v1.20.0 v1.0.3
qdm12/dnsSep 15, 2026 → Sep 15, 20260 days between releases
What's New
Major version jump with security patches and completely different application scope
Breaking Changes
- Application architecture changed from PDF rendering tool to Next.js web app
- Next.js upgraded to 16.3.3, requiring potential environment or build changes
- Access-code token verification logic changed to enforce 7-day lifetime and rate limiting
New Features
- Server-owned asset entry lifecycle and cleanup on course deletion
- Inquiry-based exercise-class teaching skill grounded in the zone of proximal development
Improvements
- Render service now injects CSP and guards against untrusted HTML execution
- Audio provider requests block DNS rebinding and validate every redirect hop
Bug Fixes
- Patches critical vulnerabilities including Next.js RCE, access-code token expiration, and render service CSP issues
Upgrade Notes
Configuration for access-code tokens now requires `TRUST_PROXY_HEADERS=true` for rate limiting. The application architecture has changed significantly, so existing configurations are likely incompatible.
The Two Releases
1.20.0 — Display coordinates and extraction fixes
Sep 15, 2026· 1 month ago
This release focuses on enhancing PDF rendering accuracy by adding display-frame coordinates to the Rust and Node APIs and fixing various extraction issues related to text positioning and font decoding.
Full release notesOpenMAIC v1.0.3 — Security
Sep 15, 2026· 1 month ago
A security release published September 15, 2026, that patches critical vulnerabilities including a Next.js RCE, access-code token expiration, and render service CSP issues.
Full release notes