chore(deps): update dependency n8n to v1.74.1

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
n8n (source)	minor	1.73.1 -> 1.74.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

n8n-io/n8n (n8n)

v1.74.1

Compare Source

Bug Fixes

• editor: Fix parameter input validation (#​12532) (6f757f1)

v1.74.0

Compare Source

Bug Fixes

• core: Align concurrency and timeout defaults between instance and runner (#​12503) (9953477)
• core: Allow index as top-level item key for Code node (#​12469) (1b91000)
• core: Don't fail task runner task if logging fails (#​12401) (0860fbe)
• core: Ensure tasks timeout even if they don't receive settings (#​12431) (b194026)
• core: Fix execution cancellation issues in scaling mode (#​12343) (e26b406)
• core: Fix manually running a pinned trigger with offloading enabled (#​12491) (be2dcff)
• core: Fix task runner sending too many offers (#​12415) (4498e35)
• core: Increase default concurrency and timeout in task runners (#​12496) (4182095)
• core: Prevent __default__ jobs in scaling mode (#​12402) (072664b)
• core: Register workflows as active only after all of the triggers and pollers setup successfully (#​12244) (f924f2a)
• core: Return unredacted credentials from GET credentials/:id (#​12447) (ecabe34)
• core: Use rate limiter for task runner endpoints (#​12486) (491cb60)
• editor: Allow zooming when panning keycode is pressed on new canvas (#​12327) (983e87a)
• editor: Consistent protected environment styling and messaging (#​12374) (6891cef)
• editor: First project button tweaks border and copy (#​12376) (e234756)
• editor: Fix Multi option parameter expression when the value is an array (#​12430) (452a7bf)
• editor: Improve configurable nodes design on new canvas (#​12317) (0ecce10)
• editor: Minor styling improvements in project settings page (#​12405) (09ddce0)
• editor: Never show Pinned Data Callout for Input Panel (#​12446) (1d5c9bd)
• editor: Nodes' icon color in dark mode (#​12279) (01b781a)
• editor: Only ignore managed credentials in the HTTP node (#​12417) (6b46657)
• editor: Remove primary highlight color from edge being executed on new canvas (#​12307) (50913de)
• editor: Render empty string instead of [empty] (#​12448) (2c72047)
• editor: Show all workflows in the error workflow dropdown in the workflow settings (#​12413) (ccda7f9)
• editor: Unify disabled parameters background color (#​12306) (8c63599)
• HTTP Request Node: Fix typo in hint (#​12439) (b6230b6)
• OpenAI Node: Add quotes to default base URL (#​12312) (2e90eba)
• OpenAI Node: Update node to account for URL in credentials (#​12356) (f78cceb)
• Postgres Node: Account for JSON expressions (#​12012) (06b86af)
• Postgres Node: Allow passing in arrays to JSON columns for insert (#​12452) (9dd0686)
• Postgres Node: Re-use connection pool across executions (#​12346) (2ca37f5)
• Run workflow if active and single webhook service has pin data (#​12425) (8053a4a)
• Set correct default for added Resource Mapper boolean fields (#​12344) (b4c77f2)
• Supabase Node: Allow for filtering on the same field multiple times (#​12429) (d7cc789)
• Zep Vector Store Node: Cloud vector store integration (#​12353) (2433d6b)

Features

• (Execute Workflow Node): Inputs for Sub-workflows (#​11830) (#​11837) (d411663)
• Add load options to new tool mode for vector stores (#​12462) (3109de6)
• Add migration to add managed column to credentials table (#​12275) (3cb7081)
• Allow using Vector Stores directly as Tools (#​12311) (76dded4)
• core: Add endpoint to create free AI credits (#​12362) (ac4e042)
• core: Add includeData parameter to GET /credentials (#​12220) (f56ad8c)
• core: Comply with NO_COLOR in logs (#​12347) (1e60bbc)
• core: Offload manual executions to workers (#​11284) (9432aa0)
• editor: Add free AI credits CTA (#​12365) (f873196)
• editor: Add support for project icons (#​12349) (9117718)
• editor: Easy AI workflow improvements (#​12400) (8dc691d)
• editor: Make workflows, credentials, executions and new canvas usable on mobile and touch devices (#​12372) (06c9473)
• editor: New Code editor based on the TypeScript language service (#​12285) (52ae02a)
• editor: Update Sub-Workflow Debugging Copy (#​12483) (04e2928)
• Google Vertex Chat Model Node: Add an option to specify GCP region (#​12300) (30f9c03)
• HighLevel Node: Add support for calendar items (#​10820) (6e189fd)
• Microsoft Entra ID Node: New node (#​11779) (3006ccf)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/n8n:1.74.1

📦 Image Reference ghcr.io/uniget-org/tools/n8n:1.74.1

digest	sha256:d74bfad9c1c180ae7073d427b1e5863577cfe1561336eeea10d0d951dfd342ea
vulnerabilities
platform	linux/amd64
size	155 MB
packages	1409

semver 5.3.0 (npm) pkg:npm/[email protected] Inefficient Regular Expression Complexity Affected range <5.7.2 Fixed version 5.7.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

pdfjs-dist 2.16.105 (npm) pkg:npm/[email protected] Affected range <=4.1.392 Fixed version 4.2.67 Description Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. Patches The patch removes the use of eval: mozilla/pdf.js#18015 Workarounds Set the option isEvalSupported to false. References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

cross-spawn 4.0.2 (npm) pkg:npm/[email protected] Inefficient Regular Expression Complexity Affected range <6.0.6 Fixed version 7.0.5 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Versions of the package cross-spawn before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string.

path-to-regexp 0.1.10 (npm) pkg:npm/[email protected] Inefficient Regular Expression Complexity Affected range <0.1.12 Fixed version 0.1.12 Description Impact The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp, originally reported in CVE-2024-45296 Patches Upgrade to 0.1.12. Workarounds Avoid using two parameters within a single path segment, when the separator is not . (e.g. no /:a-:b). Alternatively, you can define the regex used for both parameters and ensure they do not overlap to allow backtracking. References GHSA-9wv6-86v2-598j https://blakeembrey.com/posts/2024-09-web-redos/

identity 3.4.2 (npm) pkg:npm/%40azure/[email protected] Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Affected range <4.2.1 Fixed version 4.2.1 CVSS Score 6.8 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Description Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.

cookie 0.4.2 (npm) pkg:npm/[email protected] Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Affected range <0.7.0 Fixed version 0.7.0 Description Impact The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize("userName=<script>alert('XSS3')</script>; Max-Age=2592000; a", value) would result in "userName=<script>alert('XSS3')</script>; Max-Age=2592000; a=test", setting userName cookie to <script> and ignoring value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Patches Upgrade to 0.7.0, which updates the validation for name, path, and domain. Workarounds Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input. References fix: narrow the validation of cookies to match RFC6265 jshttp/cookie#167

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/12792997132.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/12792997132.