v1.1.1 v1.16.22

Name: developer-roadmap
Author: nilbuild

high risk

nilbuild/developer-roadmapSep 26, 2026 → Sep 28, 20262 days between releases

What's New

Web server validates hostnames and requires approval for worktree hooks.

Breaking Changes

Web UI returns 421 for requests not addressed to configured hosts.
Hooks approved in v1.16.21 and earlier may be re-asked for approval.

New Features

Web server validates hostnames and returns 421 for unconfigured addresses.
Repository worktree hooks require approval based on SHA256 and resolved path.
Token authentication uses HttpOnly, SameSite=Strict cookies.

Improvements

Fixed CLI JSON errors to prevent preallocation issues.
Fixed CI test flakes related to stream goroutines and idle timeouts.

Bug Fixes

Fixed CLI JSON errors to prevent preallocation issues.
Fixed CI test flakes related to stream goroutines and idle timeouts.

Upgrade Notes

If using a reverse proxy or Tailscale Serve, add the host name to the [web] allowed_hosts configuration before upgrading. Approvals recorded in v1.16.21 and earlier are missing metadata and will require re-approval on the next hook run.

The Two Releases

v1.1.1

OpenMAIC v1.1.1 — Security

Sep 26, 2026· 25 days ago

Security release fixing SSRF vulnerabilities in MinerU Cloud parsing by enforcing strict address validation and size limits.

Full release notes

v1.16.22

Sep 28, 2026· 24 days ago

Updates web server host validation and introduces strict approval requirements for repository worktree hooks to prevent unauthorized script execution.

Full release notes