Developers embedding local AI now have a clearer signal for changes that could break their applications. ggml-org announced version 1.0.0 of llama.cpp and ggml on November 13, committing to major-version increases when public interfaces become incompatible at the API or binary level.
Under the published rules, breaking changes to the public C API increase the major version. Backward-compatible features, backend updates and model support increase the minor version; fixes without API changes increase the patch version. The practical consequence for maintainers is easier dependency planning, although upgrades still need application-specific testing.
The official release notes also document immediate migration work: deprecated functions have been removed, and the speculative decoding API has moved into the main public header. Projects relying on removed interfaces will need code changes.
For operators, the release includes llama-server changes addressing CORS handling, DNS rebinding and server-side request forgery. It also restricts HF_TOKEN use to Hugging Face hosts and cancels MCP tool calls when a client disconnects or times out. These are concrete reasons to review server deployments alongside library integrations. The release notes describe fixes; they do not establish exploitation in the wild.
