v1.0.1

A security and stability release. If you run OpenMAIC 1.0.0, upgrade — and read the two configuration notes below before you do, because this release tightens two defaults.

## Security

Four advisories are published with this release. Thank you to the reporters, who found and disclosed all four privately.

- **Classroom persistence accepted a stage id that escaped the classrooms directory on write.** The read path already validated it; the write path did not. [GHSA-p2wh-m28m-c5xw](https://github.com/THU-MAIC/OpenMAIC/security/advisories/GHSA-p2wh-m28m-c5xw) — reported by [@skeletonsec](https://github.com/skeletonsec)
- **Stored slide HTML was rendered without sanitization.** Content is now restricted to the formatting vocabulary the renderer produces, sanitized once at the persistence boundary rather than at each render sink. KaTeX snapshots keep their own policy, so formulas are unaffected. [GHSA-7rhf-2798-mvcj](https://github.com/THU-MAIC/OpenMAIC/security/advisories/GHSA-7rhf-2798-mvcj) — reported by [@skeletonsec](https://github.com/skeletonsec)
- **The outbound URL guard ran only in production builds.** It now runs everywhere, and a repository-scanning test fails if a gated call site reappears. [GHSA-9m7h-vh2h-rc3w](https://github.com/THU-MAIC/OpenMAIC/security/advisories/GHSA-9m7h-vh2h-rc3w) — reported by [@uziii2208](https://github.com/uziii2208)
- **Redirects on provider requests were followed without re-validation.** Every hop is now re-checked, and credential headers are dropped on a cross-origin hop. [GHSA-725p-44hx-v52c](https://github.com/THU-MAIC/OpenMAIC/security/advisories/GHSA-725p-44hx-v52c) — reported by [@skeletonsec](https://github.com/skeletonsec)

Also in this release: dependency bumps for disclosed advisories, bounded skill-zip inflation, a bounded `import_pptx` parse, and a development persistence authenticator that now refuses to serve under `NODE_ENV=production`.

## Before you upgrade

- **Node 22.19 or newer is now required** (was 20.9).
- **Pointing at a local model server?** A client-supplied provider base URL on a loopback or private address — a local Ollama or Lemonade endpoint entered in Settings — is now rejected outside production builds too. Set `ALLOW_LOCAL_NETWORKS=true` to keep using it. Production deployments already behaved this way; development builds did not.
- **Running the development persistence authenticator in production?** It now fails closed. Set `PERSISTENCE_ALLOW_INSECURE_DEV_AUTH=true` if your deployment is on a trusted network, and plan to replace it — it provides no user isolation.
- **Calling `POST /api/classroom` directly?** It now rejects scenes that do not satisfy the slide DSL, and stage ids outside `[A-Za-z0-9_-]`.

## Also in 1.0.1

A fact-check skill, asynchronous `generate_video`, interactive-widget hints for `generate_scene`, PPT element references in Pro chat, an Exa web-search provider, a `POST /preview` endpoint and machine-readable admission state on the render service, double-click text insertion on the canvas, and `deepseek-v4-flash-vision-exp` in the DeepSeek catalog — plus faster classroom loading and around two dozen fixes across the agent runtime, generation, providers, media, and the importer.

See the full [CHANGELOG for 1.0.1](https://github.com/THU-MAIC/OpenMAIC/blob/main/CHANGELOG.md#101---2026-09-06).