v0.76.1 v1.0.2
thevoiceguy/siphon-aiSep 12, 2026 → Sep 13, 20261 day between releases
What's New
Major security release blocking CGNAT and fixing critical server-side vulnerabilities
Breaking Changes
- POST /api/classroom no longer honors client-supplied stage.id (server generates it)
- CGNAT addresses are blocked by default
- TTS generation inspects HTTP 200 responses before billing or storing
New Features
- Support for GLM-5.3 and GLM-5.3-Flash models
- Generated media written through the asset pool under server-backed persistence
- GenUI and Interactive component referencing in playback
- Render queue preflight before export compilation
Improvements
- Blocked cloud instance-metadata addresses from bypassing the outbound URL guard
- Fixed DNS rebinding attacks on the /api/proxy-media route
- Prevented unauthorized overwriting of existing classrooms via POST /api/classroom
- Added validation for TTS responses to reject non-audio content
Upgrade Notes
The server now generates the stage.id for classroom creation instead of accepting client input. CGNAT addresses are blocked by default, requiring ALLOW_LOCAL_NETWORKS=true if needed. TTS generation now validates HTTP 200 responses before billing or storing media.
The Two Releases
v0.76.1
Sep 12, 2026· 1 month ago
This release focuses on bug fixes and diagnostics, specifically improving GPU memory reporting, network connectivity, and cross-platform runtime compatibility across Apple and Linux environments.
Full release notesOpenMAIC v1.0.2 — Security
Sep 13, 2026· 1 month ago
A security release that patches vulnerabilities regarding cloud metadata access, DNS rebinding, and unauthorized classroom overwrites, while also blocking CGNAT addresses by default.
Full release notes