v1.0.2

A security release. Three advisories are published with this release, and two request paths behave differently — read the notes below before you upgrade.

## Security

Three advisories are published with this release. Thank you to the reporters, who found and disclosed them privately.

- **Cloud instance-metadata addresses bypassed the outbound URL guard.** The metadata denylist was not applied before an IP literal was accepted, so an Alibaba Cloud metadata address (`100.100.100.200`) could be reached through `/api/proxy-media` and the URL guard. Metadata hostnames and addresses — including mapped and transition encodings — are now checked before the literal and local-network branches, in every environment and regardless of `ALLOW_LOCAL_NETWORKS`. [GHSA-6xff-rgjg-v33f](https://github.com/THU-MAIC/OpenMAIC/security/advisories/GHSA-6xff-rgjg-v33f) — reported by [@lihua666a-cell](https://github.com/lihua666a-cell)
- **DNS rebinding bypassed the SSRF guard on `/api/proxy-media`.** The route validated a hostname and then let `fetch()` resolve it again at connect time, so a name whose answer changed between the two lookups could steer the socket to an internal address. The proxy now connects only to the addresses the guard validated, on every redirect hop, through a shared pinned dispatcher. [GHSA-23xq-m3mm-3j49](https://github.com/THU-MAIC/OpenMAIC/security/advisories/GHSA-23xq-m3mm-3j49) — reported by [@ry2811](https://github.com/ry2811)
- **`POST /api/classroom` let any caller overwrite an existing classroom.** A caller-chosen id was accepted and renamed over an existing classroom file. Ids are now server-generated and classroom files are created exclusively, with a bounded retry and a 409 on collision. [GHSA-87m4-6c66-pc68](https://github.com/THU-MAIC/OpenMAIC/security/advisories/GHSA-87m4-6c66-pc68) — reported by [@ry2811](https://github.com/ry2811)

Also in this release: `POST /api/generate/tts` now inspects a 200 response before storing or billing it, rejecting HTML, JSON and other non-audio bodies and never following a URL embedded in a JSON envelope.

## Before you upgrade

- **Calling `POST /api/classroom` directly?** It no longer honours a client-supplied `stage.id`. Read the classroom's `id` from the response.
- **Reaching a model server or media over a Tailscale-style overlay (`100.64.0.0/10`)?** The outbound URL guard now blocks CGNAT addresses by default, like private ranges; set `ALLOW_LOCAL_NETWORKS=true` to allow them. IANA reserved, documentation, multicast and broadcast ranges (`240.0.0.0/4`, `198.18.0.0/15`, `192.0.2.0/24`, `2001:db8::/32`, …) are refused regardless of the flag, at both the URL and the connection layer.

## Also in 1.0.2

GenUI and Interactive component referencing in playback, render queue preflight before an export compiles, generated media written through the asset pool under server-backed persistence, GLM-5.3 and GLM-5.3-Flash, and one JSON lifecycle event per render and preview transition on the render service — plus fixes for 300-second LLM timeouts, MTEF v3 formula conversion, portable ZIP retries, quiz answer-key resolution, sharp in standalone builds, and Windows material uploads.

See the full [CHANGELOG for 1.0.2](https://github.com/THU-MAIC/OpenMAIC/blob/main/CHANGELOG.md#102---2026-09-14).