v2026.09.22
udecode/platev2026.09.22Sep 21, 2026by knu
Upgrading?
AI Summary
This release focuses on JSONPath security and compatibility, restricting legacy method calls to an allowlist and switching the default evaluation engine to RFC 9535.
Key Highlights
- Restrict legacy JSONPath method calls to an allowlist for security (GHSA-9x7r-mpvj-vj8v).
- Use RFC 9535 JSONPath evaluation by default, with an opt-in flag for legacy behavior.
- Normalize examples and defaults to JSONPath expressions with an explicit `$` root.
Breaking Changes
- Agents with uncertain expressions will retain their original paths and receive `use_legacy_jsonpath: true`.
- Requires review of affected Agent URLs before removing the compatibility flag.
New Features
- Database migration for conservative expression compatibility.
- Security advisory coverage (GHSA-9x7r-mpvj-vj8v).
Full Release Notes
# v2026.09.22 ## JSONPath safety and compatibility - Restrict legacy JSONPath method calls to an allowlist for JSON value types. The guard also covers filters, computed indexes, and direct uses of the jsonpath gem. See [GHSA-9x7r-mpvj-vj8v](https://github.com/huginn/huginn/security/advisories/GHSA-9x7r-mpvj-vj8v). - Use RFC 9535 JSONPath evaluation by default. Agents requiring legacy behavior can use `use_legacy_jsonpath: true`; legacy evaluation remains subject to the method allowlist. - Normalize examples and defaults to JSONPath expressions with an explicit `$` root. ## Upgrading The database migration converts expressions only when compatibility can be established conservatively. Agents with uncertain expressions retain their original paths and receive `use_legacy_jsonpath: true`. The migration lists affected Agent URLs grouped by user, without exposing expressions or event data. Review these Agents before removing the compatibility flag. See the [upgrade guide](https://github.com/huginn/huginn/blob/v2026.09.22/UPGRADING.md#gradual-migration-to-rfc-9535-jsonpath) for migration steps and compatibility considerations. **Full Changelog**: https://github.com/huginn/huginn/compare/v2026.09.21...v2026.09.22
Related Repositories
openclaw/openclaw★ 392,696
The AI that really does things. Any OS. Any Platform. The lobster way. 🦞
nilbuild/developer-roadmap★ 370,068
Interactive roadmaps, guides and other educational content to help developers grow in their careers.
morluto/rea★ 357,683
Reverse engineer anything with agents, from app behavior down to native binaries.
anomalyco/opencode★ 219,670
The open source coding agent.
n8n-io/n8n★ 208,251
Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.