@atom8n/n8n 2.2.0

package/dist/modules/breaking-changes/rules/v2/binary-data-storage.rule.js

@@ -0,0 +1,78 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BinaryDataStorageRule = void 0;
+const config_1 = require("@n8n/config");
+const di_1 = require("@n8n/di");
+const n8n_core_1 = require("n8n-core");
+let BinaryDataStorageRule = class BinaryDataStorageRule {
+    constructor(config, executionsConfig) {
+        this.config = config;
+        this.executionsConfig = executionsConfig;
+        this.id = 'binary-data-storage-v2';
+    }
+    getMetadata() {
+        return {
+            version: 'v2',
+            title: 'Binary data in-memory mode is removed',
+            description: 'Binary files are now stored on disk (default in regular mode) or in database (default in queue mode) instead of in memory',
+            category: "infrastructure",
+            severity: 'low',
+            documentationUrl: 'https://docs.n8n.io/2-0-breaking-changes/#remove-in-memory-binary-data-mode',
+        };
+    }
+    async detect() {
+        if (this.config.mode !== 'default') {
+            return {
+                isAffected: false,
+                instanceIssues: [],
+                recommendations: [],
+            };
+        }
+        const isRegularMode = this.executionsConfig.mode === 'regular';
+        const result = {
+            isAffected: true,
+            instanceIssues: [
+                {
+                    title: 'Binary data storage mode changed',
+                    description: isRegularMode
+                        ? `Binary files are now stored in ${this.config.localStoragePath} directory by default (for regular mode) instead of in memory.`
+                        : 'Binary files are now stored in the database by default (for queue mode) instead of in memory.',
+                    level: 'info',
+                },
+            ],
+            recommendations: isRegularMode
+                ? [
+                    {
+                        action: 'Ensure adequate disk space',
+                        description: `Verify sufficient disk space is available for binary file storage in the ${this.config.localStoragePath} directory`,
+                    },
+                    {
+                        action: 'Configure persistent storage',
+                        description: 'If using containers, ensure the binary data directory is mounted on a persistent volume',
+                    },
+                    {
+                        action: 'Include in backups',
+                        description: 'Add the binary data folder to your backup procedures',
+                    },
+                ]
+                : [],
+        };
+        return result;
+    }
+};
+exports.BinaryDataStorageRule = BinaryDataStorageRule;
+exports.BinaryDataStorageRule = BinaryDataStorageRule = __decorate([
+    (0, di_1.Service)(),
+    __metadata("design:paramtypes", [n8n_core_1.BinaryDataConfig,
+        config_1.ExecutionsConfig])
+], BinaryDataStorageRule);
+//# sourceMappingURL=binary-data-storage.rule.js.map

package/dist/modules/breaking-changes/rules/v2/binary-data-storage.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binary-data-storage.rule.js","sourceRoot":"","sources":["../../../../../src/modules/breaking-changes/rules/v2/binary-data-storage.rule.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wCAA+C;AAC/C,gCAAkC;AAClC,uCAA4C;AAUrC,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IACjC,YACkB,MAAwB,EACxB,gBAAkC;QADlC,WAAM,GAAN,MAAM,CAAkB;QACxB,qBAAgB,GAAhB,gBAAgB,CAAkB;QAGpD,OAAE,GAAW,wBAAwB,CAAC;IAFnC,CAAC;IAIJ,WAAW;QACV,OAAO;YACN,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,uCAAuC;YAC9C,WAAW,EACV,2HAA2H;YAC5H,QAAQ,kBAAuC;YAC/C,QAAQ,EAAE,KAAK;YACf,gBAAgB,EACf,6EAA6E;SAC9E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACX,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO;gBACN,UAAU,EAAE,KAAK;gBACjB,cAAc,EAAE,EAAE;gBAClB,eAAe,EAAE,EAAE;aACnB,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,KAAK,SAAS,CAAC;QAE/D,MAAM,MAAM,GAA4B;YACvC,UAAU,EAAE,IAAI;YAChB,cAAc,EAAE;gBACf;oBACC,KAAK,EAAE,kCAAkC;oBACzC,WAAW,EAAE,aAAa;wBACzB,CAAC,CAAC,kCAAkC,IAAI,CAAC,MAAM,CAAC,gBAAgB,gEAAgE;wBAChI,CAAC,CAAC,+FAA+F;oBAClG,KAAK,EAAE,MAAM;iBACb;aACD;YACD,eAAe,EAAE,aAAa;gBAC7B,CAAC,CAAC;oBACA;wBACC,MAAM,EAAE,4BAA4B;wBACpC,WAAW,EAAE,4EAA4E,IAAI,CAAC,MAAM,CAAC,gBAAgB,YAAY;qBACjI;oBACD;wBACC,MAAM,EAAE,8BAA8B;wBACtC,WAAW,EACV,yFAAyF;qBAC1F;oBACD;wBACC,MAAM,EAAE,oBAAoB;wBAC5B,WAAW,EAAE,sDAAsD;qBACnE;iBACD;gBACF,CAAC,CAAC,EAAE;SACL,CAAC;QAEF,OAAO,MAAM,CAAC;IACf,CAAC;CACD,CAAA;AAhEY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,YAAO,GAAE;qCAGiB,2BAAgB;QACN,yBAAgB;GAHxC,qBAAqB,CAgEjC"}

package/dist/modules/breaking-changes/rules/v2/cli-replace-update-workflow-command.rule.d.ts

