cc-ci-orchestrator/cc-ci-plan/upstream/n8n.md

Upstream sources — n8n

service	image	source repo	releases / changelog
app	n8nio/n8n	https://github.com/n8n-io/n8n	https://github.com/n8n-io/n8n/releases
db	pgautoupgrade/pgautoupgrade	https://github.com/pgautoupgrade/pgautoupgrade	https://hub.docker.com/r/pgautoupgrade/pgautoupgrade/tags

Standing notes

• pgautoupgrade uses a non-standard tag scheme (e.g. 17-alpine, 18-alpine) mapping to the TARGET Postgres major version. 18-alpine = upgrade-on-start to Postgres 18. The compose.postgres.yml controls this image; the main compose.yml uses only n8nio/n8n (sqlite mode).
• n8n 2.x: standard rolling upgrade is safe between 2.x versions; DB migrations run automatically on startup. Confirmed live on cc-ci 2026-07-15 (2.27.2 -> 2.31.0, sqlite mode): all TypeORM migrations completed cleanly on boot, editor served HTTP 200 immediately after.
• The n8n Docker image on Docker Hub uses plain semver tags (e.g. 2.25.3); no -stable suffix needed.
• https://docs.n8n.io/release-notes/ now 404s (checked 2026-07-15) -- n8n appears to have dropped the docs-site changelog. Use GitHub Releases instead: https://github.com/n8n-io/n8n/releases (tag format n8n@<version>, e.g. n8n@2.31.0) -- this is the canonical source now.
• 2.31.0 shipped "private credentials enabled by default" (UI renamed to "end-user credentials") and a Notion node API migration -- functional/UX changes worth a heads-up to the operator, not deployment blockers (no compose/env/migration impact).
• 2.32.0 (minor, 2026-06-xx): Instance AI / AI Agent builder + core bug fixes. No breaking changes, no N8N_* env renames, no required manual migration. 2.32.1-2.32.7 = patch bugfixes (AI Agent preview rename to "V1", agent channel credential setup, Instance AI follow-up-loop guard, AI Assistant verification LLM fallback). Confirmed live on cc-ci 2026-07-24 (2.31.0 -> 2.32.4): TypeORM migrations clean, editor served HTTPS 200.
• 2.33.0 (minor, 2026-07-28; GitHub release marked "Pre-release" but the 2.33.x line stabilized -- 2.33.3 carries the "Latest" badge): features = admin-managed instance credentials, workflow review requests + publish/unpublish public API endpoints, API deprecation of workflow activate/deactivate public API endpoints (replaced by publish/unpublish; old endpoints still work but deprecated -- flag for operators who automate via the public API), new OPTIONAL env N8N_SCHEDULER_MAX_ATTEMPTS (scheduler dead-letter threshold), OpenTelemetry config API, Microsoft Excel (SharePoint) node, custom OAuth scopes for Google/Microsoft creds. core: Prevent concurrent instance startups from racing database migrations is a relevant migration-safety fix. No breaking compose/config changes; no required operator action for the recipe. 2.33.1-2.33.3 = patch bugfixes (2.33.3: security-audit risk reporter import + MCP server trigger execution-data save).
• 2.34.0 (2026-08-04, the day of this run) exists but is NOT the survey target; operator directed 2.33.3. 2.34.0 is a larger minor (Agent management in instance MCP, LDAP/OIDC SSO config API, editor OIDC logout, durable-scheduler misfire policy, etc.) -- a future run may target it.