n8n-io/n8n
1
0
Fork 0
mirror of https://github.com/n8n-io/n8n.git synced 2026-10-11 22:50:06 +00:00
Code Issues Packages Projects Releases Wiki Activity
16,996 Commits 1,864 Branches 2,194 Tags
990047817739d0c143c82b067f0957cfe434a6ce
Commit Graph
16996 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
n8n-assistant[bot]andn8n-release-helper[bot] 9900478177 🚀 Release 1.123.84 (#40630) 
Co-authored-by: n8n-release-helper[bot] <265227495+n8n-release-helper[bot]@users.noreply.github.com>
v1 [email protected] 		2026-10-08 07:33:05 +00:00
Luigi GubelloandClaude Opus 5.5 fa26c87723 chore: Update npm dependencies (backport to 1.x) (#40598) 
Co-authored-by: Claude Opus 5.5 <[email protected]>
 2026-10-07 20:11:39 +02:00
n8n-assistant[bot]andMatsuuu 9e655c64ae 🚀 Release 1.123.83 (#39941) 
Co-authored-by: Matsuuu <[email protected]>
[email protected] 		2026-09-30 08:51:35 +03:00
n8n-assistant[bot]andMatsu ab0b5351ec chore: Bundle/1.x (#39936) 
Co-authored-by: Matsu <[email protected]>
 2026-09-30 07:44:17 +03:00
Declan Carroll 205a47b0ad chore: Bump mqtt 5.7.2 → 5.16.0 (minor) on 1.x to clear 1 Aikido finding (#39561) 2026-09-28 16:34:16 +01:00
n8n-cat-bot[bot] 76e467dc14 fix: Pin cjs-module-lexer 2.2.0 to address review finding 2026-09-25 15:54:32 +00:00
Declan Carroll bcba7c4ac3 Merge branch '1.x' into cat-bot/run-36070647395-1 2026-09-25 16:24:59 +01:00
n8n-assistant[bot]andn8n-release-helper[bot] 17b3ae8cf9 🚀 Release 1.123.82 (#39573) 
Co-authored-by: n8n-release-helper[bot] <265227495+n8n-release-helper[bot]@users.noreply.github.com>
[email protected] 		2026-09-25 07:20:42 +00:00
n8n-cat-bot[bot] 70ce0cf167 chore: Bump mqtt 5.7.2 → 5.16.0 (minor) on 1.x to clear 1 Aikido finding 2026-09-24 23:17:32 +00:00
Declan Carroll 0000f053d8 chore: Bump proxy-addr 2.0.7 → 2.0.8 (patch) on 1.x to clear 1 Aikido finding (#39554) 2026-09-25 00:00:27 +01:00
n8n-cat-bot[bot] 80a0bc291f chore: Bump proxy-addr 2.0.7 → 2.0.8 on 1.x (DEVP-1204) 2026-09-24 20:33:41 +00:00
Declan Carroll aa1dfca243 chore: Bump adm-zip 0.6.0 → 0.6.1 (patch) on 1.x to clear 1 Aikido finding (#39338) 2026-09-24 13:48:27 +01:00
n8n-cat-bot[bot] de771f0aa4 fix: bump adm-zip to 0.6.1 2026-09-23 00:25:32 +00:00
n8n-assistant[bot]andn8n-release-helper[bot] 9a00ed398c 🚀 Release 1.123.81 (#38899) 
Co-authored-by: n8n-release-helper[bot] <265227495+n8n-release-helper[bot]@users.noreply.github.com>
[email protected] 		2026-09-17 07:35:42 +00:00
n8n-assistant[bot]Luigi GubelloLuigi GubelloClaude Opus 5
 		3357ecc57f fix(core): Update undici to 7.29.1 (backport to 1.x) (#38849) 
Co-authored-by: Luigi Gubello <[email protected]>
Co-authored-by: Luigi Gubello <[email protected]>
