v2.0.34 v1.0.2
NVIDIA/NeMo-Speech.cppSep 12, 2026 → Sep 13, 20261 day between releases
What's New
Security-focused release addressing SSRF and metadata bypass vulnerabilities while introducing GLM-5.3 support and breaking changes to URL guards and classroom endpoints.
Breaking Changes
- POST /api/classroom no longer honors client-supplied stage.id (server-generated now).
- Outbound URL guard now blocks CGNAT addresses by default (requires ALLOW_LOCAL_NETWORKS=true).
- POST /api/generate/tts now validates response content before storage or billing.
New Features
- GLM-5.3 and GLM-5.3-Flash support.
- GenUI and Interactive component referencing in playback.
- Render queue preflight before export compilation.
- JSON lifecycle events on render and preview transitions.
Improvements
- Updated /api/proxy-media guard logic to validate addresses at every redirect hop.
- TTS response validation to reject non-audio bodies and embedded URLs.
- Fixes for LLM timeouts, MTEF v3 formula conversion, and portable ZIP retries.
Bug Fixes
- Fix for Cloud metadata address bypassing the outbound URL guard.
- Fix for DNS rebinding bypassing the SSRF guard on /api/proxy-media.
- Fix for POST /api/classroom allowing any caller to overwrite an existing classroom.
Upgrade Notes
Clients relying on client-supplied stage.id for classroom creation must be updated to accept server-generated IDs. If your network uses CGNAT, set ALLOW_LOCAL_NETWORKS=true to prevent blocking outbound requests. Review TTS generation logic as response validation is now stricter.
The Two Releases
OpenMAIC v1.0.2 — Security
Sep 13, 2026· 1 month ago
This is a security-focused release addressing three advisories related to server-side request forgery (SSRF), metadata bypass, and classroom overwrite vulnerabilities, while also tightening URL guards and changing how TTS responses are handled.
Full release notes