llama.cpp v1.0.0: a stable API, and 35 functions removed

llama.cpp v1.0.0 shipped on November 13, and the engine below most local AI now has a version number you can plan on. After 3.5 years of rolling build tags, the project commits to semantic versioning: a breaking change to the C API means a major version bump. The same release removes the deprecated API. If your app or your vendor's app links libllama, this upgrade can break the build before it makes anything more stable.

What actually happened

The team published the v1.0.0 announcement on Hugging Face, and the release notes are on GitHub. Two libraries reach 1.0 together: libllama and libggml.

The versioning rule, for all ggml-org projects:

• MAJOR: a breaking change to the public C API in ./include.
• MINOR: a compatible feature, backend update, new model support or API addition.
• PATCH: a bug fix with no API change.

The announcement says the project supports more than 150 model architecture variants, and that it will be "stricter" about showing API and ABI breaks to downstream users.

Then the cleanup. The release notes list:

• llama_set_warmup and 35 deprecated functions removed from llama.h.
• defrag_thold and the --defrag-thold CLI flag removed.
• llama_set_embd_state_src renamed to llama_set_ctx_state_src.
• clip.h removed; multimodal code now goes through mtmd.

llama-server also gets security work: fixes for DNS rebinding and a CORS-proxy SSRF, HF_TOKEN sent only to huggingface.co hosts, and two new opt-in flags, --allow-unauthenticated-tools and --media-allow-private-urls. A new OpenAI-compatible /v1/audio/speech endpoint joins the realtime endpoint we covered in v0.8.0.

Why llama.cpp v1.0.0 matters for your business

You possibly run llama.cpp and do not know it. Many desktop AI apps and local model servers are built on this library. A stable contract below them makes local inference a safer choice for a document pipeline or an offline assistant.

Read what the promise covers:

1. The rule names the C API. The announcement does not state a stability promise for the llama-server HTTP API, the GGUF file format or CLI flags. If you use the server, test each upgrade.
2. No support window. We found no LTS or backport policy in the announcement or the release notes. A security fix can arrive only in the newest release.
3. Behavior changed with the security fixes. The new opt-in flags suggest that unauthenticated tool calls and private media URLs now need an explicit switch. If your setup used them, check after the upgrade.

What to do: pin v1.0.0 in your build, not master. Search your code for the removed names before you upgrade. Do not put llama-server on the open internet; put it behind your own auth. And ask each vendor that ships a local model which llama.cpp version is inside.

Sources: llama.cpp v1.0.0 announcement (Hugging Face), llama.cpp v1.0.0 release notes (GitHub).