@@ -0,0 +1,6 @@
+import type { BreakingChangeRuleMetadata, IBreakingChangeInstanceRule, InstanceDetectionReport } from '../../types';
+export declare class CliActivateAllWorkflowsRule implements IBreakingChangeInstanceRule {
+    id: string;
+    getMetadata(): BreakingChangeRuleMetadata;
+    detect(): Promise<InstanceDetectionReport>;
+}

package/dist/modules/breaking-changes/rules/v2/cli-replace-update-workflow-command.rule.js

@@ -0,0 +1,53 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliActivateAllWorkflowsRule = void 0;
+const di_1 = require("@n8n/di");
+let CliActivateAllWorkflowsRule = class CliActivateAllWorkflowsRule {
+    constructor() {
+        this.id = 'cli-activate-all-workflows-v2';
+    }
+    getMetadata() {
+        return {
+            version: 'v2',
+            title: 'CLI command update:workflow replaced',
+            description: 'The CLI command update:workflow has been replaced with publish:workflow and unpublish:workflow for better clarity.',
+            category: "instance",
+            severity: 'low',
+            documentationUrl: 'https://docs.n8n.io/2-0-breaking-changes/#replace-cli-command-updateworkflow',
+        };
+    }
+    async detect() {
+        const result = {
+            isAffected: true,
+            instanceIssues: [
+                {
+                    title: 'CLI command update:workflow replaced',
+                    description: 'The CLI command update:workflow has been replaced with publish:workflow and unpublish:workflow. If you were using this command in scripts or automation, you will need to update your approach.',
+                    level: 'info',
+                },
+            ],
+            recommendations: [
+                {
+                    action: 'Use the API to activate workflows',
+                    description: 'Update automation scripts to use the public API to activate workflows individually instead of the CLI command',
+                },
+                {
+                    action: 'Review deployment scripts',
+                    description: 'Check any deployment or automation scripts that may have used the CLI command to activate all workflows and update them accordingly',
+                },
+            ],
+        };
+        return result;
+    }
+};
+exports.CliActivateAllWorkflowsRule = CliActivateAllWorkflowsRule;
+exports.CliActivateAllWorkflowsRule = CliActivateAllWorkflowsRule = __decorate([
+    (0, di_1.Service)()
+], CliActivateAllWorkflowsRule);
+//# sourceMappingURL=cli-replace-update-workflow-command.rule.js.map

package/dist/modules/breaking-changes/rules/v2/cli-replace-update-workflow-command.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-replace-update-workflow-command.rule.js","sourceRoot":"","sources":["../../../../../src/modules/breaking-changes/rules/v2/cli-replace-update-workflow-command.rule.ts"],"names":[],"mappings":";;;;;;;;;AAAA,gCAAkC;AAU3B,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IAAjC;QACN,OAAE,GAAW,+BAA+B,CAAC;IA0C9C,CAAC;IAxCA,WAAW;QACV,OAAO;YACN,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,sCAAsC;YAC7C,WAAW,EACV,oHAAoH;YACrH,QAAQ,YAAiC;YACzC,QAAQ,EAAE,KAAK;YACf,gBAAgB,EACf,8EAA8E;SAC/E,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QACX,MAAM,MAAM,GAA4B;YACvC,UAAU,EAAE,IAAI;YAChB,cAAc,EAAE;gBACf;oBACC,KAAK,EAAE,sCAAsC;oBAC7C,WAAW,EACV,iMAAiM;oBAClM,KAAK,EAAE,MAAM;iBACb;aACD;YACD,eAAe,EAAE;gBAChB;oBACC,MAAM,EAAE,mCAAmC;oBAC3C,WAAW,EACV,+GAA+G;iBAChH;gBACD;oBACC,MAAM,EAAE,2BAA2B;oBACnC,WAAW,EACV,qIAAqI;iBACtI;aACD;SACD,CAAC;QAEF,OAAO,MAAM,CAAC;IACf,CAAC;CACD,CAAA;AA3CY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,YAAO,GAAE;GACG,2BAA2B,CA2CvC"}

package/dist/modules/breaking-changes/rules/v2/disabled-nodes.rule.d.ts

@@ -0,0 +1,11 @@
+import type { BreakingChangeAffectedWorkflow, BreakingChangeRecommendation } from '@n8n/api-types';
+import type { WorkflowEntity } from '@n8n/db';
+import type { INode } from 'n8n-workflow';
+import type { BreakingChangeRuleMetadata, IBreakingChangeWorkflowRule, WorkflowDetectionReport } from '../../types';
+export declare class DisabledNodesRule implements IBreakingChangeWorkflowRule {
+    private readonly DISABLED_NODES;
+    id: string;
+    getMetadata(): BreakingChangeRuleMetadata;
+    getRecommendations(_workflowResults: BreakingChangeAffectedWorkflow[]): Promise<BreakingChangeRecommendation[]>;
+    detectWorkflow(_workflow: WorkflowEntity, nodesGroupedByType: Map<string, INode[]>): Promise<WorkflowDetectionReport>;
+}

