n8n 2.38.1 - MongoDB Binding And Distroless Runners

n8n published [email protected] on 1 September 2026. The tag is a stable release, not a prerelease. The change operators will hit first is the distroless task runner image, which now copies glibc in as a matched pair so the runner binary and its libc agree.

The full release notes and downloads are on the GitHub release page. The compare range is [email protected] to [email protected], so this tag carries both 2.38 work and the 2.38.1 fixes.

Task runners that ship as distroless images fail at process start when libc is missing or mismatched. PR 37149 copies glibc into the distroless runners image as a matched pair. The same image also stages libatomic.

A timeout is now applied to the S3 startup connection check (37245). Without a timeout, a blocked or firewalled object store can stall process boot for as long as the TCP stack is willing to wait.

OpenTelemetry disable was coupled to collector reachability. PR 37203 stops a disable call from failing when the OTLP collector is unreachable. Turning telemetry off should not depend on the collector answering.

Community packages get a narrower install fix. An existing community package directory is kept when a fresh install fails (36964). That avoids wiping a working tree because a retry did not finish.

MongoDB nodes had a query correctness gap. PR 37335 adds parameter binding for sort and projection. Unbound sort and projection values are how operator interpolation leaks into query shape. Workflows that feed expressions into those fields should be retested after the upgrade.

Write volume is handled separately. The MongoDB node now batches update and find-and-update writes with bulkWrite. That cuts round trips on large item lists. It does not change the document model. It changes how many commands hit the server per node run.

Postgres gets a related identifier fix in AI nodes. Table and column names are quoted and validated. That is the SQL equivalent of the MongoDB binding work, aimed at generated queries rather than hand written ones.

The runtime now responds with an error when a webhook execution ends before the Respond to Webhook node runs (37006). Clients that treated a missing response as success will see a failure instead. That is the correct signal when the workflow never reached the response node.

Gmail Trigger polling had two loss cases. Queued messages are no longer dropped when a fetch fails in the middle of a poll. Polls also no longer miss mail when more than 100 messages arrive between ticks. One is crash safety during a fetch. The other is the 100 message cap between polls.

Chat Trigger test webhooks now apply authentication (37296). Test traffic goes through the same auth the production webhook uses. The private chat setting is also respected in tests (37406).

GET /credentials no longer eager loads projectRelations (37138). That list call is a hot path on large instances. Skipping the relation is an API performance fix, not a schema change.

OAuth token grants are bound to their approved resource (37122). Discover scopes are resolved from the request token grant (37225). Together those stop a grant from being reused on a resource it was not approved for.

HTML pages now serve a nonce based Content-Security-Policy. Git connections are limited to one instance connection. The notes do not include a migration guide for either change. Operators who inject scripts into n8n HTML, or who share one Git remote across several n8n processes, should verify those paths.

Expression evaluation restores mutating array methods on $json data (37172). If a workflow called .push() or similar on $json arrays and you rewrote it after that stopped working, check the rewrite still matches. Nested expression evaluations now share one time budget, and the engine validates timeout and memory limit settings. The editor and ai-builder buckets in this tag are mostly preview dock, tab bar, and layout work. They are not covered here.