tauri-runtime-v3.0.0-alpha.0 v1.0.2
sundowndev/phoneinfogaSep 12, 2026 → Sep 13, 20261 day between releases
What's New
Security fixes for SSRF and metadata bypass, plus ID generation changes in v1.0.2.
Breaking Changes
- Client-supplied stage.id is no longer honored in POST /api/classroom.
- CGNAT addresses are blocked by default, requiring ALLOW_LOCAL_NETWORKS=true.
New Features
- Support for GLM-5.3 and GLM-5.3-Flash models.
- GenUI and Interactive component referencing in playback.
- Render queue preflight before export compilation.
- Generated media written through the asset pool.
- One JSON lifecycle event per render and preview transition.
Improvements
- Cloud instance-metadata addresses are now blocked by the outbound URL guard.
- DNS rebinding SSRF vulnerability on /api/proxy-media is fixed.
- POST /api/generate/tts validates response content type before storing.
Bug Fixes
- Cloud metadata addresses bypassed the outbound URL guard.
- DNS rebinding bypassed the SSRF guard on /api/proxy-media.
- POST /api/classroom no longer allows overwriting via client IDs.
Upgrade Notes
Set ALLOW_LOCAL_NETWORKS=true if you rely on CGNAT addresses. Update POST /api/classroom requests to remove the stage.id parameter. Review SSRF guard configurations to ensure metadata hostnames are handled correctly.
The Two Releases
tauri-runtime v3.0.0-alpha.0
Sep 12, 2026· 1 month ago
The first alpha release of Tauri Runtime v3.0.0 introduces a type-erased runtime architecture, GTK version-agnostic raw pointers, and moves custom scheme URL logic to the runtime.
Full release notesOpenMAIC v1.0.2 — Security
Sep 13, 2026· 1 month ago
A security release preventing SSRF attacks via cloud metadata addresses and DNS rebinding. It also modifies the `POST /api/classroom` endpoint to use server-generated IDs.
Full release notes