n8n 2.31.7 - S3 Signing and Audit Fixes

n8n published [email protected] on July 27, 2026. The main operator change is strict RFC 3986 encoding when n8n signs S3 object paths, alongside a narrower credential audit path that no longer loads execution data.

The full release notes and downloads are on the GitHub release page.

The credential security audit no longer loads execution data. The change is tracked in issue 34912 and implemented by commit 0b61a96.

This removes stored run payloads from the data read path used by that audit. For instances with a large execution history, the distinction matters. Reading execution records can add database input and output, object materialization, and heap work to a task whose purpose is credential analysis. The release notes do not include a benchmark, so the size of any resource reduction is unknown.

The security boundary is also clearer. Execution payloads are no longer an input to this audit path. That is useful when operators need to explain which classes of stored data a security check reads. The notes do not describe a permission change, a new setting, or a migration. This is a core behavior correction with no documented configuration surface.

n8n now signs S3 object paths using strict RFC 3986 encoding. The fix is associated with issue 34873 and commit 75b0d34.

Object path encoding is part of the canonical request used to calculate an S3 signature. If path construction and signing do not apply the same encoding rules, the service can evaluate a different canonical path and reject the request. This patch moves n8n to the strict RFC 3986 rule at that boundary.

The notes do not list specific object names, storage providers, or failure messages affected by the old behavior. Operators should therefore avoid assuming that every S3 error in 2.31.6 or earlier maps to this fix. The useful regression case is an object key that requires URI encoding, tested through the same storage endpoint and credentials used in production.

This release contains two documented bug fixes, both in core. It does not add workflow nodes, schema changes, CLI flags, or migration instructions. It is also a stable release, not a prerelease.

The small change set also constrains the review surface. Operators can trace the audit behavior to 0b61a96 and the S3 signer behavior to 75b0d34 without treating this tag as a broader workflow engine update.

That scope makes validation direct. Exercise the credential security audit against an instance with representative execution history, and observe database read volume and process memory. For S3 storage, test object write and read paths with keys that require URI encoding. The release notes provide no compatibility matrix, so tests should use the actual S3 implementation behind the deployment.

There are no documented breaking changes. The main upgrade tradeoff is the usual one for a narrow patch: the two corrected code paths become more predictable, while unrelated workflow behavior should not be expected to change. Review the n8n 2.31.7 release page before promotion because the published notes are intentionally small.