package/dist/modules/breaking-changes/rules/v2/disabled-nodes.rule.js

@@ -0,0 +1,64 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DisabledNodesRule = void 0;
+const di_1 = require("@n8n/di");
+let DisabledNodesRule = class DisabledNodesRule {
+    constructor() {
+        this.DISABLED_NODES = [
+            'n8n-nodes-base.executeCommand',
+            'n8n-nodes-base.localFileTrigger',
+        ];
+        this.id = 'disabled-nodes-v2';
+    }
+    getMetadata() {
+        return {
+            version: 'v2',
+            title: 'Disable ExecuteCommand and LocalFileTrigger nodes by default',
+            description: 'ExecuteCommand and LocalFileTrigger nodes are now disabled by default for security reasons',
+            category: "workflow",
+            severity: 'medium',
+            documentationUrl: 'https://docs.n8n.io/2-0-breaking-changes/#disable-executecommand-and-localfiletrigger-nodes-by-default',
+        };
+    }
+    async getRecommendations(_workflowResults) {
+        return [
+            {
+                action: 'Enable nodes if required',
+                description: 'Set the appropriate environment variables or settings to enable these nodes if they are required for your workflows',
+            },
+            {
+                action: 'Replace with alternatives',
+                description: 'Consider replacing these nodes with safer alternatives that achieve the same functionality',
+            },
+        ];
+    }
+    async detectWorkflow(_workflow, nodesGroupedByType) {
+        if (process.env.NODES_EXCLUDE) {
+            return { isAffected: false, issues: [] };
+        }
+        const disabledNodes = this.DISABLED_NODES.flatMap((type) => nodesGroupedByType.get(type) ?? []);
+        if (disabledNodes.length === 0)
+            return { isAffected: false, issues: [] };
+        return {
+            isAffected: true,
+            issues: disabledNodes.map((node) => ({
+                title: `Node '${node.type}' with name '${node.name}' will be disabled`,
+                description: `This node is disabled by default in v2. If you want to keep using ${node.type} node, you can configure NODES_EXCLUDE=[].`,
+                level: 'error',
+                nodeId: node.id,
+                nodeName: node.name,
+            })),
+        };
+    }
+};
+exports.DisabledNodesRule = DisabledNodesRule;
+exports.DisabledNodesRule = DisabledNodesRule = __decorate([
+    (0, di_1.Service)()
+], DisabledNodesRule);
+//# sourceMappingURL=disabled-nodes.rule.js.map

package/dist/modules/breaking-changes/rules/v2/disabled-nodes.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"disabled-nodes.rule.js","sourceRoot":"","sources":["../../../../../src/modules/breaking-changes/rules/v2/disabled-nodes.rule.ts"],"names":[],"mappings":";;;;;;;;;AAEA,gCAAkC;AAW3B,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAAvB;QACW,mBAAc,GAAG;YACjC,+BAA+B;YAC/B,iCAAiC;SACjC,CAAC;QAEF,OAAE,GAAW,mBAAmB,CAAC;IAsDlC,CAAC;IApDA,WAAW;QACV,OAAO;YACN,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,8DAA8D;YACrE,WAAW,EACV,4FAA4F;YAC7F,QAAQ,YAAiC;YACzC,QAAQ,EAAE,QAAQ;YAClB,gBAAgB,EACf,wGAAwG;SACzG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CACvB,gBAAkD;QAElD,OAAO;YACN;gBACC,MAAM,EAAE,0BAA0B;gBAClC,WAAW,EACV,qHAAqH;aACtH;YACD;gBACC,MAAM,EAAE,2BAA2B;gBACnC,WAAW,EACV,4FAA4F;aAC7F;SACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,SAAyB,EACzB,kBAAwC;QAExC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;YAC/B,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAChG,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAEzE,OAAO;YACN,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACpC,KAAK,EAAE,SAAS,IAAI,CAAC,IAAI,gBAAgB,IAAI,CAAC,IAAI,oBAAoB;gBACtE,WAAW,EAAE,qEAAqE,IAAI,CAAC,IAAI,4CAA4C;gBACvI,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;aACnB,CAAC,CAAC;SACH,CAAC;IACH,CAAC;CACD,CAAA;AA5DY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,YAAO,GAAE;GACG,iBAAiB,CA4D7B"}

package/dist/modules/breaking-changes/rules/v2/dotenv-upgrade.rule.d.ts

@@ -0,0 +1,7 @@
+import type { BreakingChangeRuleMetadata, IBreakingChangeInstanceRule, InstanceDetectionReport } from '../../types';
+export declare class DotenvUpgradeRule implements IBreakingChangeInstanceRule {
+    id: string;
+    getMetadata(): BreakingChangeRuleMetadata;
+    private fileExists;
+    detect(): Promise<InstanceDetectionReport>;
+}

