v0.6.8 v1.1.4
high risk
BITyia/DroneSplatOct 10, 2026 → Oct 11, 20261 day between releases
What's New
Security release enforces model authorization and binds render jobs to requesting owners.
Breaking Changes
- Server-managed providers require explicit model lists (`*_MODELS`).
- Qwen voice clone models must be explicitly authorized.
New Features
- Render jobs are now bound to the requesting owner.
- Legacy classroom media URLs are revoked when courses are deleted.
Improvements
- Providers using server credentials only send authorized models.
- Media responses use private caching with revalidation.
Bug Fixes
- Fix for missing model authorization for server-managed credentials (High severity).
- MP4 render jobs now bound to requesting owner (Medium severity).
- Deleted courses now revoke legacy classroom media URLs (Low severity).
Upgrade Notes
Upgrade the render-service together with or before the app. Configure explicit model lists for server-managed providers. Mixed service versions will fail closed through a dedicated owner-bound job namespace.
The Two Releases
v0.6.8
Astryx v0.6.8
Oct 10, 2026· 12 days ago
A patch release focused on interaction reliability, accessible state, and clearer integration tooling.
Full release notesv1.1.4
OpenMAIC v1.1.4 — Security
Oct 11, 2026· 11 days ago
A security release enforcing model authorization for server-managed credentials and binding render jobs to the requesting user.
Full release notes