v2026.10.04 Changes Upgrade to json 3.0.2, which rejects duplicate object keys and JavaScript-style comments by default. Deduplicate automatic Agent checks from schedules and controller Agents while a check is queued, running, or awaiting retry. #3767 Move navigation labels to translation keys while preserving the English text. #3763 Upgrade the bundled database and Docker Compose MySQL services t…
v2026.09.22 JSONPath safety and compatibility Restrict legacy JSONPath method calls to an allowlist for JSON value types. The guard also covers filters, computed indexes, and direct uses of the jsonpath gem. See GHSA-9x7r-mpvj-vj8v. Use RFC 9535 JSONPath evaluation by default. Agents requiring legacy behavior can use use_legacy_jsonpath: true; legacy evaluation remains subject to the method allowl…
v2026.09.21 This release improves recovery from stalled background jobs, adds opt-in proxy routing for individual Agents, and updates the Ruby and Docker runtimes. Background jobs Add an optional delayed_job_master process that forks single-threaded workers on demand. Set DELAYED_JOB_WORKERS to control concurrency and DELAYED_JOB_MAX_MEMORY to recycle workers after jobs that exceed the memory limi…
v2026.09.09 This release adds a way to keep Agents from reaching internal addresses on shared instances, and hardens several defaults. Agents that fetch URLs and the Scenario import form request whatever URL a user configures, so on an instance where untrusted users can create Agents, any user could make the server connect to loopback, private-network or cloud metadata addresses. Huginn can now ro…
This security release fixes three issues: A Scenario description containing HTML could execute script in the browser of a user importing the Scenario, both in the import preview and after the import. Scenario icons were likewise stored without validation. Any authenticated user could read any file readable by the Huginn process by handing a file pointer to a file-consuming Agent, even with ENABLE_…
This security release fixes four issues: A crafted PdfInfoAgent event URL could execute arbitrary shell commands even when insecure Agents were disabled. An authenticated user could bind another user's private OAuth Service to an Agent, allowing the Agent to use the other user's stored OAuth credential. An authenticated user could manually trigger event propagation across other users' Agents. Conc…
What's Changed Mismatched ruby versions - updated to 2.6.9 by @2600box in #3058 Drop BasecampAgent by @knu in #3056 made mysql flush appear as code by @2600box in #3059 Migrate from RR to RSpec Mocks by @knu in #3066 fix error 'tried to create Proc object without a block' in Gemfile by @JaHIY in #3097 Upgrade mini_racer to the latest version by @knu in #3103 Add a Liquid variable referring to the…
Backfill CHANGELOG