Maestro v0.1.1 — two-command trial
A maintenance release focused on how long it takes to get from finding Maestro to seeing it run, plus a dependency sweep.
Try it in two commands
git clone https://github.com/Yigtwxx/Maestro.git && cd Maestro
docker compose -f docker-compose.quickstart.yml up -dThen open http://localhost:8080. This runs the published images, so nothing compiles locally and there is nothing to configure. Set MAESTRO_PORT if 8080 is taken on your machine — it moves the proxy and the generated links together.
Embedding models are pulled automatically, so RAG and document upload need no key. Chat runs on whichever provider you connect, and Gemini's free tier needs no credit card. For chat locally too:
docker compose -f docker-compose.quickstart.yml exec ollama ollama pull qwen3.5:9b
docker compose -f docker-compose.quickstart.yml restart backendOne thing that would otherwise catch you out: task start is gated on an active plan and the bundled payment gateway is a mock, so a fresh account gets HTTP 402. In a local trial, make your own account unmetered rather than pretending to pay:
docker compose -f docker-compose.quickstart.yml exec backend \
python -m app.scripts.grant_admin --email you@example.comThe quickstart file uses fixed, publicly documented credentials and binds only to 127.0.0.1. It is a trial environment, not a deployment — production still goes through docker-compose.prod.yml and your own .env.prod.
Dependencies
Fifteen advisories against the frontend lockfile are closed — 13 high, 1 moderate, 1 low, from five roots: postcss and sharp under Next, fast-uri via ajv under the Sentry webpack plugin, brace-expansion through the eslint chain, and @eslint/plugin-kit. No direct dependency had shipped a release carrying the fixes, so each is pinned through an override at the lowest patched version inside the same major, leaving every parent's declared range satisfied.
minimatch is overridden as well, and not because it is vulnerable: the eslint config-array chain still resolves minimatch 3.x, whose only compatible brace-expansion line has no patched release at all, and forcing the fixed major underneath it throws on every lint run. npm audit now reports zero.
Documentation
The README was a 757-line manual. Configuration and the endpoint list moved to docs/CONFIGURATION.md and docs/API.md, and a positioning section now says plainly where CrewAI, LangGraph or n8n are the better choice.
Fixes
- The quickstart image pin now moves with the release. It previously referenced a tag built before the quickstart existed, which worked by accident and would have drifted silently on the next backend change.
- The deploy workflow is gated behind a
DEPLOY_ENABLEDrepository variable. It triggers on release tags, and with no host configured it could only fail — leaving a red run against a published release for a rollout nobody requested.
Full changelog: v0.1.0...v0.1.1