v1.0.150 v1.0.3
cheaper-inference/OmniRouteSep 14, 2026 → Sep 15, 20261 day between releases
What's New
Security release patches critical Next.js RCE and hardens access token handling
Breaking Changes
- Access-code tokens now expire after 7 days (previously never expired).
- Token verification is now rate-limited per client.
- Content-Security-Policy now restricts untrusted HTML rendering.
New Features
- Server asset lifecycle management.
- Inquiry-based exercise-class teaching skill.
Improvements
- Upgraded Next.js to 16.3.3 to patch critical remote code execution.
- Fixed DNS rebinding and metadata address bypasses in media proxy.
- Injected Content-Security-Policy for untrusted HTML rendering.
Bug Fixes
- Fixed untrusted HTML rendering in headless Chromium.
- Fixed DNS rebinding and metadata address bypasses in media proxy.
Upgrade Notes
Access tokens will expire after 7 days, requiring client-side logic updates to handle re-authentication. Verify that inline scripts or specific HTML structures are compatible with the new Content-Security-Policy. Ensure rate limiting configurations align with your infrastructure.
The Two Releases
v1.0.150
Sep 14, 2026· 1 month ago
This release addresses a scaling issue in PowerPoint exports where speaker notes were not correctly sized relative to the slides, ensuring better visual alignment.
Full release notesOpenMAIC v1.0.3 — Security
Sep 15, 2026· 1 month ago
Security release patching critical vulnerabilities including a Next.js Remote Code Execution (RCE) and fixing access token and HTML rendering issues.
Full release notes