This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Affected surfaces
ReleasePort's take
Moderate signalServer‑configured providers are now immutable against client overrides, eliminating API‑key tampering risks in shared deployments.
Why it matters: This security hardening (severity 80) blocks client manipulation of provider settings, protecting shared environments from credential leakage.
Summary
AI summaryBroad release touches Bug Fixes, Other Changes, v0, and https://github.com/THU-MAIC/OpenMAIC/pull/615.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | High |
Server‑configured providers can no longer be overridden by client settings, preventing API‑key tampering on shared deployments. Server‑configured providers can no longer be overridden by client settings, preventing API‑key tampering on shared deployments. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Medium |
Adds Pro Mode toggle in MAIC Editor, turning generated slides into an editable canvas with undo/redo. Adds Pro Mode toggle in MAIC Editor, turning generated slides into an editable canvas with undo/redo. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Medium |
Makes streaming course outline editable before generation, allowing review, edit, reorder, and add/delete scenes. Makes streaming course outline editable before generation, allowing review, edit, reorder, and add/delete scenes. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Medium |
Makes exported classroom ZIPs offline‑ready by inlining external assets. Makes exported classroom ZIPs offline‑ready by inlining external assets. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Low |
Adds Claude Opus 4.8 and MiniMax M3 to the default model registry. Adds Claude Opus 4.8 and MiniMax M3 to the default model registry. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Low |
Adds Gemini 3.5 Flash to the model registry. Adds Gemini 3.5 Flash to the model registry. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Low |
Adds Xiaomi MiMo Token Plan support. Adds Xiaomi MiMo Token Plan support. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Low |
Adds Azure STT (Fast Transcription) as a speech‑to‑text provider. Adds Azure STT (Fast Transcription) as a speech‑to‑text provider. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Low |
Adds Traditional Chinese (zh‑TW) and Brazilian Portuguese (pt‑BR) interface languages. Adds Traditional Chinese (zh‑TW) and Brazilian Portuguese (pt‑BR) interface languages. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Feature | Low |
Adds web search providers: Brave, Baidu, Bocha, and MiniMax. Adds web search providers: Brave, Baidu, Bocha, and MiniMax. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Adds HappyHorse video adapter and Lemonade as an LLM provider. Adds HappyHorse video adapter and Lemonade as an LLM provider. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Adds OpenAI image generation environment‑variable fallback. Adds OpenAI image generation environment‑variable fallback. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Feature | Low |
Adds generated‑video manifest references so produced videos survive export/import. Adds generated‑video manifest references so produced videos survive export/import. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Bugfix | Medium |
Keep interactive scenes alive across remounts using an iframe keep‑alive pool, preventing reloads during navigation. Keep interactive scenes alive across remounts using an iframe keep‑alive pool, preventing reloads during navigation. Source: llm_adapter@2026-06-02 Confidence: high |
— |
| Bugfix | Medium |
Restore orchestration director's ability to answer user questions and stop runaway turns by removing maxTurns limit. Restore orchestration director's ability to answer user questions and stop runaway turns by removing maxTurns limit. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Bugfix | Medium |
Restore agent attribution in the director summary. Restore agent attribution in the director summary. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Bugfix | Low |
Skip shapes with malformed SVG paths during PPTX export instead of aborting the whole process. Skip shapes with malformed SVG paths during PPTX export instead of aborting the whole process. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Bugfix | Low |
Prevent memory leaks and silent export failures in chart/export components. Prevent memory leaks and silent export failures in chart/export components. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Bugfix | Low |
Add defensive checks in ChartElement to prevent crashes on malformed chart data. Add defensive checks in ChartElement to prevent crashes on malformed chart data. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Bugfix | Low |