package/dist/modules/breaking-changes/rules/v2/dotenv-upgrade.rule.js

@@ -0,0 +1,74 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DotenvUpgradeRule = void 0;
+const di_1 = require("@n8n/di");
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+let DotenvUpgradeRule = class DotenvUpgradeRule {
+    constructor() {
+        this.id = 'dotenv-upgrade-v2';
+    }
+    getMetadata() {
+        return {
+            version: 'v2',
+            title: 'Upgrade dotenv',
+            description: 'The dotenv library has been upgraded, which may affect how .env files are parsed',
+            category: "environment",
+            severity: 'low',
+            documentationUrl: 'https://docs.n8n.io/2-0-breaking-changes/#upgrade-dotenv',
+        };
+    }
+    async fileExists(path) {
+        try {
+            await (0, promises_1.access)(path, node_fs_1.constants.F_OK);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async detect() {
+        const result = {
+            isAffected: false,
+            instanceIssues: [],
+            recommendations: [],
+        };
+        const possibleEnvPaths = [
+            (0, node_path_1.join)(process.cwd(), '.env'),
+            (0, node_path_1.join)(process.cwd(), '.env.local'),
+            (0, node_path_1.join)(process.cwd(), '.env.development'),
+            (0, node_path_1.join)(process.cwd(), '.env.production'),
+        ];
+        const existsChecks = await Promise.all(possibleEnvPaths.map(async (path) => ({
+            path,
+            exists: await this.fileExists(path),
+        })));
+        const existingEnvFiles = existsChecks.filter((check) => check.exists);
+        if (existingEnvFiles.length === 0) {
+            return result;
+        }
+        result.isAffected = true;
+        result.instanceIssues.push({
+            title: 'dotenv library upgrade detected',
+            description: 'The dotenv library has been upgraded, which changes how values containing # or newlines are parsed. This may affect .env file parsing.',
+            level: 'warning',
+        });
+        result.recommendations.push({
+            action: 'Review .env files',
+            description: 'Ensure any values containing # or newlines are quoted appropriately. Avoid ambiguous unquoted usages that might now be interpreted differently.',
+        });
+        return result;
+    }
+};
+exports.DotenvUpgradeRule = DotenvUpgradeRule;
+exports.DotenvUpgradeRule = DotenvUpgradeRule = __decorate([
+    (0, di_1.Service)()
+], DotenvUpgradeRule);
+//# sourceMappingURL=dotenv-upgrade.rule.js.map

package/dist/modules/breaking-changes/rules/v2/dotenv-upgrade.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotenv-upgrade.rule.js","sourceRoot":"","sources":["../../../../../src/modules/breaking-changes/rules/v2/dotenv-upgrade.rule.ts"],"names":[],"mappings":";;;;;;;;;AAAA,gCAAkC;AAClC,qCAAoC;AACpC,+CAA0C;AAC1C,yCAAiC;AAU1B,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAAvB;QACN,OAAE,GAAW,mBAAmB,CAAC;IAoElC,CAAC;IAnEA,WAAW;QACV,OAAO;YACN,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,gBAAgB;YACvB,WAAW,EACV,kFAAkF;YACnF,QAAQ,eAAoC;YAC5C,QAAQ,EAAE,KAAK;YACf,gBAAgB,EAAE,0DAA0D;SAC5E,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAY;QACpC,IAAI,CAAC;YACJ,MAAM,IAAA,iBAAM,EAAC,IAAI,EAAE,mBAAS,CAAC,IAAI,CAAC,CAAC;YACnC,OAAO,IAAI,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IAED,KAAK,CAAC,MAAM;QACX,MAAM,MAAM,GAA4B;YACvC,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,EAAE;YAClB,eAAe,EAAE,EAAE;SACnB,CAAC;QAGF,MAAM,gBAAgB,GAAG;YACxB,IAAA,gBAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC;YAC3B,IAAA,gBAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,YAAY,CAAC;YACjC,IAAA,gBAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,kBAAkB,CAAC;YACvC,IAAA,gBAAI,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,iBAAiB,CAAC;SACtC,CAAC;QAGF,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CACrC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACrC,IAAI;YACJ,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;SACnC,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAGtE,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC;QACf,CAAC;QAED,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC;YAC1B,KAAK,EAAE,iCAAiC;YACxC,WAAW,EACV,wIAAwI;YACzI,KAAK,EAAE,SAAS;SAChB,CAAC,CAAC;QAEH,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC;YAC3B,MAAM,EAAE,mBAAmB;YAC3B,WAAW,EACV,iJAAiJ;SAClJ,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IACf,CAAC;CACD,CAAA;AArEY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,YAAO,GAAE;GACG,iBAAiB,CAqE7B"}

package/dist/modules/breaking-changes/rules/v2/file-access.rule.d.ts

@@ -0,0 +1,11 @@
+import type { BreakingChangeAffectedWorkflow, BreakingChangeRecommendation } from '@n8n/api-types';
+import type { WorkflowEntity } from '@n8n/db';
+import type { INode } from 'n8n-workflow';
+import type { BreakingChangeRuleMetadata, IBreakingChangeWorkflowRule, WorkflowDetectionReport } from '../../types';
+export declare class FileAccessRule implements IBreakingChangeWorkflowRule {
+    private readonly FILE_NODES;
+    id: string;
+    getMetadata(): BreakingChangeRuleMetadata;
+    getRecommendations(_workflowResults: BreakingChangeAffectedWorkflow[]): Promise<BreakingChangeRecommendation[]>;
+    detectWorkflow(_workflow: WorkflowEntity, nodesGroupedByType: Map<string, INode[]>): Promise<WorkflowDetectionReport>;
+}

