v1.812.0 v1.0.3
tashfeenahmed/freellmapiSep 15, 2026 → Sep 15, 20260 days between releases
What's New
Critical security patch for Next.js RCE and access-code token expiration enforcement.
Breaking Changes
- Access-code tokens now enforce a 7-day server-side lifetime and are rate-limited.
- HTML rendering in headless Chromium now uses strict Content-Security-Policy.
- Audio provider requests validate every redirect hop to prevent SSRF attacks.
New Features
- Server-managed asset lifecycle with automatic release on course deletion.
- Inquiry-based exercise-class teaching skill grounded in the zone of proximal development.
Improvements
- Next.js upgraded from 16.2.11 to 16.3.3 to patch a critical remote code execution vulnerability.
- Access-code token verification is now rate-limited per client.
- Framed same-origin SVG and XHTML documents are sanitized during rendering.
Bug Fixes
- Fixed critical remote code execution vulnerability in Next.js.
- Fixed untrusted HTML rendering without network policy in headless Chromium.
- Fixed access-code tokens that never expired and verification that was not throttled.
Upgrade Notes
Applications relying on access-code tokens will need to handle the new 7-day expiration window. Review HTML rendering configurations if custom scripts were previously allowed in previews. Ensure audio provider requests are not blocked by the new redirect hop validation.
The Two Releases
v1.812.0
Sep 15, 2026· 1 month ago
Introduces per-route CORS controls, dynamic AI toolsets, and enhancements to Git sync and session artifact sharing.
Full release notesOpenMAIC v1.0.3 — Security
Sep 15, 2026· 1 month ago
A critical security release upgrading Next.js to patch a Remote Code Execution vulnerability and addressing three security advisories regarding access-code tokens, HTML rendering, and audio provider requests. It also introduces server-side asset lifecycle management and a new inquiry-based teaching skill.
Full release notes