recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

upstream(n8n): release-notes sources 2.38.x

Browse Source
This commit is contained in:
autonomic-bot
2026-09-07 21:49:50 +00:00
parent b360bfbb7c
commit be9687962c
1 changed files with 34 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cc-ci-plan/upstream/n8n.md
+34
View File
@@ -137,3 +137,37 @@
2.37.5 withdrawn). 2.36.9 holds the Stable/Latest badge; 2.37.x remains Pre-release on GitHub
(consistent precedent). Re-verified 2.37.3→2.37.6 (pure core bugfixes), no breaking changes beyond
the already-flagged 2.37.0 API behavior pair. Rolling upgrade safe. Recommended release: `-y`.
- 2.37.7 (2026-09-01, patch): core/editor bugfixes (distroless runners glibc/libatomic copy; thread
execution id through dynamic-credential storage; scope active workflow IDs to user's projects;
route secrets pasted in AI chat to real credential forms; gate autosave on document hydration).
- 2.37.8/2.37.9/2.37.10/2.37.11 (2026-09-02..04, patches): mostly core/editor/ai-builder bugfixes.
2.37.9 and 2.37.10 are noted on the Releases page; 2.37.11 = 1 core fix (thread execution id through
dynamic-credential storage backport). No breaking compose/env/migration changes.
- 2.38.0 (2026-09-01, Pre-release): the 2.38 feature minor — a large feature/bugfix release (Confluence
page/space operations, Databricks user-delegated OAuth2, Moonshot/MiniMax/Qwen Cloud model providers
in Agent Builder, background sub-agent delegation, nonce-based Content-Security-Policy on HTML pages,
chat trigger publish validation + workflow:execute access control, restore mutating array methods on
$json in expressions, MongoDB bulkWrite, etc.). No breaking compose/env/migration changes; no
`N8N_*` env renames; the 2.37.0 API behavior pair (JSON content-type on decorator body routes;
binary-data endpoint adapt) still applies to HTTP API callers only.
- 2.38.1 (2026-09-01, Pre-release): a large patch — bugfixes (mongodb sort/projection parameter
binding; S3 startup connection timeout; domain-restricted credential in own node; OAuth token grant
binding; restore mutating array methods on $json in expressions; etc.) + features (n8n credits
section in agent tools modal, Confluence page get comments/labels/space, Moonshot/MiniMax/Qwen Cloud
model providers, nonce-based CSP, split hosted chat page into trusted shell + sandboxed frame).
No breaking compose/config changes.
- 2.38.2 (2026-09-02, Pre-release): core bugfix (restore ...) — see Releases page.
- 2.38.3 (2026-09-0?, Pre-release): patch bugfixes (bundle backports to 2.38.x release track —
egress filtering, credential-destination grants, proxy-agent behavior, shared-workflow/user queries;
nonce-based CSP on HTML pages). No breaking compose/config changes.
- 2.38.4 (2026-09-0?, Pre-release; **newest 2.38.x tag** — abra lists it as the top upgrade candidate):
patch bugfixes. No breaking compose/env/migration changes; rolling upgrade safe (sqlite, TypeORM
auto-migrate on boot). The 2.37.0 API behavior pair (JSON content-type on decorator body routes;
binary-data endpoint adapt) still applies — HTTP API callers only, no recipe impact.
- 2026-09-07 run: PR #7 extended 2.34.4 → **2.38.4** (newest tag abra lists; 2.37.5/2.38.0-era withdrawn
tags skipped). 2.38.x line remains Pre-release on GitHub (consistent tracking-the-newest-tag
precedent: 2.34.2/2.35.2/2.36.3/2.37.3/2.37.6 were all Pre-release when taken). Rolling upgrade safe
(sqlite, TypeORM auto-migrate on boot). No breaking compose/config changes for the recipe. Operator
flag (unchanged from 2.37.0): the two API behavior changes only affect HTTP API callers. Recommended
release: `-y` (feature minor across 2.34.4 → 2.38.4). CVE-2026-73088 was adjudicated NOT-FIXED in the
2.x window by the 2026-09-04 parent run; not blocking.