v1.11.0 v1.0.2
azophy/sshifuSep 10, 2026 → Sep 13, 20263 days between releases
What's New
Security update blocks metadata/DNS attacks and modifies classroom creation logic.
Breaking Changes
- POST /api/classroom no longer honors client-supplied stage.id; read ID from response body
- CGNAT addresses are now blocked by default, requiring ALLOW_LOCAL_NETWORKS=true
New Features
- Support for GLM-5.3 and GLM-5.3-Flash models
- GenUI and Interactive component referencing in playback
- Render queue preflight before export compilation
- Generated media written through the asset pool under server-backed persistence
Improvements
- Cloud instance-metadata addresses are now blocked by the outbound URL guard
- DNS rebinding bypass on /api/proxy-media is fixed by validating addresses at connection time
- Server-generated IDs are used for classrooms instead of client-supplied ones
- TTS generation now validates response content types and does not follow URL redirects
Bug Fixes
- Cloud instance-metadata addresses bypassed the outbound URL guard
- DNS rebinding bypassed the SSRF guard on /api/proxy-media
Upgrade Notes
Update POST /api/classroom to extract the stage.id from the response body. If you need local network access, set ALLOW_LOCAL_NETWORKS=true as CGNAT is now blocked by default.
The Two Releases
v1.11.0
Sep 10, 2026· 1 month ago
This release adds support for MCP Apps and Resources, along with a version check on startup. It also improves database connectors by providing better error messages and resource management.
Full release notesOpenMAIC v1.0.2 — Security
Sep 13, 2026· 1 month ago
A security update that fixes three advisories by blocking cloud metadata addresses and DNS rebinding, while changing how classrooms are created. The update modifies request handling for media proxying and TTS generation to prevent unauthorized access.
Full release notes