v2026.09.22
sergeyzwezdin/hubav2026.09.22Sep 21, 2026by knu
Upgrading?
AI Summary
Security-focused release addressing JSONPath evaluation safety and compatibility, transitioning to RFC 9535 by default.
Key Highlights
- JSONPath safety and compatibility improvements
- Restriction of legacy JSONPath method calls to an allowlist
- Default use of RFC 9535 JSONPath evaluation
- Database migration for expressions with conservative compatibility checks
Breaking Changes
- JSONPath evaluation defaults to RFC 9535
- Legacy JSONPath method calls restricted to allowlist
New Features
- JSONPath safety guard
- RFC 9535 JSONPath support
- Legacy mode opt-in via flag
Full Release Notes
# v2026.09.22 ## JSONPath safety and compatibility - Restrict legacy JSONPath method calls to an allowlist for JSON value types. The guard also covers filters, computed indexes, and direct uses of the jsonpath gem. See [GHSA-9x7r-mpvj-vj8v](https://github.com/huginn/huginn/security/advisories/GHSA-9x7r-mpvj-vj8v). - Use RFC 9535 JSONPath evaluation by default. Agents requiring legacy behavior can use `use_legacy_jsonpath: true`; legacy evaluation remains subject to the method allowlist. - Normalize examples and defaults to JSONPath expressions with an explicit `$` root. ## Upgrading The database migration converts expressions only when compatibility can be established conservatively. Agents with uncertain expressions retain their original paths and receive `use_legacy_jsonpath: true`. The migration lists affected Agent URLs grouped by user, without exposing expressions or event data. Review these Agents before removing the compatibility flag. See the [upgrade guide](https://github.com/huginn/huginn/blob/v2026.09.22/UPGRADING.md#gradual-migration-to-rfc-9535-jsonpath) for migration steps and compatibility considerations. **Full Changelog**: https://github.com/huginn/huginn/compare/v2026.09.21...v2026.09.22
Related Repositories
openclaw/openclaw★ 392,714
The AI that really does things. Any OS. Any Platform. The lobster way. 🦞
nilbuild/developer-roadmap★ 370,095
Interactive roadmaps, guides and other educational content to help developers grow in their careers.
morluto/rea★ 360,215
Reverse engineer anything with agents, from app behavior down to native binaries.
anomalyco/opencode★ 219,858
The open source coding agent.
n8n-io/n8n★ 208,278
Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.