v0.0.40 v1.0.2
qdm12/dnsSep 12, 2026 → Sep 13, 20261 day between releases
What's New
Fixes critical security flaws and alters API behavior for classroom management and network access
Breaking Changes
- POST /api/classroom no longer honors client-supplied stage.id
- CGNAT addresses are now blocked by default unless ALLOW_LOCAL_NETWORKS=true
New Features
- Render queue preflight before export compilation
- GLM-5.3 and GLM-5.3-Flash model support
- JSON lifecycle events on render service
- Fixes for 300-second LLM timeouts and MTEF v3 formula conversion
- GenUI and Interactive component referencing in playback
Improvements
- Cloud instance-metadata addresses blocked by outbound URL guard
- DNS rebinding bypass fixed on /api/proxy-media
- POST /api/generate/tts now strictly validates response content types
Bug Fixes
- Fixed unauthorized classroom overwrites
- Fixed 300-second LLM timeouts
- Fixed MTEF v3 formula conversion
Upgrade Notes
Update client code to handle server-generated IDs for POST /api/classroom. If using CGNAT networks like Tailscale, set ALLOW_LOCAL_NETWORKS=true to restore access.
The Two Releases
v0.0.40
Sep 12, 2026· 1 month ago
This release introduces a comprehensive overhaul of artifacts and a new local community desktop application, including features like interactive HTML artifacts, bidirectional repo sync, and a fully functional local environment with model management.
Full release notesOpenMAIC v1.0.2 — Security
Sep 13, 2026· 1 month ago
A security release published September 13, 2026, addressing cloud metadata bypasses, DNS rebinding, and unauthorized classroom overwrites.
Full release notes