v1.25.2 v1.1.2
thevoiceguy/siphon-aiSep 28, 2026 → Sep 28, 20260 days between releases
What's New
Switches from PDF text sizing logic to strict SSRF security validation
Breaking Changes
- Caller-supplied URLs that redirect are refused
- Caller-supplied URLs containing query strings or fragments are refused
- Loopback/private addresses require ALLOW_LOCAL_NETWORKS
New Features
- Strict provider transport implementation prevents SSRF
- Size-bounded streaming for classroom media downloads
Improvements
- Error responses no longer carry provider response bodies or connection details
Bug Fixes
- Classroom media generation downloads are now strictly validated for HTTPS and size-bounded
- Provider check errors return fixed messages without response text
Upgrade Notes
Configure `ALLOW_LOCAL_NETWORKS` for private addresses and ensure all caller-supplied URLs are static and non-redirecting, as these are now strictly rejected.
The Two Releases
1.25.2 — Script sizes and ToUnicode repair checks
Sep 28, 2026· 24 days ago
This release refines text sizing logic for superscripts and subscripts and improves the repair checks for ToUnicode CMaps in subset fonts.
Full release notesOpenMAIC v1.1.2 — Security
Sep 28, 2026· 24 days ago
A security release addressing Server-Side Request Forgery (SSRF) vulnerabilities by enforcing strict provider transport validation, refusing redirects, and sanitizing error messages to prevent information leakage.
Full release notes