rea-agents-6.4.0 v1.1.4
umputun/ralphexOct 11, 2026 → Oct 11, 20260 days between releases
What's New
Security release fixes model authorization and render job binding
Breaking Changes
- Providers using server credentials must explicitly configure `*_MODELS` or YAML `models` lists
- Migration is required: list selectable model IDs, restart the server, and update saved selections
- Unlisted models will not reach providers using server credentials
Improvements
- Render jobs are bound to the requesting owner to prevent unauthorized access
- Legacy classroom media URLs are revoked when associated courses are deleted
- Media responses use private caching with revalidation
Bug Fixes
- Fixed high-severity vulnerability where server-managed providers were not authorizing selected models
- Fixed medium-severity vulnerability where MP4 render jobs were not bound to the requesting owner
- Fixed low-severity vulnerability where deleted courses did not revoke legacy classroom media URLs
Upgrade Notes
Upgrade the render-service together with or before the main application. Providers using server credentials must explicitly configure `*_MODELS` or YAML `models` lists, and a migration is required to list selectable model IDs, restart the server, and update saved selections.
The Two Releases
rea-agents: v6.4.0
Oct 11, 2026· 11 days ago
Adds Android device inspection via ADB, JEB decompiler integration, and enhances Ghidra support for Windows PE and MIPS binaries.
Full release notesOpenMAIC v1.1.4 — Security
Oct 11, 2026· 11 days ago
A security release addressing three advisories regarding model authorization, render job ownership, and revoked course media. It introduces a breaking change in how server-managed providers handle model authorization and requires upgrading the render-service.
Full release notes