chore(deps): update dependency n8n to v1.97.1

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
n8n (source)	minor	1.95.3 -> 1.97.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

n8n-io/n8n (n8n)

v1.97.1

Compare Source

1.97.1 (2025-06-04)

v1.97.0

Compare Source

Bug Fixes

• core: Allow dotfiles in sendFile to fix WorkFlow settings 404 error (#​14744) (7928a9b)
• core: Honor absolute paths for N8N_LOG_FILE_LOCATION (#​15873) (1e5b905)
• core: Normalize trailing slash when setting CORS headers for test webhooks (#​15906) (61d0c6a)

Performance Improvements

• core: Lazyload LDAP during bootup (#​15907) (31b6f32)

v1.96.0

Compare Source

Bug Fixes

• API: Allow false as a dependant value for public api json schema validation (#​15858) (5a8899c)
• Check if form trigger URL is live before oppening pop-up (#​15800) (041ada1)
• core: Don't allow creating more projects than allowed by exploiting a race condition (#​15218) (6466e76)
• core: Fix sorting of executions not working on postgres and mysql (#​15423) (eca282d)
• core: Fix timezone-dependent test failures in Insights weekly compaction (#​15680) (096806a)
• core: Simplify Websocket origin security checks (#​15761) (bbe2b12)
• core: Solve memory leak in TaskRequester (#​15768) (0398505)
• core: Support helpers.request in task runners (#​15859) (7f8b943)
• editor: Deactivate workflow on save if trigger is missing (#​15642) (3ba6419)
• editor: Delete all connections of nodes with multiple ones when removed from canvas (#​15713) (c4ea757)
• editor: Fix Execute workflow button hover state (#​15518) (57d7b5e)
• editor: Handle Insights calculations to prevent Infinity numbers (#​15727) (d1a39d9)
• editor: Move focus to search input in RLC (#​15741) (fee10da)
• editor: Set deterministic width for sidebar (#​15753) (3f9a271)
• editor: Simplifying empty project deletion (#​15834) (6bf2d8a)
• editor: Update copy for debug modal paywall (#​15905) (d0ff662)
• editor: Use last task data for calculating the current state (#​15546) (1daf0ff)
• GitHub Node: Update auth urls for enterprise server (#​15533) (bc66d9f)
• Jina AI Node: Default value for "Output format" option (#​15683) (e125854)
• Microsoft SharePoint Node: Add back the support for cred only node (#​15806) (0fdeba5)
• n8n Form Node: Use execution.mode instead of hard coding webhook (#​15647) (636e9f4)
• Run evaluations loop manually always from first row (#​15794) (b8ab4b6)
• Skip subworkflow input test temporarily (#​15803) (ba70cab)

Features

• API: Add user management endpoints to the Projects Public API (#​12329) (4459c7e)
• core: Allow specifying Content-Security-Policy-Report-Only (#​15805) (c127846)
• core: Start listening to IPv6 addresses as well by default (#​15810) (9f44f40)
• editor: Add ability to extract sub-workflows to canvas context menu (#​15538) (5985df6)
• editor: Combine 'Move to Folder' and 'Change owner' modals (#​15756) (e860dd6)
• editor: Support pasting an expression into a number parameter (#​15722) (2a1475d)
• MCP Server Trigger Node: Cleanup MCP server management, use sanitized trigger node's name as name for the MCP server (#​15751) (07a636e)
• Perplexity Node: New node (#​13604) (6d3e6ee)
• Respond to Webhook Node: Setting to configure outputs (#​15619) (be5f14e)

Performance Improvements

• core: Shorten bootup for all instance types (#​15856) (73c9a52)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/n8n:1.97.1

📦 Image Reference ghcr.io/uniget-org/tools/n8n:1.97.1

digest	sha256:8e836af86ef682e496e803522346430643034a3adfe04748e592b4bc15844156
vulnerabilities
platform	linux/amd64
size	173 MB
packages	1414

pdfjs-dist 2.16.105 (npm) pkg:npm/[email protected] Improper Check for Unusual or Exceptional Conditions Affected range <=4.1.392 Fixed version 4.2.67 CVSS Score 8.8 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Description Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. Patches The patch removes the use of eval: mozilla/pdf.js#18015 Workarounds Set the option isEvalSupported to false. References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

semver 5.3.0 (npm) pkg:npm/[email protected] Inefficient Regular Expression Complexity Affected range <5.7.2 Fixed version 5.7.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

identity 3.4.2 (npm) pkg:npm/%40azure/[email protected] Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Affected range <4.2.1 Fixed version 4.2.1 CVSS Score 6.8 CVSS Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N Description Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.

brace-expansion 2.0.2 (npm) pkg:npm/[email protected] Uncontrolled Resource Consumption Affected range >=2.0.1 <=4.0.0 Fixed version Not Fixed CVSS Score 1.3 CVSS Vector CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Description A vulnerability was found in juliangruber brace-expansion up to 1.1.11. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is a5b98a4f30d7813266b221435e1eaaf25a1b0ac5. It is recommended to apply a patch to fix this issue.

auth-js 2.65.0 (npm) pkg:npm/%40supabase/[email protected] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Affected range <2.69.1 Fixed version 2.69.1 CVSS Score 1.3 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U Description Impact The library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the wrong API function being called. Implementations that follow security best practice and validate user controlled inputs, such as the userId are not affected by this. Patches Strict value checks have been added to all affected functions. These functions now require that the userId and factorId parameters MUST be valid UUID (v4). Patched version: >= 2.69.1 Workarounds Implementations that follow security best practice and validate user controlled inputs, such as the userId are not affected by this. It is recommended that users of the auth-js library always follow security best practice and validate all inputs, before passing these to other functions or libraries. References supabase/auth-js#1063

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/15590906425.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/15590906425.