A recent update broke workflows without corresponding update log entry (which broke a critical workflow we were relying on as well as a few downstream ones):
The change introduced by chore: Bundle 2026-W7 by n8n-assistant[bot] · Pull Request #26214 · n8n-io/n8n · GitHub broke our workflows, and there was not a corresponding changelog entry for this.
The addition of “caller” (and some other properties) to unsafeObjectProperties broke our workflows. What’s curious is that list differs from other various hardcoded property denylists. We’re being forced to monkeypatch n8n for now.
Changes and restrictions like this should be gated (or disablable) behind an environment variable like the other security options - for example, our instance allows arbitrary commands to be run, why would we want to block certain properties? To that end, we’d like a toggle to disable this feature, and it would be pertinent that these changes be logged in the future (as well as perhaps protecting against prototype pollution in other ways that remove the need to block arbitrary properties users may rely on that would share a name)