v1.0.3

A security release. Three advisories are published with this release, and Next.js is upgraded to patch a critical remote code execution. It also carries the fixes and features merged since 1.0.2.

## Security

- **Access-code tokens never expired, and verification was not throttled.** Verification tokens (`timestamp.HMAC`) were accepted regardless of age because neither verifier checked the timestamp, and `POST /api/access-code/verify` had no attempt throttling. Both verifiers now enforce a 7-day server-side lifetime and reject non-canonical signatures, and verification is rate-limited per client when `TRUST_PROXY_HEADERS=true`; without a trusted proxy the app cannot attribute requests to a client, so a long random `ACCESS_CODE` is the protection and a warning is logged when it is short. [GHSA-qpmr-534w-hhpg](https://github.com/THU-MAIC/OpenMAIC/security/advisories/GHSA-qpmr-534w-hhpg) — reported by @CaptBoykin (#1513)
- **The render service ran untrusted HTML in headless Chromium without a network policy.** On the `/preview` and `/render` paths the packager's Content-Security-Policy was not applied, so inline script could reach loopback and internal addresses, and on `/render` the response was painted into the returned MP4. Both paths now inject a first-parsed CSP, the preview frame is additionally guarded by request interception, and framed same-origin `.svg`/`.xhtml` documents are sanitized. In the shipped image the container's egress lockdown already limited the reachable surface to loopback; deployments that disable it or run the service unisolated were exposed. [GHSA-vqq3-22q7-289w](https://github.com/THU-MAIC/OpenMAIC/security/advisories/GHSA-vqq3-22q7-289w) — reported by @CaptBoykin (#1512)
- **Audio provider requests followed redirects and re-resolved DNS unvalidated.** TTS, ASR, voice registration and voice cloning validated a client-supplied base URL once and then issued a plain fetch, so a redirect or a DNS-rebinding answer could reach an internal address. These requests now validate every redirect hop and connect only to the addresses the guard validated, on every hop; a client base URL can never reach a private, loopback or cloud-metadata address, even with `ALLOW_LOCAL_NETWORKS` set. [GHSA-9p8q-rcmg-pmjw](https://github.com/THU-MAIC/OpenMAIC/security/advisories/GHSA-9p8q-rcmg-pmjw) — reported by @CaptBoykin (#1514)
- **Next.js upgraded to patch a critical RCE.** Bumped from 16.2.11 to 16.3.3, which patches an unauthenticated remote code execution on Windows-hosted servers ([GHSA-p293-qw3h-jr36](https://github.com/vercel/next.js/security/advisories/GHSA-p293-qw3h-jr36) / CVE-2026-75604). (#1503)

## Features

- Storage: the server owns the asset entry lifecycle and releases assets on course deletion. (#1472, #1473)
- Skills: add an inquiry-based exercise-class teaching skill grounded in the zone of proximal development. (#1382)

## Bug Fixes

- Importer: resolve embedded PPTX videos when the legacy link points at NULL, and upload video posters through the configured callback (`@openmaic/importer` 0.2.1). (#1507)
- Storage: keep jsonb writes valid when model output contains NUL or lone surrogates (#1499); allow one owner material to be bound to multiple sessions (#1500).
- Classroom: render a transient server error as a retryable state instead of the terminal "course does not exist" card, on both the pane and the standalone route. (#1485)
- Upload: resolve the generic Office MIME (`application/vnd.ms-office`) via the filename extension. (#1498)
- Settings: maintain the ASR language state invariant on provider selection. (#1443)
- TTS: treat a custom provider's Add-dialog default base URL as a configured credential path so generation narration is not skipped. (#1482)
- Export: tolerate malformed authored CSS in classroom exports instead of dropping later assets. (#1422)
- Render service: preserve plan audio during chunk assembly. (#1358)
- Docker: enable the Pro workbench flag in Docker builds and allow a non-TLS localhost cookie. (#1484)

## Other Changes

- Docs: document the deployment assumptions and pre-report checks in the security policy. (#1511)
- Tests: isolate the image URL-guard test environment so it no longer inherits the generic OpenAI fallback. (#1476)

**Full Changelog**: https://github.com/THU-MAIC/OpenMAIC/blob/main/CHANGELOG.md