package/dist/modules/breaking-changes/rules/v2/file-access.rule.js

@@ -0,0 +1,54 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileAccessRule = void 0;
+const di_1 = require("@n8n/di");
+let FileAccessRule = class FileAccessRule {
+    constructor() {
+        this.FILE_NODES = ['n8n-nodes-base.readWriteFile', 'n8n-nodes-base.readBinaryFiles'];
+        this.id = 'file-access-restriction-v2';
+    }
+    getMetadata() {
+        return {
+            version: 'v2',
+            title: 'File Access Restrictions',
+            description: 'File access is now restricted to a default directory for security purposes',
+            category: "workflow",
+            severity: 'medium',
+            documentationUrl: 'https://docs.n8n.io/2-0-breaking-changes/#set-default-value-for-n8n_restrict_file_access_to',
+        };
+    }
+    async getRecommendations(_workflowResults) {
+        return [
+            {
+                action: 'Configure file access paths',
+                description: 'Set N8N_RESTRICT_FILE_ACCESS_TO to a semicolon-separated list of allowed paths if workflows need to access files outside the default directory',
+            },
+        ];
+    }
+    async detectWorkflow(_workflow, nodesGroupedByType) {
+        const fileNodes = this.FILE_NODES.flatMap((nodeType) => nodesGroupedByType.get(nodeType) ?? []);
+        if (fileNodes.length === 0)
+            return { isAffected: false, issues: [] };
+        return {
+            isAffected: true,
+            issues: fileNodes.map((node) => ({
+                title: `File access node '${node.type}' with name '${node.name}' affected`,
+                description: 'File access for this node is now restricted to configured directories.',
+                level: 'warning',
+                nodeId: node.id,
+                nodeName: node.name,
+            })),
+        };
+    }
+};
+exports.FileAccessRule = FileAccessRule;
+exports.FileAccessRule = FileAccessRule = __decorate([
+    (0, di_1.Service)()
+], FileAccessRule);
+//# sourceMappingURL=file-access.rule.js.map

package/dist/modules/breaking-changes/rules/v2/file-access.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-access.rule.js","sourceRoot":"","sources":["../../../../../src/modules/breaking-changes/rules/v2/file-access.rule.ts"],"names":[],"mappings":";;;;;;;;;AAEA,gCAAkC;AAW3B,IAAM,cAAc,GAApB,MAAM,cAAc;IAApB;QACW,eAAU,GAAG,CAAC,8BAA8B,EAAE,gCAAgC,CAAC,CAAC;QAEjG,OAAE,GAAW,4BAA4B,CAAC;IA4C3C,CAAC;IA1CA,WAAW;QACV,OAAO;YACN,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,4EAA4E;YACzF,QAAQ,YAAiC;YACzC,QAAQ,EAAE,QAAQ;YAClB,gBAAgB,EACf,6FAA6F;SAC9F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CACvB,gBAAkD;QAElD,OAAO;YACN;gBACC,MAAM,EAAE,6BAA6B;gBACrC,WAAW,EACV,gJAAgJ;aACjJ;SACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,SAAyB,EACzB,kBAAwC;QAExC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAChG,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAErE,OAAO;YACN,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAChC,KAAK,EAAE,qBAAqB,IAAI,CAAC,IAAI,gBAAgB,IAAI,CAAC,IAAI,YAAY;gBAC1E,WAAW,EAAE,wEAAwE;gBACrF,KAAK,EAAE,SAAS;gBAChB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;aACnB,CAAC,CAAC;SACH,CAAC;IACH,CAAC;CACD,CAAA;AA/CY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,YAAO,GAAE;GACG,cAAc,CA+C1B"}

package/dist/modules/breaking-changes/rules/v2/git-node-bare-repos.rule.d.ts

@@ -0,0 +1,10 @@
+import type { BreakingChangeAffectedWorkflow, BreakingChangeRecommendation } from '@n8n/api-types';
+import type { WorkflowEntity } from '@n8n/db';
+import type { INode } from 'n8n-workflow';
+import type { BreakingChangeRuleMetadata, IBreakingChangeWorkflowRule, WorkflowDetectionReport } from '../../types';
+export declare class GitNodeBareReposRule implements IBreakingChangeWorkflowRule {
+    id: string;
+    getMetadata(): BreakingChangeRuleMetadata;
+    getRecommendations(_workflowResults: BreakingChangeAffectedWorkflow[]): Promise<BreakingChangeRecommendation[]>;
+    detectWorkflow(_workflow: WorkflowEntity, nodesGroupedByType: Map<string, INode[]>): Promise<WorkflowDetectionReport>;
+}

