recipe-maintainers/cc-ci-orchestrator
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

upstream(n8n): release-notes sources 2.38.5-2.39.2 (2026-09-11 run)

Browse Source
This commit is contained in:
autonomic-bot
2026-09-11 07:27:07 +00:00
parent 951a108c1f
commit dc6aa1c2c4
1 changed files with 34 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cc-ci-plan/upstream/n8n.md
+34
View File
@@ -171,3 +171,37 @@
flag (unchanged from 2.37.0): the two API behavior changes only affect HTTP API callers. Recommended
release: `-y` (feature minor across 2.34.4 → 2.38.4). CVE-2026-73088 was adjudicated NOT-FIXED in the
2.x window by the 2026-09-04 parent run; not blocking.
- 2.38.5 (2026-09-09, patch): 1 core fix (keep reporting the original job error when the job key is
gone).
- 2.38.6 (2026-09-10, patch; **Stable/Latest badge**): 1 perf fix (bound peak memory during source
control push).
- 2.39.0 (2026-09-08, Pre-release): the 2.39 feature minor — large feature/bugfix release. Features:
source-control push/pull + status endpoints in the public API, **workflow version endpoint
(deprecates the old two-variable path — API-level deprecation)**, Instance reporting module, opt-in
concurrency limits for Instance AI runs, OTLP gRPC support for OTel, Confluence/Jira Atlassian
Service Account (2LO) auth, MS Teams channel-message + Online Meeting ops, Databricks partner UA +
hidden chat model, Instance AI folder exploration / past-conversation search / credential-selection
guidance, **encryption-key module rework** (always load the encryption module and seed keys safely
on startup; cache keys in memory; pluggable write path with rotation moved into the module; signing
deployment keys stored in the same wrapped form as data-encryption keys), deprecate + hide the Ask
AI tab in the Code node. Many core/editor/node fixes (webhook Set-Cookie response headers; OTel
header redaction in settings; Azure OpenAI classic/Foundry credential fix; OIDC failed-login
redirect; Qdrant client update for Node 26; AMQP trigger receiver reattach; Anthropic disabled
thinking; etc.). No breaking compose/env/migration changes; no `N8N_*` env renames.
- 2.39.1 (2026-09-09, Pre-release): 1 core fix — **repair legacy-format data-encryption keys during
bootstrap** (upgrade-relevant: old-format keys are repaired, not rejected).
- 2.39.2 (2026-09-10, Pre-release): 2 core fixes (memoize pairedItem ancestry traversal; reuse an
existing consent grant after the visitor authenticates mid-flow) + 1 perf (stop copying user
workflows into the Instance AI sandbox). Docker Hub `2.39.2` manifest verified multi-arch
(amd64 + arm64, active, 2026-09-10).
- 2026-09-11 run: survey framed 2.34.4 → 2.39.2, but the morning reconcile closed PR #7 as
merged-upstream and upstream main released **3.5.0+2.38.4** — so the effective compose window is
**2.38.4 → 2.39.2** on a FRESH branch (no open upgrade PR to extend). 2.38.6 holds the
Stable/Latest badge; 2.39.x is Pre-release (consistent tracking-the-newest-tag precedent:
2.34.2/2.35.2/2.36.3/2.37.3/2.37.6/2.38.4 were all Pre-release when taken). Rolling upgrade safe
(sqlite mode, TypeORM auto-migrate on boot). Live-deploy watch item: the 2.39.0 encryption-key
module rework + 2.39.1 legacy-key repair (recipe injects N8N_ENCRYPTION_KEY as a secret).
Operator flags, all HTTP-API-caller-level only: 2.33.0 workflow activate/deactivate deprecation;
2.36.0 Array.merge→mergeIntoObject + workflow-tags API migration; 2.37.0 "Any workflow" caller-policy
deprecation + JSON content-type on decorator body routes + binary-data endpoint adapt; 2.39.0
workflow-version endpoint deprecation. Recommended release: `-y` (feature minor).