v2026.09.09 This release adds a way to keep Agents from reaching internal addresses on shared instances, and hardens several defaults. Agents that fetch URLs and the Scenario import form request whatever URL a user configures, so on an instance where untrusted users can create Agents, any user could make the server connect to loopback, private-network or cloud metadata addresses. Huginn can now ro…
This security release fixes three issues: A Scenario description containing HTML could execute script in the browser of a user importing the Scenario, both in the import preview and after the import. Scenario icons were likewise stored without validation. Any authenticated user could read any file readable by the Huginn process by handing a file pointer to a file-consuming Agent, even with ENABLE_…
This security release fixes four issues: A crafted PdfInfoAgent event URL could execute arbitrary shell commands even when insecure Agents were disabled. An authenticated user could bind another user's private OAuth Service to an Agent, allowing the Agent to use the other user's stored OAuth credential. An authenticated user could manually trigger event propagation across other users' Agents. Conc…
What's Changed Mismatched ruby versions - updated to 2.6.9 by @2600box in #3058 Drop BasecampAgent by @knu in #3056 made mysql flush appear as code by @2600box in #3059 Migrate from RR to RSpec Mocks by @knu in #3066 fix error 'tried to create Proc object without a block' in Gemfile by @JaHIY in #3097 Upgrade mini_racer to the latest version by @knu in #3103 Add a Liquid variable referring to the…
Backfill CHANGELOG