package/dist/modules/breaking-changes/rules/v2/git-node-bare-repos.rule.js

@@ -0,0 +1,66 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitNodeBareReposRule = void 0;
+const di_1 = require("@n8n/di");
+let GitNodeBareReposRule = class GitNodeBareReposRule {
+    constructor() {
+        this.id = 'git-node-bare-repos-v2';
+    }
+    getMetadata() {
+        return {
+            version: 'v2',
+            title: 'Git node bare repositories disabled by default',
+            description: 'N8N_GIT_NODE_DISABLE_BARE_REPOS now defaults to true for security. Bare repositories are disabled to prevent RCE attacks via Git hooks',
+            category: "workflow",
+            severity: 'medium',
+            documentationUrl: 'https://docs.n8n.io/2-0-breaking-changes/#change-the-default-value-of-n8n_git_node_disable_bare_repos-to-true',
+        };
+    }
+    async getRecommendations(_workflowResults) {
+        return [
+            {
+                action: 'Review Git node usage',
+                description: 'Check if any Git nodes in your workflows use bare repositories. Bare repositories are now disabled by default for security reasons.',
+            },
+            {
+                action: 'Migrate away from bare repositories',
+                description: 'If possible, update your workflows to use regular Git repositories instead of bare repositories.',
+            },
+            {
+                action: 'Enable bare repositories if required (not recommended)',
+                description: 'If you absolutely need bare repository support and understand the security risks, set N8N_GIT_NODE_DISABLE_BARE_REPOS=false. This is not recommended as it exposes your instance to potential RCE attacks via Git hooks.',
+            },
+        ];
+    }
+    async detectWorkflow(_workflow, nodesGroupedByType) {
+        const disableBareRepos = process.env.N8N_GIT_NODE_DISABLE_BARE_REPOS;
+        if (disableBareRepos === 'false') {
+            return { isAffected: false, issues: [] };
+        }
+        const gitNodes = nodesGroupedByType.get('n8n-nodes-base.git') ?? [];
+        if (gitNodes.length === 0) {
+            return { isAffected: false, issues: [] };
+        }
+        return {
+            isAffected: true,
+            issues: gitNodes.map((node) => ({
+                title: `Git node '${node.name}' may be affected by bare repository restrictions`,
+                description: 'This workflow contains a Git node. Bare repositories are now disabled by default for security reasons. If this node uses bare repositories, it may fail. Review your Git node configuration and migrate to regular repositories if needed, or set N8N_GIT_NODE_DISABLE_BARE_REPOS=false (not recommended) to re-enable bare repository support.',
+                level: 'warning',
+                nodeId: node.id,
+                nodeName: node.name,
+            })),
+        };
+    }
+};
+exports.GitNodeBareReposRule = GitNodeBareReposRule;
+exports.GitNodeBareReposRule = GitNodeBareReposRule = __decorate([
+    (0, di_1.Service)()
+], GitNodeBareReposRule);
+//# sourceMappingURL=git-node-bare-repos.rule.js.map

package/dist/modules/breaking-changes/rules/v2/git-node-bare-repos.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-node-bare-repos.rule.js","sourceRoot":"","sources":["../../../../../src/modules/breaking-changes/rules/v2/git-node-bare-repos.rule.ts"],"names":[],"mappings":";;;;;;;;;AAEA,gCAAkC;AAW3B,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAA1B;QACN,OAAE,GAAW,wBAAwB,CAAC;IAsEvC,CAAC;IApEA,WAAW;QACV,OAAO;YACN,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,gDAAgD;YACvD,WAAW,EACV,wIAAwI;YACzI,QAAQ,YAAiC;YACzC,QAAQ,EAAE,QAAQ;YAClB,gBAAgB,EACf,+GAA+G;SAChH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CACvB,gBAAkD;QAElD,OAAO;YACN;gBACC,MAAM,EAAE,uBAAuB;gBAC/B,WAAW,EACV,qIAAqI;aACtI;YACD;gBACC,MAAM,EAAE,qCAAqC;gBAC7C,WAAW,EACV,kGAAkG;aACnG;YACD;gBACC,MAAM,EAAE,wDAAwD;gBAChE,WAAW,EACV,0NAA0N;aAC3N;SACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,SAAyB,EACzB,kBAAwC;QAIxC,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;QACrE,IAAI,gBAAgB,KAAK,OAAO,EAAE,CAAC;YAElC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC1C,CAAC;QAGD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;QAEpE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC1C,CAAC;QAID,OAAO;YACN,UAAU,EAAE,IAAI;YAChB,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC/B,KAAK,EAAE,aAAa,IAAI,CAAC,IAAI,mDAAmD;gBAChF,WAAW,EACV,iVAAiV;gBAClV,KAAK,EAAE,SAAS;gBAChB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;aACnB,CAAC,CAAC;SACH,CAAC;IACH,CAAC;CACD,CAAA;AAvEY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,YAAO,GAAE;GACG,oBAAoB,CAuEhC"}

