v1.812.0 v1.0.3
juanfont/headscaleSep 15, 2026 → Sep 15, 20260 days between releases
What's New
Security release patches critical RCE and enforces access code lifetime limits
Breaking Changes
- Access-code tokens are now rejected if they exceed a 7-day server-side lifetime.
- Verification tokens are rate-limited per client when using a trusted proxy.
New Features
- Server-side asset lifecycle management and cleanup.
- New inquiry-based exercise-class teaching skill.
- Improved handling of model output containing NUL or lone surrogates.
Improvements
- Next.js upgraded to patch a critical remote code execution vulnerability.
- Untrusted HTML is now sanitized with injected Content-Security-Policy on render paths.
- Audio provider requests validate every redirect hop to prevent DNS rebinding attacks.
- Access-code tokens now enforce a 7-day server-side lifetime and are rate-limited.
Upgrade Notes
Access codes with a lifetime exceeding 7 days will be rejected; ensure they are regenerated. When using a trusted proxy, verification tokens are now rate-limited per client.
The Two Releases
v1.812.0
Sep 15, 2026· 1 month ago
This release enhances HTTP trigger flexibility with per-route CORS allowlists and introduces significant AI chat capabilities like session artifact sharing and dynamic toolsets.
Full release notesOpenMAIC v1.0.3 — Security
Sep 15, 2026· 1 month ago
This is a security release addressing critical vulnerabilities in access code verification, untrusted HTML rendering, and audio provider requests, alongside a Next.js upgrade and storage lifecycle improvements.
Full release notes