v2026.09.22
quickwit-oss/quickwitv2026.09.22Sep 21, 2026by knu
Upgrading?
AI Summary
Introduces JSONPath safety and compatibility updates by restricting legacy method calls via an allowlist and switching to RFC 9535 JSONPath evaluation by default, with a conservative database migration strategy.
Key Highlights
- Restricts legacy JSONPath method calls via allowlist
- Migration to RFC 9535 JSONPath evaluation
- Conservative database migration for compatibility
- Upgrade guide provided for affected Agents
Breaking Changes
- Agents with uncertain expressions will have `use_legacy_jsonpath: true` set by default and require review.
New Features
- JSONPath security improvements
- RFC 9535 JSONPath compliance
Full Release Notes
# v2026.09.22 ## JSONPath safety and compatibility - Restrict legacy JSONPath method calls to an allowlist for JSON value types. The guard also covers filters, computed indexes, and direct uses of the jsonpath gem. See [GHSA-9x7r-mpvj-vj8v](https://github.com/huginn/huginn/security/advisories/GHSA-9x7r-mpvj-vj8v). - Use RFC 9535 JSONPath evaluation by default. Agents requiring legacy behavior can use `use_legacy_jsonpath: true`; legacy evaluation remains subject to the method allowlist. - Normalize examples and defaults to JSONPath expressions with an explicit `$` root. ## Upgrading The database migration converts expressions only when compatibility can be established conservatively. Agents with uncertain expressions retain their original paths and receive `use_legacy_jsonpath: true`. The migration lists affected Agent URLs grouped by user, without exposing expressions or event data. Review these Agents before removing the compatibility flag. See the [upgrade guide](https://github.com/huginn/huginn/blob/v2026.09.22/UPGRADING.md#gradual-migration-to-rfc-9535-jsonpath) for migration steps and compatibility considerations. **Full Changelog**: https://github.com/huginn/huginn/compare/v2026.09.21...v2026.09.22
Related Repositories
A cross-platform desktop All-in-One assistant for Claude Code, Codex, OpenCode, OpenClaw, Grok Build & Hermes Agent. Only official website: ccswitch.io
An open-source remote desktop application designed for self-hosting, as an alternative to TeamViewer.
Build smaller, faster, and more secure desktop and mobile applications with a web frontend.
π RuView turns commodity WiFi signals into real-time spatial intelligence, vital sign monitoring, and presence detection — all without a single pixel of video.
Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one