n8n 1.123.83 Pins cjs-module-lexer at 2.2.0

n8n published tag [email protected] on 30 September 2026 (2026-09-30T06:13:31Z). The release notes list one bug fix: pin cjs-module-lexer at 2.2.0. The tag is a stable release. On that tag the workspace package is n8n-monorepo at version 1.123.83.

The full release notes and downloads are on the GitHub release page. The notes point at the compare range from [email protected] to [email protected].

Commit 76e467d is the change the notes cite. The author is n8n-cat-bot. The subject line is fix: Pin cjs-module-lexer 2.2.0 to address review finding.

The patch adds one exact version to the overrides object in the workspace package.json:

"cjs-module-lexer": "2.2.0"

That object already forces adm-zip to 0.6.1, proxy-addr to 2.0.8, @isaacs/brace-expansion to 5.0.1, ast-types to 0.16.1, and @azure/identity to 4.13.0.

cjs-module-lexer is absent from dependencies and from devDependencies. No workspace package declares it, so a direct version bump was not available. The pnpm override rewrites every transitive request onto 2.2.0.

pnpm-lock.yaml gets the same key under its top level overrides map. A package.json override paired with a stale lockfile still installs the copies the lockfile already resolved. The notes give no advisory identifier, no affected node name, and no config key.

Before the pin, pnpm-lock.yaml resolved two lexer versions. [email protected] depended on [email protected]. [email protected] and [email protected] depended on [email protected]. The import-in-the-middle snapshot lists the lexer next to [email protected], [email protected], and [email protected].

The patch deletes both old package entries and both empty snapshot stubs. One resolution remains:

[email protected]:
  resolution: {integrity: sha512-4bHTS2YuzUvtoLjdy+98ykbNB5jS0+07EvFNXerqZQJ89F7DI6ET7OQo/HJuW6K0aVsKA9hj9/RVb2kQVOrPDQ==}

Three snapshot edges now read cjs-module-lexer: 2.2.0: [email protected], [email protected], and [email protected]. The new snapshot is an empty dependency map. The lexer brings no nested packages of its own.

[email protected] declared 1.2.2. [email protected] declared 1.4.3. Both now parse with 2.2.0. The gain is one copy and one integrity hash. The release notes include no fixture diff for named export detection.

Upstream cjs-module-lexer 2.2.0, published 2 January 2026, replaces an eval used to decode string literals with a dedicated string scanner. The n8n commit does not quote that changelog. The pin is a dependency floor for a review finding.

[email protected] is the runtime consumer. This lockfile lists it under @opentelemetry/[email protected], @sentry/[email protected], and @sentry/[email protected]. Those packages patch require and ask the lexer for CommonJS export names while modules load. A worker with OpenTelemetry instrumentation or the Sentry Node SDK calls that parser. Workflow JSON, credential payloads, and node parameters stay as they are.

[email protected] and [email protected] are the test consumers. Jest uses the lexer when a test imports named exports from a CommonJS module. That path runs in CI for this repository. The queue worker and the webhook process leave jest-runtime unloaded. The patch adds no per package exception, so the override hits the test copies and the runtime hook together.

The notes list no migration procedure. Install the tag so pnpm reads the override and the updated pnpm-lock.yaml, then restart the process. An image built from [email protected] keeps lexer 1.2.2 and 1.4.3 until that image is rebuilt. A process that is already up keeps the modules it loaded at startup.

The pin commit edits package.json and pnpm-lock.yaml. Workflow definitions and credential schemas stay valid.

After rollout, run one workflow that loads a CommonJS community node or a database driver with tracing or Sentry enabled. A lexer mismatch on that hook shows up as a missing export on a patched module, at startup or on the first require. The notes report no such failure on 2.2.0.

The release notes also link a Cubic review of the release pull request, pull 39941.