v2026.9.7.1 v2026.09.08
high risk
tobychui/zoraxySep 8, 2026 → Sep 8, 20260 days between releases
What's New
Security release fixes HTML injection, unauthorized file reading, and cross-origin request handling issues
Breaking Changes
- Agents relying on Huginn's own API from served pages will stop working
- Docker images generate random APP_SECRET_TOKEN
New Features
- Content-Security-Policy sandboxing headers
- Devise paranoid mode enabled
- Random secrets for DataOutputAgent and LiquidOutputAgent
Improvements
- Hardens Docker defaults with random secrets
Bug Fixes
- Fixed HTML injection in Scenario descriptions and icons
- Fixed unauthorized file reading via Agents (leaking APP_SECRET_TOKEN)
- Fixed cross-origin request handling issues
Upgrade Notes
Agents calling Huginn's own API from served pages will stop working. Docker images now use random APP_SECRET_TOKEN, requiring manual rotation of secrets if they were previously fixed.
The Two Releases
v2026.9.7.1
v2026.9.7.1
Sep 8, 2026· 1 month ago
A minor patch release addressing UI alignment issues and enhancing the activity graph visualization.
Full release notesv2026.09.08
v2026.09.08
Sep 8, 2026· 1 month ago
Security release fixing HTML injection vulnerabilities, unauthorized file reading, and cross-origin request handling issues.
Full release notes