Let whiteboard code elements capture internal scroll/drag instead of the canvas. Let whiteboard code elements capture internal scroll/drag instead of the canvas. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Bugfix | Low |
Preserve discussion triggers when importing classroom ZIPs. Preserve discussion triggers when importing classroom ZIPs. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Bugfix | Low |
Fix generated video thumbnails. Fix generated video thumbnails. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Bugfix | Low |
Gate media snippets in the interactive‑outlines prompt template to avoid unwanted inclusion. Gate media snippets in the interactive‑outlines prompt template to avoid unwanted inclusion. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Bugfix | Low |
Hide unsupported MiniMax Hailuo fast text‑to‑video model and remove weak Lemonade recommended models. Hide unsupported MiniMax Hailuo fast text‑to‑video model and remove weak Lemonade recommended models. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
| Bugfix | Low |
Fix Haiku 4.5 thinking controls behavior. Fix Haiku 4.5 thinking controls behavior. Source: granite4.1:30b@2026-06-02-audit Confidence: low |
— |
Full changelog
Features
- MAIC Editor (v0) — slide editing surface — A new Pro Mode toggle turns any generated slide into an editable canvas: select and edit text, insert text boxes and images, navigate and reorder slides from a thumbnail rail, with history-aware undo/redo. This is the first surface of the broader MAIC Editor framework (gated behind
NEXT_PUBLIC_MAIC_EDITOR_ENABLED) #615 - Editable outline before generation — The streaming course outline now morphs into an inline editor: review, edit, reorder, and add or delete scenes and bullet points, then confirm to generate the full course — so you catch structure problems before spending a full generation #558
- Offline-ready classroom export — Exported teaching resource packs and classroom ZIPs now inline external assets so interactive pages open fully offline, even when copied to another machine #613
- Add Claude Opus 4.8 and MiniMax M3 to the default model registry #635
- Add Gemini 3.5 Flash #584
- Add Xiaomi MiMo Token Plan support #578 (by @xuruiray)
- Add web search providers: Brave and Baidu #42 (by @YizukiAme), Bocha #524, and MiniMax #634
- Add Azure STT (Fast Transcription) as a speech-to-text provider #175 (by @ismailariyan)
- Add HappyHorse video adapter #509 (by @xuruiray) and Lemonade as an LLM provider #508
- Add OpenAI image generation environment-variable fallback #510 (by @xuruiray)
- Add generated-video manifest references so produced videos survive export/import #540
- Add Traditional Chinese (zh-TW) #517 (by @alvinets) and Brazilian Portuguese (pt-BR) #602 (by @hemanz) interface languages
Bug Fixes
- Server-configured providers are now admin-managed — providers set via server environment can no longer be overridden by client settings, preventing base-URL/key tampering on shared deployments #624; fixes server API-key fallback when the client echoes the provider base URL #533 (by @LooThao); auto-selects the server LLM model #577 (by @xuruiray); and enforces a "usable provider ⇒ concrete model" invariant #581
- Keep interactive scenes alive across remounts with an iframe keep-alive pool, so interactive content no longer reloads when navigating #629
- Restore the orchestration director's ability to answer the user's question and stop runaway turns (removed
maxTurns) #599; restore agent attribution in the director summary #554 (by @ashutoshrana) - Skip shapes with malformed SVG paths instead of aborting the whole PPTX export #505; prevent memory leaks and silent export failures #552 (by @arnow117)
- Add defensive checks in ChartElement to prevent crashes on malformed chart data #588 (by @tongshu2023)
- Let whiteboard code elements capture internal scroll/drag instead of the canvas #544 (by @cosarah)
- Preserve discussion triggers when importing classroom ZIPs #557 (by @cosarah)
- Fix generated video thumbnails #546
- Gate media snippets in the interactive-outlines prompt template #628
- Hide the unsupported MiniMax Hailuo fast text-to-video model #632; remove weak Lemonade recommended models #567 (by @cosarah)
- Fix Haiku 4.5 thinking controls #501
- Use an ESM import for TypeScript in the pptxgenjs rollup config #616
- Align zh-TW provider names with the rest of the locale set
Other Changes
- Add a Fumadocs-based documentation site #622
- Add a VoxCPM2 setup guide and tighten the README section #500 #502
- Fix the commercial licensing contact email #604 (by @DHQ1204)
Full Changelog: https://github.com/THU-MAIC/OpenMAIC/compare/v0.2.1...v0.2.2
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About OpenMAIC
Open Multi-Agent Interactive Classroom — Get an immersive, multi-agent learning experience in just one click
Related context
Related tools
Beta — feedback welcome: [email protected]