v2026.09.22
gohugoio/hugov2026.09.22Sep 21, 2026by knu
Upgrading?
AI Summary
Huginn v2026.09.22 restricts legacy JSONPath calls for security and switches to RFC 9535 evaluation.
Key Highlights
- Restricted legacy JSONPath method calls to an allowlist for security
- Switched to RFC 9535 JSONPath evaluation by default
- Added `use_legacy_jsonpath: true` flag for backward compatibility
- Database migration for expressions with conservative compatibility checks
- Normalized examples to use explicit `$` root
Breaking Changes
- Legacy JSONPath method calls are restricted to an allowlist
- Default JSONPath evaluation switched to RFC 9535
New Features
- JSONPath security update
- RFC 9535 standardization
- Migration support for legacy agents
Full Release Notes
# v2026.09.22 ## JSONPath safety and compatibility - Restrict legacy JSONPath method calls to an allowlist for JSON value types. The guard also covers filters, computed indexes, and direct uses of the jsonpath gem. See [GHSA-9x7r-mpvj-vj8v](https://github.com/huginn/huginn/security/advisories/GHSA-9x7r-mpvj-vj8v). - Use RFC 9535 JSONPath evaluation by default. Agents requiring legacy behavior can use `use_legacy_jsonpath: true`; legacy evaluation remains subject to the method allowlist. - Normalize examples and defaults to JSONPath expressions with an explicit `$` root. ## Upgrading The database migration converts expressions only when compatibility can be established conservatively. Agents with uncertain expressions retain their original paths and receive `use_legacy_jsonpath: true`. The migration lists affected Agent URLs grouped by user, without exposing expressions or event data. Review these Agents before removing the compatibility flag. See the [upgrade guide](https://github.com/huginn/huginn/blob/v2026.09.22/UPGRADING.md#gradual-migration-to-rfc-9535-jsonpath) for migration steps and compatibility considerations. **Full Changelog**: https://github.com/huginn/huginn/compare/v2026.09.21...v2026.09.22
Related Repositories
ollama/ollama★ 184,236
Get up and running with Kimi, GLM, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma and other models.
fatedier/frp★ 110,064
A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet.
infiniflow/ragflow★ 92,631
RAGFlow is a leading open-source Retrieval-Augmented Generation (RAG) engine that fuses cutting-edge RAG with Agent capabilities to create a superior context layer for LLMs
junegunn/fzf★ 83,715
:cherry_blossom: A command-line fuzzy finder
caddyserver/caddy★ 78,251
Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS