v1.812.0 v1.0.3
codewhale-hq/CodewhaleSep 15, 2026 → Sep 15, 20260 days between releases
What's New
Security patches and asset management added in v1.0.3, diverging from v1.812.0's AI and CLI features
Breaking Changes
- Access-code tokens now enforce a strict 7-day server-side lifetime and rate limiting, breaking existing long-lived tokens.
New Features
- Server-side asset lifecycle management releasing assets on course deletion
- Inquiry-based exercise-class teaching skills
Improvements
- Upgraded Next.js to 16.3.3 to patch a critical unauthenticated remote code execution vulnerability
- Enhanced Content Security Policy (CSP) enforcement on untrusted HTML execution
- Audio provider requests now validate DNS resolution to prevent DNS rebinding attacks
Upgrade Notes
Access-code tokens now expire after 7 days server-side; update authentication logic to handle expiration. The render service now applies stricter CSP policies that may block inline scripts in previews.
The Two Releases
v1.812.0
Sep 15, 2026· 1 month ago
This release introduces per-route CORS allowlists, enhances AI session sharing capabilities, and improves the CLI with trash management features. It also adds support for dynamic AI agent toolsets and pre-approved cloud accounts.
Full release notesOpenMAIC v1.0.3 — Security
Sep 15, 2026· 1 month ago
This is a security-focused release that patches critical vulnerabilities including a remote code execution flaw in Next.js. It introduces stricter token expiration policies, enhanced Content Security Policy (CSP) enforcement, and protection against DNS rebinding attacks. Beyond security, it adds features for asset lifecycle management and inquiry-based teaching skills while resolving various bugs in the classroom and storage systems.
Full release notes