v2026.09.22

# v2026.09.22

## JSONPath safety and compatibility

- Restrict legacy JSONPath method calls to an allowlist for JSON value types.  The guard also covers filters, computed indexes, and direct uses of the jsonpath gem.  See [GHSA-9x7r-mpvj-vj8v](https://github.com/huginn/huginn/security/advisories/GHSA-9x7r-mpvj-vj8v).
- Use RFC 9535 JSONPath evaluation by default.  Agents requiring legacy behavior can use `use_legacy_jsonpath: true`; legacy evaluation remains subject to the method allowlist.
- Normalize examples and defaults to JSONPath expressions with an explicit `$` root.

## Upgrading

The database migration converts expressions only when compatibility can be established conservatively.  Agents with uncertain expressions retain their original paths and receive `use_legacy_jsonpath: true`.  The migration lists affected Agent URLs grouped by user, without exposing expressions or event data.

Review these Agents before removing the compatibility flag.  See the [upgrade guide](https://github.com/huginn/huginn/blob/v2026.09.22/UPGRADING.md#gradual-migration-to-rfc-9535-jsonpath) for migration steps and compatibility considerations.

**Full Changelog**: https://github.com/huginn/huginn/compare/v2026.09.21...v2026.09.22