## n8n-io/n8n — stable…v1

_382+ commits._

### Features
- **feat(core): Make the vm expression engine the default on 1.x (#36498)** (75bedd8)

### Fixes
- **fix: Pin cjs-module-lexer 2.2.0 to address review finding** (76e467d)
- **fix: bump adm-zip to 0.6.1** (de771f0)
- **fix(core): Update undici to 7.29.1 (backport to 1.x) (#38849)** (3357ecc)
- **fix(core): Update vm2 to 3.12.2 (backport to 1.x) (#38846)** (b3b77aa)
- **fix(Snowflake Node): Update the Snowflake SDK to 3.3.0 (backport to 1.x) (#38831)** (1281ee6)
- **fix(core): Allow a domain-restricted credential to work in its own node (backport to 1.x) (#38786)** (7e98622)
- **fix(core): Apply credential allowed domains in declarative node requests (backport to 1.x) (#38723)** (35ffb88)
- **fix(core): Resolve managed OAuth endpoint fields from the credential type (backport to 1.x) (no-changelog) (#38163)** (24040d8)
- **fix(core): Bump browserslist to 4.28.7 to clear CVE-2026-73088/73089** (9de4cce)
- **fix(core): Normalize env values before schema-based parsing (backport to 1.x) (#36733)** (5c9153e)
- **fix(core): Wrap a trigger's closeFunction in an expression isolate at creation time (backport to 1.x) (#36699)** (fccd046)
- **fix(core): Only init the expression engine for commands that evaluate expressions (backport to 1.x) (#36649)** (16a8676)
- **fix(core): Release test-webhook isolate only after teardown completes (backport to 1.x) (#36633)** (a75e5ed)
- **fix(core): CAT-3451 (backport to 1.x) (#36593)** (951edd7)
- **fix(core): Acquire expression isolate for dynamic node parameter requests (backport to 1.x) (#36494)** (4ee48e6)
- **fix: Bump undici from 7.28.0 to 7.29.0 via pnpm override** (ab2a6bf)
- **fix: Bump tar from 7.5.16 to 7.5.21 via pnpm override** (d97e715)
- **fix: Bump adm-zip from 0.5.10 to 0.6.0 via pnpm override** (c4d602e)
- **fix(core): Bump fast-uri from 3.1.2 to 3.1.5** (8e4e278)
- **fix(core): Stop scheduled poll ticks from releasing the activation's expression isolate (#35934)** (ae489a6)
- **fix(editor): Improve resource locator link preview handling (#35570)** (7fd9a6e)
- **fix(Onfleet Trigger Node): Fix content type issue (backport 1.x) (#24878)** (a71b153)
- **fix(Code Node): External modules not working even when allowed in n8n version 1.x (#34093)** (beb673e)
- **fix(core): Settle webhook execution promise on early errors (backport to 1.x) (#33998)** (ec985f4)
- **fix(core): Preserve Date values passed to the expression isolate (backport to 1.x) (#33364)** (0e04591)
- **fix: Fix 5 security issues in hono, vue-i18n, linkify-it (#33164)** (e325585)
- **fix(core): Exclude error workflow executions from billable execution count (backport to 1.x) (#32544)** (f3fbfb0)
- **fix: Fix 5 security issues in tmp, ws, axios and 1 more (#32706)** (68fb550)
- **fix: Fix 21 security issues in tmp, protobufjs, ws and 8 more (#32687)** (bf85807)
- **fix(core): Resolve legacy $item accessor properties in vm expression engine (no-changelog) (backport to 1.x) (#32564)** (bc4f73a)
- **fix: Upgrade uuid to 11.1.1 to address advisories (1.x) (#32511)** (7336c56)

### Backend
- **:rocket: Release 1.123.83 (#39941)** (9e655c6)
- **Merge branch '1.x' into cat-bot/run-36070647395-1** (bcba7c4)
- **:rocket: Release 1.123.82 (#39573)** (17b3ae8)
- **:rocket: Release 1.123.81 (#38899)** (9a00ed3)
- **:rocket: Release 1.123.80 (#38771)** (108c716)
- **:rocket: Release 1.123.79 (#38268)** (28dd85a)
- **:rocket: Release 1.123.77 (#37697)** (a1400f1)
- **:rocket: Release 1.123.76 (#37610)** (cbee391)
- **:rocket: Release 1.123.75 (#36790)** (34740ba)
- **:rocket: Release 1.123.74 (#36683)** (9826eec)
- **:rocket: Release 1.123.73 (#36562)** (1a4cb1c)
- **:rocket: Release 1.123.72 (#36390)** (d062821)
- **:rocket: Release 1.123.71 (#36182)** (d29aec3)
- **:rocket: Release 1.123.70 (#36104)** (9d8fa66)
- **:rocket: Release 1.123.69 (#35575)** (430e6e5)
- **:rocket: Release 1.123.68 (#35403)** (67e50eb)
- **:rocket: Release 1.123.67 (#34700)** (ff05cd3)
- **:rocket: Release 1.123.66 (#34393)** (205a227)
- **:rocket: Release 1.123.65 (#34046)** (81ade1a)
- **:rocket: Release 1.123.64 (#33810)** (25d74f9)
- **:rocket: Release 1.123.63 (#33416)** (90b2f59)
- **:rocket: Release 1.123.62 (#33208)** (06379ca)
- **:rocket: Release 1.123.61 (#32926)** (2320517)
- **:rocket: Release 1.123.60 (#32743)** (f01ddc1)
- **:rocket: Release 1.123.59 (#32640)** (de78044)
- **:rocket: Release 1.123.58 (#32557)** (30d0c95)

### Chore
- **chore: Bundle/1.x (#39936)** (ab0b535)
- **chore: Bump mqtt 5.7.2 → 5.16.0 (minor) on 1.x to clear 1 Aikido finding (#39561)** (205a47b)
- **chore: Bump mqtt 5.7.2 → 5.16.0 (minor) on 1.x to clear 1 Aikido finding** (70ce0cf)
- **chore: Bump proxy-addr 2.0.7 → 2.0.8 (patch) on 1.x to clear 1 Aikido finding (#39554)** (0000f05)
- **chore: Bump proxy-addr 2.0.7 → 2.0.8 on 1.x (DEVP-1204)** (80a0bc2)
- **chore: Bump adm-zip 0.6.0 → 0.6.1 (patch) on 1.x to clear 1 Aikido finding (#39338)** (aa1dfca)
- **chore: Bundle/1.x (#38767)** (fff2c84)
- **build: Patch docker images to not build with pnpm 12 (#38223)** (55c635f)
- **chore: Bump hono 4.12.34 → 4.13.5 (minor) on 1.x to clear 3 Aikido findings (#38162)** (53ebf21)
- **chore: Bump hono 4.12.34 -> 4.13.5 (minor) on 1.x to clear 3 Aikido findings** (1cc6d83)
- **chore: Bump multer 2.2.0 → 2.3.0 (minor) on 1.x to clear 4 Aikido findings (#38160)** (f9edcd5)
- **chore: Bump multer 2.2.0 -> 2.3.0 (minor) on 1.x to clear 4 Aikido findings** (2787b94)
- **chore: Bump js-yaml 4.2.0 → 4.3.2 (patch) on 1.x to clear 2 Aikido findings (#38158)** (3b5d084)
- **chore: Bump js-yaml 4.3.1 -> 4.3.2 (patch) on 1.x to clear 2 Aikido findings** (18ea962)
- **chore: Bump sharp 0.35.0 → 0.35.4 (patch) on 1.x to clear 1 Aikido finding (#38157)** (695e2b8)
- **chore: Bump sharp 0.35.0 -> 0.35.4 (patch) on 1.x to clear 1 Aikido finding** (21f482f)
- **chore: Bump @xmldom/xmldom 0.8.14 → 0.8.15 (patch) on 1.x to clear 1 Aikido finding (#38154)** (b73fbb5)
- **chore: Bump @xmldom/xmldom 0.8.14 -> 0.8.15 (patch) on 1.x to clear 1 Aikido finding** (fbc26d5)
- **chore: Bump fflate 0.7.4 → 0.7.5 (patch) on 1.x to clear 1 Aikido finding (#38150)** (526f6aa)
- **chore: Bump fflate 0.7.4 -> 0.7.5 (patch) on 1.x to clear 1 Aikido finding** (51805b7)
- **chore: Bump fast-uri 3.1.5 → 3.1.6 (patch) on 1.x to clear 4 Aikido findings (#38145)** (ad1b1d8)
- **chore: Bump fast-uri 3.1.5 → 3.1.6 (patch) on 1.x to clear 4 Aikido findings** (a9e11f6)
- **ci: Remove a stray tree entry from the 1.x branch (no-changelog) (#37616)** (72b1ab1)
- **chore: Bundle/1.x (#37587)** (cac1cad)
