diff --git a/cc-ci-plan/upstream/n8n.md b/cc-ci-plan/upstream/n8n.md
index 7f79860..06ad216 100644
--- a/cc-ci-plan/upstream/n8n.md
+++ b/cc-ci-plan/upstream/n8n.md
@@ -254,3 +254,51 @@
   compose/env changes; no new migrations beyond the 15 already verified at 2.40.2. Stable badge
   now on the 2.39.x line (2.39.9/2.39.10 released 2026-09-21); 2.40.x pre-release per precedent.
   Recommended release: `-y`.
+- 2.40.6 (2026-09-24, patch): core fixes (keep OpenTelemetry export working after a restart when
+  Sentry is enabled; retry instance reports that cross the UTC midnight boundary) + feature
+  (authenticate instance reports with the license certificate).
+- 2.40.7 (2026-09-25, patch): 1 core fix (propagate project span attributes to node spans).
+- 2.41.0 (2026-09-22, Pre-release; the 2.41 feature minor — note the 2.40.x patch line continued
+  alongside with 2.40.6/2.40.7): a large feature/bugfix release. Features: standalone node
+  execution as a Workflow Builder / AI Assistant tool, admin permission for node execution in the
+  assistant, API credential creation with source IDs, push-based reload endpoint for custom-node
+  development, execution view/delete permissions in project roles, MCP-registry capability
+  filtering, Databricks Embeddings/Chat-Model node, MS Teams @mentions + a Chat resource, MiniMax
+  dynamic model list, email-change confirmation flow. Core bugfixes include repair of
+  data-encryption keys stored as the raw instance key, stalled-job success finalization,
+  multi-main workflow-publishing fix, stop an unreachable external-secrets provider blocking
+  startup, undici 7.29.1 + vm2 3.12.2 bumps, RFC 9068 MCP OAuth compliance. **No breaking
+  compose/env/migration changes; no `N8N_*` env renames.** (2.41.1/2.41.2 = patch bugfixes.)
+- 2.41.3 (2026-09-25, patch): 1 core fix (propagate project span attributes to node spans). Last
+  week's PR #9 target — !testme GREEN (run 21, 2026-09-28); TypeORM migrations clean live.
+- 2.41.4 (2026-09-30, patch): API/core/editor fixes (return an execution when its stored trace
+  context is incomplete; count a database ping as successful when its reply arrives during
+  event-loop lag; store queue job results only for executions this process enqueued) + features
+  (n8n Assistant onboarding thread for new Cloud signups; route assistant credit CTAs to top-up).
+- 2.41.5 (2026-10-01, patch): atom-feed release body empty (release republish / no listed changes).
+- 2.42.0 (2026-09-29, Pre-release; the 2.42 feature minor): a large feature/bugfix release.
+  Features: AI Agent Tool can use its own tools under a pre-v3 parent agent, workflow descriptions
+  on create, `extendsCredential` in workflow create/update, OpenAPI path-parameter validation,
+  credential descriptions behind an instance flag, Anthropic prompt caching in the Message op,
+  API projects with source IDs, pinned Apply/Apply-Continue CLI commands, MCP-registry feature-flag
+  removal, Agent Builder/editor improvements. ~60 core/editor/node bugfixes (chat-integration
+  shutdown, Redis pubsub reconnect + half-open detection, OTel-after-restart-with-Sentry,
+  instance-report unique index, expression-isolate release, async delete retries). **No breaking
+  compose/env/migration changes; no `N8N_*` env renames.**
+- 2.42.1 (2026-09-30, patch): API/editor fixes (emit valid schemas for untyped values in the Public
+  API spec; return an execution when its trace context is incomplete) + editor feature (show the
+  n8n logo on canvas in canvas-only mode).
+- 2.42.2 (2026-10-01, patch; **newest numeric tag on Docker Hub — verified 2026-10-02**): 1 core
+  fix (stop waiting on Bull `job.finished()` for queued executions). Docker Hub `2.42.2` manifest
+  active; no 2.43.x exists.
+- 2026-10-02 run: reconcile confirmed coopcloud upstream main still `9141e23` (3.5.1+2.40.5) and
+  PR #9 (branch `upgrade-a144baf`, at 2.41.3, !testme GREEN 2026-09-28) still open/unmerged — so
+  per the one-evolving-PR contract the run extends PR #9 with a fast-forward commit
+  **2.40.5 → 2.42.2**. abra lists 2.42.2 as the newest candidate and a direct Docker Hub tag
+  enumeration agrees (no 2.43.x). The delta spans two feature minors (2.41.0, 2.42.0) plus patches
+  on both lines; **no breaking compose/env/migration changes, no `N8N_*` renames**. Rolling
+  upgrade safe (sqlite default; TypeORM migrations auto-run on boot). Operator flags remain
+  HTTP-API-caller-level only (2.33.0 workflow activate/deactivate deprecation; 2.36.0
+  `Array.merge`→`mergeIntoObject`; 2.37.0 JSON content-type on decorator body routes + binary-data
+  endpoint adapt; 2.39.0 workflow-version endpoint deprecation; 2.40.x `POST /rest/login`
+  `emailOrLdapLoginId` rename). Recommended release: `-y`.