n8n 1.123.79 - Dependency Pins And Managed OAuth

n8n published tag [email protected] on 10 September 2026. The GitHub release page notes are a single heading. That heading is the compare from [email protected] to [email protected]: root pnpm.overrides bumps for several libraries, plus one credential behavior fix marked no-changelog.

The full release notes and downloads are on the GitHub release page. GitHub metadata marks the tag as not a prerelease. The compare is 17 commits across 12 files from 7 contributors. Fourteen are a n8n-cat-bot commit plus its merge. The release page has no library bullets. The release commit is 28dd85a (#38268).

Three bumps name the advisories they clear. Each edits the root override block and refreshes pnpm-lock.yaml.

fast-uri moves from 3.1.5 to 3.1.6 (#38145). The commit says it is transitive through ajv@8 and is reached at runtime by express-openapi-validator in packages/cli. Four high severity ids need 3.1.6 or newer: CVE-2026-75899, CVE-2026-75931, CVE-2026-75975, and CVE-2026-76172.

fflate moves from 0.7.4 to 0.7.5 (#38150). It is a direct dependency of n8n-nodes-base. The pin is raised so the tree resolves a single 0.7.5, clearing CVE-2026-45820 (high).

@xmldom/xmldom moves from 0.8.14 to 0.8.15 (#38154). The commit calls it transitive only, through samlify, @authenio/xml-encryption, xml-crypto, and mammoth. The selector @xmldom/xmldom@<=0.8.14 becomes <=0.8.15. That clears CVE-2026-83610 (medium).

Four more override edits name an Aikido finding count and a version span. They do not name advisory ids.

sharp moves from 0.35.0 to 0.35.4 (#38157). The message says the patch clears one finding.

js-yaml is less tidy. The package.json edit moves the override from 4.3.1 to 4.3.2 and says that clears two findings (#38158). The merge commit title instead says 4.2.0 to 4.3.2. The pin in the override block is 4.3.2. Neither message names the advisories.

multer moves from 2.2.0 to 2.3.0 (#38160). The commit calls this a minor bump and says it clears four findings. It sits on the multipart request path, and the message lists no behavior changes. Recheck uploads on staging.

hono moves from 4.12.34 to 4.13.5 (#38162). The selector changes from hono@<=4.12.34 to <=4.13.5. The package arrives through @modelcontextprotocol/sdk, directly and via @hono/node-server. No source file in this repo imports hono. The bump clears CVE-2026-84363 (medium), CVE-2026-84364 (low), and CVE-2026-84365 (medium). The commit calls it a runtime dependency bump with no type surface to adjust, and it does not describe what 4.13.5 changes inside the MCP SDK.

#38163 is the only application change. The message calls it a backport to the 1.x line and marks it no-changelog, which is why the release page is silent. The diff is packages/cli/src/credentials-helper.ts, packages/cli/src/credentials-overwrites.ts, and the tests.

CredentialsOverwrites.usesManagedAuth returns true only when an overwrite for that credential type exists and applying it changes at least one stored field. It calls applyOverwrite, then checks whether applied[key] differs from data[key]. Empty stored fields that the overwrite fills count as managed. Fields the user already customized do not.

When that check is true, applyDefaultsAndOverwrites ignores the stored value for MANAGED_OAUTH_PINNED_FIELDS: authUrl, accessTokenUrl, grantType, authentication, requestTokenUrl, and signatureMethod. For each name it looks up a property whose type is hidden and whose default is a string. A non empty admin overwrite wins. Otherwise the credential type default is written. The patch comment says the stored user value is never used.

Tests force a managed OAuth2 fixture back to the type defaults for authUrl and accessTokenUrl while keeping clientId and clientSecret. An admin overwrite for accessTokenUrl wins over both. OAuth1 does the same for requestTokenUrl and accessTokenUrl and keeps consumerKey and consumerSecret. If usesManagedAuth is false, or the field type is string rather than hidden as on generic oAuth2Api, the stored URL stays. A custom hidden endpoint on a managed type is ignored unless that URL is a type level overwrite.

#38223 edits docker/images/runners/Dockerfile and docker/images/runners/Dockerfile.distroless. Both gain ARG PNPM_VERSION=10.22.0. The line corepack enable pnpm becomes npm i -g "pnpm@${PNPM_VERSION}". The commit message is “Patch docker images to not build with pnpm 12”. NODE_VERSION stays 24.13.1 and PYTHON_VERSION stays 3.13. The step that strips catalog and workspace from package.json, so an extended image can still run pnpm add, is unchanged. The main server image is not in this diff. Only the JavaScript task runner images are.

The release body lists no breaking change and no migration. Two effects still show up after install.

Managed OAuth credentials ignore stored hidden endpoint fields. Put a custom token URL in the credential overwrite for that type if the instance needs one. Credentials that are not managed keep the stored value. Editable string fields, such as generic OAuth2 accessTokenUrl, also keep it.

Extended runner images that assumed corepack enable pnpm now install pnpm 10.22.0 with npm at build time. Corepack will not select pnpm 12 in these two Dockerfiles.

Library overrides do not change workflow JSON. They change what pnpm.overrides resolves in the published artifact, which the empty release text does not list. This delta is only [email protected] to [email protected]. Hosts below 1.123.77 also pick up earlier 1.123 patches, outside this tag.