v2026.09.08 v2026.09.09

Name: SenseVoice
Author: QwenAudio

medium risk

QwenAudio/SenseVoiceSep 8, 2026 → Sep 8, 20261 day between releases

What's New

Adds outbound proxy support and randomizes Docker secrets.

Breaking Changes

Pages calling Huginn's own API from within a served page will stop working.

New Features

Added outbound proxy support (e.g., Smokescreen) to block internal network access.
Scenario imports now include timeout and size limits with better error reporting.
Docker images tagged with release version (e.g., ghcr.io/huginn/huginn:v2026.09.09).
Agents honor http_proxy on the net_http backend by default.
Scenario imports follow redirects and report validation errors.

Improvements

Docker images no longer ship fixed secrets; random secrets are generated on start.
Agents without a proxy option now honor http_proxy on the net_http backend.
Scenario imports follow redirects and report validation errors.

Bug Fixes

Scenario imports now include timeout and size limits with better error reporting.
Agents honor http_proxy on the net_http backend by default.
Scenario imports follow redirects and report validation errors.

Upgrade Notes

Ensure you set APP_SECRET_TOKEN in your environment if you rely on container restarts, as secrets are now randomized. Operators with untrusted users should enable OUTBOUND_PROXY or ENABLE_SMOKESCREEN=true to prevent internal network access. Note that the Content-Security-Policy from v2026.09.08 may block API calls made from within served pages.

The Two Releases

v2026.09.08

Sep 8, 2026· 1 month ago

A critical security release that fixes vulnerabilities involving HTML injection, arbitrary file reading, and privilege escalation in web request handlers.

Full release notes

v2026.09.09

Sep 8, 2026· 1 month ago

This release adds outbound proxy support to prevent Agents from reaching internal addresses and hardens deployment defaults by randomizing secrets.

Full release notes