v2.28.0

Bug Fixes

• API: Return 409 when deleting a published workflow (#​32600) (1f774c8)
• Bitbucket Trigger Node: Use account_id to validate credentials instead of username (#​30172) (5dc9c45)
• Bump form-data, tmp, protobufjs to patched versions (#​32436) (a1cfd14)
• Bump protobufjs, js-yaml, @​opentelemetry/core for nightly Trivy (#​32542) (2dac96d)
• Cap ci-filter deepen value and fall back to --unshallow (#​32581) (af563c6)
• Compression Node: Decompress only the archive members (#​32486) (cafc64c)
• core: Account for pending CSV uploads in data-table size budget (#​31394) (e4757d2)
• core: Change default value of the COOP header (#​32377) (b94ff9b)
• core: Clean up workflow publication outbox records (#​32795) (900c0ea)
• core: Coalesce outbox drains and wait for in-flight processing on shutdown (#​32548) (7230fa3)
• core: Drive workflow folder placement through validated parentFolderId (#​31364) (0f1c1a8)
• core: Evaluate expressions in AI tool description for node-as-to… (#​31495) (beba723)
• core: Exclude error workflow executions from billable execution count (#​32315) (f6c2bcc)
• core: Fix error path schema mismatch in mcp tools (#​32560) (c91250f)
• core: Handle malformed agent tool calls (#​32276) (285e4a9)
• core: Implement workflow-folder-conflict handling in import process (#​32391) (97f45cc)
• core: Keep $fromAI placeholders intact on fields with expressions disabled (#​31681) (43eec00)
• core: Keep thread history when observation cursor lacks observations (#​32773) (0197817)
• core: Let allowlisted Python packages import their own submodules via relative imports (#​32772) (46aa8e4)
• core: Limit execution data size for display reads (#​32508) (524d4e8)
• core: Make workflow evaluations work alongside config evals (#​32384) (19eeb5e)
• core: Negotiate token_endpoint_auth_method during MCP OAuth2 DCR (#​32289) (734af04)
• core: Persist run data for Instance AI trigger executions in queue mode (#​32498) (db1e21f)
• core: Prevent assigning unusable credentials in mcp (#​32353) (7ddde95)
• core: Propagate execution context to sub-workflow tools (#​32577) (09f5888)
• core: Propagate stop signal to sub-workflow executions on workers in queue mode (#​32206) (ae7f699)
• core: Request protected-resource scopes during MCP OAuth2 DCR (#​32300) (e8ee370)
• core: Resolve duplicate generated schema fields (#​32275) (94594e3)
• core: Save Instance AI workflow edits through workspace files (#​32545) (1e80d41)
• core: Shorten private-credential OAuth authorization links (#​32584) (c1582a6)
• core: Stop re-asking answered or skipped clarifying questions (#​32755) (9ce241b)
• core: Support v4 and v5 schemas for strapi consumers (#​32559) (d6758db)
• core: Surface form submission errors instead of failing silently (#​32305) (60ac614)
• core: Suspend query acquisition during database connection recovery (#​32394) (7440fca)
• core: Time out stalled HTTP response body reads (#​32411) (50887bf)
• core: Upgrade @​n8n_io/license-sdk to v3 and resolve node-rsa to v2 (#​32552) (ebbd629)
• editor: Clamp and truncate long workflow descriptions in MCP settings (#​32104) (b953709)
• editor: Hide function info-box tooltip while typing arguments (#​32371) (59971c8)
• editor: Hide template setup button when only disabled nodes lack credentials (#​32625) (801bd5f)
• editor: Polish API key scope picker radio alignment, contrast and form spacing (#​32420) (229560e)
• editor: Preserve existing node IDs when AI edits a workflow (#​32593) (cbb9ae5)
• editor: Prevent autosave failure loop after AI builder modifies a workflow (#​32558) (4821bed)
• editor: Prevent drag and drop of a folder onto itself (#​31510) (4f8af4d)
• editor: Show a rejection screen when the OAuth consent target is unavailable (#​32594) (2c3c67f)
• editor: Show rotated API keys in the create modal and outline the read-only Close button (#​32480) (31e8ddc)
• editor: Widen callable subworkflow list using callerPolicy in workflow picker (#​32522) (f105b34)
• editor: Wrap long unbroken strings in tooltip (#​32345) (a0b35d5)
• Extract inline run-report attachments before aggregating sizing (#​32799) (c8a3a3c)
• Fix 26 security issues in electron, axios, undici and 5 more (#​32688) (c7fcbb7)
• Form Node: Evaluate expressions in form fields on subsequent pages (#​32352) (35adffa)
• Form Trigger Node: Add default value for authentication parameter to prevent crash on old workflows (#​32627) (940f389)
• Handle HTTP raw body validation loops (#​32277) (d5dd492)
• Hides preview suggestions on smaller screens due to lack of space (#​32444) (ad298e7)
• HTTP Request Node: Preserve all repeated query parameters in cURL import (#​32253) (8b01aac)
• Kafka Node: Route Schema Registry client through configurable egress protection (#​32370) (f19d744)
• Kafka Trigger Node: Surface consumer errors instead of waiting indefinitely (#​32642) (30b2127)
• Make QA metrics telemetry truly fire-and-forget (#​32597) (6e8a7fc)
• Microsoft OneDrive Node: Validate upload file name to replace misleading Graph error (#​32470) (f998a1f)
• Nextcloud Node: Fix broken user actions and folder sharing, add internal link share type (#​32002) (3767449)
• Prompt to save before manual run with autosave disabled (#​32513) (2124c08)
• RedactValues throws TypeError on null-valued credential fields (#​32804) (7ebd0cf)
• Removes phantom telemetry profile caused by missing user id fallback (#​32344) (ef148c6)
• Salesforce Node: Reuse JWT session token across requests (#​32325) (0e4d2c3)
• Slack Node: Handle missing response property in pagination (#​32328) (d673064)
• Stop a timed-out background AI builder from respawning itself (#​32630) (8c96484)
• Suggest the configured AI provider's chat model when building workflows (#​32634) (b294e3d)

