[2.14.1] - 2026-10-25
Changed
- Dev toolchain hardened (dev-scope only; runtime
dependenciesunchanged):vitestbumped to v5 (clears the vitest/@vitest/mocker path-traversal advisories and the tinypool RCE advisories, and pulls a Vite outside the advised range),release-itto v21 (clears its basic-ftp/get-uri/proxy-agent/undici advisory chain),n8n-workflowtest copy to^2.16.0(resolves to the same version the @n8n toolchain installs),@types/nodeto v22 to match the Node 22 runtime CI publishes from, and@n8n/node-clipinned to^0.53.4so CI no longer drifts to unpublished releases. handlebarspinned to^4.7.10viaoverrides— the release that fixes the three Handlebars JS-injection advisories (GHSA-8r5x-fm3f-whwj and GHSA-p8wg-vrv2-v86f critical, GHSA-xw65-4hp5-5hc7 moderate) reachable through the dev toolchain;@n8n/node-clipins handlebars 4.7.9 exactly in its nested tree, so no dedupe-free route reaches the fixed version.@n8n/community-nodes/no-overrides-fieldis disabled forpackage.jsononly (with the existing shape-rule exemptions) because the community ruleset forbidsoverridesby default; non-root overrides have no effect on consumers, so this only hardens the dev/CI tree.HuduAiToolscodex category corrected to a supported community category (AI→Utility): the current@n8n/node-clivalid-node-categoriesrule rejectsAIin.node.jsoncodex files.- Remaining advisories are documented as accepted risk:
zod(<4.6.6, fixed only in the zod 4 line — the n8n ecosystem is on zod 3) and dev/peer-scope packages with no upstream fix yet (@langchain/coredev copy pinned to the 0.3 line this code targets,@n8n/ai-utilities,@n8n/config,openai,@browserbasehq/stagehand,@langchain/community/classic,zod-to-json-schema,uuid).