Decaf Blog Data pipelines, open-source tooling, reverse engineering, and systems notes

n8n 1.123.62 - Security Dependency Fixes

4 min read

n8n [email protected] was published on June 29, 2026, as a focused security dependency release for workflow operators. The important change is a fix set covering five security issues in hono, vue-i18n, and linkify-it, which matters for teams that run n8n as part of data movement, job routing, and web workflow automation.

The full release notes and downloads are on the GitHub release page.

Security fixes in runtime dependencies

The n8n [email protected] release contains one listed bug fix: five security issues were addressed across hono, vue-i18n, and linkify-it. The release notes do not break out CVE identifiers, affected code paths, or exploit conditions. That leaves operators with a simple reading: this is a dependency security update, not a workflow feature update.

For data teams, that still matters. n8n often sits at the edge of a pipeline, receiving webhook traffic, sending requests to APIs, rendering workflow state, and passing values between services. A security fix in the HTTP layer, text processing layer, or interface translation layer can affect the risk profile of the whole automation host, even when no node behavior changes.

The referenced item is #33164, with commit e325585 attached in the release notes. The notes only state the affected packages and the count of issues, so the practical action is to treat the release as a patch candidate for exposed or shared instances.

Why this matters for workflow operators

n8n is commonly used as glue code for internal data flows: webhook ingestion, SaaS extraction, ticket routing, alert fan out, file movement, and scheduled API calls. Those workflows can carry tokens, customer records, source system identifiers, and job metadata. Even a small dependency patch deserves attention when the service has network access and stored credentials.

The named packages point to different parts of the application surface. hono is associated with HTTP handling. vue-i18n is tied to interface internationalization. linkify-it parses text and detects links. The release notes do not say which issue maps to which risk, so a cautious upgrade plan should avoid narrow assumptions about impact.

This release is not marked as a prerelease. That makes it suitable to consider as a normal patch release, subject to the same validation path used for other n8n maintenance updates. The absence of migration notes also suggests that the main compatibility question is whether local workflows, custom nodes, and community packages behave normally after the package update.

Validation should focus on automation paths

Because the release notes list only dependency security fixes, validation should stay close to the parts of n8n that carry production work. Run a small set of representative workflows before rolling the version into a shared environment. Include webhook triggers, scheduled workflows, credential backed API nodes, and any community package paths that are important to the deployment.

Pay attention to workflow execution history, error formatting, and text fields that contain URLs. The linkify-it mention makes link parsing worth checking in forms, notifications, descriptions, and any workflow output that operators read in the interface. The release does not claim a behavior change there, but it is a sensible place to look because the package is named directly.

For platform teams, the main record keeping task is simple. Note the installed tag, preserve the previous image or package version for rollback, and record the release link in the change entry. The GitHub release page is the source of record for this patch.

What is not in this release

There are no listed node additions, connector changes, queue changes, execution engine updates, or database migration notes in the provided release text. That should shape expectations. This is not a release to evaluate for new extraction coverage or orchestration features.

The internal review badges included in the GitHub text do not add operator guidance. They point to review tooling rather than n8n behavior. For a release announcement, the useful signal remains the dependency security fix and the exact tag to deploy.

Where to get it