v2.2.4 v1.0.2
nilbuild/developer-roadmapSep 7, 2026 → Sep 13, 20266 days between releases
What's New
Upgrading from ScrapeGraphAI v2.2.4 to OpenMAIC v1.0.2 introduces security fixes and GLM-5.3 support.
Breaking Changes
- POST /api/classroom no longer honors a client-supplied stage.id
- Outbound URL guard now blocks CGNAT addresses by default
New Features
- Added support for GLM-5.3 and GLM-5.3-Flash models
- Added JSON lifecycle events for render and preview transitions
- Enabled GenUI and Interactive component referencing in playback
- Implemented generated media writing through the asset pool
Improvements
- Added strict validation to POST /api/generate/tts to reject non-audio responses
- Added Gemini 2.5 token limits to prevent truncation
Bug Fixes
- Fixed Cloud instance-metadata address bypassing the outbound URL guard
- Fixed DNS rebinding bypass on /api/proxy-media
- Fixed unauthorized overwrite of classrooms via POST /api/classroom
- Fixed telemetry settings reading from config instead of environment
Upgrade Notes
This release represents a major shift from the ScrapeGraphAI repository to the OpenMAIC repository. You must update your configuration to handle the new CGNAT blocking policy and the change in how classroom IDs are handled. Migrate any GLM model references to the new GLM-5.3 models.
The Two Releases
v2.2.4
Sep 7, 2026· 1 month ago
This release fixes a critical bug where telemetry settings were read from the config file instead of the environment. It adds support for Gemini 2.5 token limits and improves error handling to surface HTTP errors and missing content instead of returning NA.
Full release notesOpenMAIC v1.0.2 — Security
Sep 13, 2026· 1 month ago
This is a security release addressing three advisories, including metadata address bypass, DNS rebinding, and classroom overwrite vulnerabilities. It also introduces strict response validation for TTS generation.
Full release notes