v2026.09.22
promptslab/Promptifyv2026.09.22Sep 21, 2026by knu
Upgrading?
AI Summary
This release addresses a critical security vulnerability in JSONPath evaluation by migrating to RFC 9535 standards and implementing strict allowlists for legacy methods.
Key Highlights
- Security update (GHSA-9x7r-mpvj-vj8v) restricting legacy JSONPath method calls to an allowlist.
- Migration to RFC 9535 JSONPath evaluation as the default standard.
- Database migration strategy that conservatively handles agents with uncertain expressions.
Breaking Changes
- Restricts legacy JSONPath method calls to an allowlist.
- Use RFC 9535 JSONPath evaluation by default (legacy behavior requires `use_legacy_jsonpath: true`).
- Agents with uncertain expressions retain their original paths and receive `use_legacy_jsonpath: true`.
New Features
- RFC 9535 JSONPath evaluation support.
- Allowlist for legacy JSONPath method calls.
- Migration tooling to detect and flag affected agents.
Full Release Notes
# v2026.09.22 ## JSONPath safety and compatibility - Restrict legacy JSONPath method calls to an allowlist for JSON value types. The guard also covers filters, computed indexes, and direct uses of the jsonpath gem. See [GHSA-9x7r-mpvj-vj8v](https://github.com/huginn/huginn/security/advisories/GHSA-9x7r-mpvj-vj8v). - Use RFC 9535 JSONPath evaluation by default. Agents requiring legacy behavior can use `use_legacy_jsonpath: true`; legacy evaluation remains subject to the method allowlist. - Normalize examples and defaults to JSONPath expressions with an explicit `$` root. ## Upgrading The database migration converts expressions only when compatibility can be established conservatively. Agents with uncertain expressions retain their original paths and receive `use_legacy_jsonpath: true`. The migration lists affected Agent URLs grouped by user, without exposing expressions or event data. Review these Agents before removing the compatibility flag. See the [upgrade guide](https://github.com/huginn/huginn/blob/v2026.09.22/UPGRADING.md#gradual-migration-to-rfc-9535-jsonpath) for migration steps and compatibility considerations. **Full Changelog**: https://github.com/huginn/huginn/compare/v2026.09.21...v2026.09.22
Related Repositories
public-apis/public-apis★ 491,126
A collective list of free APIs
NousResearch/hermes-agent★ 255,898
The agent that grows with you
yt-dlp/yt-dlp★ 199,993
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,478
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,699
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.