package/dist/modules/breaking-changes/rules/v2/index.d.ts

@@ -0,0 +1,11 @@
+import { BinaryDataStorageRule } from './binary-data-storage.rule';
+import { CliActivateAllWorkflowsRule } from './cli-replace-update-workflow-command.rule';
+import { GitNodeBareReposRule } from './git-node-bare-repos.rule';
+import { RemovedDatabaseTypesRule } from './removed-database-types.rule';
+import { SettingsFilePermissionsRule } from './settings-file-permissions.rule';
+import { SqliteLegacyDriverRule } from './sqlite-legacy-driver.rule';
+import { TaskRunnerDockerImageRule } from './task-runner-docker-image.rule';
+import { TaskRunnersRule } from './task-runners.rule';
+import { WaitNodeSubworkflowRule } from './wait-node-subworkflow.rule';
+declare const v2Rules: (typeof BinaryDataStorageRule | typeof CliActivateAllWorkflowsRule | typeof GitNodeBareReposRule | typeof RemovedDatabaseTypesRule | typeof SettingsFilePermissionsRule | typeof SqliteLegacyDriverRule | typeof TaskRunnerDockerImageRule | typeof TaskRunnersRule | typeof WaitNodeSubworkflowRule)[];
+export { v2Rules };

package/dist/modules/breaking-changes/rules/v2/index.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v2Rules = void 0;
+const binary_data_storage_rule_1 = require("./binary-data-storage.rule");
+const cli_replace_update_workflow_command_rule_1 = require("./cli-replace-update-workflow-command.rule");
+const disabled_nodes_rule_1 = require("./disabled-nodes.rule");
+const dotenv_upgrade_rule_1 = require("./dotenv-upgrade.rule");
+const file_access_rule_1 = require("./file-access.rule");
+const git_node_bare_repos_rule_1 = require("./git-node-bare-repos.rule");
+const oauth_callback_auth_rule_1 = require("./oauth-callback-auth.rule");
+const process_env_access_rule_1 = require("./process-env-access.rule");
+const pyodide_removed_rule_1 = require("./pyodide-removed.rule");
+const queue_worker_max_stalled_count_rule_1 = require("./queue-worker-max-stalled-count.rule");
+const removed_database_types_rule_1 = require("./removed-database-types.rule");
+const removed_nodes_rule_1 = require("./removed-nodes.rule");
+const settings_file_permissions_rule_1 = require("./settings-file-permissions.rule");
+const sqlite_legacy_driver_rule_1 = require("./sqlite-legacy-driver.rule");
+const task_runner_docker_image_rule_1 = require("./task-runner-docker-image.rule");
+const task_runners_rule_1 = require("./task-runners.rule");
+const tunnel_option_rule_1 = require("./tunnel-option.rule");
+const start_node_removed_rule_1 = require("./start-node-removed.rule");
+const wait_node_subworkflow_rule_1 = require("./wait-node-subworkflow.rule");
+const workflow_hooks_deprecated_rule_1 = require("./workflow-hooks-deprecated.rule");
+const v2Rules = [
+    removed_nodes_rule_1.RemovedNodesRule,
+    process_env_access_rule_1.ProcessEnvAccessRule,
+    pyodide_removed_rule_1.PyodideRemovedRule,
+    file_access_rule_1.FileAccessRule,
+    disabled_nodes_rule_1.DisabledNodesRule,
+    wait_node_subworkflow_rule_1.WaitNodeSubworkflowRule,
+    git_node_bare_repos_rule_1.GitNodeBareReposRule,
+    start_node_removed_rule_1.StartNodeRemovedRule,
+    dotenv_upgrade_rule_1.DotenvUpgradeRule,
+    oauth_callback_auth_rule_1.OAuthCallbackAuthRule,
+    cli_replace_update_workflow_command_rule_1.CliActivateAllWorkflowsRule,
+    workflow_hooks_deprecated_rule_1.WorkflowHooksDeprecatedRule,
+    queue_worker_max_stalled_count_rule_1.QueueWorkerMaxStalledCountRule,
+    tunnel_option_rule_1.TunnelOptionRule,
+    removed_database_types_rule_1.RemovedDatabaseTypesRule,
+    settings_file_permissions_rule_1.SettingsFilePermissionsRule,
+    task_runners_rule_1.TaskRunnersRule,
+    task_runner_docker_image_rule_1.TaskRunnerDockerImageRule,
+    sqlite_legacy_driver_rule_1.SqliteLegacyDriverRule,
+    binary_data_storage_rule_1.BinaryDataStorageRule,
+];
+exports.v2Rules = v2Rules;
+//# sourceMappingURL=index.js.map

package/dist/modules/breaking-changes/rules/v2/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/modules/breaking-changes/rules/v2/index.ts"],"names":[],"mappings":";;;AAAA,yEAAmE;AACnE,yGAAyF;AACzF,+DAA0D;AAC1D,+DAA0D;AAC1D,yDAAoD;AACpD,yEAAkE;AAClE,yEAAmE;AACnE,uEAAiE;AACjE,iEAA4D;AAC5D,+FAAuF;AACvF,+EAAyE;AACzE,6DAAwD;AACxD,qFAA+E;AAC/E,2EAAqE;AACrE,mFAA4E;AAC5E,2DAAsD;AACtD,6DAAwD;AACxD,uEAAiE;AACjE,6EAAuE;AACvE,qFAA+E;AAE/E,MAAM,OAAO,GAAG;IAEf,qCAAgB;IAChB,8CAAoB;IACpB,yCAAkB;IAClB,iCAAc;IACd,uCAAiB;IACjB,oDAAuB;IACvB,+CAAoB;IACpB,8CAAoB;IAEpB,uCAAiB;IACjB,gDAAqB;IACrB,sEAA2B;IAC3B,4DAA2B;IAC3B,oEAA8B;IAC9B,qCAAgB;IAChB,sDAAwB;IACxB,4DAA2B;IAC3B,mCAAe;IACf,yDAAyB;IACzB,kDAAsB;IACtB,gDAAqB;CACrB,CAAC;AACO,0BAAO"}

