
Bugfix	Medium	`harbor pull` and other compose‑backed commands now fail with a clear error when compose resolution fails. `harbor pull` and other compose‑backed commands now fail with a clear error when compose resolution fails. Source: llm_adapter@2026-07-18 Confidence: high	—
Bugfix	Medium	`harbor launch --workflow` routes coding agents through Boost module chains. `harbor launch --workflow` routes coding agents through Boost module chains. Source: llm_adapter@2026-07-18 Confidence: low	—
Bugfix	Medium	Renames `harbor hf cache` to `harbor hf cachedir`, freeing `hf cache` for official HF CLI. Renames `harbor hf cache` to `harbor hf cachedir`, freeing `hf cache` for official HF CLI. Source: llm_adapter@2026-07-18 Confidence: low	—
Bugfix	Low	Boost `autocheck` excludes failed or spoofed page reads from evidence; `/caveman` and `/ponytail` commands trigger only in their own module. Boost `autocheck` excludes failed or spoofed page reads from evidence; `/caveman` and `/ponytail` commands trigger only in their own module. Source: granite4.1:30b@2026-07-18-audit Confidence: high	—
Bugfix	Low	`harbor pull` correctly handles mixed service/model/flag arguments, routing flags like `--no-defaults` to the compose resolver. `harbor pull` correctly handles mixed service/model/flag arguments, routing flags like `--no-defaults` to the compose resolver. Source: granite4.1:30b@2026-07-18-audit Confidence: high	—
Bugfix	Low	Container test runner auto‑runs the install suite when needed and works on Alpine, Arch, Rocky; compose files can waive lint rules via `x-harbor-lint-ignore`. Container test runner auto‑runs the install suite when needed and works on Alpine, Arch, Rocky; compose files can waive lint rules via `x-harbor-lint-ignore`. Source: granite4.1:30b@2026-07-18-audit Confidence: high	—

Full changelog

Misc

Harbor Boost gains agentic modules: quickhop and deephop for web research, autocheck for deliverable audits, and diffscope for scoped file-change checks, with caveman and ponytail as response style modules.
harbor launch --workflow routes coding agents through Boost module chains.
harbor launch supports the grok CLI as a host tool.
Faster Hugging Face downloads via hf_transfer.
harbor hf cache is renamed to harbor hf cachedir, freeing hf cache to pass through to the official HF CLI.
HF cache scans now rescue models the hub library misses, keep listing models when the cache scan throws, and llamacpp models without a slash in their ID can be removed.
Boost read_url now validates every redirect hop, closing an SSRF vector in web research modules.
Boost autocheck keeps failed or spoofed page reads out of its evidence, and the /caveman and /ponytail style commands only trigger in their own module.
Boost token counting no longer stalls on multi-megabyte pathological inputs.
harbor pull and other compose-backed commands now fail with a clear error when compose resolution fails, instead of running a bare docker subcommand.
harbor up a b -t now tails logs for all requested services, not just the first.
Assorted CLI fixes: doctor --check ordering, up --open target, and ui.main resolution for open/url/tunnel/qr.
harbor pull handles mixed service/model/flag arguments correctly, routing flags like --no-defaults to the compose resolver instead of misreading them as model names.
Host Deno runs no longer show update-check nags or send telemetry.
The container test runner auto-runs the install suite when needed and works on Alpine, Arch, and Rocky; compose files can waive lint rules via x-harbor-lint-ignore.

Breaking: built-in Boost workflow presets and the keel/sightline modules were removed; the former caveman/ponytail research workflows are now quickhop/deephop.

Full Changelog: https://github.com/av/harbor/compare/v0.5.2...v0.5.3

Breaking Changes

Removed built-in Boost workflow presets and the `keel` and `sightline` modules.
Renamed command: `harbor hf cache` → `harbor hf cachedir`, freeing `hf cache` to pass through to the official HF CLI.

Security Fixes

Boost `read_url` validates every redirect hop, closing an SSRF vector in web research modules.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track LLM Harbor

Get notified when new releases ship.

About LLM Harbor

Containerized LLM toolkit. Run LLM backends, APIs, frontends, and additional services via a concise CLI. `Apache-2.0` `Docker/Shell`