389 lines
34 KiB
Markdown
389 lines
34 KiB
Markdown
# Upstream sources — n8n
|
||
|
||
| service | image | source repo | releases / changelog |
|
||
|---------|-------|-------------|----------------------|
|
||
| app | n8nio/n8n | https://github.com/n8n-io/n8n | https://github.com/n8n-io/n8n/releases |
|
||
| db | pgautoupgrade/pgautoupgrade | https://github.com/pgautoupgrade/docker-pgautoupgrade | https://hub.docker.com/r/pgautoupgrade/pgautoupgrade/tags |
|
||
|
||
## Standing notes
|
||
- pgautoupgrade uses a non-standard tag scheme (e.g. `17-alpine`, `18-alpine`) mapping to the TARGET
|
||
Postgres major version. `18-alpine` = upgrade-on-start to Postgres 18. The compose.postgres.yml
|
||
controls this image; the main compose.yml uses only `n8nio/n8n` (sqlite mode).
|
||
- n8n 2.x: standard rolling upgrade is safe between 2.x versions; DB migrations run automatically on startup.
|
||
Confirmed live on cc-ci 2026-07-15 (2.27.2 -> 2.31.0, sqlite mode): all TypeORM migrations completed
|
||
cleanly on boot, editor served HTTP 200 immediately after.
|
||
- The n8n Docker image on Docker Hub uses plain semver tags (e.g. `2.25.3`); no `-stable` suffix needed.
|
||
- `https://docs.n8n.io/release-notes/` now 404s (checked 2026-07-15) -- n8n appears to have dropped the
|
||
docs-site changelog. Use GitHub Releases instead: https://github.com/n8n-io/n8n/releases (tag format
|
||
`n8n@<version>`, e.g. `n8n@2.31.0`) -- this is the canonical source now.
|
||
- 2.31.0 shipped "private credentials enabled by default" (UI renamed to "end-user credentials") and a
|
||
Notion node API migration -- functional/UX changes worth a heads-up to the operator, not deployment
|
||
blockers (no compose/env/migration impact).
|
||
- 2.32.0 (minor, 2026-06-xx): Instance AI / AI Agent builder + core bug fixes. No breaking changes, no
|
||
`N8N_*` env renames, no required manual migration. 2.32.1-2.32.7 = patch bugfixes (AI Agent preview
|
||
rename to "V1", agent channel credential setup, Instance AI follow-up-loop guard, AI Assistant
|
||
verification LLM fallback). Confirmed live on cc-ci 2026-07-24 (2.31.0 -> 2.32.4): TypeORM migrations
|
||
clean, editor served HTTPS 200.
|
||
- 2.33.0 (minor, 2026-07-28; GitHub release marked "Pre-release" but the 2.33.x line stabilized --
|
||
2.33.3 carries the "Latest" badge): features = admin-managed instance credentials, workflow review
|
||
requests + publish/unpublish public API endpoints, **API deprecation of workflow activate/deactivate
|
||
public API endpoints** (replaced by publish/unpublish; old endpoints still work but deprecated -- flag
|
||
for operators who automate via the public API), new OPTIONAL env `N8N_SCHEDULER_MAX_ATTEMPTS`
|
||
(scheduler dead-letter threshold), OpenTelemetry config API, Microsoft Excel (SharePoint) node, custom
|
||
OAuth scopes for Google/Microsoft creds. `core: Prevent concurrent instance startups from racing
|
||
database migrations` is a relevant migration-safety fix. No breaking compose/config changes; no
|
||
required operator action for the recipe. 2.33.1-2.33.3 = patch bugfixes (2.33.3: security-audit risk
|
||
reporter import + MCP server trigger execution-data save).
|
||
- 2.34.0 (2026-08-04, marked **Pre-release** on GitHub) is a larger minor (Agent management in
|
||
instance MCP, LDAP/OIDC SSO config API, editor OIDC logout, durable-scheduler misfire policy, etc.).
|
||
The GitHub release body lists mostly "Bug Fixes" (core task-broker/runner resilience, SSE/OTel fixes,
|
||
editor OAuth/credential/agent-credential fixes); no breaking compose/env/migration changes, no
|
||
`N8N_*` env renames. No required operator action for the recipe.
|
||
- 2.33.4 (2026-08-05, patch): core task-broker resilience when a runner dies + recover unresponsive
|
||
task runners; template "see all" tracking; skip redundant workflow-edit approval in AI Assistant.
|
||
- 2.33.5 (2026-08-06, carries the **Latest** badge as of this run): single editor bugfix (focus
|
||
Markdown editor input before toolbar).
|
||
- 2.34.1 (2026-08-05, Pre-release): core recover unresponsive task runners + editor agent-capability
|
||
chip spacing.
|
||
- 2.34.2 (2026-08-06, Pre-release): editor bugfixes (focus Markdown editor input before toolbar; show
|
||
agent tool credentials above configuration).
