From 9c619abd6ce5c267d742c4fa8dfa5c6e7ade0c1c Mon Sep 17 00:00:00 2001
From: autonomic-bot <autonomic-bot@git.autonomic.zone>
Date: Fri, 28 Aug 2026 04:15:13 +0000
Subject: [PATCH] upstream(n8n): release-notes sources 2.36.4..2.37.3

---
 cc-ci-plan/upstream/n8n.md | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/cc-ci-plan/upstream/n8n.md b/cc-ci-plan/upstream/n8n.md
index 0c23ba2..b57cd3f 100644
--- a/cc-ci-plan/upstream/n8n.md
+++ b/cc-ci-plan/upstream/n8n.md
@@ -79,3 +79,35 @@
 - 2026-08-21 run: planning 2.34.4 → 2.36.3 (newest tag abra lists). Whole 2.36.x line still
   Pre-release on GitHub (2.33.5/Latest was superseded by 2.35.x line). Rolling upgrade safe, sqlite
   mode, TypeORM migrations auto-run on boot. No operator action required.
+- 2.36.4 (2026-08-21, Pre-release): 3 core fixes (env normalization before schema parsing; chat and
+  MCP trigger auth-mode validation for end-user credentials; wrap trigger closeFunction in an
+  expression isolate).
+- 2.36.5 (2026-08-21, Pre-release): 1 core fix (raise AI Assistant model verification token limit).
+- 2.36.6 (2026-08-24): 1 editor fix (personalization survey / community registration modal on
+  Instance AI landing page).
+- 2.36.7 (2026-08-25, **current Stable / Latest badge**; `stable` tag points here): API fix (adapt
+  binary data endpoint), API cross-backport (require a JSON content type on decorator routes that
+  take a body), core fixes (reconcile license auto-renewal on startup leader takeover; route OAuth2
+  token requests through environment proxies), feature (remove offset query param from list workflow
+  history endpoint). This is the newest stable-line release; the 2.37.x line is still pre-release.
+- 2.37.0 (2026-08-25, Pre-release): a large feature minor. Agent Builder / AIA / core/editor
+  bugfixes + features (Slack Agent view, prompt caching for Anthropic, SharePoint node v2 = default,
+  form-trigger OAuth2 (added then reverted), role-mapping rule CRUD endpoints, execution
+  startedAfter/startedBefore filters, Agent/community-package hardening: serialize community
+  package installs + non-destructive downloads + cold-boot storm reduction, MCP tool schemas as JSON
+  Schema 2020-12, distroless n8n image variant). **Deprecation: the "Any workflow" caller policy**
+  (API/config-level — flag for operators using execution-caller policies). Two enforced API behavior
+  changes: **require JSON content type on decorator body routes** and **"adapt binary data endpoint"**
+  (HTTP clients sending a body to those routes must send `Content-Type: application/json`). No
+  breaking compose/env/migration changes, no `N8N_*` env renames.
+- 2.37.1 (2026-08-25, Pre-release): 1 core fix (route OAuth2 token requests through env proxies in
+  every process).
+- 2.37.3 (2026-08-27, Pre-release; 2.37.2 was withdrawn): 2 runner-image fixes (copy glibc into
+  distroless runners image as a matched pair; stage libatomic into the distroless runners image) —
+  relevant if using n8n's community/distroless runner image.
+- 2026-08-28 run: PR #7 extended 2.34.4 → **2.37.3** (newest tag abra lists; 2.37.2 withdrawn, that
+  tag does not exist). 2.36.7 holds the Stable/Latest badge; 2.37.x remains Pre-release on GitHub,
+  consistent with the tracking-the-newest-tag precedent (2.34.2/2.35.2/2.36.3 were pre-release when
+  taken). Rolling upgrade safe (sqlite, TypeORM auto-migrate on boot). Operator flag: the two 2.37.0
+  API behavior changes (JSON content-type on decorator body routes; binary-data endpoint adapt) only
+  affect HTTP API callers. Recommended release: `-y` (feature minor).