v2026.09.22
karpathy/nn-zero-to-herov2026.09.22Sep 21, 2026by knu
Upgrading?
AI Summary
This release prioritizes JSONPath safety by restricting legacy method calls and switching to RFC 9535 evaluation by default to prevent security vulnerabilities.
Key Highlights
- Legacy JSONPath method calls are restricted to an allowlist.
- RFC 9535 JSONPath evaluation is used by default.
- Migration tool helps convert existing expressions conservatively.
- Explicit `$` root is normalized in examples and defaults.
New Features
- Safe JSONPath evaluation with method allowlist.
- RFC 9535 compliance for JSONPath expressions.
- Database migration for gradual transition to new behavior.
Full Release Notes
# v2026.09.22 ## JSONPath safety and compatibility - Restrict legacy JSONPath method calls to an allowlist for JSON value types. The guard also covers filters, computed indexes, and direct uses of the jsonpath gem. See [GHSA-9x7r-mpvj-vj8v](https://github.com/huginn/huginn/security/advisories/GHSA-9x7r-mpvj-vj8v). - Use RFC 9535 JSONPath evaluation by default. Agents requiring legacy behavior can use `use_legacy_jsonpath: true`; legacy evaluation remains subject to the method allowlist. - Normalize examples and defaults to JSONPath expressions with an explicit `$` root. ## Upgrading The database migration converts expressions only when compatibility can be established conservatively. Agents with uncertain expressions retain their original paths and receive `use_legacy_jsonpath: true`. The migration lists affected Agent URLs grouped by user, without exposing expressions or event data. Review these Agents before removing the compatibility flag. See the [upgrade guide](https://github.com/huginn/huginn/blob/v2026.09.22/UPGRADING.md#gradual-migration-to-rfc-9535-jsonpath) for migration steps and compatibility considerations. **Full Changelog**: https://github.com/huginn/huginn/compare/v2026.09.21...v2026.09.22
Related Repositories
rasbt/LLMs-from-scratch★ 107,072
Implement a ChatGPT-like LLM in PyTorch from scratch, step by step
lyogavin/airllm★ 40,206
AirLLM 2.8T LLM inference with single 4GB GPU
NirDiamant/RAG_Techniques★ 29,960
This repository showcases various advanced techniques for Retrieval-Augmented Generation (RAG) systems. Each technique has a detailed notebook tutorial.
microsoft/OmniParser★ 25,539
A simple screen parsing tool towards pure vision based GUI agent
NirDiamant/GenAI_Agents★ 24,658
50+ tutorials and implementations for Generative AI Agent techniques, from basic conversational bots to complex multi-agent systems.