|
||
- 2026-08-07 run: operator directed 2.33.3 -> 2.34.2 (the newest). The whole 2.34.x line is still
|
||
marked Pre-release on GitHub (2.33.5 holds the Latest badge); flagged in the PR body. No breaking
|
||
changes across 2.33.3 -> 2.34.2; rolling upgrade safe (TypeORM migrations auto-run on boot).
|
||
- 2.35.0 (2026-08-11, Pre-release): major feature release — self-hosted AI Assistant onboarding,
|
||
Simplified Custom Auth credentials, Agent Builder test runs + HITL, Discord agent chat channel,
|
||
local agent token counting, **VM expression engine now the default** (was opt-in), MCP SDK v2
|
||
migration + MCP 2026-07-28 discovery handshake, Kafka Node v2, Salesforce OAuth2 JWT, GitHub
|
||
dispatch timeout, X/Twitter Node OAuth2/API migrated to x.com, Azure Key Vault configurable
|
||
endpoints, Postgres-version startup warning, workflow review improvements (diffs, metadata, version
|
||
descriptions), and numerous core/editor bugfixes. No breaking compose/config/migration changes.
|
||
- 2.35.1 (2026-08-12, Pre-release): 2 core bugfixes — data-tables resume scope, TLS options per hop
|
||
through a proxy.
|
||
- 2.35.2 (2026-08-13, Pre-release): 1 core bugfix — report real activation mode for triggers via
|
||
publication outbox. **Deployed on cc-ci 2026-08-15**: 2.34.4→2.35.2, TypeORM migrations clean,
|
||
editor served HTTP 200. No breaking changes, no N8N_* env renames, no required operator action.
|
||
- 2.35.3 (2026-08-14, Pre-release): bugfixes (Google Ads v21→v25 API migration, MS Teams OAuth scope
|
||
restore, workflow publication outbox abort deadline) + feature (skip update approval for workflows
|
||
from same Instance AI session). Not deployed (2.35.2 was the survey target).
|
||
- 2.36.0 (2026-08-18, Pre-release; 2.36.1 was briefly tagged then withdrawn — 2.36.2 compares
|
||
2.36.0...2.36.2): a large feature minor. Core/ai-builder/editor bugfixes + new features (Agent
|
||
sandboxes + writable workspaces, MCP folder/move/read-data-table tools, Schedule Trigger missed-
|
||
execution grace period + catch-up coalescing, Confluence Cloud OAuth2 + page get sub-tree, MiniMax
|
||
M3/H3, LangSmith session debug export, role-mapping/roles API endpoints, n8n User Auth GA, etc.).
|
||
No breaking compose/env/migration changes, no `N8N_*` env renames; the deprecation notices
|
||
(Array.merge→Array.mergeIntoObject in expressions, workflow tags API migration) are API-level only.
|
||
2.36.2 (2026-08-19, patch): 3 fixes (decorator-route request schema in /discover, end-user
|
||
credential resolution in node parameters, editor agent-preview alignment). 2.36.3 (2026-08-20,
|
||
patch): 4 core/editor fixes (task-runners only restart when slow, expression engine init on
|
||
expression commands, test-webhook isolate release after teardown, Edit Fields type selector styles).
|
||
- 2026-08-21 run: planning 2.34.4 → 2.36.3 (newest tag abra lists). Whole 2.36.x line still
|
||
Pre-release on GitHub (2.33.5/Latest was superseded by 2.35.x line). Rolling upgrade safe, sqlite
|
||
mode, TypeORM migrations auto-run on boot. No operator action required.
|
||
- 2.36.4 (2026-08-21, Pre-release): 3 core fixes (env normalization before schema parsing; chat and
|
||
MCP trigger auth-mode validation for end-user credentials; wrap trigger closeFunction in an
|
||
expression isolate).
|
||
- 2.36.5 (2026-08-21, Pre-release): 1 core fix (raise AI Assistant model verification token limit).
|
||
- 2.36.6 (2026-08-24): 1 editor fix (personalization survey / community registration modal on
|
||
Instance AI landing page).
|
||
- 2.36.7 (2026-08-25, **current Stable / Latest badge**; `stable` tag points here): API fix (adapt
|
||
binary data endpoint), API cross-backport (require a JSON content type on decorator routes that
|
||
take a body), core fixes (reconcile license auto-renewal on startup leader takeover; route OAuth2
|
||
token requests through environment proxies), feature (remove offset query param from list workflow
|
||
history endpoint). This is the newest stable-line release; the 2.37.x line is still pre-release.
|
||
- 2.37.0 (2026-08-25, Pre-release): a large feature minor. Agent Builder / AIA / core/editor
|
||
bugfixes + features (Slack Agent view, prompt caching for Anthropic, SharePoint node v2 = default,
|
||
form-trigger OAuth2 (added then reverted), role-mapping rule CRUD endpoints, execution
|
||
startedAfter/startedBefore filters, Agent/community-package hardening: serialize community
|
||
package installs + non-destructive downloads + cold-boot storm reduction, MCP tool schemas as JSON
|
||
Schema 2020-12, distroless n8n image variant). **Deprecation: the "Any workflow" caller policy**
|
||
(API/config-level — flag for operators using execution-caller policies). Two enforced API behavior
|
||
changes: **require JSON content type on decorator body routes** and **"adapt binary data endpoint"**
|
||
(HTTP clients sending a body to those routes must send `Content-Type: application/json`). No
|
||
breaking compose/env/migration changes, no `N8N_*` env renames.