- **chore: Bump browserslist 4.27.0 → 4.28.7 (minor) on 1.x to clear 2 Aikido findings (#37579)** (01132b1)
- **chore: Bump jose to 6.2.9 on 1.x to clear 1 Aikido finding (#36677)** (6ab893b)
- **chore: Bump jose to 6.2.9 via range override to clear AIKIDO-2026-584205** (f1afdf9)
- **chore: Bump jose 6.1.3 → 6.2.5 (minor) on 1.x to clear 1 Aikido finding** (c0c909d)
- **chore: Bump strnum 2.2.3 → 2.4.2 (minor) on 1.x to clear 1 Aikido finding (#36673)** (a9981e4)
- **chore: Bump strnum 2.2.3 → 2.4.2 (minor) on 1.x to clear 1 Aikido finding** (6aca3df)
- **chore: Bump highlight.js 11.8.0 → 11.12.0 (minor) on 1.x to clear 1 Aikido finding (#36672)** (77ca098)
- **chore: Bump highlight.js 11.8.0 → 11.12.0 (minor) on 1.x to clear 1 Aikido finding** (4c32079)
- **chore: Bump js-yaml 4.2.0 → 4.3.1 (minor) on 1.x to clear 3 Aikido findings (#36669)** (8324fd3)
- **chore: Bump js-yaml 4.2.0 → 4.3.1 (minor) on 1.x to clear 3 Aikido findings** (9d95d48)
- **chore: Bump linkify-it 5.0.1 → 5.0.2 (patch) on 1.x to clear 1 Aikido finding (#36668)** (c581ac6)
- **chore: Bump linkify-it 5.0.1 → 5.0.2 (patch) on 1.x to clear 1 Aikido finding** (4bafad7)
- **chore: Bump @langchain/langgraph-checkpoint 1.0.0 → 1.0.3 (patch) on 1.x to clear 1 Aikido finding (#36666)** (b4cecf4)
- **chore: Bump @langchain/langgraph-checkpoint 1.0.0 → 1.0.3 (patch) on 1.x to clear 1 Aikido finding** (900ee39)
- **chore: Bump hono 4.12.27 → 4.12.34 (patch) on 1.x to clear 4 Aikido findings (#36665)** (b85fb40)
- **chore: Bump hono 4.12.27 → 4.12.34 (patch) on 1.x to clear 4 Aikido findings** (9e130cf)
- **chore: Bump tar-fs 2.1.4 → 2.1.5 (patch) on 1.x to clear 1 Aikido finding (#36663)** (de040ce)
- **chore: Bump tar-fs 2.1.4 → 2.1.5 (patch) on 1.x to clear 1 Aikido finding** (54434d6)
- **chore: Bump sanitize-html 2.17.4 → 2.17.5 (patch) on 1.x to clear 1 Aikido finding (#36661)** (7596c0f)
- **chore: Bump sanitize-html 2.17.4 → 2.17.5 (patch) on 1.x to clear 1 Aikido finding** (22a227a)
- **chore: Bump pg 8.12.0 → 8.21.0 (minor) on 1.x to clear 1 Aikido finding (#36656)** (4f2a5c2)
- **chore: Bump pg 8.12.0 → 8.21.0 (minor) on 1.x to clear 1 Aikido finding** (8340dc2)
- **chore: Bump vm2 3.11.4 → 3.11.6 (patch) on 1.x to clear 10 Aikido findings (#36637)** (a066a97)
- **chore: Bump vm2 3.11.4 → 3.11.6 (patch) on 1.x to clear 10 Aikido findings** (94387d3)
- **chore: Bump @intlify/shared 11.1.10 → 11.4.4 (minor) on 1.x to clear 1 Aikido finding (#36626)** (f326d32)
- **chore: Bump @intlify/shared 11.1.10 → 11.4.4 (minor) on 1.x to clear 1 Aikido finding** (6a2bd2b)
- **chore: Bundle/1.x (#36559)** (4648e23)
- **chore: Bump mammoth 1.11.0 → 1.12.1 (minor) on 1.x to clear 2 Aikido findings (#36365)** (438f3e9)
- **chore: Bump mammoth 1.11.0 → 1.12.1 (minor) on 1.x to clear 2 Aikido findings** (4512cee)
- **chore: Bump @zone-eu/mailsplit 5.4.8 → 5.4.15 (patch) on 1.x to clear 1 Aikido finding (#36359)** (71e1482)
- **chore: Bump @zone-eu/mailsplit 5.4.8 → 5.4.15 (patch) on 1.x to clear 1 Aikido finding** (d59af9a)
- **chore: Bump @xmldom/xmldom 0.8.13 → 0.8.14 (patch) on 1.x to clear 2 Aikido findings (#36357)** (e267e45)
- **chore: Bump @xmldom/xmldom 0.8.13 → 0.8.14 (patch) on 1.x to clear 2 Aikido findings** (69d727b)
- **chore: Bump isolated-vm 6.1.2 → 6.2.0 (minor) on 1.x to clear 1 Aikido finding (#36356)** (763a7b8)
