chore: upgrade n8nio/n8n to 2.48.2 #10

Open

autonomic-bot wants to merge 1 commits from upgrade-da8a15f into main

pull from: upgrade-da8a15f

merge into: :main

:main

:upgrade-da8a15f

:upgrade-a144baf

:upgrade-ef0dd56

:upgrade-cdfded8

:upgrade-3.4.0+2.25.3

:upgrade-3.4.1+2.27.0

:upgrade-3.3.0+2.23.2

:upgrade-3.3.0+2.22.6

:upgrade-3.3.0+2.23.1

:upgrade-3.3.0+2.22.3

Conversation 6 Commits 1 Files Changed 1

+1 -1

autonomic-bot commented 2026-10-30 04:53:00 +00:00

Owner

Copy Link

Copy Source

Recipe upgrade: n8n 2.47.2 → 2.48.2

Image-tag bump only; the recipe version label is intentionally left at 3.5.2+2.45.2 (the operator's
final abra recipe release publishes it).

service	image	current	new
app	n8nio/n8n	2.47.2	2.48.2
db	pgautoupgrade/pgautoupgrade	18-alpine	18-alpine (unchanged — optional postgres compose only)

Upstream release notes: app n8nio/n8n 2.47.2→2.48.2: https://github.com/n8n-io/n8n/releases/tag/n8n%402.48.2
(2.48.1: https://github.com/n8n-io/n8n/releases/tag/n8n%402.48.1 · 2.48.0: https://github.com/n8n-io/n8n/releases/tag/n8n%402.48.0)

Why 2.48.2 and not 3.x

3.0.0/3.1.0/3.2.0 are a breaking major: N8N_NODES_API_VERSION 3, Chat Hub off by default,
many removed nodes (legacy Function/Item Lists, LangChain Code, Cron/Interval, HTML Extract, legacy
OpenAI, …), $evaluateExpression() removed from the Code node, AI Agent v1 modes removed, the
~/.n8n/binaryData → ~/.n8n/storage rename (refuses to start if both exist), in-memory binary-data
mode and N8N_PRE_EXECUTE_ERROR_CREATES_EXECUTION removed. See
https://docs.n8n.io/changelog/v30-breaking-changes. The recipe has no pattern for major jumps, so this
PR takes the newest same-major tag and leaves 3.x as an operator-scheduled migration.

Note: 2.48.x is the current Pre-release/beta line (GitHub marks 2.48.0/2.48.1/2.48.2
prerelease=true; Docker Hub beta = 2.48.2, stable/latest = 2.47.5). This follows the
established tracking-the-newest-tag precedent; flagging so the operator can decide when to publish.

What changed in the window

• 2.48.0 (feature minor): Apps bindings UI, Apps linked to n8n Assistant chats, default Assistant
  model → Claude Opus 5.5, Microsoft Work IQ OAuth2 credential, logout telemetry/audit events, archived
  workflows hidden in the migration report by default, Agent Gateway credit stopping, node operation
  annotations, migration-report long-load message, credential restriction callout, unified chat/Markdown
  rendering, Paddle node renamed Paddle Classic, plus core/AI-builder/editor fixes (redaction policy
  on log streaming/telemetry/error reports; webhook body charset decoding; expression-engine parity;
  scheduled-task reaper batching; OAuth JWKS retired-key handling; Agent HITL/memory fixes).
• 2.48.1 (patch): expression transfers after built-in replacements; bare node references across
  expression engines; Edit Image font registration; migration-report column width.
• 2.48.2 (patch): Public API rejects edits to read-only credential nodes; animated node border
  corners; agent tabs for new drafts.

No N8N_* env renames, no required compose/volume/label changes, no manual migration. TypeORM
migrations auto-run on boot (verified live below). Paddle→Paddle Classic is a node display-name change,
not a deployment blocker. Runtime deprecation notices are unchanged from prior upgrades (warn-only;
WEBHOOK_URL→N8N_WEBHOOK_URL, internal runner mode, unverified-packages default, reduced runner
timeout/compression defaults) — the recipe only sets WEBHOOK_URL.

Advisory scan (2.47.2 → 2.48.2)

CVEs fixed by this upgrade: 0 identified by the deterministic scan. 9 sources checked (5 registry
URLs + advisory APIs), no failed sources.

1 advisory could not be judged: GHSA-365g-vjw2-grx8 (high) — adjudicated NOT-FIXED. The
advisory states "No code changes have been made to alter the behavior of the Execute Command node";
the vulnerable range is > 0.0.1 (includes 2.48.2) with no patched version. Mitigation (if users are
untrusted) is NODES_EXCLUDE=["n8n-nodes-base.executeCommand"]. Informational, not a regression in
this window.

