From dc6aa1c2c41e038e6831c843d19cf0e11b902e17 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Fri, 11 Sep 2026 07:27:07 +0000 Subject: [PATCH] upstream(n8n): release-notes sources 2.38.5-2.39.2 (2026-09-11 run) --- cc-ci-plan/upstream/n8n.md | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/cc-ci-plan/upstream/n8n.md b/cc-ci-plan/upstream/n8n.md index e897ba6..7e0697f 100644 --- a/cc-ci-plan/upstream/n8n.md +++ b/cc-ci-plan/upstream/n8n.md @@ -171,3 +171,37 @@ flag (unchanged from 2.37.0): the two API behavior changes only affect HTTP API callers. Recommended release: `-y` (feature minor across 2.34.4 → 2.38.4). CVE-2026-73088 was adjudicated NOT-FIXED in the 2.x window by the 2026-09-04 parent run; not blocking. +- 2.38.5 (2026-09-09, patch): 1 core fix (keep reporting the original job error when the job key is + gone). +- 2.38.6 (2026-09-10, patch; **Stable/Latest badge**): 1 perf fix (bound peak memory during source + control push). +- 2.39.0 (2026-09-08, Pre-release): the 2.39 feature minor — large feature/bugfix release. Features: + source-control push/pull + status endpoints in the public API, **workflow version endpoint + (deprecates the old two-variable path — API-level deprecation)**, Instance reporting module, opt-in + concurrency limits for Instance AI runs, OTLP gRPC support for OTel, Confluence/Jira Atlassian + Service Account (2LO) auth, MS Teams channel-message + Online Meeting ops, Databricks partner UA + + hidden chat model, Instance AI folder exploration / past-conversation search / credential-selection + guidance, **encryption-key module rework** (always load the encryption module and seed keys safely + on startup; cache keys in memory; pluggable write path with rotation moved into the module; signing + deployment keys stored in the same wrapped form as data-encryption keys), deprecate + hide the Ask + AI tab in the Code node. Many core/editor/node fixes (webhook Set-Cookie response headers; OTel + header redaction in settings; Azure OpenAI classic/Foundry credential fix; OIDC failed-login + redirect; Qdrant client update for Node 26; AMQP trigger receiver reattach; Anthropic disabled + thinking; etc.). No breaking compose/env/migration changes; no `N8N_*` env renames. +- 2.39.1 (2026-09-09, Pre-release): 1 core fix — **repair legacy-format data-encryption keys during + bootstrap** (upgrade-relevant: old-format keys are repaired, not rejected). +- 2.39.2 (2026-09-10, Pre-release): 2 core fixes (memoize pairedItem ancestry traversal; reuse an + existing consent grant after the visitor authenticates mid-flow) + 1 perf (stop copying user + workflows into the Instance AI sandbox). Docker Hub `2.39.2` manifest verified multi-arch + (amd64 + arm64, active, 2026-09-10). +- 2026-09-11 run: survey framed 2.34.4 → 2.39.2, but the morning reconcile closed PR #7 as + merged-upstream and upstream main released **3.5.0+2.38.4** — so the effective compose window is + **2.38.4 → 2.39.2** on a FRESH branch (no open upgrade PR to extend). 2.38.6 holds the + Stable/Latest badge; 2.39.x is Pre-release (consistent tracking-the-newest-tag precedent: + 2.34.2/2.35.2/2.36.3/2.37.3/2.37.6/2.38.4 were all Pre-release when taken). Rolling upgrade safe + (sqlite mode, TypeORM auto-migrate on boot). Live-deploy watch item: the 2.39.0 encryption-key + module rework + 2.39.1 legacy-key repair (recipe injects N8N_ENCRYPTION_KEY as a secret). + Operator flags, all HTTP-API-caller-level only: 2.33.0 workflow activate/deactivate deprecation; + 2.36.0 Array.merge→mergeIntoObject + workflow-tags API migration; 2.37.0 "Any workflow" caller-policy + deprecation + JSON content-type on decorator body routes + binary-data endpoint adapt; 2.39.0 + workflow-version endpoint deprecation. Recommended release: `-y` (feature minor).