v0.76.1 v1.0.2
cheaper-inference/OmniRouteSep 12, 2026 → Sep 13, 20261 day between releases
What's New
Major version upgrade introduces security fixes and API changes, blocking CGNAT and altering classroom endpoint behavior
Breaking Changes
- `POST /api/classroom` no longer honors client-supplied `stage.id`
- Outbound URL guard now blocks CGNAT addresses by default
New Features
- GenUI and Interactive component referencing
- Render queue preflight before export
- Generated media written via asset pool
- GLM-5.3 and GLM-5.3-Flash support
- JSON lifecycle events on render service
Improvements
- Cloud instance-metadata addresses bypassed the outbound URL guard
- DNS rebinding bypassed the SSRF guard
- `POST /api/classroom` allowed arbitrary overwrites
- Metadata hostnames checked before literals
- Proxy uses shared pinned dispatcher
Bug Fixes
- Validating TTS, ASR, and voice cloning redirects
Upgrade Notes
This is a security release with breaking changes to the `/api/classroom` endpoint and the outbound URL guard. The `/api/classroom` endpoint no longer honors client-supplied `stage.id`, and the URL guard now blocks CGNAT addresses by default. Ensure your clients are updated to handle these changes, particularly regarding metadata access and classroom configuration.
The Two Releases
v0.76.1
Sep 12, 2026· 1 month ago
This release focuses on diagnostics, debugging capabilities, and stability improvements. It adds visibility into GPU memory advertising and connection paths, while fixing various issues related to tool definitions, CUDA support, and device matching.
Full release notesOpenMAIC v1.0.2 — Security
Sep 13, 2026· 1 month ago
Security release addressing SSRF vulnerabilities, preventing unauthorized classroom overwriting, and fixing TTS/ASR redirect handling.
Full release notes