One week ago the team behind Open Melody released v1.0.2, but I've just noticed this.
In summary, this release is announced as:
This is a critical maintenance update as it includes all security-related changes released in Movable Type 4.361 (#944) and v4.37 (#973)
Added new configuration directives, DeniedAssetFileExtensions and AssetFileExtensions, which allow administrators precise control over the types of files users can upload (#946)
The release notes are available for you to review at:
https://github.com/openmelody/melody/wiki/release-v1.0.2
In order to login and evaluate the product, you have to go to:
http://www.openmelodydemo.org/v1x.html
