v0.6.2 v1.1.3
MinishLab/sembleOct 5, 2026 → Oct 5, 20260 days between releases
What's New
Major version jump introduces HTML sanitization for `/api/persistence` to fix XSS vulnerability.
Breaking Changes
- Slide HTML via `/api/persistence` is reduced to the renderer's formatting vocabulary (scripts, event handlers, and javascript: URLs are removed).
- Inline styles are re-serialized without spaces (e.g., `text-align:center`).
New Features
- Sanitization of course documents to prevent script injection.
- Restriction of formatting vocabulary to renderer's safe set.
Improvements
- Security update to sanitize HTML in `/api/persistence` endpoint.
- Applied same sanitization policy as `/api/classroom` to the owner-bound document store.
Upgrade Notes
Existing documents stored in the database are sanitized upon retrieval. Users relying on scripts or custom inline styles in `/api/persistence` will see content stripped or reformatted.
The Two Releases
v0.6.2
Oct 5, 2026· 17 days ago
This release focuses on stability improvements and maintenance for the Semble project. Key updates include fixes for cache validation and server shutdown handling, as well as a security update to pin release workflow actions.
Full release notesOpenMAIC v1.1.3 — Security
Oct 5, 2026· 17 days ago
This security release addresses a critical vulnerability in the persistence API by sanitizing slide HTML to prevent script execution in the browser when users access course documents.
Full release notes