|
||
- 2.37.1 (2026-08-25, Pre-release): 1 core fix (route OAuth2 token requests through env proxies in
|
||
every process).
|
||
- 2.37.3 (2026-08-27, Pre-release; 2.37.2 was withdrawn): 2 runner-image fixes (copy glibc into
|
||
distroless runners image as a matched pair; stage libatomic into the distroless runners image) —
|
||
relevant if using n8n's community/distroless runner image.
|
||
- 2026-08-28 run: PR #7 extended 2.34.4 → **2.37.3** (newest tag abra lists; 2.37.2 withdrawn, that
|
||
tag does not exist). 2.36.7 holds the Stable/Latest badge; 2.37.x remains Pre-release on GitHub,
|
||
consistent with the tracking-the-newest-tag precedent (2.34.2/2.35.2/2.36.3 were pre-release when
|
||
taken). Rolling upgrade safe (sqlite, TypeORM auto-migrate on boot). Operator flag: the two 2.37.0
|
||
API behavior changes (JSON content-type on decorator body routes; binary-data endpoint adapt) only
|
||
affect HTTP API callers. Recommended release: `-y` (feature minor).
|
||
NOTE: PR #7's `!testme` on this date was BLOCKED — `*.ci.commoninternet.net` wildcard cert expired
|
||
(bridge: `CERTIFICATE_VERIFY_FAILED certificate has expired`). UNVERIFIED; operator renewed the cert
|
||
(now valid to 2026-11-29). The 2.37.3 work must be re-verified by a fresh `!testme`.
|
||
- 2.34.5 (2026-08-12, patch): 1 core fix (apply TLS options per hop through a proxy).
|
||
- 2.34.6 (2026-08-14, patch): 3 fixes (core `continueErrorOutput` `details` field; Google Ads sunset
|
||
v21→v25 API migration; MS Teams Restore `Group.ReadWrite.All` OAuth2 scope — matches the 2.35.3
|
||
in-progress backports).
|
||
- 2.35.4/2.35.5/2.35.6/2.35.7 (2026-08-19..21, patches): API schema for decorator routes in /discover;
|
||
Google Ads v25 view metric rename; task-runners not restarted when only slow; expression engine
|
||
init on expression commands; test-webhook isolate release after teardown; env normalization before
|
||
schema parsing; end-user credential resolution; trigger closeFunction isolate; AI Assistant token
|
||
limit raise. All patch bugfixes, no breaking changes.
|
||
- 2.36.8 (2026-08-28, patch): 1 core fix (domain-restricted credential usable in its own node) —
|
||
cross-backport of the 2.37.4 fix into the stable line.
|
||
- 2.36.9 (2026-08-31, patch; **now the Stable/Latest badge** — `stable` tag): 1 core fix (apply proxy
|
||
environment variables consistently across packages and processes, cross-backport of 2.37.1/2.37.3).
|
||
- 2.37.4 (2026-08-28, Pre-release): 1 core fix (allow a domain-restricted credential to work in its
|
||
own node).
|
||
- 2.37.5 (2026-08-31): **withdrawn** — no plain `2.37.5` tag on Docker Hub (only partial
|
||
`2.37.5-amd64/-arm64/-pc` artifact tags, no manifest). Skip entirely, like 2.37.2/2.36.1.
|
||
- 2.37.6 (2026-08-31, Pre-release; **newest 2.37.x tag**): 1 core fix (thread execution id through
|
||
dynamic-credential storage).
|
||
- 2026-08-31 run: PR #7 extended 2.34.4 → **2.37.6** (newest tag abra lists = 2.37.6/2.37.4/2.37.3/…;
|
||
2.37.5 withdrawn). 2.36.9 holds the Stable/Latest badge; 2.37.x remains Pre-release on GitHub
|
||
(consistent precedent). Re-verified 2.37.3→2.37.6 (pure core bugfixes), no breaking changes beyond
|
||
the already-flagged 2.37.0 API behavior pair. Rolling upgrade safe. Recommended release: `-y`.
|
||
- 2.37.7 (2026-09-01, patch): core/editor bugfixes (distroless runners glibc/libatomic copy; thread
|
||
execution id through dynamic-credential storage; scope active workflow IDs to user's projects;
|
||
route secrets pasted in AI chat to real credential forms; gate autosave on document hydration).
|
||
- 2.37.8/2.37.9/2.37.10/2.37.11 (2026-09-02..04, patches): mostly core/editor/ai-builder bugfixes.
|
||
2.37.9 and 2.37.10 are noted on the Releases page; 2.37.11 = 1 core fix (thread execution id through
|
||
dynamic-credential storage backport). No breaking compose/env/migration changes.
