v0.80.0 v2026.09.08
QwenAudio/SenseVoiceSep 7, 2026 → Sep 8, 20260 days between releases
What's New
Pixi adds experimental conda-script support; Huginn releases critical security fixes for HTML injection and privilege escalation.
Breaking Changes
- Pages that relied on calling Huginn's own API from within a served page will stop working.
New Features
- Added Content-Security-Policy headers to web responses.
- Random admin password generation in rake db:seed.
- Random default secrets for DataOutputAgent and LiquidOutputAgent.
Improvements
- Hardened deployment defaults by removing fixed APP_SECRET_TOKEN from Docker configurations.
Bug Fixes
- Fixed HTML injection vulnerability in Scenario descriptions and icons.
- Fixed arbitrary file read vulnerability accessible to any authenticated user.
- Fixed privilege escalation in web pages served by Agents.
Upgrade Notes
Operators should rotate APP_SECRET_TOKEN and any other secrets in .env after upgrading. Pages calling Huginn's own API from within a served page will stop working.
The Two Releases
v0.80.0
Sep 7, 2026· 1 month ago
Pixi introduces experimental support for `conda-script`, allowing users to create self-contained scripts in languages like R and C++ that include their own dependencies and instructions.
Full release notesv2026.09.08
Sep 8, 2026· 1 month ago
A critical security release that fixes vulnerabilities involving HTML injection, arbitrary file reading, and privilege escalation in web request handlers.
Full release notes