v1.0.2 v1.0.3
azophy/sshifuSep 13, 2026 → Sep 15, 20262 days between releases
What's New
Security updates include token lifetime enforcement and Next.js RCE patch
Breaking Changes
- Access-code tokens now enforce a 7-day server-side lifetime, breaking existing long-lived tokens
New Features
- Storage asset lifecycle management with automatic release
- Inquiry-based exercise-class teaching skill
- Docker builds now enable the Pro workbench flag
Improvements
- Access-code tokens enforce a 7-day server-side lifetime
- Render service applies Content-Security-Policy and sanitizes HTML
- Audio provider requests validate every redirect hop
- Next.js upgraded to version 16.3.3 to patch RCE
- Access-code verification is rate-limited per client
Bug Fixes
- PPTX video resolution bug fixed
- jsonb write validation bug fixed
- Classroom rendering errors fixed
Upgrade Notes
Ensure `ALLOW_LOCAL_NETWORKS=true` if you need local network access. Access-code tokens now expire after 7 days; update your token generation logic if necessary.
The Two Releases
OpenMAIC v1.0.2 — Security
Sep 13, 2026· 1 month ago
A security update that fixes three advisories by blocking cloud metadata addresses and DNS rebinding, while changing how classrooms are created. The update modifies request handling for media proxying and TTS generation to prevent unauthorized access.
Full release notesOpenMAIC v1.0.3 — Security
Sep 15, 2026· 1 month ago
This security release addresses three advisories by upgrading Next.js to patch a critical RCE and enforcing stricter token lifetimes and rate limits. It also introduces new storage asset lifecycle features and an inquiry-based teaching skill, alongside various bug fixes.
Full release notes