v0.10.0 v1.0.3
sundowndev/phoneinfogaSep 15, 2026 → Sep 15, 20260 days between releases
What's New
Critical security release patches a Next.js RCE vulnerability and enforces token expiration.
Breaking Changes
- Access-code tokens previously never expired and are now limited to 7 days.
- Verification tokens are now rate-limited per client.
New Features
- Server-owned asset lifecycle and release on course deletion.
- Inquiry-based exercise-class teaching skill added to skills.
- Fixed importer to resolve embedded PPTX videos.
- Fixed classroom rendering to show transient server errors as retryable states.
Improvements
- Render service now applies Content-Security-Policy and sanitizes HTML.
- Audio provider requests validate redirects and DNS to prevent SSRF attacks.
- Next.js upgraded to 16.3.3 to patch a critical remote code execution vulnerability.
Bug Fixes
- Fixed importer to resolve embedded PPTX videos.
- Fixed classroom rendering to show transient server errors as retryable states.
Upgrade Notes
Access-code tokens now expire after 7 days; configure `TRUST_PROXY_HEADERS` if relying on client rate limiting. Next.js has been upgraded to 16.3.3.
The Two Releases
v0.10.0
Sep 15, 2026· 1 month ago
This release introduces a unified provider dashboard, monthly key budgets, and improved quota forecasting. It also includes fixes for suspended accounts and better handling of provider-reported request sizes to skip models with insufficient context windows.
Full release notesOpenMAIC v1.0.3 — Security
Sep 15, 2026· 1 month ago
A critical security release addressing four advisories, including a remote code execution vulnerability in Next.js. It introduces token expiration, rate limiting, and sanitization improvements for the render service.
Full release notes