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
 2026-09-16 14:48:39 +00:00
n8n-assistant[bot]Luigi GubelloLuigi GubelloClaude Opus 5
 		b3b77aa5ba fix(core): Update vm2 to 3.12.2 (backport to 1.x) (#38846) 
Co-authored-by: Luigi Gubello <[email protected]>
Co-authored-by: Luigi Gubello <[email protected]>
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
 2026-09-16 15:10:44 +02:00
n8n-assistant[bot]Luigi GubelloLuigi GubelloClaude Opus 5
 		1281ee6444 fix(Snowflake Node): Update the Snowflake SDK to 3.3.0 (backport to 1.x) (#38831) 
Co-authored-by: Luigi Gubello <[email protected]>
Co-authored-by: Luigi Gubello <[email protected]>
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
 2026-09-16 14:13:10 +02:00
n8n-assistant[bot]andBernhard Wittmann 7e9862219b fix(core): Allow a domain-restricted credential to work in its own node (backport to 1.x) (#38786) 
Co-authored-by: Bernhard Wittmann <[email protected]>
 2026-09-16 10:33:06 +00:00
n8n-assistant[bot]andMatsuuu 108c7163f8 🚀 Release 1.123.80 (#38771) 
Co-authored-by: Matsuuu <[email protected]>
[email protected] 		2026-09-16 09:32:00 +03:00
n8n-assistant[bot] fff2c84a51 chore: Bundle/1.x (#38767) 2026-09-16 08:22:02 +03:00
n8n-assistant[bot]Guillaume JacquartClaude Opus 4.7
 		35ffb8881e fix(core): Apply credential allowed domains in declarative node requests (backport to 1.x) (#38723) 
Co-authored-by: Guillaume Jacquart <[email protected]>
Co-authored-by: Claude Opus 4.7 <[email protected]>
 2026-09-15 13:58:33 +00:00
n8n-assistant[bot]MatsuuuMatsuuu
 		28dd85aaf2 🚀 Release 1.123.79 (#38268) 
Co-authored-by: Matsuuu <[email protected]>
Co-authored-by: Matsuuu <[email protected]>
[email protected] 		2026-09-10 09:06:29 +03:00
Matsu 55c635f9bf build: Patch docker images to not build with pnpm 12 (#38223) 2026-09-09 16:33:22 +03:00
n8n-assistant[bot]andAndreas Fitzek 24040d8f32 fix(core): Resolve managed OAuth endpoint fields from the credential type (backport to 1.x) (no-changelog) (#38163) 
Co-authored-by: Andreas Fitzek <[email protected]>
 2026-09-09 10:18:57 +02:00
Declan Carroll 53ebf213a3 chore: Bump hono 4.12.34 → 4.13.5 (minor) on 1.x to clear 3 Aikido findings (#38162) 2026-09-09 05:25:21 +01:00
n8n-cat-bot[bot]andClaude Opus 5 1cc6d839de chore: Bump hono 4.12.34 -> 4.13.5 (minor) on 1.x to clear 3 Aikido findings 
hono is transitive only, reaching the tree through @modelcontextprotocol/sdk (both
directly and via @hono/node-server), and is already pinned by a root pnpm
override. Raise the existing `hono@<=4.12.34` selector to `<=4.13.5` and refresh
the lockfile so the single resolved copy in the tree is 4.13.5, clearing
CVE-2026-84363 (medium), CVE-2026-84364 (low) and CVE-2026-84365 (medium).

