This security release fixes stored cross-site scripting (XSS) in shared OAuth service names and Agent descriptions. It also adds CSRF protection to administrator user switching. Upgrade all installations, especially those with multiple users or imported scenarios.

Security fixes

Escape OAuth service names on Agent pages. A user could share a service with a crafted display name and run JavaScript in the session of another user who attached it to an Agent and viewed the Agent page. Thanks to @leediay153 for reporting this issue. GHSA-rjw9-xx87-f2ww
Sanitize Agent descriptions after rendering Markdown. Crafted Agent options, including those in imported scenarios, could inject active HTML into descriptions.
Require POST requests with CSRF protection for switching to another user and returning to the original administrator. Administrator authentication is still required to switch users.

Upgrade notes

No database migration is required for these fixes. Update to v2026.11.05 and restart Huginn's processes, or pull and recreate containers using the official release images. Custom clients using the user-switching endpoints must use POST with a valid CSRF token; GET is no longer supported. Custom Agent descriptions now allow safe HTML only.

Other changes

Lock GitHub Actions dependencies and verify the action lockfile in CI. #3825
Record container publishing deployments in GitHub Actions.

Full Changelog: https://github.com/huginn/huginn/compare/v2026.11.01...v2026.11.05