v2026.9.28 v1.1.2
Friedrich-M/UniMateSep 28, 2026 → Sep 28, 20260 days between releases
What's New
Security release prevents SSRF by enforcing strict provider transport and URL validation
Breaking Changes
- Caller-supplied base URLs that redirect are now refused
- Caller-supplied base URLs containing query strings or fragments are refused
- Local network access for unmanaged providers now requires the ALLOW_LOCAL_NETWORKS flag
New Features
- Strict provider transport prevents internal address probing
- Classroom media generation downloads are size-bounded and secure
- Agent-runtime video and poster downloads require HTTPS
Improvements
- Provider response bodies and connection details are removed from error messages
- Client-supplied AliDocMind endpoints must be official hosts
- Error messages for better security clarity
Upgrade Notes
Review the 'Known breaking changes' section regarding base URL validation and query strings. If you rely on local network access for unmanaged providers, ensure the ALLOW_LOCAL_NETWORKS flag is set.
The Two Releases
v2026.9.28
Sep 28, 2026· 24 days ago
The release introduces automated PyPI deployments and removes the `adb-shell` dependency. It also includes various bug fixes related to parsing timing, OEM archives, and battery data.
Full release notesOpenMAIC v1.1.2 — Security
Sep 28, 2026· 24 days ago
A security release preventing Server-Side Request Forgery (SSRF) by enforcing strict provider transport for all external connections.
Full release notes