n8n ships v2.31 across the board as Inngest adds deferred abort and scoring

n8n’s biggest week in months: v2.31.0 security and platform fixes

n8n dominated the week with a coordinated release of v2.31.0 across three maintenance streams, backporting critical fixes. The headline release, n8n 2.31.0, shipped on July 14 and brought a suite of bug fixes alongside the new features. Most notably, dynamic credential tokens are now bound to a user ID, closing a security gap that could have allowed credential reuse across user contexts. This fix was immediately backported to 2.31.1 and 2.30.5 on July 15.

Security hardening continued with 2.30.7 and 2.31.3, which both fix SES request signing and add provenance-attested linting for community packages, ensuring that plugins installed from npm can be verified against their source. The 1.x maintenance line also got attention: 1.123.66 fixed external modules in the Code node that had stopped working.

Platform stability saw improvements across the board. Webhook execution promises now settle properly on early errors, fixed in 2.29.11, 2.30.4, and 1.123.65. The 2.31.x line also required explicit execution mode for MCP workflow executions — backported to 2.31.2 and 2.30.6 — preventing workflows from running in unintended environments.

Inngest adds deferred abort and v2 scoring

Inngest’s JS SDK 4.13.0 introduced defer().abort(), letting developers programmatically cancel deferred runs. This is a practical addition for workflows that need to react to external cancellation signals without waiting for a timeout.

The Inngest Server v1.37.0 added a v2 scoring endpoint (POST /v2/runs/{runId}/scores), allowing you to record named scores against function runs or individual steps. This is straightforward telemetry for evaluation pipelines — think A/B testing prompt strategies or tracking LLM response quality per step.

Temporal and Trigger.dev: bundler fixes and v3 cleanup

Temporal’s TypeScript SDK 1.20.3 fixed a webpack module cache regression introduced in 1.20.1, and made LangSmith bundle rewrites compatible with pnpm’s non-hoisting layout. The fire-and-forget LangSmith run emission also removes a problematic yield point that could reorder commands under signalWithStart.

Trigger.dev v4.5.4 (also covered in the Trigger.dev changelog) removed the v3 engine entirely, marking a clean break. It also added secret marking for syncEnvVars and fixed a chat.agent message drop — a welcome stability fix for anyone using agent-based workflows.