v0.80.0 v1.1.2
0xNyk/council-of-high-intelligenceSep 27, 2026 → Sep 28, 20261 day between releases
What's New
Security release tightening provider URL validation and refusing redirects
Breaking Changes
- Caller-supplied URLs that redirect or contain query strings/fragments are refused
- Loopback or private addresses require ALLOW_LOCAL_NETWORKS unless server-configured
- Pinned provider requests do not use Node's environment proxy
Improvements
- Server-side provider connections are pinned to validated addresses and refuse redirects
- Error responses no longer carry provider response bodies or connection details
- Classroom media generation downloads now use strict provider transport (HTTPS only)
Upgrade Notes
Ensure caller-supplied URLs do not redirect or contain query strings/fragments. If using loopback or private addresses, set the ALLOW_LOCAL_NETWORKS environment variable.
The Two Releases
0.80.0
Sep 27, 2026· 24 days ago
This major version focuses on performance optimizations and CI integration improvements for the WorkTrunk tool. It introduces signed release artifacts and resolves complex issues with worktree management and submodule handling.
Full release notesOpenMAIC v1.1.2 — Security
Sep 28, 2026· 24 days ago
A security release tightening provider URL validation, refusing redirects, and sanitizing error messages to prevent internal probing.
Full release notes