|
||
- 2.38.0 (2026-09-01, Pre-release): the 2.38 feature minor — a large feature/bugfix release (Confluence
|
||
page/space operations, Databricks user-delegated OAuth2, Moonshot/MiniMax/Qwen Cloud model providers
|
||
in Agent Builder, background sub-agent delegation, nonce-based Content-Security-Policy on HTML pages,
|
||
chat trigger publish validation + workflow:execute access control, restore mutating array methods on
|
||
$json in expressions, MongoDB bulkWrite, etc.). No breaking compose/env/migration changes; no
|
||
`N8N_*` env renames; the 2.37.0 API behavior pair (JSON content-type on decorator body routes;
|
||
binary-data endpoint adapt) still applies to HTTP API callers only.
|
||
- 2.38.1 (2026-09-01, Pre-release): a large patch — bugfixes (mongodb sort/projection parameter
|
||
binding; S3 startup connection timeout; domain-restricted credential in own node; OAuth token grant
|
||
binding; restore mutating array methods on $json in expressions; etc.) + features (n8n credits
|
||
section in agent tools modal, Confluence page get comments/labels/space, Moonshot/MiniMax/Qwen Cloud
|
||
model providers, nonce-based CSP, split hosted chat page into trusted shell + sandboxed frame).
|
||
No breaking compose/config changes.
|
||
- 2.38.2 (2026-09-02, Pre-release): core bugfix (restore ...) — see Releases page.
|
||
- 2.38.3 (2026-09-0?, Pre-release): patch bugfixes (bundle backports to 2.38.x release track —
|
||
egress filtering, credential-destination grants, proxy-agent behavior, shared-workflow/user queries;
|
||
nonce-based CSP on HTML pages). No breaking compose/config changes.
|
||
- 2.38.4 (2026-09-0?, Pre-release; **newest 2.38.x tag** — abra lists it as the top upgrade candidate):
|
||
patch bugfixes. No breaking compose/env/migration changes; rolling upgrade safe (sqlite, TypeORM
|
||
auto-migrate on boot). The 2.37.0 API behavior pair (JSON content-type on decorator body routes;
|
||
binary-data endpoint adapt) still applies — HTTP API callers only, no recipe impact.
|
||
- 2026-09-07 run: PR #7 extended 2.34.4 → **2.38.4** (newest tag abra lists; 2.37.5/2.38.0-era withdrawn
|
||
tags skipped). 2.38.x line remains Pre-release on GitHub (consistent tracking-the-newest-tag
|
||
precedent: 2.34.2/2.35.2/2.36.3/2.37.3/2.37.6 were all Pre-release when taken). Rolling upgrade safe
|
||
(sqlite, TypeORM auto-migrate on boot). No breaking compose/config changes for the recipe. Operator
|
||
flag (unchanged from 2.37.0): the two API behavior changes only affect HTTP API callers. Recommended
|
||
release: `-y` (feature minor across 2.34.4 → 2.38.4). CVE-2026-73088 was adjudicated NOT-FIXED in the
|
||
2.x window by the 2026-09-04 parent run; not blocking.
|
||
- 2.38.5 (2026-09-09, patch): 1 core fix (keep reporting the original job error when the job key is
|
||
gone).
|
||
- 2.38.6 (2026-09-10, patch; **Stable/Latest badge**): 1 perf fix (bound peak memory during source
|
||
control push).
|
||
- 2.39.0 (2026-09-08, Pre-release): the 2.39 feature minor — large feature/bugfix release. Features:
|
||
source-control push/pull + status endpoints in the public API, **workflow version endpoint
|
||
(deprecates the old two-variable path — API-level deprecation)**, Instance reporting module, opt-in
|
||
concurrency limits for Instance AI runs, OTLP gRPC support for OTel, Confluence/Jira Atlassian
|
||
Service Account (2LO) auth, MS Teams channel-message + Online Meeting ops, Databricks partner UA +
|
||
hidden chat model, Instance AI folder exploration / past-conversation search / credential-selection
|
||
guidance, **encryption-key module rework** (always load the encryption module and seed keys safely
|
||
on startup; cache keys in memory; pluggable write path with rotation moved into the module; signing
|
||
deployment keys stored in the same wrapped form as data-encryption keys), deprecate + hide the Ask
|
||
AI tab in the Code node. Many core/editor/node fixes (webhook Set-Cookie response headers; OTel
|
||
header redaction in settings; Azure OpenAI classic/Foundry credential fix; OIDC failed-login
|
||
redirect; Qdrant client update for Node 26; AMQP trigger receiver reattach; Anthropic disabled
|
||
thinking; etc.). No breaking compose/env/migration changes; no `N8N_*` env renames.
|
||
- 2.39.1 (2026-09-09, Pre-release): 1 core fix — **repair legacy-format data-encryption keys during
|
||
bootstrap** (upgrade-relevant: old-format keys are repaired, not rejected).
|
||
- 2.39.2 (2026-09-10, Pre-release): 2 core fixes (memoize pairedItem ancestry traversal; reuse an
|
||
existing consent grant after the visitor authenticates mid-flow) + 1 perf (stop copying user
|
||
workflows into the Instance AI sandbox). Docker Hub `2.39.2` manifest verified multi-arch
|
||
(amd64 + arm64, active, 2026-09-10).
