v1.10.0 v1.1.1
medium risk
Friedrich-M/UniMateSep 26, 2026 → Sep 26, 20261 day between releases
What's New
Security release fixes SSRF vulnerability in MinerU Cloud parsing.
Breaking Changes
- Upload and ZIP URLs from MinerU Cloud must be HTTPS public addresses.
New Features
- SSRF guard prevents access to loopback or private addresses via MinerU Cloud.
- Decompression stops immediately if size limits are exceeded.
- IPv4-compatible IPv6 addresses are now classified by their embedded IPv4.
- JSON responses and decompressed entries are size-bounded.
- MinerU Cloud URLs are now fetched through strict provider transport.
Bug Fixes
- Fixes Server-Side Request Forgery (SSRF) vulnerability in MinerU Cloud parsing (GHSA-cpjc-vgjh-c5jp).
Upgrade Notes
Ensure MinerU Cloud upload and result URLs use HTTPS. Self-hosted setups are unaffected by the new address policies. Address-policy refusals are not retried.
The Two Releases
v1.10.0
v1.10.0
Sep 26, 2026· 26 days ago
Enhances real-time performance with progressive dashboard loading, implements idempotency keys, and introduces Realtime Protocol v2.
Full release notesv1.1.1
OpenMAIC v1.1.1 — Security
Sep 26, 2026· 26 days ago
A security release addressing a Server-Side Request Forgery (SSRF) vulnerability in MinerU Cloud parsing.
Full release notes