No source file imports hono, so this is a runtime-dependency bump with no type
surface of ours to adjust.

Co-Authored-By: Claude Opus 5 <[email protected]>
 2026-09-09 04:05:52 +00:00
Declan Carroll f9edcd565f chore: Bump multer 2.2.0 → 2.3.0 (minor) on 1.x to clear 4 Aikido findings (#38160) 2026-09-09 04:30:36 +01:00
n8n-cat-bot[bot]andClaude Opus 5 2787b94c43 chore: Bump multer 2.2.0 -> 2.3.0 (minor) on 1.x to clear 4 Aikido findings 
Co-Authored-By: Claude Opus 5 <[email protected]>
 2026-09-09 03:10:55 +00:00
Declan Carroll 3b5d084933 chore: Bump js-yaml 4.2.0 → 4.3.2 (patch) on 1.x to clear 2 Aikido findings (#38158) 2026-09-09 03:50:09 +01:00
n8n-cat-bot[bot]andClaude Opus 5 18ea962392 chore: Bump js-yaml 4.3.1 -> 4.3.2 (patch) on 1.x to clear 2 Aikido findings 
Co-Authored-By: Claude Opus 5 <[email protected]>
 2026-09-09 02:26:49 +00:00
Declan Carroll 695e2b8699 chore: Bump sharp 0.35.0 → 0.35.4 (patch) on 1.x to clear 1 Aikido finding (#38157) 2026-09-09 02:35:24 +01:00
n8n-cat-bot[bot]andClaude Opus 5 21f482f349 chore: Bump sharp 0.35.0 -> 0.35.4 (patch) on 1.x to clear 1 Aikido finding 
Co-Authored-By: Claude Opus 5 <[email protected]>
 2026-09-09 01:09:44 +00:00
Declan Carroll b73fbb5080 chore: Bump @xmldom/xmldom 0.8.14 → 0.8.15 (patch) on 1.x to clear 1 Aikido finding (#38154) 2026-09-08 23:34:55 +01:00
n8n-cat-bot[bot]andClaude Opus 5 fbc26d571c chore: Bump @xmldom/xmldom 0.8.14 -> 0.8.15 (patch) on 1.x to clear 1 Aikido finding 
@xmldom/xmldom is transitive only (samlify, @authenio/xml-encryption,
xml-crypto, mammoth), already pinned by a root pnpm override. Raise the
existing `@xmldom/xmldom@<=0.8.14` selector to `<=0.8.15` and refresh the
lockfile so the single resolved copy in the tree is 0.8.15, clearing
CVE-2026-83610 (medium).

Co-Authored-By: Claude Opus 5 <[email protected]>
 2026-09-08 22:13:30 +00:00
Declan Carroll 526f6aa338 chore: Bump fflate 0.7.4 → 0.7.5 (patch) on 1.x to clear 1 Aikido finding (#38150) 2026-09-08 22:16:12 +01:00
n8n-cat-bot[bot]andClaude Opus 5 51805b7e53 chore: Bump fflate 0.7.4 -> 0.7.5 (patch) on 1.x to clear 1 Aikido finding 
fflate is a direct dependency of n8n-nodes-base, pinned at 0.7.4. Raise the
declared pin to 0.7.5 and refresh the lockfile so the only resolved copy in
the tree is 0.7.5, clearing CVE-2026-45820 (high).

Co-Authored-By: Claude Opus 5 <[email protected]>
 2026-09-08 20:49:54 +00:00
Declan Carroll ad1b1d87e1 chore: Bump fast-uri 3.1.5 → 3.1.6 (patch) on 1.x to clear 4 Aikido findings (#38145) 2026-09-08 20:46:03 +01:00
n8n-cat-bot[bot]andClaude Opus 5 a9e11f6f77 chore: Bump fast-uri 3.1.5 → 3.1.6 (patch) on 1.x to clear 4 Aikido findings 
Raises the existing pnpm.overrides entry for fast-uri from 3.1.5 to 3.1.6
and refreshes the lockfile. fast-uri is transitive (via ajv@8, reached at
runtime through express-openapi-validator in packages/cli).

Clears CVE-2026-75899, CVE-2026-75931, CVE-2026-75975 and CVE-2026-76172
(all high, needs >= 3.1.6).

