v0.1.8 v1.0.2
high risk
openai/openai-realtime-agentsSep 12, 2026 → Sep 13, 20262 days between releases
What's New
Security release blocks metadata access and fixes SSRF bypass
Breaking Changes
- POST /api/classroom no longer honors client-supplied stage.id
- CGNAT addresses (100.64.0.0/10) are now blocked by default
New Features
- GenUI and Interactive component referencing in playback
- Render queue preflight before export compilation
- Generated media persistence via asset pool
- Support for GLM-5.3 and GLM-5.3-Flash
Improvements
- Blocked cloud instance-metadata addresses from bypassing the URL guard
- Fixed DNS rebinding bypass in SSRF guard
- Prevented arbitrary overwrite of classrooms via POST requests
- Inspected TTS responses to reject non-audio bodies
Bug Fixes
- TTS responses now reject non-audio bodies
Upgrade Notes
Review the security advisories before upgrading. Be aware that POST /api/classroom no longer accepts client-supplied stage.id and CGNAT addresses are now blocked by default.
The Two Releases
v0.1.8
v0.1.8
Sep 12, 2026· 1 month ago
Introduces keyword matching options, improved property search functionality, and controls for SAM reply behaviors.
Full release notesv1.0.2
OpenMAIC v1.0.2 — Security
Sep 13, 2026· 1 month ago
A security release blocking cloud metadata addresses, fixing DNS rebinding, and preventing unauthorized classroom overwrites.
Full release notes