|
||
- 2026-09-11 run: survey framed 2.34.4 → 2.39.2, but the morning reconcile closed PR #7 as
|
||
merged-upstream and upstream main released **3.5.0+2.38.4** — so the effective compose window is
|
||
**2.38.4 → 2.39.2** on a FRESH branch (no open upgrade PR to extend). 2.38.6 holds the
|
||
Stable/Latest badge; 2.39.x is Pre-release (consistent tracking-the-newest-tag precedent:
|
||
2.34.2/2.35.2/2.36.3/2.37.3/2.37.6/2.38.4 were all Pre-release when taken). Rolling upgrade safe
|
||
(sqlite mode, TypeORM auto-migrate on boot). Live-deploy watch item: the 2.39.0 encryption-key
|
||
module rework + 2.39.1 legacy-key repair (recipe injects N8N_ENCRYPTION_KEY as a secret).
|
||
Operator flags, all HTTP-API-caller-level only: 2.33.0 workflow activate/deactivate deprecation;
|
||
2.36.0 Array.merge→mergeIntoObject + workflow-tags API migration; 2.37.0 "Any workflow" caller-policy
|
||
deprecation + JSON content-type on decorator body routes + binary-data endpoint adapt; 2.39.0
|
||
workflow-version endpoint deprecation. Recommended release: `-y` (feature minor).
|
||
- 2.38.7 (2026-09-11, patch): 3 core fixes (MCP toolkit members on workers; consent-grant reuse;
|
||
trust the CA from GIT_SSL_CAINFO for source-control HTTPS remotes).
|
||
- 2.39.3 (2026-09-11, Pre-release): 1 core fix (GIT_SSL_CAINFO trust — 2.38.7 backport).
|
||
- 2.39.4 (2026-09-11, Pre-release): 1 core fix (sandbox npm install flags by provider).
|
||
- 2.39.5 (2026-09-14, stable line): editor fix (revoke end-user credentials) + feature
|
||
(instance-report log streaming events).
|
||
- 2.39.6 (2026-09-16, stable line): core fix (Gateway credits eligibility) + features (**v3
|
||
breaking-change rule for the storage-directory rename**; **warn on deprecated N8N_DB_PING_TIMEOUT
|
||
env var** — recipe does not set it).
|
||
- 2.39.7 (2026-09-17, stable line; **`stable` tag points here** — the stable badge moved to the
|
||
2.39.x line): core breaking-change-detection resilience; editor numeric credential inputs.
|
||
- 2.40.0 (2026-09-15, Pre-release, feature minor — large): Microsoft Dataverse core node; AI Agent
|
||
forced first-iteration tool calls; Git-based promotion model (selective promote, timestamped
|
||
branches, promotion entities/DTOs); **workflow publication service enabled by default**;
|
||
ephemeral sandboxes; agent episodic memory; ai_preference table; HTTP Request
|
||
PROPFIND/MKCOL/MOVE/COPY/REPORT; Grist OAuth2; MS Teams online-meeting/channel-message ops; v3
|
||
migration-report rules (storage-directory rename, preExecute) + "chat hub goes away" warning;
|
||
N8N_DB_PING_TIMEOUT deprecation warning; secret-redaction consolidation; queue-mode execution
|
||
timeout for stuck jobs; ~150 core/editor/node bugfixes. **No breaking compose/env/migration
|
||
changes; no N8N_* renames.**
|
||
- 2.40.1 (2026-09-16, Pre-release): GitHub release body EMPTY (maintenance republish, no listed
|
||
changes).
|
||
- 2.40.2 (2026-09-17, Pre-release): core breaking-change-detection resilience + editor numeric
|
||
credential inputs (the 2.39.7 pair on the 2.40 line). Docker Hub manifest verified active.
|
||
- 2.40.3 (2026-09-18, Pre-release): core "repair data-encryption keys stored as the raw instance
|
||
key" + editor blank-workflow-preview fix. Published the morning of the 2026-09-18 run — newer
|
||
than the operator's snapshot (which named 2.40.2 as newest); NOT taken that run (operator's
|
||
explicit target 2.40.2), flagged in the plan/PR as a trivial follow-up bump.
|
||
- 2026-09-18 run: PR #8 (branch upgrade-ef0dd56, at 2.39.2 since 2026-09-11, !testme GREEN then)
|
||
extended **2.38.4 → 2.40.2** on upstream main tip 0b436ec (still 3.5.0+2.38.4 — upstream has not
|
||
started the bump). Stable badge on 2.39.7; 2.40.x pre-release per precedent. Rolling upgrade
|
||
safe (sqlite, TypeORM auto-migrate). Operator flags unchanged (API-caller-level deprecations,
|
||
encryption-key rework informational, N8N_DB_PING_TIMEOUT warn-only, recipe doesn't set it).
|
||
2.40.3 exists (see above) — flagged, not taken. Recommended release: `-y`.
|
||
- 2.40.4 (2026-09-21, Pre-release): core fix (tear down workflow triggers when publication meets a
|
||
node type the instance cannot load) + perf (stop loading project members when listing
|
||
credentials).
