npm / n8n-workflow
n8n-workflow
What changed in n8n-workflow 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-28.
9 breaking7 security31 new APIs and options4 performance17 behavior and defaults46 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initn8n-workflow 2114 changes
Breaking changes 9
The editor prevents usage of deprecated nodes.
Exported workflow JSON no longer includes credential names.
An average with no numeric values now returns null instead of NaN.
Node timestamps are no longer included in the workflow OpenAPI schema.
The unused N8N_SCHEDULER_MIN_INTERVAL setting was removed.
Node and credential type policies are now enabled by default.
Creating or updating workflows with deprecated nodes is blocked.
Foundry nodes and credentials are renamed to Microsoft Foundry.
Single node runs in n8n Assistant require workflow create scope.
Security 7
Access keys are treated as secret credential fields during linting.
Assistant execution reads now check execution:read access and apply execution redaction.
Draft Agent runs now check agent read access and credential access.
The trigger now verifies webhook signatures.
The inbound pipeline now refuses revoked access tokens of the local server.
Execution results are now filtered by projectId for member API keys.
The instance CSP is served on all non-script responses.
New APIs and options 31
A V3 migration is available for the Edit Image node.
Edit Image V2 is available and uses napi-rs/canvas.
n8n Connect servers are added to MCP registry servers.
The Agent Builder can set up Microsoft Foundry models, list Foundry deployments in the Agents model selector, and support Claude deployments on Foundry.
The Microsoft Teams agent channel is now available.
Workflow editors can triage migration findings for their workflows.
The migration report now includes an “Executions might fail” impact to help assess migration findings.
The migration report can now be exported as CSV.
The n8n node now has an action to add a user to a project.
OAuth2 credentials can use custom scopes, allowing developers to request provider-specific permissions.
Agents can send mention-only Slack replies.
Webhook and MCP Trigger nodes can authenticate through trusted sources.
API dependency endpoints are available for workflows, credentials, and data tables.
Automated migrations are implemented for removed nodes.
A new endpoint notifies workflow owners about migration findings.
Foundry credentials for the Azure OpenAI Chat Model node now have an optional Project field.
The Text Classifier can optionally include confidence scores in its output.
Antigravity is available in the MCP client connection dialog as a connection option.
The node uses the Anthropic Messages schema for Claude deployments.
Crash journal paths can be set per process.
A credentialTransfer policy enforcement point is available for credential transfers.
Package import supports an overwrite schema conflict policy for data tables.
Package import supports an overwrite-non-destructive schema conflict policy for data tables.
The embeddings node supports Entra ID authentication.
Google Vertex AI credentials are available, including project selection.
The health check timeout is configurable.
A Microsoft SharePoint Trigger node is available.
Metrics for database connection recovery are available, and Prometheus metrics can be served while the database is unavailable.
Opt-in start marker spans are available for workflow and node executions.
WhatsApp is available as an agent channel, with inbound media handling and message quality rate-limit handling.
Workflow tool inputs can be configured for Agents.
Performance 4
The agent builder can chain config writes without re-reading the config.
Config writes are sent as objects containing only changed fields.
The system prompt is kept static to enable prompt caching.
The Instance AI skill sandbox is prepared in the background.
Behavior and default changes 17
Agents SDK spans now include gen_ai.provider.name and gen_ai.agent.id; AI Agent and chat model spans also receive OTel GenAI attributes.
Granular credential sharing is now always on.
A promotion commit message is optional; n8n generates a default when one is not provided.
Respond to Chat can now be used in embedded chat mode.
The trigger now validates subscription challenges and events.
Budget alerts and stops now apply to sub-agent runs.
The durable scheduler is now enabled by default.
Expression spans are turned off by default.
Public API POST requests now honor the Idempotency-Key header, allowing clients to make idempotent requests.
Version 2 is now the default for new Kafka nodes and triggers.
V2, with full V1 parity, is now the default.
In-flight production executions are suspended when a worker shuts down.
Workflow read endpoints now return the parent folder.
The agent builder can edit skill instructions in place.
Every OTel span includes execution identity.
Devin replaces Windsurf in the MCP client dialog.
Workflow history trimming runs as a durable daily system task.
Fixes and other changes 46
Agent node tools can use global credentials.
Array min() and max() now work on arrays containing more than 125,000 numbers.
Number, boolean, and options credential fields now accept expressions.
Lakebase function calls with no arguments now send a JSON body.
The node backs off reconnect attempts when the server drops each new connection.
The workflow's own Error Trigger runs when no error workflow is selected.
The node now stores boolean and falsy expression values.
Request batching stops when the execution is cancelled.
Declarative node output items are paired with their input items, and output items are paired before the error output split.
Graph subscriptions are renewed via lifecycle notifications.
A node is no longer retried after its execution is cancelled.
The flow falls back to OpenID discovery after receiving HTML metadata responses.
Every public API 401 response advertises the OAuth resource challenge.
Text-only DeepSeek models are routed correctly, and a DeepSeek search alias is added.
Waiting executions are re-armed after a leader takeover.
Static data written by a webhook trigger is now persisted.
Anthropic thinking turns are replayed with their tool arguments.
The node now decodes data URIs and validates Base64 input.
The trigger checks the mailbox when it activates and can find new mail on servers with a broken IMAP4rev2 mode.
MCP content arrays are passed through instead of double-wrapping tool results.
Image operations now report token usage and send max_completion_tokens when analyzing an image.
Structured inputs are now passed to OpenAI Responses tools.
Values containing commas remain a single query parameter.
Data table and variable editing are aligned on protected instances.
Validation is skipped when the mapped value is null.
When a recipient field is an array, the node now sends to every recipient.
1Password fields are exposed for secret preview and autocomplete.
Node type policies are applied to agent node tools.
Entra OAuth2 is wired into the agent Azure OpenAI runtime.
The size argument of the chunk() expression extension is validated.
Credential type policies are applied to credential tests and probes, and credential-only nodes are hidden under such a policy.
The Vector Store insert is guarded against using the wrong index, and embeddings request float encoding from the Unity AI Gateway.
The editor can download binary data from an Engine v2 execution.
The execution retry menu is aligned and its actions are clarified.
Instance AI saves validate execution timeout against the configured maximum.
The trigger reports failed polls and limits the backlog per poll.
OAuth server rate limits use the configured values.
Datetime fields are normalized to Odoo format before writes.
Public API pagination limits are validated and defaulted.
Regex matching now ignores case when the ignore case option is enabled.
Copy source paths are percent-encoded.
Kimi K3 and other OpenAI-compatible Assistant model providers work on self-hosted Assistant.
MCP server connection failures are reported by verify_mcp_server.
Waiting executions remain unchanged when a resume request fails.
Workflow validation reports approval tools that have no tool connected.
A workflow version can be reverted even when it uses credentials the user cannot use.