v1.20.0 v1.0.3
UNITRONIX/BetterDeskSep 15, 2026 → Sep 15, 20260 days between releases
What's New
Major security updates and Next.js upgrade address critical vulnerabilities
Breaking Changes
- Access-code tokens now enforce a 7-day server-side lifetime, breaking clients relying on long-lived tokens
New Features
- Server-owned asset lifecycle management deletes assets on course deletion
Improvements
- Access-code verification is now rate-limited and tokens are rejected if non-canonical
- Untrusted HTML rendering is now guarded by Content-Security-Policy injection
Bug Fixes
- Fixed access-code token expiration and verification throttling
- Fixed audio provider requests following redirects without validation
Upgrade Notes
Access-code tokens expire after 7 days; update client logic to handle expiration. The server now manages asset lifecycle, so clients should stop managing assets manually.
The Two Releases
1.20.0 — Display coordinates and extraction fixes
Sep 15, 2026· 1 month ago
Adds display coordinates and extraction fixes, including an upgrade to `lopdf`.
Full release notesOpenMAIC v1.0.3 — Security
Sep 15, 2026· 1 month ago
A security release addressing four critical vulnerabilities including access code token expiration, untrusted HTML rendering, and audio provider request redirects. It also upgrades Next.js to patch a remote code execution vulnerability and introduces server-owned asset lifecycle management.
Full release notes