upstream(n8n): release-notes sources 2.38.x

cc-ci-plan/upstream/n8n.md

@@ -137,3 +137,37 @@
   2.37.5 withdrawn). 2.36.9 holds the Stable/Latest badge; 2.37.x remains Pre-release on GitHub
   (consistent precedent). Re-verified 2.37.3→2.37.6 (pure core bugfixes), no breaking changes beyond
   the already-flagged 2.37.0 API behavior pair. Rolling upgrade safe. Recommended release: `-y`.
+- 2.37.7 (2026-09-01, patch): core/editor bugfixes (distroless runners glibc/libatomic copy; thread
+  execution id through dynamic-credential storage; scope active workflow IDs to user's projects;
+  route secrets pasted in AI chat to real credential forms; gate autosave on document hydration).
+- 2.37.8/2.37.9/2.37.10/2.37.11 (2026-09-02..04, patches): mostly core/editor/ai-builder bugfixes.
+  2.37.9 and 2.37.10 are noted on the Releases page; 2.37.11 = 1 core fix (thread execution id through
+  dynamic-credential storage backport). No breaking compose/env/migration changes.
+- 2.38.0 (2026-09-01, Pre-release): the 2.38 feature minor — a large feature/bugfix release (Confluence
+  page/space operations, Databricks user-delegated OAuth2, Moonshot/MiniMax/Qwen Cloud model providers
+  in Agent Builder, background sub-agent delegation, nonce-based Content-Security-Policy on HTML pages,
+  chat trigger publish validation + workflow:execute access control, restore mutating array methods on
+  $json in expressions, MongoDB bulkWrite, etc.). No breaking compose/env/migration changes; no
+  `N8N_*` env renames; the 2.37.0 API behavior pair (JSON content-type on decorator body routes;
+  binary-data endpoint adapt) still applies to HTTP API callers only.
+- 2.38.1 (2026-09-01, Pre-release): a large patch — bugfixes (mongodb sort/projection parameter
+  binding; S3 startup connection timeout; domain-restricted credential in own node; OAuth token grant
+  binding; restore mutating array methods on $json in expressions; etc.) + features (n8n credits
+  section in agent tools modal, Confluence page get comments/labels/space, Moonshot/MiniMax/Qwen Cloud
+  model providers, nonce-based CSP, split hosted chat page into trusted shell + sandboxed frame).
+  No breaking compose/config changes.
+- 2.38.2 (2026-09-02, Pre-release): core bugfix (restore ...) — see Releases page.
+- 2.38.3 (2026-09-0?, Pre-release): patch bugfixes (bundle backports to 2.38.x release track —
+  egress filtering, credential-destination grants, proxy-agent behavior, shared-workflow/user queries;
+  nonce-based CSP on HTML pages). No breaking compose/config changes.
+- 2.38.4 (2026-09-0?, Pre-release; **newest 2.38.x tag** — abra lists it as the top upgrade candidate):
+  patch bugfixes. No breaking compose/env/migration changes; rolling upgrade safe (sqlite, TypeORM
+  auto-migrate on boot). The 2.37.0 API behavior pair (JSON content-type on decorator body routes;
+  binary-data endpoint adapt) still applies — HTTP API callers only, no recipe impact.
+- 2026-09-07 run: PR #7 extended 2.34.4 → **2.38.4** (newest tag abra lists; 2.37.5/2.38.0-era withdrawn
+  tags skipped). 2.38.x line remains Pre-release on GitHub (consistent tracking-the-newest-tag
+  precedent: 2.34.2/2.35.2/2.36.3/2.37.3/2.37.6 were all Pre-release when taken). Rolling upgrade safe
+  (sqlite, TypeORM auto-migrate on boot). No breaking compose/config changes for the recipe. Operator
+  flag (unchanged from 2.37.0): the two API behavior changes only affect HTTP API callers. Recommended
+  release: `-y` (feature minor across 2.34.4 → 2.38.4). CVE-2026-73088 was adjudicated NOT-FIXED in the
+  2.x window by the 2026-09-04 parent run; not blocking.