⟳ Updates Hub
H
Home / Self-hosted

Huginn

Website ↗ RSS 14 items Fetched 39m ago
H
Huginn Self-hosted v2026.11.05

v2026.11.05

v2026.11.05 This security release fixes stored cross-site scripting (XSS) in shared OAuth service names and Agent descriptions. It also adds CSRF protection to administrator user switching. Upgrade all installations, especially those with multiple users or imported scenarios. Security fixes Escape OAuth service names on Agent pages. A user could share a service with a crafted display name and run…

H
Huginn Self-hosted v2026.11.01

v2026.11.01

v2026.11.01 This maintenance release updates bundled gems and adds a three-day cooldown before newly published gems are selected during dependency resolution. Changes Update Feedjira to 4.0.3, Kaminari to 1.3.1, Faraday to 2.15.1, Bootsnap to 1.26.1, AWS SDK for S3 to 1.236.0, and AWS SDK Core to 3.262.0. #3824 Add a three-day gem release cooldown and update the lockfile's Bundler version to 4.0.2…

H
Huginn Self-hosted v2026.10.26

v2026.10.26

v2026.10.26 This release updates certificate trust following the eMudhra intermediate CA incident. Docker builds now require Ubuntu's corrected CA package, and gRPC connections prefer the OS trust store over the gem's bundled certificates. Changes Require ca-certificates version 20260816ubuntu0.24.04.1 or later in the Ubuntu 24.04 Docker images. Builds fail if the update is unavailable. See USN-89…

H
Huginn Self-hosted v2026.10.24

v2026.10.24

v2026.10.24 Ruby 4.0.9 includes fixes for memory corruption when compiling attacker-controlled regular expressions. See the Ruby advisory for details. Changes Upgrade Ruby to 4.0.9, including the official Docker images. #3805 Upgrade the bundled MySQL server to 8.4.13. #3809 Select the web interface language with the LOCALE environment variable. Translations come from an additional gem, with Engli…

H
Huginn Self-hosted v2026.10.14

v2026.10.14

v2026.10.14 Changes Show maps of location Events with OpenStreetMap and Leaflet when UserLocationAgent has no Google Maps api_key, instead of showing no map. #3791 Upgrade the PostgreSQL Docker Compose example from PostgreSQL 9.5 to 18. #3789 Move the Heroku setup to the heroku-24 stack and Heroku's native multi-buildpack support. #3788 Remove the OpenShift and Cloud Foundry deployment files, whos…

H
Huginn Self-hosted v2026.10.04

v2026.10.04

v2026.10.04 Changes Upgrade to json 3.0.2, which rejects duplicate object keys and JavaScript-style comments by default. Deduplicate automatic Agent checks from schedules and controller Agents while a check is queued, running, or awaiting retry. #3767 Move navigation labels to translation keys while preserving the English text. #3763 Upgrade the bundled database and Docker Compose MySQL services t…

H
Huginn Self-hosted v2026.09.22

v2026.09.22

v2026.09.22 JSONPath safety and compatibility Restrict legacy JSONPath method calls to an allowlist for JSON value types. The guard also covers filters, computed indexes, and direct uses of the jsonpath gem. See GHSA-9x7r-mpvj-vj8v. Use RFC 9535 JSONPath evaluation by default. Agents requiring legacy behavior can use use_legacy_jsonpath: true; legacy evaluation remains subject to the method allowl…

H
Huginn Self-hosted v2026.09.21

v2026.09.21

v2026.09.21 This release improves recovery from stalled background jobs, adds opt-in proxy routing for individual Agents, and updates the Ruby and Docker runtimes. Background jobs Add an optional delayed_job_master process that forks single-threaded workers on demand. Set DELAYED_JOB_WORKERS to control concurrency and DELAYED_JOB_MAX_MEMORY to recycle workers after jobs that exceed the memory limi…

H
Huginn Self-hosted v2026.09.09

v2026.09.09

v2026.09.09 This release adds a way to keep Agents from reaching internal addresses on shared instances, and hardens several defaults. Agents that fetch URLs and the Scenario import form request whatever URL a user configures, so on an instance where untrusted users can create Agents, any user could make the server connect to loopback, private-network or cloud metadata addresses. Huginn can now ro…

H
Huginn Self-hosted v2026.09.08

v2026.09.08

This security release fixes three issues: A Scenario description containing HTML could execute script in the browser of a user importing the Scenario, both in the import preview and after the import. Scenario icons were likewise stored without validation. Any authenticated user could read any file readable by the Huginn process by handing a file pointer to a file-consuming Agent, even with ENABLE_…

H
Huginn Self-hosted v2026.08.27

v2026.08.27

This security release fixes four issues: A crafted PdfInfoAgent event URL could execute arbitrary shell commands even when insecure Agents were disabled. An authenticated user could bind another user's private OAuth Service to an Agent, allowing the Agent to use the other user's stored OAuth credential. An authenticated user could manually trigger event propagation across other users' Agents. Conc…

H
Huginn Self-hosted v2022.08.18

v2022.08.18

What's Changed Mismatched ruby versions - updated to 2.6.9 by @2600box in #3058 Drop BasecampAgent by @knu in #3056 made mysql flush appear as code by @2600box in #3059 Migrate from RR to RSpec Mocks by @knu in #3066 fix error 'tried to create Proc object without a block' in Gemfile by @JaHIY in #3097 Upgrade mini_racer to the latest version by @knu in #3103 Add a Liquid variable referring to the…