v0.10.1 v2026.09.22
medium risk
facebookresearch/sam-audioSep 21, 2026 → Sep 21, 20260 days between releases
What's New
Implements RFC 9535 JSONPath compliance with security hardening and legacy mode support.
Breaking Changes
- Agents requiring legacy behavior must enable `use_legacy_jsonpath: true`
- Legacy JSONPath method calls are restricted to an allowlist
New Features
- RFC 9535 JSONPath evaluation is now used by default
- Legacy JSONPath method calls are restricted to an allowlist for security
- Configuration flag `use_legacy_jsonpath` allows agents to retain legacy behavior
Improvements
- Database migration converts expressions conservatively
- Examples and defaults are normalized to JSONPath expressions with an explicit `$` root
Bug Fixes
- Restricts legacy JSONPath method calls to address security vulnerability GHSA-9x7r-mpvj-vj8v
Upgrade Notes
Agents with uncertain expressions will automatically receive `use_legacy_jsonpath: true`. Review affected Agents before removing this flag to ensure compatibility.
The Two Releases
v0.10.1
v0.10.1
Sep 21, 2026· 1 month ago
A maintenance release focusing on attachment handling, OAuth stability, and administrative tools. It introduces a unified bank transfer API and improvements to coding agents.
Full release notesv2026.09.22
v2026.09.22
Sep 21, 2026· 1 month ago
Implements RFC 9535 JSONPath safety by restricting legacy method calls and normalizing JSONPath expressions.
Full release notes