v1.0.2 v1.0.3
high risk
openai/openai-realtime-agentsSep 13, 2026 → Sep 15, 20262 days between releases
What's New
Critical security release patching Next.js RCE and access token flaws
Breaking Changes
- Next.js upgrade to patch critical Remote Code Execution vulnerability
- POST /api/classroom ignores client-supplied stage.id
New Features
- Storage lifecycle management where server owns asset entries
- Inquiry-based exercise-class teaching skill
Improvements
- Dependency bump: Next.js upgraded to patch RCE
Bug Fixes
- Fixed access-code token expiration and verification throttling
- Fixed untrusted HTML execution in headless Chromium
- Fixed audio provider requests following unvalidated redirects and DNS
- Patched critical Next.js Remote Code Execution (RCE)
Upgrade Notes
Upgrade Next.js to patch a critical RCE vulnerability. Access-code tokens now enforce a 7-day server-side lifetime. HTML rendering paths now include CSP injection.
The Two Releases
v1.0.2
OpenMAIC v1.0.2 — Security
Sep 13, 2026· 1 month ago
A security release blocking cloud metadata addresses, fixing DNS rebinding, and preventing unauthorized classroom overwrites.
Full release notesv1.0.3
OpenMAIC v1.0.3 — Security
Sep 15, 2026· 1 month ago
A critical security release addressing vulnerabilities in access tokens, HTML rendering, and audio provider requests, alongside a Next.js upgrade.
Full release notes