n8n patches its way through the week while Trigger.dev and Inngest polish their edges

n8n's security and reliability sweep

The week's biggest story is n8n's sustained patch cadence across both its 1.x and 2.x branches, with the most significant fix landing in n8n 2.35.0: the AI Agent Node now stops pre-tool-call text from leaking into agent responses — a subtle but important correctness fix for anyone building LLM-powered workflows. The same release also applies the redaction policy to Code node console output, closing a potential data-exposure gap where sensitive values could slip through in logs.

Reliability was a recurring theme across the 2.35.x line. n8n 2.35.1 fixed TLS options being applied per-hop when requests traverse a proxy — a real-world headache for anyone running n8n behind a corporate gateway or multi-tier network. n8n 2.35.2 corrected the reported activation mode for triggers activated via the publication outbox, clearing up confusion about whether a workflow is genuinely live. Then n8n 2.35.3 rounded out the week by allowing the details field in continueErrorOutput mode, plus adding an abort deadline to bound publication outbox record processing — preventing a hung process from blocking the queue forever.

The maintenance branch saw the same fixes roll through. n8n 2.34.5 carried the proxy TLS fix, while n8n 2.34.6 brought the details field fix and migrated the Google Ads Node from the sunset v21 API to v25 — a reminder that even stable branches need to keep pace with external API deprecations. The oldest line, n8n 1.123.70, was mostly dependency hardening (adm-zip, tar, undici bumps), and n8n 1.123.71 appeared to be a follow-on with no notable user-facing changes.

Trigger.dev streamlines its runtime

Over in the Trigger.dev camp, v4.5.11 shipped midweek with a focus on polish rather than new features. The release notes point to general improvements in the self-hosted Docker experience, which matters for teams that want the orchestration layer running inside their own infrastructure rather than relying on the cloud offering. Nothing here is headline-grabbing, but consistent incremental releases keep the runtime stable for the growing number of teams using it for long-running background tasks.

Inngest loosens the sandbox limits

Inngest's JS SDK 4.18.1 made a small but welcome change: sandbox names can now be up to 255 characters, including uppercase ULIDs and human-readable names. That removes an artificial constraint that bit teams using non-lowercase identifiers or wanting more descriptive sandbox labels. It's a minor patch, but the kind of friction-removal that makes the SDK feel more forgiving in day-to-day use.

The big picture

Reading across the releases, the week's through-line is hardening: n8n aggressively patched its execution core and security boundaries across three concurrently-supported versions, Trigger.dev tightened its runtime, and Inngest removed a naming constraint. None of the changes are flashy, but together they speak to a maturing ecosystem where the platforms are investing in stability and correctness over new surface area — exactly what you want from infrastructure you're betting production workflows on.