OpenMAIC v1.0.1 — Security and stability

A security and stability release. If you run OpenMAIC 1.0.0, upgrade — and read the two configuration notes below before you do, because this release tightens two defaults.

Security

Four advisories are published with this release. Thank you to the reporters, who found and disclosed all four privately.

• Classroom persistence accepted a stage id that escaped the classrooms directory on write. The read path already validated it; the write path did not. GHSA-p2wh-m28m-c5xw — reported by @skeletonsec
• Stored slide HTML was rendered without sanitization. Content is now restricted to the formatting vocabulary the renderer produces, sanitized once at the persistence boundary rather than at each render sink. KaTeX snapshots keep their own policy, so formulas are unaffected. GHSA-7rhf-2798-mvcj — reported by @skeletonsec
• The outbound URL guard ran only in production builds. It now runs everywhere, and a repository-scanning test fails if a gated call site reappears. GHSA-9m7h-vh2h-rc3w — reported by @uziii2208
• Redirects on provider requests were followed without re-validation. Every hop is now re-checked, and credential headers are dropped on a cross-origin hop. GHSA-725p-44hx-v52c — reported by @skeletonsec

Also in this release: dependency bumps for disclosed advisories, bounded skill-zip inflation, a bounded import_pptx parse, and a development persistence authenticator that now refuses to serve under NODE_ENV=production.

Before you upgrade

• Node 22.19 or newer is now required (was 20.9).
• Pointing at a local model server? A client-supplied provider base URL on a loopback or private address — a local Ollama or Lemonade endpoint entered in Settings — is now rejected outside production builds too. Set ALLOW_LOCAL_NETWORKS=true to keep using it. Production deployments already behaved this way; development builds did not.
• Running the development persistence authenticator in production? It now fails closed. Set PERSISTENCE_ALLOW_INSECURE_DEV_AUTH=true if your deployment is on a trusted network, and plan to replace it — it provides no user isolation.
• Calling POST /api/classroom directly? It now rejects scenes that do not satisfy the slide DSL, and stage ids outside [A-Za-z0-9_-].

Also in 1.0.1

A fact-check skill, asynchronous generate_video, interactive-widget hints for generate_scene, PPT element references in Pro chat, an Exa web-search provider, a POST /preview endpoint and machine-readable admission state on the render service, double-click text insertion on the canvas, and deepseek-v4-flash-vision-exp in the DeepSeek catalog — plus faster classroom loading and around two dozen fixes across the agent runtime, generation, providers, media, and the importer.

See the full CHANGELOG for 1.0.1.