n8n weekly roundup: 3.0 beta, 2.46 and 12 security fixes

The n8n 3.0 beta came out on October 27, 2026, and n8n says the stable 3.x release follows in early December. The same day brought n8n 2.46 on the beta track, and on October 28 n8n published 12 security advisories with fixes in 2.45.5, 2.46.1, 3.0.1 and 1.123.89. If you self-host, update to the latest 2.x patch now and run the Migration Report before you plan the 3.0 upgrade.

The short version

• n8n 3.0 beta: 3.0.0 (October 27) and 3.0.1 (October 28), Docker images only. Stable is announced for early December, and the upgrade is one way.
• 2.x versions: on October 31, npm's stable and latest tags point to 2.45.7 and beta and next to 2.46.3.
• n8n 2.46: a better Migration Report, an Edit Image node v2 and more Agents features.
• Security: 12 advisories (3 High, 9 Medium) in n8n's October 28 update. Cloud is patched automatically; self-hosted instances need an upgrade.
• Events: n8n is at Microsoft Ignite in San Francisco, November 17-19, and its community calendar lists meetups and online sessions.

n8n 3.0 beta: what's in it and when stable ships

n8n announced the 3.0 beta on its blog on October 27. It's a release about reliability, stability and security rather than new features: it collects the breaking changes n8n has saved up since 2.0. The headline changes:

• Self-hosted n8n now runs on Docker only. Installing with npm or npx n8n is no longer supported.
• Legacy nodes are removed, including Function, Function Item, Item Lists, Cron, Interval and the legacy OpenAI node. Most have a direct replacement, and many migrate automatically.
• The default Code node timeout on task runners drops from 5 minutes to 1 minute.
• Manual executions always run on workers in queue mode, and the in-memory binary data mode is removed.
• Safer defaults: encryption key rotation always on, Slack credentials require a signing secret, and unverified community packages are off by default.

The dates and support windows, from the same post:

• Stable: early December 2026.
• 2.x: security and critical bug fixes for 12 months after the stable release; new features ship on 3.x only.
• 1.x: support ends December 31, 2026, and there's no direct path from 1.x to 3.x.
• No rollback: moving to 3.x is one way, so take a full backup and try a test instance first.

GitHub has tags for n8n@3.0.0 and n8n@3.0.1, and Docker Hub keeps publishing v3-nightly images (the latest on October 31). We tested the beta ourselves: what we found upgrading to 3.0.1. To get ready, read our guides to the Migration Report and to backing up before the one-way upgrade.

n8n's post also shared two community numbers: GitHub stars grew from about 160,000 at the 2.0 release to over 208,000, and community forum members from 115,192 to over 183,000.

n8n 2.46 and this week's 2.x patches

n8n 2.46.0 was published on October 27 on the beta track, followed by 2.46.1 (October 28), 2.46.2 (October 29) and 2.46.3 (October 30), according to npm. On the stable track, 2.45.4 through 2.45.7 came out between October 26 and October 30.

From the 2.46.0 changelog, the changes most people will notice:

• Migration Report: CSV export, a new "Executions might fail" impact, filtering by project, and workflow editors can triage the findings for their own workflows.
• Edit Image node v2, plus a 3.0 migration for the old version.
• Public API: dependency endpoints for workflows, credentials and data tables.
• Agents: Microsoft Foundry models (including Claude deployments on Foundry), a Microsoft Teams channel, and mention-only Slack replies.

Our 2.46 roundup covers the release in detail.

Security: 12 advisories in the October 28 update

n8n's October 28 security update lists 12 advisories: three High and nine Medium. The High ones are:

• Deprecated code nodes allowing code execution in the n8n main process.
• An insecure GraphicsMagick configuration.
• Insufficient isolation in workflow expression evaluation.

The fixed versions are 2.45.5 (stable), 2.46.1 (beta), 3.0.1 (3.x beta) and 1.123.89 (1.x). n8n Cloud instances are patched automatically. If you self-host a version below the fixed ones, n8n recommends upgrading. Our security update post goes through each advisory and who is affected.

From the n8n blog

• n8n on n8n: beyond the service desk model (October 29). Romina da Costa, n8n's head of internal AI and automation, opens a new series on how n8n runs automation internally. She explains where a central automation team hits its limit and the four principles her team now follows to help every team build and own its automations.
• Throttling vs. rate limiting (October 30). How to handle 429 Too Many Requests errors in workflows: pace requests up front, and back off when the provider tells you to wait.

n8n events coming up

• Microsoft Ignite, San Francisco, November 17-19. n8n announced on X that it will be at booth 5344R.
• Community events. n8n posted on X that its community calendar had 11 meetups, hackathons, workshops and online sessions in the week of October 26. Upcoming ones are listed on the n8n Community Events calendar.

What people asked about in the forum

Topics that drew discussion in the n8n community forum this week:

• Invoice reminders that never double-send, a stage pattern driven by a spreadsheet.
• Testing a "green" execution that quietly produces no output.
• How Variables work on the Pro Cloud plan.

Also on then8nblog this week

• n8n task runners explained: internal vs external mode and Python
• n8n 3.0 beta is out: what we found upgrading to 3.0.1
• n8n 2.46: what's new and should you upgrade
• n8n security update: 12 advisories fixed in 2.45.5 and 3.0.1
• n8n Migration Report: how to read it and fix every 3.0 issue

All our weekly roundups are on the weekly roundup tag page.