|
||
- 2.40.5 (2026-09-21, Pre-release): core fix (limit declarative routing during base URL ownership
|
||
checks). Docker Hub `2.40.5` manifest verified active multi-arch (amd64+arm64, digest
|
||
sha256:9f693fd5..., 2026-09-21) — not a withdrawn 2.37.5-style partial tag. NOTE: 2.40.x
|
||
`POST /rest/login` now takes `emailOrLdapLoginId` instead of `email` (request-shape change; the
|
||
cc-ci login-state test only GETs /rest/login so unaffected).
|
||
- 2026-09-21 run: the flagged catch-up. PR #8 (branch `upgrade-ef0dd56`, at 2.40.2, !testme GREEN
|
||
2026-09-18) extended **2.40.2 → 2.40.5** on the same upstream main tip `0b436ec` (n8n NOT
|
||
merged upstream today, unlike discourse/keycloak/matrix-synapse). 2.40.2→2.40.5 is bugfix-only
|
||
(encryption-key raw-repair, trigger teardown, declarative-routing limit); no breaking
|
||
compose/env changes; no new migrations beyond the 15 already verified at 2.40.2. Stable badge
|
||
now on the 2.39.x line (2.39.9/2.39.10 released 2026-09-21); 2.40.x pre-release per precedent.
|
||
Recommended release: `-y`.
|
||
- 2.40.6 (2026-09-24, patch): core fixes (keep OpenTelemetry export working after a restart when
|
||
Sentry is enabled; retry instance reports that cross the UTC midnight boundary) + feature
|
||
(authenticate instance reports with the license certificate).
|
||
- 2.40.7 (2026-09-25, patch): 1 core fix (propagate project span attributes to node spans).
|
||
- 2.41.0 (2026-09-22, Pre-release; the 2.41 feature minor — note the 2.40.x patch line continued
|
||
alongside with 2.40.6/2.40.7): a large feature/bugfix release. Features: standalone node
|
||
execution as a Workflow Builder / AI Assistant tool, admin permission for node execution in the
|
||
assistant, API credential creation with source IDs, push-based reload endpoint for custom-node
|
||
development, execution view/delete permissions in project roles, MCP-registry capability
|
||
filtering, Databricks Embeddings/Chat-Model node, MS Teams @mentions + a Chat resource, MiniMax
|
||
dynamic model list, email-change confirmation flow. Core bugfixes include repair of
|
||
data-encryption keys stored as the raw instance key, stalled-job success finalization,
|
||
multi-main workflow-publishing fix, stop an unreachable external-secrets provider blocking
|
||
startup, undici 7.29.1 + vm2 3.12.2 bumps, RFC 9068 MCP OAuth compliance. **No breaking
|
||
compose/env/migration changes; no `N8N_*` env renames.** (2.41.1/2.41.2 = patch bugfixes.)
|
||
- 2.41.3 (2026-09-25, patch): 1 core fix (propagate project span attributes to node spans). Last
|
||
week's PR #9 target — !testme GREEN (run 21, 2026-09-28); TypeORM migrations clean live.
|
||
- 2.41.4 (2026-09-30, patch): API/core/editor fixes (return an execution when its stored trace
|
||
context is incomplete; count a database ping as successful when its reply arrives during
|
||
event-loop lag; store queue job results only for executions this process enqueued) + features
|
||
(n8n Assistant onboarding thread for new Cloud signups; route assistant credit CTAs to top-up).
|
||
- 2.41.5 (2026-10-01, patch): atom-feed release body empty (release republish / no listed changes).
|
||
- 2.42.0 (2026-09-29, Pre-release; the 2.42 feature minor): a large feature/bugfix release.
|
||
Features: AI Agent Tool can use its own tools under a pre-v3 parent agent, workflow descriptions
|
||
on create, `extendsCredential` in workflow create/update, OpenAPI path-parameter validation,
|
||
credential descriptions behind an instance flag, Anthropic prompt caching in the Message op,
|
||
API projects with source IDs, pinned Apply/Apply-Continue CLI commands, MCP-registry feature-flag
|
||
removal, Agent Builder/editor improvements. ~60 core/editor/node bugfixes (chat-integration
|
||
shutdown, Redis pubsub reconnect + half-open detection, OTel-after-restart-with-Sentry,
|
||
instance-report unique index, expression-isolate release, async delete retries). **No breaking
|
||
compose/env/migration changes; no `N8N_*` env renames.**
|
||
- 2.42.1 (2026-09-30, patch): API/editor fixes (emit valid schemas for untyped values in the Public
|
||
API spec; return an execution when its trace context is incomplete) + editor feature (show the
|
||
n8n logo on canvas in canvas-only mode).
|
||
- 2.42.2 (2026-10-01, patch; **newest numeric tag on Docker Hub — verified 2026-10-02**): 1 core
|
||
fix (stop waiting on Bull `job.finished()` for queued executions). Docker Hub `2.42.2` manifest
|
||
active; no 2.43.x exists.
