Strata v0.1.38 released: DNS rebinding security fix + 6.4% 128K prompt speedup

What it is

On October 3, the open-source inference engine Strata shipped v0.1.38 with two notable changes:

• Security fix: when no API key is explicitly configured, the HTTP server now only accepts localhost and LAN hosts, closing the external attack surface; DNS-rebinding attacks are mitigated.
• Performance: ~6.4% prompt-processing speedup at 128K-context IQ2_XS quantization.

Why this release matters

DNS rebinding is the canonical attack vector against local AI services — a malicious page can bypass the browser's same-origin policy and hit http://localhost:8080/v1/chat. Strata 0.1.38 narrowing the default bind to localhost/LAN is the most important change in this release.

Impact

• Users running Strata on public-facing hosts, containers or VMs must now set an explicit API key to expose the service externally
• 128K-context prompt handling is one of Strata's marquee features; 6.4% speedup directly benefits long-doc summarization and post-RAG processing

Local deployment angle

If you only run Strata on a workstation or home LAN, this upgrade is zero-migration — the new defaults are already secure; just confirm the "API bind to 127.0.0.1" log line on first start.