v0.8.5 v2026.09.08

Name: nn-zero-to-hero
Author: karpathy

medium risk

karpathy/nn-zero-to-heroSep 5, 2026 → Sep 8, 20263 days between releases

What's New

Security release fixes critical vulnerabilities and enforces CSP headers.

Breaking Changes

Web request handlers now use CSP sandbox headers, potentially breaking pages calling Huginn's own API.
TwitterStreamAgent has been retired due to API shutdown.

New Features

Content-Security-Policy headers added to web requests.
Docker secret randomization on container start.
Devise paranoid mode enabled.

Improvements

Hardened Content-Security-Policy headers for web request handlers.
Docker configurations no longer ship a fixed APP_SECRET_TOKEN.

Bug Fixes

Fixed HTML injection in Scenario descriptions during import.
Fixed unauthorized file reads by authenticated users via Agents.
Fixed web request spoofing by serving pages on a sandboxed origin.

Upgrade Notes

Rotate `APP_SECRET_TOKEN` if untrusted users exist, as file-read vulnerabilities may have exposed secrets. Pages relying on calling Huginn's own API from served content will break due to new CSP headers. The TwitterStreamAgent has been retired.

The Two Releases

v0.8.5

Sep 5, 2026· 2 months ago

A security and connectivity release introducing ZeroRelay and ZeroRouter, expanding live chat capabilities, and hardening plugin and sandbox boundaries.

Full release notes

v2026.09.08

Sep 8, 2026· 1 month ago

Security release fixing HTML injection, unauthorized file reading, and web request spoofing vulnerabilities.

Full release notes