v2026.9.21 v2026.09.22
high risk
NVIDIA/NeMo-Speech.cppSep 21, 2026 → Sep 21, 20260 days between releases
What's New
Switches to RFC 9535 JSONPath evaluation by default and restricts legacy method calls for security.
Breaking Changes
- Switching to RFC 9535 JSONPath evaluation may break legacy agent expressions
- Restricted legacy JSONPath method calls to an allowlist
New Features
- RFC 9535 JSONPath evaluation support
- JSONPath security guard with method allowlist
- Database migration tooling for expressions
Improvements
- Conservative database migration for expressions
- Normalization of examples and defaults to JSONPath expressions with explicit root
Bug Fixes
- Addressed JSONPath security vulnerabilities (GHSA-9x7r-mpvj-vj8v)
Upgrade Notes
The database migration converts expressions conservatively; agents with uncertain expressions retain original paths and receive `use_legacy_jsonpath: true`. Review affected Agents before removing the compatibility flag.
The Two Releases
v2026.9.21
v2026.9.21
Sep 21, 2026· 1 month ago
A maintenance release updating dependencies and fixing ADB mountinfo read-write detection.
Full release notesv2026.09.22
v2026.09.22
Sep 21, 2026· 1 month ago
A critical security and compatibility update regarding JSONPath evaluation, moving to RFC 9535 standard and restricting legacy method calls to prevent security vulnerabilities.
Full release notes