v0.96.1 v2026.09.22
medium risk
tobychui/zoraxySep 21, 2026 → Sep 21, 20260 days between releases
What's New
Switches JSONPath evaluation to RFC 9535 standards by default and restricts legacy method calls
Breaking Changes
- Default JSONPath evaluation changes from legacy to RFC 9535; legacy behavior requires explicit flag.
New Features
- Automatic migration flag for legacy JSONPath paths.
Improvements
- Restricts legacy JSONPath method calls to an allowlist for security.
- Switches to RFC 9535 JSONPath evaluation by default.
- Normalizes examples and defaults to JSONPath expressions with an explicit `$` root.
Bug Fixes
- Addresses security vulnerability GHSA-9x7r-mpvj-vj8v by restricting method calls.
Upgrade Notes
Database migration converts expressions conservatively; agents with uncertain expressions retain legacy paths and require manual review.
The Two Releases
v0.96.1
v0.96.1
Sep 21, 2026· 1 month ago
A minor release adjusting theme API key names to improve consistency following the introduction of themes in the previous version.
Full release notesv2026.09.22
v2026.09.22
Sep 21, 2026· 1 month ago
Addresses security vulnerabilities in JSONPath evaluation by restricting legacy method calls to an allowlist and switching to RFC 9535 standards by default.
Full release notes