# Upstream sources — n8n

| service | image | source repo | releases / changelog |
|---------|-------|-------------|----------------------|
| app     | n8nio/n8n | https://github.com/n8n-io/n8n | https://github.com/n8n-io/n8n/releases |
| db      | pgautoupgrade/pgautoupgrade | https://github.com/pgautoupgrade/docker-pgautoupgrade | https://hub.docker.com/r/pgautoupgrade/pgautoupgrade/tags |

## Standing notes
- pgautoupgrade uses a non-standard tag scheme (e.g. `17-alpine`, `18-alpine`) mapping to the TARGET
  Postgres major version. `18-alpine` = upgrade-on-start to Postgres 18. The compose.postgres.yml
  controls this image; the main compose.yml uses only `n8nio/n8n` (sqlite mode).
- n8n 2.x: standard rolling upgrade is safe between 2.x versions; DB migrations run automatically on startup.
  Confirmed live on cc-ci 2026-07-15 (2.27.2 -> 2.31.0, sqlite mode): all TypeORM migrations completed
  cleanly on boot, editor served HTTP 200 immediately after.
- The n8n Docker image on Docker Hub uses plain semver tags (e.g. `2.25.3`); no `-stable` suffix needed.
- `https://docs.n8n.io/release-notes/` now 404s (checked 2026-07-15) -- n8n appears to have dropped the
  docs-site changelog. Use GitHub Releases instead: https://github.com/n8n-io/n8n/releases (tag format
  `n8n@<version>`, e.g. `n8n@2.31.0`) -- this is the canonical source now.
- 2.31.0 shipped "private credentials enabled by default" (UI renamed to "end-user credentials") and a
  Notion node API migration -- functional/UX changes worth a heads-up to the operator, not deployment
  blockers (no compose/env/migration impact).
- 2.32.0 (minor, 2026-06-xx): Instance AI / AI Agent builder + core bug fixes. No breaking changes, no
  `N8N_*` env renames, no required manual migration. 2.32.1-2.32.7 = patch bugfixes (AI Agent preview
  rename to "V1", agent channel credential setup, Instance AI follow-up-loop guard, AI Assistant
  verification LLM fallback). Confirmed live on cc-ci 2026-07-24 (2.31.0 -> 2.32.4): TypeORM migrations
  clean, editor served HTTPS 200.
- 2.33.0 (minor, 2026-07-28; GitHub release marked "Pre-release" but the 2.33.x line stabilized --
  2.33.3 carries the "Latest" badge): features = admin-managed instance credentials, workflow review
  requests + publish/unpublish public API endpoints, **API deprecation of workflow activate/deactivate
  public API endpoints** (replaced by publish/unpublish; old endpoints still work but deprecated -- flag
  for operators who automate via the public API), new OPTIONAL env `N8N_SCHEDULER_MAX_ATTEMPTS`
  (scheduler dead-letter threshold), OpenTelemetry config API, Microsoft Excel (SharePoint) node, custom
  OAuth scopes for Google/Microsoft creds. `core: Prevent concurrent instance startups from racing
  database migrations` is a relevant migration-safety fix. No breaking compose/config changes; no
  required operator action for the recipe. 2.33.1-2.33.3 = patch bugfixes (2.33.3: security-audit risk
  reporter import + MCP server trigger execution-data save).
- 2.34.0 (2026-08-04, marked **Pre-release** on GitHub) is a larger minor (Agent management in
  instance MCP, LDAP/OIDC SSO config API, editor OIDC logout, durable-scheduler misfire policy, etc.).
  The GitHub release body lists mostly "Bug Fixes" (core task-broker/runner resilience, SSE/OTel fixes,
  editor OAuth/credential/agent-credential fixes); no breaking compose/env/migration changes, no
  `N8N_*` env renames. No required operator action for the recipe.
- 2.33.4 (2026-08-05, patch): core task-broker resilience when a runner dies + recover unresponsive
  task runners; template "see all" tracking; skip redundant workflow-edit approval in AI Assistant.
- 2.33.5 (2026-08-06, carries the **Latest** badge as of this run): single editor bugfix (focus
  Markdown editor input before toolbar).
- 2.34.1 (2026-08-05, Pre-release): core recover unresponsive task runners + editor agent-capability
  chip spacing.
- 2.34.2 (2026-08-06, Pre-release): editor bugfixes (focus Markdown editor input before toolbar; show
  agent tool credentials above configuration).
- 2026-08-07 run: operator directed 2.33.3 -> 2.34.2 (the newest). The whole 2.34.x line is still
  marked Pre-release on GitHub (2.33.5 holds the Latest badge); flagged in the PR body. No breaking
  changes across 2.33.3 -> 2.34.2; rolling upgrade safe (TypeORM migrations auto-run on boot).
- 2.35.0 (2026-08-11, Pre-release): major feature release — self-hosted AI Assistant onboarding,
  Simplified Custom Auth credentials, Agent Builder test runs + HITL, Discord agent chat channel,
  local agent token counting, **VM expression engine now the default** (was opt-in), MCP SDK v2
  migration + MCP 2026-07-28 discovery handshake, Kafka Node v2, Salesforce OAuth2 JWT, GitHub
  dispatch timeout, X/Twitter Node OAuth2/API migrated to x.com, Azure Key Vault configurable
  endpoints, Postgres-version startup warning, workflow review improvements (diffs, metadata, version
  descriptions), and numerous core/editor bugfixes. No breaking compose/config/migration changes.
- 2.35.1 (2026-08-12, Pre-release): 2 core bugfixes — data-tables resume scope, TLS options per hop
  through a proxy.
- 2.35.2 (2026-08-13, Pre-release): 1 core bugfix — report real activation mode for triggers via
  publication outbox. **Deployed on cc-ci 2026-08-15**: 2.34.4→2.35.2, TypeORM migrations clean,
  editor served HTTP 200. No breaking changes, no N8N_* env renames, no required operator action.
- 2.35.3 (2026-08-14, Pre-release): bugfixes (Google Ads v21→v25 API migration, MS Teams OAuth scope
  restore, workflow publication outbox abort deadline) + feature (skip update approval for workflows
  from same Instance AI session). Not deployed (2.35.2 was the survey target).
- 2.36.0 (2026-08-18, Pre-release; 2.36.1 was briefly tagged then withdrawn — 2.36.2 compares
  2.36.0...2.36.2): a large feature minor. Core/ai-builder/editor bugfixes + new features (Agent
  sandboxes + writable workspaces, MCP folder/move/read-data-table tools, Schedule Trigger missed-
  execution grace period + catch-up coalescing, Confluence Cloud OAuth2 + page get sub-tree, MiniMax
  M3/H3, LangSmith session debug export, role-mapping/roles API endpoints, n8n User Auth GA, etc.).
  No breaking compose/env/migration changes, no `N8N_*` env renames; the deprecation notices
  (Array.merge→Array.mergeIntoObject in expressions, workflow tags API migration) are API-level only.
  2.36.2 (2026-08-19, patch): 3 fixes (decorator-route request schema in /discover, end-user
  credential resolution in node parameters, editor agent-preview alignment). 2.36.3 (2026-08-20,
  patch): 4 core/editor fixes (task-runners only restart when slow, expression engine init on
  expression commands, test-webhook isolate release after teardown, Edit Fields type selector styles).
- 2026-08-21 run: planning 2.34.4 → 2.36.3 (newest tag abra lists). Whole 2.36.x line still
  Pre-release on GitHub (2.33.5/Latest was superseded by 2.35.x line). Rolling upgrade safe, sqlite
  mode, TypeORM migrations auto-run on boot. No operator action required.