v0.6.2 v1.1.3
high risk
Gentleman-Programming/engramOct 5, 2026 → Oct 5, 20260 days between releases
What's New
Security release fixes Stored XSS vulnerability in course documents via HTML sanitization.
Breaking Changes
- Slide HTML formatting vocabulary reduced: scripts, event-handler attributes, `javascript:` URLs, and inline styles without spaces are removed.
New Features
- HTML sanitization on persistence for course documents
- XSS vulnerability mitigation applied to document read/write operations
Improvements
- Fixes Stored XSS vulnerability (GHSA-6c52-8h4v-5xvg) in `/api/persistence`
- Formerly stored documents are sanitized when next read
- Applied same sanitization policy as `/api/classroom`
Upgrade Notes
Formerly stored documents will be sanitized on the next read. Be aware that inline styles without spaces and certain HTML attributes (scripts, event handlers) are removed.
The Two Releases
v0.6.2
v0.6.2
Oct 5, 2026· 17 days ago
This release focuses on improving workflow stability and fixing critical server and cache behaviors by pinning actions and validating manifest mtimes.
Full release notesv1.1.3
OpenMAIC v1.1.3 — Security
Oct 5, 2026· 17 days ago
Security release that fixes a Stored XSS vulnerability in course documents served via `/api/persistence` by sanitizing slide HTML on every write and read.
Full release notes