n8n published [email protected] on 25 August 2026. Queue mode workers now send OAuth2 token requests through HTTP_PROXY and HTTPS_PROXY, the same path the main process already used. The rest of the patch is API content type enforcement, license auto renewal after leader takeover, and a cursor only history list.
The full release notes and downloads are on the GitHub release page.
OAuth2 token refresh now follows env proxies ¶
Background token refresh bypassed HTTP_PROXY and HTTPS_PROXY on worker processes. Interactive reconnect on the main process worked. Background refresh did not. The failure was connect ETIMEDOUT against the token host on port 443. Google, Salesforce, and Gong credentials all hit it in a production queue mode fleet.
#37009 (97f9252) builds proxy aware agents inside @n8n/client-oauth2 whenever a proxy applies to the token URL. Token requests no longer depend on process global agent state. ClientOAuth2.accessTokenRequest had been setting axios proxy: false and only building custom agents for ignoreSSLIssues or an SSRF lookup. The plain proxied case fell back to https.globalAgent, which was proxy aware only on main.
The same change adds a 300 second timeout on those token requests. The package ships its own axios copy, so it never received the shared default.
NO_PROXY is honored. Direct connect still happens when no proxy applies. Tests live in packages/@n8n/client-oauth2/test/proxy-routing.integration.test.ts. This patch only fixes the token path. Installing env proxy global agents in every process type is deferred to a later minor.
License auto renewal after leader takeover ¶
A leader can win election before the license module registers its takeover handler. The listener is one shot. If it misses the event, auto renewal stays off for the process lifetime. The certificate then expires. Licensed features such as SSO fail until restart.
#36937 (d98d300) reconciles auto renewal right after handlers register. If the instance is already leader, it enables auto renewal itself. Scope is license only. A broader replay of the takeover event was rejected because other handlers are not safe to run twice.
Coverage is in packages/cli/src/commands/__tests__/start.test.ts, describe block init - license auto-renewal reconciliation. Reproduce with N8N_MULTI_MAIN_SETUP_ENABLED=true and EXECUTIONS_MODE=queue. An instance that already missed the event still needs a restart after upgrade so the reconcile path can run.
Public API content type, history offset, and binary data ¶
Decorator routes that take a body now reject a non JSON Content-Type with 415. #36958 (bf90b05) closes a gap that appeared after the workflow tags endpoints moved onto the decorator pattern. Form encoded or XML bodies were parsed and handled. The spec promised 415.
On this 2.36.x backport the generated spec change covers four routes: create a role, update a role, create a role mapping rule, and update workflow tags. Other body routes still go through express-openapi-validator, which already answered 415. GET routes and POST /workflows/{id}/unpublish are untouched. application/json is accepted with any casing and any parameters. A missing or empty Content-Type is allowed only when every body field is optional.
#36952 (08331e1) removes the offset query parameter from GET /workflows/{workflowId}/history. Pagination is cursor only, matching the other Public API list endpoints. The endpoint was recent and low usage. The project accepted the break without a deprecation window. GET /api/v1/workflows/{workflowId}/history?limit=2 then page with nextCursor is unchanged. ?offset=2 is now a no op, not an error.
#36994 (f6f237c) adapts GET /rest/binary-data so the handler can locate the file it returns. The notes do not spell out the old lookup path. Treat it as an internal locator fix.
Upgrade notes ¶
This tag is a stable patch, not a prerelease. Two client visible breaks sit inside it.
API clients that POST form encoded bodies to decorator routes will now get 415 instead of a silent parse. Send Content-Type: application/json. A publish call with Content-Type: application/x-www-form-urlencoded is the easy check. The workflow should stay unpublished.
API clients that page workflow history with offset will get the first page again. Switch to nextCursor.
Queue mode fleets behind a forward proxy should pick this up for OAuth2 refresh. Confirm HTTPS_PROXY is set on worker processes, not only on main.