Live deploy evidence on cc-ci

Deployed the WIP with --chaos at dev-n8n.ci.commoninternet.net (local swarm), then tore it down.

• 1/1 replica on n8nio/n8n:2.48.2; all TypeORM migrations completed cleanly through
  AddContentHashToAgentChatAttachments1794216623022.
• Logs: task broker ready, JS Task Runner registered, Cluster aligned on version 2.48.2,
  Version: 2.48.2, "Editor is now accessible".
• HTTP: /healthz → 200, /rest/login → 401 (auth-gated, as expected).
• Only warn-level runtime deprecations; the Python-internal-runner warning is pre-existing (the image
  lacks Python).
• Teardown verified: 0 dev-n8n stacks, 0 residual volumes, env file removed.

Operator action

1. Review; merge this PR when ready.
2. Publish the recipe with: abra recipe release n8n -y
   (minor: relative to the published label app tag 2.45.2 the delta includes the 2.46, 2.47 and 2.48
   feature minors).
3. The 3.x major is a separate, deliberate migration (run the v3 Migration Report first).

CI verification is run against this one-commit PR head. NOT merged — for operator review.

cc @trav @notplants

CI verification is run against this one-commit PR head. NOT merged — for operator review.

cc @trav @notplants

## Recipe upgrade: n8n `2.47.2` → `2.48.2` Image-tag bump only; the recipe version label is intentionally left at `3.5.2+2.45.2` (the operator's final `abra recipe release` publishes it). | service | image | current | new | |---------|-------|---------|-----| | app | `n8nio/n8n` | `2.47.2` | **`2.48.2`** | | db | `pgautoupgrade/pgautoupgrade` | `18-alpine` | `18-alpine` (unchanged — optional postgres compose only) | **Upstream release notes:** app `n8nio/n8n` 2.47.2→2.48.2: https://github.com/n8n-io/n8n/releases/tag/n8n%402.48.2 (2.48.1: https://github.com/n8n-io/n8n/releases/tag/n8n%402.48.1 · 2.48.0: https://github.com/n8n-io/n8n/releases/tag/n8n%402.48.0) ### Why 2.48.2 and not 3.x `3.0.0`/`3.1.0`/`3.2.0` are a **breaking major**: `N8N_NODES_API_VERSION` 3, Chat Hub off by default, many removed nodes (legacy Function/Item Lists, LangChain Code, Cron/Interval, HTML Extract, legacy OpenAI, …), `$evaluateExpression()` removed from the Code node, AI Agent v1 modes removed, the `~/.n8n/binaryData` → `~/.n8n/storage` rename (refuses to start if both exist), in-memory binary-data mode and `N8N_PRE_EXECUTE_ERROR_CREATES_EXECUTION` removed. See https://docs.n8n.io/changelog/v30-breaking-changes. The recipe has no pattern for major jumps, so this PR takes the newest **same-major** tag and leaves 3.x as an operator-scheduled migration. **Note:** 2.48.x is the current **Pre-release/beta line** (GitHub marks 2.48.0/2.48.1/2.48.2 `prerelease=true`; Docker Hub `beta` = 2.48.2, `stable`/`latest` = 2.47.5). This follows the established tracking-the-newest-tag precedent; flagging so the operator can decide when to publish. ### What changed in the window - **2.48.0** (feature minor): Apps bindings UI, Apps linked to n8n Assistant chats, default Assistant model → Claude Opus 5.5, Microsoft Work IQ OAuth2 credential, logout telemetry/audit events, archived workflows hidden in the migration report by default, Agent Gateway credit stopping, node operation annotations, migration-report long-load message, credential restriction callout, unified chat/Markdown rendering, Paddle node renamed **Paddle Classic**, plus core/AI-builder/editor fixes (redaction policy on log streaming/telemetry/error reports; webhook body charset decoding; expression-engine parity; scheduled-task reaper batching; OAuth JWKS retired-key handling; Agent HITL/memory fixes). - **2.48.1** (patch): expression transfers after built-in replacements; bare node references across expression engines; Edit Image font registration; migration-report column width. - **2.48.2** (patch): Public API rejects edits to read-only credential nodes; animated node border corners; agent tabs for new drafts. No `N8N_*` env renames, no required compose/volume/label changes, no manual migration. TypeORM migrations auto-run on boot (verified live below). Paddle→Paddle Classic is a node display-name change, not a deployment blocker. Runtime deprecation notices are unchanged from prior upgrades (warn-only; `WEBHOOK_URL`→`N8N_WEBHOOK_URL`, internal runner mode, unverified-packages default, reduced runner timeout/compression defaults) — the recipe only sets `WEBHOOK_URL`. ### Advisory scan (2.47.2 → 2.48.2) **CVEs fixed by this upgrade: 0 identified by the deterministic scan.** 9 sources checked (5 registry URLs + advisory APIs), no failed sources. 1 advisory could not be judged: **GHSA-365g-vjw2-grx8** (high) — adjudicated **NOT-FIXED**. The advisory states *"No code changes have been made to alter the behavior of the Execute Command node"*; the vulnerable range is `> 0.0.1` (includes 2.48.2) with no patched version. Mitigation (if users are untrusted) is `NODES_EXCLUDE=["n8n-nodes-base.executeCommand"]`. Informational, not a regression in this window. ### Live deploy evidence on cc-ci Deployed the WIP with `--chaos` at `dev-n8n.ci.commoninternet.net` (local swarm), then tore it down. - 1/1 replica on `n8nio/n8n:2.48.2`; all TypeORM migrations completed cleanly through `AddContentHashToAgentChatAttachments1794216623022`. - Logs: task broker ready, JS Task Runner registered, `Cluster aligned on version 2.48.2`, `Version: 2.48.2`, "Editor is now accessible". - HTTP: `/healthz` → **200**, `/rest/login` → **401** (auth-gated, as expected). - Only warn-level runtime deprecations; the Python-internal-runner warning is pre-existing (the image lacks Python). - Teardown verified: 0 `dev-n8n` stacks, 0 residual volumes, env file removed. ### Operator action 1. Review; merge this PR when ready. 2. Publish the recipe with: `abra recipe release n8n -y` (minor: relative to the published label app tag 2.45.2 the delta includes the 2.46, 2.47 and 2.48 feature minors). 3. The 3.x major is a separate, deliberate migration (run the v3 Migration Report first). CI verification is run against this one-commit PR head. NOT merged — for operator review. cc @trav @notplants CI verification is run against this one-commit PR head. NOT merged — for operator review. cc @trav @notplants