|
||
- 2026-10-02 run: reconcile confirmed coopcloud upstream main still `9141e23` (3.5.1+2.40.5) and
|
||
PR #9 (branch `upgrade-a144baf`, at 2.41.3, !testme GREEN 2026-09-28) still open/unmerged — so
|
||
per the one-evolving-PR contract the run extends PR #9 with a fast-forward commit
|
||
**2.40.5 → 2.42.2**. abra lists 2.42.2 as the newest candidate and a direct Docker Hub tag
|
||
enumeration agrees (no 2.43.x). The delta spans two feature minors (2.41.0, 2.42.0) plus patches
|
||
on both lines; **no breaking compose/env/migration changes, no `N8N_*` renames**. Rolling
|
||
upgrade safe (sqlite default; TypeORM migrations auto-run on boot). Operator flags remain
|
||
HTTP-API-caller-level only (2.33.0 workflow activate/deactivate deprecation; 2.36.0
|
||
`Array.merge`→`mergeIntoObject`; 2.37.0 JSON content-type on decorator body routes + binary-data
|
||
endpoint adapt; 2.39.0 workflow-version endpoint deprecation; 2.40.x `POST /rest/login`
|
||
`emailOrLdapLoginId` rename). Recommended release: `-y`.
|
||
- 2.42.3 (2026-10-05, patch): API fix (let global members grant variable scopes to API keys) + core
|
||
fix (keep the task runner running on an unhandled promise rejection) + editor feature (Gateway
|
||
credits promotions on community nodes).
|
||
- 2.42.4 (2026-10-07, patch): release body empty (republish / no listed changes).
|
||
- 2.42.5 (2026-10-08, patch): 1 editor fix (show the Agent artifact while the builder creates it).
|
||
- 2.42.6 (2026-10-09, patch): core feature (block create/update of workflows with deprecated nodes) +
|
||
Gemini node feature (Nano Banana 2.1 + 2 Lite in the image-model list). Backport of the 2.43.3 pair
|
||
onto the stable 2.42 line.
|
||
- 2.42.7 (2026-10-12, patch): 2 core fixes (concurrent credential tests no longer share one node-type
|
||
registry; resume tool calls for deferred tools a skill loaded).
|
||
- 2.43.0 (2026-10-06, Pre-release; the 2.43 feature minor): a large feature/bugfix release. Features:
|
||
Agent Builder / Instance AI / editor improvements + ~many core/API/editor fixes (valid schemas for
|
||
untyped values in the Public API spec; global members can grant variable scopes to API keys; return
|
||
an execution when its stored trace context is incomplete; Azure OpenAI Chat Model; etc.). **No
|
||
breaking compose/env/migration changes; no `N8N_*` env renames.** (2.43.1/2.43.2 = patch bugfixes:
|
||
editor Assistant/Execute UI; Kimi K3 + OpenAI-compatible Assistant providers self-hosted; Agent
|
||
artifact preview; agent-builder prompt-caching/background-sandbox perf.)
|
||
- 2.43.3 (2026-10-09, Pre-release): core feature (block create/update of workflows with deprecated
|
||
nodes) + Gemini node feature (Nano Banana 2.1 + 2 Lite in the image-model list).
|
||
- 2.43.4 (2026-10-12, patch, **stable line**): 2 core fixes (handle each Chat Hub segment once in
|
||
queue mode; resume tool calls for deferred tools a skill loaded).
|
||
- 2.43.5 (2026-10-14, patch, stable line): core fix (validate the `size` arg of the `chunk()`
|
||
expression extension) + editor feature (show Gemini models by name / prioritised first).
|
||
- 2.43.6 (2026-10-15, patch, **stable line — `stable` floating Docker tag points here**, digest
|
||
`sha256:dd580fe1…`): 1 core fix (create an XML parser per webhook request body). Backport of the
|
||
2.44.2 fix onto the stable 2.43 line.
|
||
- 2.44.0 (2026-10-13, **Pre-release / beta line — `beta` floating Docker tag points to 2.44.2**): the
|
||
2.44 feature minor. Large core/editor change set (credential/node-type policy enforcement across
|
||
agent tools, credential tests/probes, package import, folder/credential/delete-transfer moves;
|
||
block the assistant when AI credits hit zero; per-process crash-journal paths; configurable
|
||
healthcheck timeout; Microsoft SharePoint Trigger node; many bugfixes). **No breaking
|
||
compose/env/volume/label changes; no `N8N_*` renames.**
|
||
- 2.44.1 (2026-10-14, Pre-release/beta): 1 editor feature (Gemini models by name / prioritised first).
|
||
- 2.44.2 (2026-10-15, Pre-release/beta; **newest numeric tag abra lists**; Docker Hub `beta` floating
|
||
tag = `sha256:b57e7a9c…`): 1 core fix (create an XML parser per webhook request body).
|
||
- 2026-10-09 run (not separately logged here): PR #9 (branch `upgrade-a144baf`) extended from the
|
||
2.42.2 of the 2026-10-02 run to **2.43.2** (newest numeric tag abra listed that day). 2.43.2 was
|
||
still Pre-release on GitHub at the time (tracking-the-newest-tag precedent).
