v1.16.22 v1.1.2
high risk
nilbuild/developer-roadmapSep 28, 2026 → Sep 28, 20260 days between releases
What's New
Security release hardens SSRF protections and introduces strict provider transport.
Breaking Changes
- Caller-supplied URLs that redirect are refused instead of followed.
- Caller-supplied provider base URLs containing query strings or fragments are refused.
- Loopback or private addresses require ALLOW_LOCAL_NETWORKS to be used.
- Client-supplied AliDocMind endpoints must be official hosts.
New Features
- Strict provider transport pins connections to validated addresses and refuses redirects.
- Agent-runtime image and video tools now use strict provider transport.
Improvements
- Provider check and generation errors now return fixed messages without provider details.
- Agent-runtime image and video tools now use strict provider transport.
Bug Fixes
- Security fix for SSRF vulnerabilities via client-supplied provider URLs.
Upgrade Notes
Read Behavior Changes before upgrading. If using loopback or private addresses, set the ALLOW_LOCAL_NETWORKS environment variable.
The Two Releases
v1.16.22
v1.16.22
Sep 28, 2026· 24 days ago
Updates web server host validation and introduces strict approval requirements for repository worktree hooks to prevent unauthorized script execution.
Full release notesv1.1.2
OpenMAIC v1.1.2 — Security
Sep 28, 2026· 24 days ago
Security release hardening SSRF protections by restricting provider connections to validated addresses and refusing redirects.
Full release notes