autonomic-bot requested review from trav 2026-10-30 04:53:00 +00:00

autonomic-bot requested review from notplants 2026-10-30 04:53:00 +00:00

autonomic-bot commented 2026-10-30 04:53:16 +00:00

Author

Owner

Copy Link

Copy Source

!testme

!testme

autonomic-bot commented 2026-10-30 04:53:44 +00:00

Author

Owner

Copy Link

Copy Source

🌻 cc-ci — n8n @ da8a15f8 ✅ passed

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `n8n` @ `da8a15f8` ✅ **passed** [](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/113) [](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/113) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/113) · [dashboard](https://ci.autonomic.zone/)

autonomic-bot changed title from chore: upgrade n8nio/n8n to 2.46.2 to chore: upgrade n8nio/n8n to 2.47.2 2026-11-06 04:54:45 +00:00

autonomic-bot commented 2026-11-06 04:55:02 +00:00

Author

Owner

Copy Link

Copy Source

!testme

!testme

autonomic-bot commented 2026-11-06 04:55:06 +00:00

Author

Owner

Copy Link

Copy Source

🌻 cc-ci — n8n @ 07f31367 ✅ passed

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `n8n` @ `07f31367` ✅ **passed** [](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/139) [](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/139) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/139) · [dashboard](https://ci.autonomic.zone/)

autonomic-bot changed title from chore: upgrade n8nio/n8n to 2.47.2 to chore: upgrade n8nio/n8n to 2.48.2 2026-11-13 05:28:02 +00:00

autonomic-bot added 1 commit 2026-11-13 05:28:04 +00:00

chore: upgrade n8nio/n8n to 2.48.2 aff404af82

autonomic-bot force-pushed upgrade-da8a15f from 07f3136720 to aff404af82 2026-11-13 05:28:04 +00:00 Compare

autonomic-bot commented 2026-11-13 05:28:06 +00:00

Author

Owner

Copy Link

Copy Source

!testme

!testme

autonomic-bot commented 2026-11-13 05:28:26 +00:00

Author

Owner

Copy Link

Copy Source

🌻 cc-ci — n8n @ aff404af ✅ passed

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `n8n` @ `aff404af` ✅ **passed** [](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/154) [](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/154) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/154) · [dashboard](https://ci.autonomic.zone/)

All checks were successful

Hide all checks

cc-ci/testme cc-ci: success

Details

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin upgrade-da8a15f:upgrade-da8a15f

git checkout upgrade-da8a15f

Sign in to join this conversation.

Reviewers

No Reviewers

trav

notplants

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

aadil (alizeh) autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants spacehobo (Nick Moffitt) trav (Trav Fryer)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: recipe-maintainers/n8n#10