🚀 Release 1.123.23

[n8n-assistant]

1.123.23 (2026-03-04)

Bug Fixes

• Backport transitive dependency bumps to 1.x (#26260) (aef8c80)
• editor: Replace jsonpath with jsonpath-plus to resolve CVE (#26408) (10aa98f)
• Fix 14 security issues in jsonpath, mailparser, mysql2 and 9 more (#26363) (9b1d456)

[cubic-dev-ai]

No issues found across 13 files

Architecture diagram

sequenceDiagram
    participant UI as Editor UI
    participant CLI as n8n Server (CLI)
    participant Nodes as Nodes Base / Langchain
    participant JPP as jsonpath-plus
    participant MP as mailparser
    participant DB as MySQL Database

    Note over UI,DB: n8n v1.123.23 Runtime Flow (Security Hardened)

    rect rgb(23, 37, 84)
    Note right of UI: Expression Evaluation
    UI->>JPP: CHANGED: Evaluate JSON expression via jsonpath-plus
    JPP-->>UI: Return result to Editor canvas
    end

    rect rgb(5, 46, 22)
    Note right of CLI: Workflow Execution
    CLI->>Nodes: Execute Node logic
    
    opt JSON Path Extraction
        Nodes->>JPP: CHANGED: Evaluate data path (replacing jsonpath)
        JPP-->>Nodes: Return filtered JSON object
    end

    opt Email Node (Incoming/Parsing)
        Nodes->>MP: CHANGED: Parse email data with updated mailparser
        MP-->>Nodes: Return parsed body/attachments
    end

    opt MySQL Node
        Nodes->>DB: CHANGED: Execute SQL via updated mysql2 driver
        DB-->>Nodes: Return dataset
    end
    
    Nodes-->>CLI: Workflow result
    end

    Note over CLI,Nodes: Version bumps applied across @n8n/api-types, @n8n/db, and @n8n/permissions

Loading

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!