v2026.09.22
TimoBolkart/FLAME-Universev2026.09.22Sep 21, 2026by knu
Upgrading?
AI Summary
This release prioritizes security by restricting legacy JSONPath method calls and introduces RFC 9535 JSONPath evaluation as the new default, requiring a migration strategy for existing agents.
Key Highlights
- Restricts legacy JSONPath method calls to an allowlist for security (GHSA-9x7r-mpvj-vj8v)
- Switches default JSONPath evaluation to RFC 9535
- Adds `use_legacy_jsonpath` flag for backward compatibility
- Database migration identifies affected agents without exposing data
Breaking Changes
- Default JSONPath evaluation changed from legacy to RFC 9535
- Legacy JSONPath method calls restricted to allowlist
- Agents with incompatible expressions may need `use_legacy_jsonpath: true`
New Features
- RFC 9535 JSONPath evaluation
- JSONPath method allowlist
- Migration guide for gradual rollout
- Conservative database migration strategy
Full Release Notes
# v2026.09.22 ## JSONPath safety and compatibility - Restrict legacy JSONPath method calls to an allowlist for JSON value types. The guard also covers filters, computed indexes, and direct uses of the jsonpath gem. See [GHSA-9x7r-mpvj-vj8v](https://github.com/huginn/huginn/security/advisories/GHSA-9x7r-mpvj-vj8v). - Use RFC 9535 JSONPath evaluation by default. Agents requiring legacy behavior can use `use_legacy_jsonpath: true`; legacy evaluation remains subject to the method allowlist. - Normalize examples and defaults to JSONPath expressions with an explicit `$` root. ## Upgrading The database migration converts expressions only when compatibility can be established conservatively. Agents with uncertain expressions retain their original paths and receive `use_legacy_jsonpath: true`. The migration lists affected Agent URLs grouped by user, without exposing expressions or event data. Review these Agents before removing the compatibility flag. See the [upgrade guide](https://github.com/huginn/huginn/blob/v2026.09.22/UPGRADING.md#gradual-migration-to-rfc-9535-jsonpath) for migration steps and compatibility considerations. **Full Changelog**: https://github.com/huginn/huginn/compare/v2026.09.21...v2026.09.22
Related Repositories
public-apis/public-apis★ 491,135
A collective list of free APIs
openclaw/openclaw★ 392,705
The AI that really does things. Any OS. Any Platform. The lobster way. 🦞
nilbuild/developer-roadmap★ 370,073
Interactive roadmaps, guides and other educational content to help developers grow in their careers.
morluto/rea★ 358,099
Reverse engineer anything with agents, from app behavior down to native binaries.
obra/superpowers★ 303,174
An agentic skills framework & software development methodology that works.