Features

• Add concurrency field to sizing-matrix Topology (#​32767) (1c75eb6)
• Add successful executions to evaluation dataset (#​32308) (713094c)
• AI Agent Node: Add binary PDF passthrough for models with native PDF support (#​28038) (64c337b)
• API: Use scope checks instead of system roles for resource access (#​32769) (908bab7)
• AWS Transcribe Node: Add AWS Assume Role authentication (#​32017) (038b623)
• Compression Node: Add tar and tar.gz support (#​32547) (d595631)
• core: Add 'workflows-imported' logstreaming event (#​32488) (70d4a67)
• core: Add agent heartbeat session metrics (#​32732) (fd2cf90)
• core: Add Azure storage mode for execution data (#​32368) (1d6415c)
• core: Add Instance AI error correlation and structured observability (#​32400) (f53a648)
• core: Add knowledge file storage for agents (#​31956) (3ae74f1)
• core: Add knowledge retrieval tools for agents (#​32485) (8e5dd83)
• core: Add node-class-description-name-camelcase community node lint rule (#​32443) (fb16f72)
• core: Add prometheus metrics for detailed metrics on webhook & form workflows (#​32251) (b9e7729)
• core: Add Prometheus metrics for Instance AI runs (#​32489) (4218e1b)
• core: Add redirect URLs allow lists to MCP server (#​24739) (b513f54)
• core: Add support for 'create-stub' mode in credential handling… (#​32507) (6b453d9)
• core: Enable creation of custom instance (global) roles (#​32590) (e60bb4b)
• core: Enable scheduled execution deduplication by default (#​32533) (dcbdb10)
• core: Enable thinking modes for instance ai (#​32768) (c8e4c76)
• core: Expand secret redaction patterns (JWT, PEM keys, vendor tokens, URL creds) (#​32440) (f815269)
• core: Gate MCP tool calls on the caller's private-credential status (#​32446) (8cac6e7)
• core: Make MCP and OAuth server IP rate limits configurable via environment variables (#​32203) (b34ab3b)
• core: OpenAI Responses API support for agent pdf passthrough (#​32604) (ade94af)
• core: Prioritize workflow as code over json (#​32668) (e11e0b1)
• core: Reduce templates complexity in KB (#​32694) (9341fdb)
• core: Resolve the triggering user's private credentials over MCP OAuth (#​32432) (d6cc6c6)
• core: Show required scope badge on Swagger UI operations (#​32240) (58ba32d)
• core: Support MCP tool filtering for Instance AI MCP connections (#​31836) (7a3a190)
• core: Update credential handling in workflows-imported event (#​32794) (95a7532)
• Derive picker coverage map from ledger in build-matrix (#​32721) (33d38e3)
• editor: Add owner filter to API keys "All" tab (#​32430) (888be28)
• editor: Add Roles settings area with instance roles tab (#​32775) (3983a48)
• editor: Add rotate action for API keys (#​32342) (44d9f3d)
• editor: Improve credential saving UX for OAuth credentials (#​32653) (d52762f)
• editor: Investigate failed executions on Instance AI editor hand-offs (#​32675) (504b282)
