diff --git a/cc-ci-plan/upstream/n8n.md b/cc-ci-plan/upstream/n8n.md
index 610bc30..a73f325 100644
--- a/cc-ci-plan/upstream/n8n.md
+++ b/cc-ci-plan/upstream/n8n.md
@@ -354,3 +354,35 @@
   converged. Advisory scan 2.43.2→2.43.6: 0 CVEs fixed (9 sources, none failed). Recommended
   release: `-y` (relative to the published label app tag 2.40.5 the delta spans feature minors
   2.41/2.42/2.43).
+- 2.43.7 (2026-10-16, patch): core suspend in-flight production executions at worker shutdown.
+- 2.43.8 (2026-10-19, patch): core turn off expression spans by default (backport of 2.44.4).
+- 2.44.3 (2026-10-16, patch): core keep Observer detail lines instead of discarding the response.
+- 2.44.4 (2026-10-19, patch): core reuse connections in the log-streaming webhook destination; turn
+  off expression spans by default.
+- 2.44.5 (2026-10-21, patch): core key queue job outcomes by job on shutdown resume; editor load
+  credential types on startup.
+- 2.44.6 (2026-10-22, patch; **`stable` floating tag points here**): Postgres Node prevent global
+  pgtypes overwrite.
+- 2.45.0 (2026-10-20, Pre-release; the 2.45 feature minor): automated migrations for removed nodes;
+  node and credential type policies enabled by default; durable scheduler enabled by default;
+  Idempotency-Key on Public API POSTs; workflow migration-findings endpoints/notifications; Kafka v2
+  default for new nodes; Monday.com V2 default; AI Agent/Assistant, editor and node fixes; UI rebrand.
+  **No breaking compose/env/volume/label changes; no `N8N_*` renames.**
+- 2.45.1 (2026-10-21, Pre-release): core claim an idle worker's next queue job and its lock atomically;
+  Microsoft Teams Trigger Graph subscription renewal via lifecycle notifications; editors can triage
+  migration findings.
+- 2.45.2 (2026-10-22, Pre-release; **`beta` floating tag points here — newest numeric tag**): core read
+  type-availability policies from memory at enforcement points; Postgres Node prevent global pgtypes
+  overwrite; migration report CSV export; OAuth-confirmation/email logo update.
+- 2026-10-23 run: reconcile confirmed coopcloud upstream main moved to `c834df2` ("NODE_FUNCTION_ALLOW_EXTERNAL
+  in env file", on top of 3.5.1+2.40.5) and PR #9 (branch `upgrade-a144baf`, at 2.43.6) still
+  open/unmerged. Per the one-evolving-PR contract, PR #9 extended **2.40.5 → 2.45.2** (explicit target
+  = highest tag abra lists). 2.45.x is the current Pre-release/beta line; **stable = 2.44.6** (verified
+  live via Docker Hub floating tags), flagged to the operator. Window spans feature minors 2.41–2.45,
+  but release notes show **no breaking compose/env/volume/label changes and no `N8N_*` renames**.
+  Live-deployed on cc-ci `dev-n8n`: TypeORM migrations completed cleanly through
+  `CreatePromotionRunAndReviewTables1792139680417`, editor accessible, `/healthz` 200, `/rest/login`
+  401; runtime deprecation warnings only (`WEBHOOK_URL`→`N8N_WEBHOOK_URL`, internal runner mode,
+  unverified-packages default, runner-timeout/compression-limit default reductions). Advisory scan
+  2.40.5→2.45.2: 0 CVEs identified, BUT the GitHub advisory sources failed (unauthenticated rate
+  limit) — scan incomplete, not to be read as clean. Recommended release: `-y`.