v2026.9.14 v1.0.3

Name: DroneSplat
Author: BITyia

high risk

BITyia/DroneSplatSep 14, 2026 → Sep 15, 20261 day between releases

What's New

Upgraded Next.js to 16.3.3 and enforced 7-day token lifetimes to patch critical security vulnerabilities.

Breaking Changes

Next.js 16.3.3 upgrade may require configuration changes
Access-code tokens now expire after 7 days and are rate-limited
Content-Security-Policy injection may block previously allowed inline scripts

New Features

Server-side storage lifecycle management where the server owns asset entries
Inquiry-based exercise-class teaching skill

Improvements

Next.js upgraded to patch critical remote code execution vulnerability
Access-code tokens now enforce server-side lifetime and signature validation
Render service now injects CSP to prevent untrusted HTML execution
Audio provider now validates redirect hops and DNS resolution

Bug Fixes

Patched critical remote code execution vulnerability in Next.js
Fixed untrusted HTML execution in render service
Fixed access-code tokens lacking expiration and rate limiting

Upgrade Notes

Update Next.js configuration to accommodate version 16.3.3; clients relying on long-lived access codes must implement refresh logic; review CSP settings if inline scripts are used.

The Two Releases

v2026.9.14

Sep 14, 2026· 1 month ago

Improves error reporting and user experience by handling edge cases in archive reading, timezone handling, and indicator loading.

Full release notes

v1.0.3

OpenMAIC v1.0.3 — Security

Sep 15, 2026· 1 month ago

A security-focused release patching critical vulnerabilities in Next.js and access-code tokens, alongside new storage and teaching features.

Full release notes