LocalAI v4.9.0 hardens auth, adds MiniMax-H3 video gen

LocalAI 4.9.0, released by mudler on 20 Aug, is a 13-day, 146-PR release focused on stability and everyday usability rather than new engines. The headline change is deny-by-default authentication: every HTTP route now requires credentials unless explicitly listed in a public registry, fixing bypasses where unprefixed aliases like /moderations, /models, /backends, and /mcp/chat/completions fell outside the old protected-prefix list. Chat also gains opt-in end-to-end context compression, where older complete turns are compressed through a LocalAI model before inference, preserving system prompts, newest messages, and tool-call units, with ratio and duration returned as metadata.

On the media side, vllm-cpp opens a second engine handle for MiniMax-H3 checkpoints, enabling video generation that renders video and audio jointly — the MP4 includes a real AAC track, and prompting for speech gets lip-synced. Qwen3-TTS arrives on llama.cpp across CUDA, ROCm, SYCL, Vulkan, Metal, and L4T. A KNN router provides similarity-weighted voting over a persisted labeled prompt corpus, treating unknown prompts as undecidable. Infrastructure upgrades include parallel Hugging Face downloads, global admission control, backend traces, reversible PII pseudonyms, and CUDA builds expanded from one or two architectures to eight on amd64 and five on arm64, covering A100, L4, 4090, H100/H200, B200, Jetson Orin and Jetson Thor.