Skip to content

jan

v0.8.4 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

chatgpt llm llamacpp localai self-hosted tauri

Affected surfaces

deps rce_ssrf

Summary

AI summary

Settings move to backend store, Japanese translations update, chat folding toggle adds, Rag and security fixes apply, OpenAI gateway integrates.

Full changelog

Migration

Settings and credentials now live in a backend-managed store.

Provider settings and credentials previously persisted in the webview's localStorage. In 0.8.4, Jan reads and writes them from a backend-managed store instead (secrets go to the OS keyring). Your existing settings and API keys are copied over automatically on first launch - no manual action is needed, and from this version on all new changes are saved to the backend store.

Your old localStorage data is not deleted - it's kept as a snapshot so you can downgrade to a pre-0.8.4 build and still have your previous settings. Any changes you make in 0.8.4+ live only in the backend store, so a downgrade sees the older snapshot, not your latest settings.


What's Changed

  • chore(flatpak): add 0.8.3 release notes to appdata by @qnixsynapse in https://github.com/janhq/jan/pull/8343
  • docs: update changelogs for v0.8.3 and update documentation by @qnixsynapse in https://github.com/janhq/jan/pull/8336
  • Merge release/v0.8.3 to main by @qnixsynapse in https://github.com/janhq/jan/pull/8344
  • i18n(ja): update Japanese translations (#8264) by @mahirhir in https://github.com/janhq/jan/pull/8348
  • i18n(ja): complete common.json translations and fix terminology (#8264) by @mahirhir in https://github.com/janhq/jan/pull/8349
  • i18n(ja): complete settings.json translations (#8264) by @mahirhir in https://github.com/janhq/jan/pull/8352
  • fix(markdown): force code blocks LTR in RTL language context by @qnixsynapse in https://github.com/janhq/jan/pull/8350
  • feat(chat): add toggle for folding interim text into reasoning trace by @qnixsynapse in https://github.com/janhq/jan/pull/8363
  • fix(rag): repair embeddings, stop chat-model reloads, and parse more PDFs by @qnixsynapse in https://github.com/janhq/jan/pull/8360
  • ci: close issues inactive for over 180 days by @qnixsynapse in https://github.com/janhq/jan/pull/8366
  • ci: grant actions:write to stale workflow for state persistence by @qnixsynapse in https://github.com/janhq/jan/pull/8377
  • fix(chat): stop persisting detached assistant replies in branched threads by @qnixsynapse in https://github.com/janhq/jan/pull/8376
  • feat(settings): move settings/credentials off localStorage to backend store by @qnixsynapse in https://github.com/janhq/jan/pull/8388
  • fix(params): coerce numeric assistant params from string to number by @qnixsynapse in https://github.com/janhq/jan/pull/8386
  • fix: use snake case for ADL enum in get_gpu_usage by @nkulshre-amd in https://github.com/janhq/jan/pull/8390
  • fix(chat): stop MCP tool-approval popup from hanging; move transient approval state off disk by @qnixsynapse in https://github.com/janhq/jan/pull/8391
  • API key rotation for Gemini by @jjchen01 in https://github.com/janhq/jan/pull/8408
  • fix(security): bump handlebars to 4.7.9 to clear RCE advisory by @qnixsynapse in https://github.com/janhq/jan/pull/8395
  • fix(chat): ignore custom SSE event types in OpenAI-compatible streams by @qnixsynapse in https://github.com/janhq/jan/pull/8392
  • feat: OpenAI-compatible translating gateway + Responses API + unified reasoning by @qnixsynapse in https://github.com/janhq/jan/pull/8423
  • fix: Stabilize chat prefix caching, restore cloud providers, unify logging (v0.8.4) by @qnixsynapse in https://github.com/janhq/jan/pull/8425
  • fix(mcp): guard against duplicate serve() on streamable-http MCP servers by @thinhlpg in https://github.com/janhq/jan/pull/8435
  • fix(providers): send anthropic-version on model-list fetch by @qnixsynapse in https://github.com/janhq/jan/pull/8433
  • fix(desktop): macOS hide-on-close; hide-to-tray when Local API Server runs by @qnixsynapse in https://github.com/janhq/jan/pull/8436
  • feat(extensions): bundle built-in extensions into the app binary and update tests by @qnixsynapse in https://github.com/janhq/jan/pull/8437
  • feat(llamacpp): per-model chat template kwargs by @qnixsynapse in https://github.com/janhq/jan/pull/8441
  • feat: token counter for remote/MLX providers + chat & inference fixes by @qnixsynapse in https://github.com/janhq/jan/pull/8456
  • fix(chat): preserve AbortError identity when stopping mid model-load by @thinhlpg in https://github.com/janhq/jan/pull/8443
  • fix(chat): stop hiding the llama.cpp token counter during chat by @qnixsynapse in https://github.com/janhq/jan/pull/8461
  • feat(web-search): native web_search/web_fetch via tauri-plugin-websearch by @qnixsynapse in https://github.com/janhq/jan/pull/8464
  • fix: persist chain-of-thought duration in thread metadata by @qnixsynapse in https://github.com/janhq/jan/pull/8474
  • refactor: centralize llamacpp extension lookup with scoped-name fallback by @qnixsynapse in https://github.com/janhq/jan/pull/8487

New Contributors

  • @mahirhir made their first contribution in https://github.com/janhq/jan/pull/8348
  • @nkulshre-amd made their first contribution in https://github.com/janhq/jan/pull/8390

Full Changelog: https://github.com/janhq/jan/compare/v0.8.3...v0.8.4

Breaking Changes

  • Settings and credentials now read/written from a backend-managed store instead of webview `localStorage`.

Security Fixes

  • Bump handlebars to 4.7.9 to clear RCE advisory

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track jan

Get notified when new releases ship.

Sign up free

About jan

Jan is an open source alternative to ChatGPT that runs 100% offline on your computer.

All releases →

Related context

Related tools

Beta — feedback welcome: [email protected]