package/dist/modules/breaking-changes/rules/v2/oauth-callback-auth.rule.d.ts

@@ -0,0 +1,6 @@
+import type { BreakingChangeRuleMetadata, IBreakingChangeInstanceRule, InstanceDetectionReport } from '../../types';
+export declare class OAuthCallbackAuthRule implements IBreakingChangeInstanceRule {
+    id: string;
+    getMetadata(): BreakingChangeRuleMetadata;
+    detect(): Promise<InstanceDetectionReport>;
+}

package/dist/modules/breaking-changes/rules/v2/oauth-callback-auth.rule.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthCallbackAuthRule = void 0;
+const di_1 = require("@n8n/di");
+let OAuthCallbackAuthRule = class OAuthCallbackAuthRule {
+    constructor() {
+        this.id = 'oauth-callback-auth-v2';
+    }
+    getMetadata() {
+        return {
+            version: 'v2',
+            title: 'Require auth on OAuth callback URLs by default',
+            description: 'OAuth callbacks now enforce n8n user authentication by default for improved security',
+            category: "instance",
+            severity: 'medium',
+            documentationUrl: 'https://docs.n8n.io/2-0-breaking-changes/#require-authentication-on-oauth-callback-urls-by-default',
+        };
+    }
+    async detect() {
+        if (process.env.N8N_SKIP_AUTH_ON_OAUTH_CALLBACK) {
+            return { isAffected: false, instanceIssues: [], recommendations: [] };
+        }
+        return {
+            isAffected: true,
+            instanceIssues: [
+                {
+                    title: 'OAuth callback authentication now required',
+                    description: 'OAuth callbacks will now enforce n8n user authentication by default unless N8N_SKIP_AUTH_ON_OAUTH_CALLBACK is explicitly set to true.',
+                    level: 'warning',
+                },
+            ],
+            recommendations: [
+                {
+                    action: 'Review OAuth workflows',
+                    description: 'If you need to skip authentication on OAuth callbacks (e.g., for embed mode), set N8N_SKIP_AUTH_ON_OAUTH_CALLBACK=true',
+                },
+            ],
+        };
+    }
+};
+exports.OAuthCallbackAuthRule = OAuthCallbackAuthRule;
+exports.OAuthCallbackAuthRule = OAuthCallbackAuthRule = __decorate([
+    (0, di_1.Service)()
+], OAuthCallbackAuthRule);
+//# sourceMappingURL=oauth-callback-auth.rule.js.map

package/dist/modules/breaking-changes/rules/v2/oauth-callback-auth.rule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-callback-auth.rule.js","sourceRoot":"","sources":["../../../../../src/modules/breaking-changes/rules/v2/oauth-callback-auth.rule.ts"],"names":[],"mappings":";;;;;;;;;AAAA,gCAAkC;AAU3B,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAA3B;QACN,OAAE,GAAW,wBAAwB,CAAC;IAyCvC,CAAC;IAvCA,WAAW;QACV,OAAO;YACN,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,gDAAgD;YACvD,WAAW,EACV,sFAAsF;YACvF,QAAQ,YAAiC;YACzC,QAAQ,EAAE,QAAQ;YAClB,gBAAgB,EACf,oGAAoG;SACrG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,MAAM;QAGX,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,CAAC;YACjD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;QACvE,CAAC;QAED,OAAO;YACN,UAAU,EAAE,IAAI;YAChB,cAAc,EAAE;gBACf;oBACC,KAAK,EAAE,4CAA4C;oBACnD,WAAW,EACV,uIAAuI;oBACxI,KAAK,EAAE,SAAS;iBAChB;aACD;YACD,eAAe,EAAE;gBAChB;oBACC,MAAM,EAAE,wBAAwB;oBAChC,WAAW,EACV,wHAAwH;iBACzH;aACD;SACD,CAAC;IACH,CAAC;CACD,CAAA;AA1CY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,YAAO,GAAE;GACG,qBAAqB,CA0CjC"}

package/dist/modules/breaking-changes/rules/v2/process-env-access.rule.d.ts

@@ -0,0 +1,10 @@
+import { BreakingChangeRecommendation } from '@n8n/api-types';
+import { WorkflowEntity } from '@n8n/db';
+import { INode } from 'n8n-workflow';
+import type { BreakingChangeRuleMetadata, IBreakingChangeWorkflowRule, WorkflowDetectionReport } from '../../types';
+export declare class ProcessEnvAccessRule implements IBreakingChangeWorkflowRule {
+    id: string;
+    getMetadata(): BreakingChangeRuleMetadata;
+    detectWorkflow(workflow: WorkflowEntity, _nodesGroupedByType: Map<string, INode[]>): Promise<WorkflowDetectionReport>;
+    getRecommendations(): Promise<BreakingChangeRecommendation[]>;
+}