chore(deps): update dependency n8n to v1.55.3

[uniget-bot]

This PR contains the following updates:

Package	Update	Change
n8n (source)	minor	1.54.4 -> 1.55.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

n8n-io/n8n (n8n)

v1.55.3

Compare Source

Bug Fixes

• core: Fix XSS validation and separate URL validation (#​10424) (4833fcb)
• editor: Fix flaky mapping tests (#​10453) (2ed97c3)

v1.55.2

Compare Source

Bug Fixes

• editor: Fix context menu bug when right clicking node (#​10455) (97c5cae)
• editor: Buffer json chunks in stream response (#​10439) (efc6558)

v1.55.1

Compare Source

Bug Fixes

• core: Fix payload property in workflow-post-execute event (#​10413) (94423be)
• core: Use explicit types in configs to ensure valid decorator metadata (#​10433) (c32ba82)
• Project Viewer always seeing a connection error when testing credentials (#​10417) (5edd513)

v1.55.0

Compare Source

Bug Fixes

• Add better error handling for chat errors (#​10408) (f82b6e4)
• AI Agent Node: Fix issues with some tools not populating (#​10406) (51a1edd)
• core: Account for cancelling an execution with no workers available (#​10343) (b044e78)
• core: Account for owner when filtering by project ID in GET /workflows in Public API (#​10379) (5ac65b3)
• core: Enforce shutdown timer and sequence on SIGINT for main (#​10346) (5255793)
• core: Filter out prototype and constructor lookups in expressions (#​10382) (8e7d29a)
• core: Fix duplicate Redis publisher (#​10392) (45813de)
• core: Fix worker shutdown errors when active executions (#​10353) (e071b73)
• core: Prevent XSS in user update endpoints (#​10338) (7898498)
• core: Prevent XSS via static cache dir (#​10339) (4f392b5)
• core: Rate limit MFA activation and verification endpoints (#​10330) (b6c47c0)
• editor: Connect up new project viewer role to the FE (#​9913) (117e2d9)
• editor: Enable credential sharing between all types of projects (#​10233) (1cf48cc)
• editor: Fix rendering of SVG icons in public chat on iOS (#​10381) (7ab3811)
• editor: Fixing XSS vulnerability in toast messages (#​10329) (38bdd9f)
• editor: Revert change that hid swagger docs in the ui (#​10350) (bae49d3)
• n8n Form Trigger Node: Fix issue preventing v1 node from working (#​10364) (9b647a9)
• Require mfa code for password change if its enabled (#​10341) (9d7caac)
• Require mfa code to disable mfa (#​10345) (3384f52)

Features

• Add Ask assistant behind feature flag (#​9995) (5ed2a77)
• AI Transform Node: New node (#​10405) (4d222ac)
• AI Transform Node: New node (#​9990) (0de9d56)
• core: Allow overriding npm registry for community packages (#​10325) (33a2703)
• editor: Add schema view to expression modal (#​9976) (71b6c67)
• MySQL Node: Return decimal types as numbers (#​10313) (f744d7c)
• Okta Node: Add Okta Node (#​10278) (5cac0f3)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[nicholasdille-bot]

Auto-approved because label type/renovate is present.

[github-actions]

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/n8n:1.55.3

📦 Image Reference ghcr.io/uniget-org/tools/n8n:1.55.3

digest	sha256:28d614465b6deca7c3deb21e12171003acb90820e2f3798cc1f32edbbacaad55
vulnerabilities
platform	linux/amd64
size	142 MB
packages	1344

axios 1.6.7 (npm) pkg:npm/[email protected] Server-Side Request Forgery (SSRF) Affected range >=1.3.2 <=1.7.3 Fixed version 1.7.4 Description axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

semver 5.3.0 (npm) pkg:npm/[email protected] Inefficient Regular Expression Complexity Affected range <5.7.2 Fixed version 5.7.2 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

pdfjs-dist 2.16.105 (npm) pkg:npm/[email protected] Affected range <=4.1.392 Fixed version 4.2.67 Description Impact If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain. Patches The patch removes the use of eval: mozilla/pdf.js#18015 Workarounds Set the option isEvalSupported to false. References https://bugzilla.mozilla.org/show_bug.cgi?id=1893645

fast-xml-parser 4.2.5 (npm) pkg:npm/[email protected] Uncontrolled Resource Consumption Affected range <4.4.1 Fixed version 4.4.1 CVSS Score 7.5 CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description Summary A ReDOS exists on currency.js was discovered by Gauss Security Labs R&D team. Details https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/src/v5/valueParsers/currency.js#L10 contains a vulnerable regex PoC pass the following string '\t'.repeat(13337) + '.' Impact Denial of service during currency parsing in experimental version 5 of fast-xml-parser-library https://gauss-security.com

axios 1.6.5 (npm) pkg:npm/[email protected] Server-Side Request Forgery (SSRF) Affected range >=1.3.2 <=1.7.3 Fixed version 1.7.4 Description axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

axios 1.7.3 (npm) pkg:npm/[email protected] Server-Side Request Forgery (SSRF) Affected range >=1.3.2 <=1.7.3 Fixed version 1.7.4 Description axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.

micromatch 4.0.7 (npm) pkg:npm/[email protected] Inefficient Regular Expression Complexity Affected range <=4.0.7 Fixed version Not Fixed Description The NPM package micromatch is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.

identity 3.4.2 (npm) pkg:npm/%40azure/[email protected] Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Affected range <4.2.1 Fixed version 4.2.1 CVSS Score 5.5 CVSS Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Description Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.

[github-actions]

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/10504684912.

[github-actions]

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/10504684912.