v2.2.0 v0.2.14
nexu-io/open-designOct 5, 2026 → Oct 7, 20262 days between releases
What's New
Compares PentAGI 2.2 with sub2api 0.2.14, focusing on security hardening for admin credentials and payment callbacks.
Breaking Changes
- New installations fail if ADMIN_PASSWORD is too short/long or ADMIN_EMAIL is invalid
- Default admin email changes from admin@sub2api.local
- DOCKER_INSIDE defaults to false, host socket is no longer mounted automatically
New Features
- Randomized admin email generation to prevent brute force attacks
- Enforced password strength (8-72 bytes) during installation
- Support for new LLM providers: MiniMax, Mistral, and xAI
Improvements
- Security hardening for CVE-2026-14784 with isolated Docker sockets
- Fixed EasyPay callback forgery vulnerability
- Unified web_search tool with intent-driven fallback chains
Bug Fixes
- Fixed remote Codex model directory API key discovery issue
Upgrade Notes
Existing deployments are unaffected by most changes but should update credentials if using weak passwords or the old default admin email. New installations require strict validation for ADMIN_PASSWORD length and ADMIN_EMAIL format.
The Two Releases
2.2.0
Oct 5, 2026· 17 days ago
A major update supporting modern LLMs from new providers (MiniMax, Mistral, xAI), hardening security against CVE-2026-14784, and introducing multi-instance deployment and a Markdown editor.
Full release notesSub2API 0.2.14
Oct 7, 2026· 15 days ago
Security-focused release addressing default admin credentials and payment callback vulnerabilities in the AI API Gateway.
Full release notes