v2026.09.08 v2026.09.09

Name: onyx
Author: onyx-dot-app

medium risk

onyx-dot-app/onyxSep 8, 2026 → Sep 8, 20261 day between releases

What's New

Adds outbound proxy, import timeouts, and randomizes Docker secrets.

Breaking Changes

Per-Agent proxy option is refused when a proxy is enforced.

New Features

Outbound proxy support via OUTBOUND_PROXY or ENABLE_SMOKESCREEN
Scenario import timeout and size limit enforcement
HTTP proxy support for the net_http backend
Docker image tagging with release version

Improvements

Agents without a proxy option now honor the http_proxy environment variable
Scenario imports report fetch failures as validation errors instead of server errors
Docker images now include random APP_SECRET_TOKEN generation on container start

Bug Fixes

Scenario imports now report fetch failures as validation errors instead of server errors

Upgrade Notes

Operators should configure OUTBOUND_PROXY or ENABLE_SMOKESCREEN to block internal addresses. Agents using the net_http backend now respect the http_proxy environment variable. Ensure Scenario imports fit new size and timeout limits.

The Two Releases

v2026.09.08

Sep 8, 2026· 1 month ago

This security release addresses critical vulnerabilities regarding HTML injection, unauthorized file reading, and cross-origin request handling, while also hardening deployment defaults.

Full release notes

v2026.09.09

Sep 8, 2026· 1 month ago

This release introduces an egress proxy feature to prevent Agents from accessing internal addresses and hardens deployment defaults by randomizing secrets and adding timeouts to URL imports.

Full release notes