v0.13.7 v1.1.4
AprilNEA/OpenLogiOct 11, 2026 → Oct 11, 20260 days between releases
What's New
Security release enforces model authorization and binds render jobs to owners, requiring render-service upgrades alongside the app.
Breaking Changes
- Providers using server credentials must explicitly configure `*_MODELS` or provider YAML `models` lists to authorize models beyond defaults.
- Unlisted models never reach providers with server credentials; Qwen clone voices map to the configured model before authorization.
New Features
- Model authorization for server-managed provider credentials.
- Render jobs are now bound to the requesting owner.
- Legacy classroom media URLs are revoked when courses are deleted.
Improvements
- Mixed service versions now fail closed through a dedicated owner-bound job namespace.
- Media responses use private caching with revalidation for deleted courses.
Bug Fixes
- Fixed missing model authorization for server-managed provider credentials (High severity).
- Fixed MP4 render jobs not being bound to the requesting owner (Medium severity).
- Fixed deleted courses continuing to serve legacy classroom media URLs (Low severity).
Upgrade Notes
You must upgrade the render-service together with or before the application to prevent failures. Providers using server credentials must explicitly configure `*_MODELS` or provider YAML `models` lists; otherwise, only `DEFAULT_MODEL` and `MODEL_ROUTES` are authorized.
The Two Releases
v0.13.7
Oct 11, 2026· 11 days ago
Adds new API endpoints for reranking and moderation, introduces custom endpoint groups, and adds a reliability floor for routing.
Full release notesOpenMAIC v1.1.4 — Security
Oct 11, 2026· 11 days ago
A security release that enforces model authorization for server-managed provider credentials, binds render jobs to owners, and revokes legacy media for deleted courses. Upgrading the render-service is required alongside the application to avoid failures.
Full release notes