Co-Authored-By: Claude Opus 5 <[email protected]>
 2026-09-08 19:14:45 +00:00
n8n-assistant[bot]andn8n-release-helper[bot] a1400f1916 🚀 Release 1.123.77 (#37697) 
Co-authored-by: n8n-release-helper[bot] <265227495+n8n-release-helper[bot]@users.noreply.github.com>
[email protected] 		2026-09-03 07:34:44 +00:00
MatsuandClaude Opus 5 72b1ab10ab ci: Remove a stray tree entry from the 1.x branch (no-changelog) (#37616) 
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
 2026-09-02 08:22:43 +00:00
n8n-assistant[bot]andn8n-release-helper[bot] cbee391326 🚀 Release 1.123.76 (#37610) 
Co-authored-by: n8n-release-helper[bot] <265227495+n8n-release-helper[bot]@users.noreply.github.com>
[email protected] 		2026-09-02 10:14:10 +03:00
n8n-assistant[bot]andMatsu cac1cad223 chore: Bundle/1.x (#37587) 
Co-authored-by: Matsu <[email protected]>
 2026-09-02 08:16:43 +03:00
Declan Carroll 01132b19b8 chore: Bump browserslist 4.27.0 → 4.28.7 (minor) on 1.x to clear 2 Aikido findings (#37579) 2026-09-02 00:05:44 +01:00
n8n-cat-bot[bot]andClaude Opus 5 9de4ccefcf fix(core): Bump browserslist to 4.28.7 to clear CVE-2026-73088/73089 
browserslist is a transitive dependency only, so add a pnpm override
scoped to `browserslist@<4.28.7`. This collapses the three previously
resolved versions (4.24.4, 4.25.0, 4.27.0) onto 4.28.7, staying within
the 4.x major.

Co-Authored-By: Claude Opus 5 <[email protected]>
 2026-09-01 22:31:31 +00:00
n8n-assistant[bot]andn8n-release-helper[bot] 34740baec0 🚀 Release 1.123.75 (#36790) 
Co-authored-by: n8n-release-helper[bot] <265227495+n8n-release-helper[bot]@users.noreply.github.com>
[email protected] 		2026-08-21 07:35:26 +00:00
n8n-assistant[bot]Mike RepećClaude Sonnet 5Danny Martini
 		5c9153e013 fix(core): Normalize env values before schema-based parsing (backport to 1.x) (#36733) 
Co-authored-by: Mike Repeć <[email protected]>
Co-authored-by: Claude Sonnet 5 <[email protected]>
Co-authored-by: Danny Martini <[email protected]>
 2026-08-20 20:56:02 +02:00
n8n-assistant[bot]Danny MartiniClaude Fable 5Mike Repeć
 		fccd046c97 fix(core): Wrap a trigger's closeFunction in an expression isolate at creation time (backport to 1.x) (#36699) 
Co-authored-by: Danny Martini <[email protected]>
Co-authored-by: Claude Fable 5 <[email protected]>
Co-authored-by: Mike Repeć <[email protected]>
 2026-08-20 14:04:31 +02:00
n8n-assistant[bot]Mike RepećClaude Fable 5Danny Martini
 		16a867684a fix(core): Only init the expression engine for commands that evaluate expressions (backport to 1.x) (#36649) 
Co-authored-by: Mike Repeć <[email protected]>
Co-authored-by: Claude Fable 5 <[email protected]>
Co-authored-by: Danny Martini <[email protected]>
 2026-08-20 13:10:56 +02:00
n8n-assistant[bot]Mike RepećClaude Sonnet 5Danny Martini
 		a75e5ed20a fix(core): Release test-webhook isolate only after teardown completes (backport to 1.x) (#36633) 
Co-authored-by: Mike Repeć <[email protected]>
Co-authored-by: Claude Sonnet 5 <[email protected]>
Co-authored-by: Danny Martini <[email protected]>
 2026-08-20 13:10:31 +02:00
n8n-assistant[bot]andn8n-release-helper[bot] 9826eec801 🚀 Release 1.123.74 (#36683) 
Co-authored-by: n8n-release-helper[bot] <265227495+n8n-release-helper[bot]@users.noreply.github.com>
[email protected] 		2026-08-20 07:35:45 +00:00