n8n-core

Dangerous workflowscaution

One pull_request_target workflow exists among 30 analyzed workflows, but there were no untrusted checkouts or script-injection findings. The isolated workflow warrants awareness but is not a severe health concern.

Dependency profilecaution

The package declares 40 runtime dependencies, including substantial framework, cloud, and observability components. This is a meaningful dependency surface but is proportionate to core workflow-automation functionality rather than evidence of abandonment.

Repo package mentioncaution

The repository name does not match n8n-core and its README does not mention the package, so the package-to-repository relationship is less transparent. The mismatch may reflect a monorepo sub-package, but the missing explicit mention remains a caution.

Token permissionscaution

Nineteen analyzed workflows lack top-level token permissions and four declare top-level write access, leaving some workflow permission scope less explicit than ideal. This is a repository hygiene concern, not evidence that the release is unfit to use.