chore(deps): update dependency n8n to v1.54.2

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
n8n (source)	minor	1.53.2 -> 1.54.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

n8n-io/n8n (n8n)

v1.54.2

Compare Source

Bug Fixes

• AI Agent Node: Fix issues with some tools not populating (#​10406) (dfc5596)

v1.54.1

Compare Source

Bug Fixes
n8n Form Trigger Node: Fix issue preventing v1 node from working (https://github.com/n8n-io/n8n/issues/10364) (6b1b967)

v1.54.0

Compare Source

Bug Fixes

• core: Ensure OAuth token data is not stubbed in source control (#​10302) (98115e9)
• core: Fix expressions in webhook nodes(Form, Webhook) to access previous node's data (#​10247) (88a1701)
• core: Fix user telemetry bugs (#​10293) (42a0b59)
• core: Make execution and its data creation atomic (#​10276) (ae50bb9)
• core: Make OAuth1/OAuth2 callback not require auth (#​10263) (a8e2774)
• core: Revert transactions until we remove the legacy sqlite driver (#​10299) (1eba7c3)
• core: Surface enterprise trial error message (#​10267) (432ac1d)
• core: Upgrade tournament to address some XSS vulnerabilities (#​10277) (43ae159)
• core: VM2 sandbox should not throw on new Promise (#​10298) (7e95f9e)
• core: Webhook and form baseUrl missing (#​10290) (8131d66)
• editor: Enable moving resources only if team projects are available by the license (#​10271) (42ba884)
• editor: Fix execution retry button (#​10275) (55f2ffe)
• editor: Update design system Avatar component to show initials also when only firstName or lastName is given (#​10308) (46bbf09)
• editor: Update tags filter/editor to not show non existing tag as a selectable option (#​10297) (557a76e)
• Invoice Ninja Node: Fix payment types (#​10196) (c5acbb7)
• Loop node no input data shown (#​10224) (c8ee852)

Features

• core: Allow filtering executions and users by project in Public API (#​10250) (7056e50)
• core: Allow transferring credentials in Public API (#​10259) (07d7b24)
• core: Show sub-node error on the logs pane. Open logs pane on sub-node error (#​10248) (57d1c9a)
• core: Support community packages in scaling-mode (#​10228) (88086a4)
• core: Support create, delete, edit role for users in Public API (#​10279) (84efbd9)
• core: Support create, read, update, delete projects in Public API (#​10269) (489ce10)
• editor: Auto-add LLM chain for new LLM nodes on empty canvas (#​10245) (06419d9)
• Elasticsearch Node: Add bulk operations for Elasticsearch (#​9940) (bf8f848)
• Lemlist Trigger Node: Update Trigger events (#​10311) (15f10ec)
• MongoDB Node: Add projection to query options on Find (#​9972) (0a84e0d)
• Postgres Chat Memory, Redis Chat Memory, Xata: Add support for context window length (#​10203) (e3edeaa)
• Stripe Trigger Node: Add Stripe webhook descriptions based on the workflow ID and name (#​9956) (3433465)
• Webflow Node: Update to use the v2 API (#​9996) (6d8323f)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/n8n:1.54.2

📦 Image Reference ghcr.io/uniget-org/tools/n8n:1.54.2

digest	sha256:eb536121f86ef509af321ea9c05d387933045a76733f4777408818fc81ab0bf5
vulnerabilities
platform	linux/amd64
size	137 MB
packages	1343

axios 1.6.5 (npm) pkg:npm/[email protected] Server-Side Request Forgery (SSRF) Affected range >=1.3.2 <=1.7.3 Fixed version 1.7.4 Description axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

axios 1.6.2 (npm) pkg:npm/[email protected] Server-Side Request Forgery (SSRF) Affected range >=1.3.2 <=1.7.3 Fixed version 1.7.4 Description axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

axios 1.6.7 (npm) pkg:npm/[email protected] Server-Side Request Forgery (SSRF) Affected range >=1.3.2 <=1.7.3 Fixed version 1.7.4 Description axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

semver 5.3.0 (npm) pkg:npm/[email protected] Inefficient Regular Expression Complexity Affected range <5.7.2 Fixed version 5.7.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

pdfjs-dist 2.16.105 (npm) pkg:npm/[email protected] Affected range <=4.1.392 Fixed version 4.2.67 Description Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. Patches The patch removes the use of eval: mozilla/pdf.js#18015 Workarounds Set the option isEvalSupported to false. References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

fast-xml-parser 4.2.5 (npm) pkg:npm/[email protected] Uncontrolled Resource Consumption Affected range <4.4.1 Fixed version 4.4.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Summary A ReDOS exists on currency.js was discovered by Gauss Security Labs R&D team. Details https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/src/v5/valueParsers/currency.js#L10 contains a vulnerable regex PoC pass the following string '\t'.repeat(13337) + '.' Impact Denial of service during currency parsing in experimental version 5 of fast-xml-parser-library https://gauss-security.com

identity 3.4.2 (npm) pkg:npm/%40azure/[email protected] Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Affected range <4.2.1 Fixed version 4.2.1 CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Description Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/10391553823.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/10391553823.