• editor: Open the current workflow and credentials in Instance AI from the editor (#​32398) (b1687ef)
• editor: Redesign API key scope picker with grouped tree (#​32167) (f6afb39)
• editor: Rename n8n Connect usage table header from Model to Resource (#​32448) (ade2de9)
• editor: Render the workflow execution preview natively instead of in an iframe (#​32296) (23fb6b9)
• editor: Render workflow history and template previews natively (#​32468) (5582bb2)
• editor: Surface execution data size in the executions view (#​32505) (084a6d6)
• GitHub Node: Add Pull Request resource with create, update, merge, comments, diff and patch (#​32261) (86db3e4)
• Google Ads Node: Upgrade API from v20 to v21 (#​32712) (b91492d)
• Google Calendar Node: Allow custom OAuth2 scopes (#​32661) (7e37945)
• Google Cloud Storage Node: Allow custom OAuth2 scopes (#​32659) (0369d40)
• Google Sheets Node: Allow custom OAuth2 scopes (#​32660) (9158556)
• Google Sheets Trigger Node: Add Service Account credential support (#​32312) (7b9ba29)
• instance-ai: Simulate destructive and user-action nodes during workflow verification (#​32209) (f4a1ab6)
• LoneScale Node: Add Contact (enrich, source) and Company (search) resources (#​32009) (63f464d)
• Microsoft Excel 365 Node: Accept the generic Microsoft OAuth2 (Graph) credential (#​32434) (e2c59a5)
• Microsoft Graph Security Node: Support authenticating with the generic Microsoft OAuth2 credential (#​32529) (c2a006a)
• Microsoft Outlook Node: Accept the generic Microsoft OAuth2 (Graph) credential (#​32531) (76d9c93)
• Microsoft Teams Node: Accept the generic Microsoft OAuth2 (Graph) credential (#​32455) (93c3c2f)
• Microsoft To Do Node: Accept the generic Microsoft OAuth2 (Graph) credential (#​32492) (02b2013)
• Microsoft To Do Node: Allow custom OAuth2 scopes (#​32538) (ad8faa6)
• Phantombuster Node: Add Launch Sync operation (#​31101) (2e76cf3)
• Refactor agent runtime (#​32293) (30224e9)
• Settings for MCP Registry server usage in Instance AI (#​31692) (097f683)
• Surface MCP registry connections in the Instance AI sidebar (#​31748) (675e5e8)
• Telegram Node: Add rich message and message draft operations (#​32173) (a970e34)
• Webhook Node: Add "Only Run If" option to filter requests (#​28872) (d64aeb2)
• Write per-file mutation coverage back to the ledger row (#​32716) (a084bd8)

Performance Improvements

• core: Improve performance of pre-execution workflow checks (#​32363) (aaa4fa8)
• core: Move Instance AI clock out of the cached prompt prefix (#​32452) (630d57e)
• core: Stabilize Instance AI prompt-cache prefix across turns (#​32404) (1ea6f59)
• editor: Defer AI assistant markdown decoration and fix resource chip clicks (#​32160) (2fef949)
• Set ignoreStatic in mutation-health default Stryker config (#​32720) (05ef0a5)