v2026.09.08 v2026.09.09
tobychui/zoraxySep 8, 2026 → Sep 8, 20261 day between releases
What's New
Adds outbound proxy enforcement, scenario import improvements, and retires TwitterStreamAgent
Breaking Changes
- TwitterStreamAgent retired and cannot be created
- Scenario imports now report validation errors instead of server errors
New Features
- Outbound proxy enforcement to block internal addresses
- Scenario import improvements including timeouts, size limits, and redirect following
- Agents honor the http_proxy environment variable
- Random admin password generation in rake db:seed
Improvements
- Scenario imports report validation errors instead of server errors
- Agents without a proxy option now honor http_proxy
Upgrade Notes
Migrate existing TwitterStreamAgents before upgrading to avoid runtime errors. Ensure APP_SECRET_TOKEN is set in Docker to maintain session persistence across restarts. Untrusted users should enable OUTBOUND_PROXY or Smokescreen to prevent internal address access.
The Two Releases
v2026.09.08
Sep 8, 2026· 1 month ago
Security release fixing HTML injection vulnerabilities, unauthorized file reading, and cross-origin request handling issues.
Full release notesv2026.09.09
Sep 8, 2026· 1 month ago
Adds outbound proxy enforcement to prevent Agents from accessing internal addresses and hardens various defaults including Docker secrets and scenario imports.
Full release notes