n8n published tag [email protected] on 2 September 2026. The GitHub release body has no user facing changelog. The change that matters is in the tag compare: a backport that hardens the expression compiler sanitizer so a class field named __sanitize can no longer rebind this and reach the Function constructor.
The full release notes and downloads are on the GitHub release page.
GitHub left the notes blank ¶
The published body is a heading, a date, and a link to the tag compare. Three of the four commits on that compare are marked no-changelog. The fourth is the release automation PR.
That is why the page looks empty. It is not a no op. The compare from 2.37.6 to 2.37.7 lists 4 commits, 278 files, and 6 contributors. The bulk is a backport titled chore: Bundle 2.x onto release-candidate/2.37.x. Treat the empty body as a packaging choice, not as a signal that [email protected] is still current.
If you pin the 2.37 line, read that compare before you skip the bump. The GitHub page will not summarize it for you.
Expression compiler sanitizer ¶
The same day as the tag, advisory GHSA-hw8v-xxg5-vvvx listed [email protected] as a patched version for a High issue in the expression compiler. The GitHub release text does not mention it.
The sanitizer resolved through a dynamically scoped this. A class field named __sanitize rebound it and reached Function. On the backend, any expression author could run code in the n8n process. In the editor preview, a member’s expression could run as JavaScript in the session of whoever opened the workflow. The patch rejects reserved class member names.
The bundle touches packages/workflow/src/expression-sandboxing.ts and the runtime under packages/@n8n/expression-runtime. That is the operator reason to take this tag. Copy edits and CI pins are secondary.
If you cannot move yet, the advisory names a short term mitigation: set N8N_EXPRESSION_ENGINE=vm, restrict who can create or edit workflows, and audit node parameter expressions. It also says those steps do not fully close the hole.
Sandbox image pins and Gateway credits ¶
One remaining commit pins images in packages/testing/containers/test-containers.ts. sandboxApi moves from n8nio/n8n-sandbox-service-api:latest to n8nio/n8n-sandbox-service-api:1.2.0. sandboxRunner moves from n8nio/n8n-sandbox-service-runner-dind:latest to n8nio/n8n-sandbox-service-runner-dind:1.2.0. sandboxSandbox moves from n8nio/n8n-sandbox-service-sandbox:latest to n8nio/n8n-sandbox-service-sandbox:1.1.0.
The comment in the diff says that from 1.3.0 the runner rejects a non https SANDBOX_RUNNER_HTTP_BASE_URL, which the local stack in services/sandbox.ts still sets. This is a test fixture pin, not a production image bump. Copy the pins if your CI still follows :latest for those three names.
The other no-changelog commit renames “n8n credits” copy to “Gateway credits” in the instance AI assistant. The tool contract moves with the copy. list-credentials now returns { credentials: [{ id, name, type }], total, hasMore, hint? }. A Gateway credits managed entry can have id: null and __aiGatewayManaged: true. Credential type search adds gatewayCreditsOnly; query is no longer required when that flag is true, and those results look like { type, gatewayCredits: true }. Node listing gets the same filter.
Eval harnesses and MCP clients that parse those payloads will break on the old { id, name, type, createdAt, updatedAt } shape.
Most of the 278 file bundle is internal. Next to the sanitizer, the HTTP client in getProxyAgent now returns an undici Agent even when no proxy env is set, with connect.lookup bound to Node dns.lookup and default headersTimeout / bodyTimeout of 3600000 ms. The GitHub body does not describe that change.
Upgrade notes ¶
This is a stable patch, not a prerelease. No migration steps appear in the GitHub body because the body is empty.
If you run [email protected] or earlier on the 2.37 line, take [email protected] for the expression sanitizer. Stay on the line you already run. This tag is not a jump to a later minor.
No breaking change section was published. The instance AI credential tool response is the contract that is easy to trip over in the compare. Re run workflows that put unusual class members or array mutations in expressions after you bump.