v2026.916.1 v2026.09.22
karpathy/nn-zero-to-heroSep 21, 2026 → Sep 21, 20260 days between releases
What's New
Releases are disjoint: the newer one swaps the chat/DB patch for JSONPath security and RFC 9535 defaults.
Breaking Changes
- Legacy JSONPath method calls are now restricted to an allowlist, so previously working expressions may be rejected.
- RFC 9535 evaluation is the default, changing results for agents that depended on legacy JSONPath semantics.
- Examples and defaults are normalized to expressions with an explicit `$` root, which can alter stored paths.
New Features
- Method allowlist guard for JSONPath that also covers filters, computed indexes, and direct jsonpath gem usage.
- RFC 9535-compliant JSONPath evaluation enabled by default.
- Database migration that conservatively converts expressions and flags uncertain ones.
- Per-agent `use_legacy_jsonpath` compatibility flag for agents needing legacy behavior.
Improvements
- Closes the JSONPath security issue described in GHSA-9x7r-mpvj-vj8v.
- Migration lists affected Agent URLs grouped by user without exposing expressions or event data.
- Legacy evaluation, when opted into, remains subject to the method allowlist.
Upgrade Notes
Run the database migration, then review the flagged agents before removing `use_legacy_jsonpath`; uncertain expressions keep their original paths with the flag set. Validate JSONPath-dependent agents against RFC 9535 semantics, since results may differ from legacy evaluation. No other configuration changes are required.
The Two Releases
v2026.916.1
Sep 21, 2026· 1 month ago
This patch release fixes a bug where the chat composer's send button remained disabled on desktop and improves the classification of database errors for duplicate document inserts.
Full release notesv2026.09.22
Sep 21, 2026· 1 month ago
This release prioritizes JSONPath safety by restricting legacy method calls and switching to RFC 9535 evaluation by default to prevent security vulnerabilities.
Full release notes