chore(deps): update dependency n8n to v1.94.0

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
n8n (source)	minor	1.93.0 -> 1.94.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

n8n-io/n8n (n8n)

v1.94.0

Compare Source

Bug Fixes

• AI Agent Node: Fix tool calling when tools run in a loop (#​15250) (cd1d6c9)
• Azure OpenAI Chat Model Node: Simplify Azure Entra ID Authentication and Auto-Refresh token (#​15335) (e750d53)
• Basic LLM Chain Node: Use JSON parsing for Claude 3.7 with thinking enabled (#​15381) (c8b9a7f)
• core: Allow strings starting with numbers in alphanumeric string validator (#​15425) (64b3fa3)
• core: Load config early to fix N8N_CONFIG_FILES (#​15406) (ec63a61)
• core: Load insights module on webhook instance to save insights on webhook workflows (#​15433) (bf5551d)
• core: Make the Insights by time datetime parsing more robust (#​15413) (d9fdef3)
• core: Upgrade formidable to address CVE-2025-46653 (#​15341) (d612d7b)
• core: Upgrade snowflake-sdk to address CVE-2025-46328 (#​15345) (eb634ea)
• editor: Correctly show Workflow Breadcrumbs in MainHeader on Registered Community (#​15457) (5c38405)
• editor: Don't render now when startedAt is null (#​15283) (44ecad5)
• editor: FE fixes to insights (#​15228) (3eb1c1c)
• editor: Fix node renaming in pinned data (#​15482) (fc17cde)
• editor: Fix paired items after renaming a node (#​15440) (7d3cae5)
• editor: Fix partial chat executions (#​15379) (b6370fb)
• editor: Fix resizing NDV output panel when closing assistant (#​15313) (d7d3d33)
• editor: Fix switching between connected SQL/HTML editors (#​15297) (bb2cfc2)
• editor: Hide evaluation trigger (#​15471) (b53bd17)
• editor: Make AI Agent appear before Magento 2 when typing agent (#​15302) (d683a54)
• editor: Normalize credential data from source control (#​15434) (840a3be)
• editor: Show error toast for failed executions (#​15388) (e68149b)
• editor: Tag styling issues (#​15336) (807084e)
• Ensure diagnostics stay disabled in e2e even when enabled by environment variable (#​15322) (c026962)
• Execute Workflow Trigger Node: Show helpful error message when passing array to JSON Example (#​15458) (06e9386)
• n8n Evaluation Trigger Node: Fix tweaks (#​15473) (3985387)
• n8n Form Node: Limit the max width for text area (#​15508) (9936186)
• OpenAI Node: Hide the option to return URL for gpt-image-1 model (#​15392) (027a479)
• PostBin Node: Update base URL for postbin node (#​15358) (0cddc95)
• RabbitMQ Node: Support RabbitMQ v.4.1.0 by updating amqplib (#​15418) (cf05c33)
• Set tournament for nodes test harness (#​15346) (0699925)
• Text Classifier Node: Return error for empty inputText (#​15390) (71e5584)
• YouTube Node: Chunk file content before uploading (#​15405) (3e855b4)

Features

• Add HTTP proxy for supported LLM nodes (#​15449) (907485d)
• API: Add Public API endpoint for updating variables (#​15315) (52bf920)
• AWS IAM Node: Add new AWS IAM Node (#​11963) (ab1047e)
• editor: Add "Go to Sub-workflow" menu context action to Workflow Tool (#​15396) (2b05dbe)
• editor: Add user info on relations to enhance design of project users list (#​15420) (435d43f)
• editor: Improve canvas node insertion position (#​14289) (102c676)
• editor: Improve manual description in nodes as tools (#​15373) (726438d)
• editor: Include pending users for project users search (#​15389) (f906dba)
• editor: Keyboard shortcuts for the log view (#​15378) (1935e62)
• editor: Rollout improved log view (2nd attempt) (#​15382) (4657e34)
• editor: Show sub workflow runs in the log view (#​15163) (0c4398f)
• Execute Workflow Trigger Node: Reintroduce binary data on Workflow Triggers (#​15259) (218007e)
• Microsoft SharePoint Node: New node (#​13727) (954b662)
• n8n Evaluation Trigger Node: Add Evaluation Trigger and Evaluation Node (#​15194) (570d1e7)
• n8n Evaluation Trigger Node: Add link to dataset template in trigger (#​15455) (1f023db)
• n8n Evaluation Trigger Node: Add telemetry events (#​15465) (9834a49)
• n8n Microsoft Teams Node: New trigger node (#​12875) (870940b)
• Optimise langchain calls in batching mode (#​15243) (ff15693)
• Respond to Webhook Node: Additional output branch - Response (#​13734) (40fb4a2)
• Snowflake Node: Add support for Key-Pair authentication (#​14833) (4302c5f)

Performance Improvements

• editor: Avoid deep watch on execution result data (#​15304) (cd2e2dc)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/n8n:1.94.0

📦 Image Reference ghcr.io/uniget-org/tools/n8n:1.94.0

digest	sha256:9aa6c44680f1e7c61b774c50f030676e69dcde79d4dc730b29a04c77c4e50a80
vulnerabilities
platform	linux/amd64
size	171 MB
packages	1398

samlify 2.9.0 (npm) pkg:npm/[email protected] Improper Verification of Cryptographic Signature Affected range <2.10.0 Fixed version 2.10.0 CVSS Score 9.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N Description A Signature Wrapping attack has been found in samlify <v2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider.

pdfjs-dist 2.16.105 (npm) pkg:npm/[email protected] Improper Check for Unusual or Exceptional Conditions Affected range <=4.1.392 Fixed version 4.2.67 CVSS Score 8.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Description Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. Patches The patch removes the use of eval: mozilla/pdf.js#18015 Workarounds Set the option isEvalSupported to false. References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

semver 5.3.0 (npm) pkg:npm/[email protected] Inefficient Regular Expression Complexity Affected range <5.7.2 Fixed version 5.7.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

multer 1.4.5-lts.2 (npm) pkg:npm/[email protected] Missing Release of Memory after Effective Lifetime Affected range <2.0.0 Fixed version 2.0.0 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Impact Multer <2.0.0 is vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal busboy stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Patches Users should upgrade to 2.0.0 Workarounds None References fix: MEMORY LEAK expressjs/multer#1120 expressjs/multer@2c8505f

identity 3.4.2 (npm) pkg:npm/%40azure/[email protected] Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Affected range <4.2.1 Fixed version 4.2.1 CVSS Score 6.8 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Description Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.

undici 5.28.5 (npm) pkg:npm/[email protected] Missing Release of Memory after Effective Lifetime Affected range <5.29.0 Fixed version 5.29.0 CVSS Score 3.1 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L Description Impact Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. Patches This has been patched in nodejs/undici#4088. Workarounds If a webhook fails, avoid keep calling it repeatedly. References Reported as: nodejs/undici#3895

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/15258746150.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/15258746150.