|
||
- 2026-10-16 run: reconcile confirmed coopcloud upstream main still `9141e23` (3.5.1+2.40.5) and
|
||
PR #9 (branch `upgrade-a144baf`, at 2.43.2) still open/unmerged, so per the one-evolving-PR
|
||
contract the run extends PR #9 **2.43.2 → 2.43.6**. Operator guidance this run: verify whether
|
||
2.44.x is the newest STABLE line and take the newest SAFE patch. **2.44.x is the beta/pre-release
|
||
line** — GitHub marks 2.44.0/2.44.1/2.44.2 `prerelease=true`, and Docker Hub's `beta` floating tag
|
||
points at 2.44.2 while `stable` points at 2.43.6 (verified live). So the safe target is **2.43.6**
|
||
(newest patch on the now-stable 2.43 line), NOT the beta 2.44.2. 2.43.2→2.43.6 is patch-only
|
||
(2.43.3 deprecated-node workflow guard + Gemini image list; 2.43.4 Chat-Hub queue-mode + deferred
|
||
tools; 2.43.5 `chunk()` size-arg validation + Gemini picker; 2.43.6 per-request XML parser). No
|
||
breaking compose/env/migration changes. Live-deployed on cc-ci `dev-n8n` (2.40.5 → 2.43.6): TypeORM
|
||
migrations completed cleanly, editor `/rest/login` 401 (auth-gated, as expected), `/healthz` 200 —
|
||
converged. Advisory scan 2.43.2→2.43.6: 0 CVEs fixed (9 sources, none failed). Recommended
|
||
release: `-y` (relative to the published label app tag 2.40.5 the delta spans feature minors
|
||
2.41/2.42/2.43).
|
||
- 2.43.7 (2026-10-16, patch): core suspend in-flight production executions at worker shutdown.
|
||
- 2.43.8 (2026-10-19, patch): core turn off expression spans by default (backport of 2.44.4).
|
||
- 2.44.3 (2026-10-16, patch): core keep Observer detail lines instead of discarding the response.
|
||
- 2.44.4 (2026-10-19, patch): core reuse connections in the log-streaming webhook destination; turn
|
||
off expression spans by default.
|
||
- 2.44.5 (2026-10-21, patch): core key queue job outcomes by job on shutdown resume; editor load
|
||
credential types on startup.
|
||
- 2.44.6 (2026-10-22, patch; **`stable` floating tag points here**): Postgres Node prevent global
|
||
pgtypes overwrite.
|
||
- 2.45.0 (2026-10-20, Pre-release; the 2.45 feature minor): automated migrations for removed nodes;
|
||
node and credential type policies enabled by default; durable scheduler enabled by default;
|
||
Idempotency-Key on Public API POSTs; workflow migration-findings endpoints/notifications; Kafka v2
|
||
default for new nodes; Monday.com V2 default; AI Agent/Assistant, editor and node fixes; UI rebrand.
|
||
**No breaking compose/env/volume/label changes; no `N8N_*` renames.**
|
||
- 2.45.1 (2026-10-21, Pre-release): core claim an idle worker's next queue job and its lock atomically;
|
||
Microsoft Teams Trigger Graph subscription renewal via lifecycle notifications; editors can triage
|
||
migration findings.
|
||
- 2.45.2 (2026-10-22, Pre-release; **`beta` floating tag points here — newest numeric tag**): core read
|
||
type-availability policies from memory at enforcement points; Postgres Node prevent global pgtypes
|
||
overwrite; migration report CSV export; OAuth-confirmation/email logo update.
|
||
- 2026-10-23 run: reconcile confirmed coopcloud upstream main moved to `c834df2` ("NODE_FUNCTION_ALLOW_EXTERNAL
|
||
in env file", on top of 3.5.1+2.40.5) and PR #9 (branch `upgrade-a144baf`, at 2.43.6) still
|
||
open/unmerged. Per the one-evolving-PR contract, PR #9 extended **2.40.5 → 2.45.2** (explicit target
|
||
= highest tag abra lists). 2.45.x is the current Pre-release/beta line; **stable = 2.44.6** (verified
|
||
live via Docker Hub floating tags), flagged to the operator. Window spans feature minors 2.41–2.45,
|
||
but release notes show **no breaking compose/env/volume/label changes and no `N8N_*` renames**.
|
||
Live-deployed on cc-ci `dev-n8n`: TypeORM migrations completed cleanly through
|
||
`CreatePromotionRunAndReviewTables1792139680417`, editor accessible, `/healthz` 200, `/rest/login`
|
||
401; runtime deprecation warnings only (`WEBHOOK_URL`→`N8N_WEBHOOK_URL`, internal runner mode,
|
||
unverified-packages default, runner-timeout/compression-limit default reductions). Advisory scan
|
||
2.40.5→2.45.2: 0 CVEs identified, BUT the GitHub advisory sources failed (unauthenticated rate
|
||
limit) — scan incomplete, not to be read as clean. Recommended release: `-y`.
|