- **chore: Bump isolated-vm 6.1.2 → 6.2.0 (minor) on 1.x to clear 1 Aikido finding** (5960ab7)
- **chore: Bump nanoid 3.3.17 → 3.3.18 (patch) on 1.x to clear 2 Aikido findings (#36264)** (f41d9c9)
- **chore: Bump nanoid 3.3.17 → 3.3.18 (patch) on 1.x to clear 2 Aikido findings** (ed6bf6b)
- **chore: Bump @vue/shared 3.5.13 → 3.5.40 (patch) on 1.x to clear 1 Aikido finding (#36257)** (811c7f9)
- **chore: Bump @vue/shared 3.5.13 → 3.5.40 (patch) on 1.x to clear 1 Aikido finding** (a66000b)
- **chore: Bump @hono/node-server 1.19.13 → 1.19.15 (patch) on 1.x to clear 1 Aikido finding (#36191)** (11027de)
- **chore: Bump @vue/server-renderer 3.5.13 → 3.5.40 (patch) on 1.x to clear 1 Aikido finding (#36168)** (d472e64)
- **chore: Bump @vue/server-renderer 3.5.13 → 3.5.40 (patch) on 1.x to clear 1 Aikido finding** (2f18f94)
- **chore: Bump body-parser 2.2.1 → 2.3.0 (minor) on 1.x to clear 1 Aikido finding (#36164)** (9c5a4d9)
- **chore: Bump body-parser 2.2.1 → 2.3.0 (minor) on 1.x to clear 1 Aikido finding** (58daeb7)
- **chore: Bump nanoid 3.3.8 → 3.3.17 (patch) on 1.x to clear 3 Aikido findings (#36092)** (d78e19b)
- **ci: Notify slack on failed release publish (#36114)** (280bb98)
- **chore: Bump fast-xml-builder 1.1.7 → 1.2.1 (minor) on 1.x to clear 1 Aikido finding (#36086)** (f5c0c47)
- **chore: Bump fast-xml-builder 1.1.7 → 1.2.1 (minor) on 1.x to clear 1 Aikido finding** (df148e2)
- **chore: Bump brace-expansion 2.1.0 → 2.1.4 (patch) on 1.x to clear 3 Aikido findings (#36072)** (31f3bf7)
- **chore: Bump brace-expansion 2.1.0 → 2.1.4 (patch) on 1.x to clear 3 Aikido findings** (eab17a3)
- **chore: Bump sharp 0.33.5 → 0.35.0 (minor) on 1.x to clear 1 Aikido finding (#36059)** (a6456e6)
- **chore: Bump brace-expansion 5.0.6 → 5.0.9 (patch) on 1.x to clear 5 Aikido findings (#36050)** (914d5e0)
- **chore: Bump brace-expansion 5.0.6 → 5.0.9 (patch) on 1.x to clear 5 Aikido findings** (8ec1189)
- **chore: Bump mysql2 3.17.0 → 3.23.1 (minor) on 1.x to clear 2 Aikido findings (#36002)** (947cd2f)
- **chore: Bump mysql2 3.17.0 → 3.23.1 (minor) on 1.x to clear 2 Aikido findings** (84ed48c)
- **chore: Bump ws 8.21.0 → 8.21.1 (patch) on 1.x to clear 1 Aikido finding (#36000)** (4f82a71)
- **chore: Bump ws 8.21.0 → 8.21.1 (patch) on 1.x to clear 1 Aikido finding** (0a5ff55)
- **chore: Bump protobufjs 7.6.3 → 7.6.5 (patch) on 1.x to clear 1 Aikido finding (#35997)** (1f210be)
- **chore: Bump protobufjs 7.6.3 → 7.6.5 (patch) on 1.x to clear 1 Aikido finding** (93eaf4d)
- **chore: Bump undici 7.28.0 → 7.29.0 (minor) on 1.x to clear 5 Aikido findings (#35995)** (b70bc97)
- **chore: Bump tar 7.5.16 → 7.5.21 (patch) on 1.x to clear 10 Aikido findings (#35991)** (979dfd5)
- **chore: Bump adm-zip 0.5.10 → 0.6.0 (minor) on 1.x to clear 2 Aikido findings (#35985)** (e2256b0)
- **chore: Bump fast-uri 3.1.2 → 3.1.5 (patch) on 1.x to clear 6 Aikido findings (#35975)** (eb446cc)
- **chore: Bundle/1.x (#35561)** (3e4fb19)
- **chore: Bundle/1.x (#34679)** (1cd2c5f)
- **chore: Bundle/1.x (#33794)** (3508001)
- **chore: Bundle/1.x (#32897)** (1cf0d11)
- **ci: Remove Slack notification from Trivy container scan (#32649)** (db2f5f7)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/n8n-io/n8n?utm_source=github-action)._