Creator Portal Falsche Ablehnung für n8n-nodes-speechall

atacan · 18. Juli 2026 um 12:14

Creator Portal Falschmeldung für `n8n-nodes-speechall@0.1.5`

Hallo n8n-Team,

Ich melde einen offenbar Scanner-Versions-Mismatch im Creator Portal, der das Community-Paket n8n-nodes-speechall@0.1.5 betrifft.

Paket: n8n-nodes-speechall@0.1.5
npm: https://www.npmjs.com/package/n8n-nodes-speechall
GitHub: GitHub - Speechall/speechall-n8n-node · GitHub
Beglaubigter Commit: 61562b67af982c735a943a5fa1b38b0ba838a032
Das Creator Portal lehnt dieses Paket ab, aber der aktuelle Scanner akzeptiert es.
Nachstellung:

@n8n/scan-community-package@0.27.0 lehnt fälschlicherweise ab:
dist/credentials/SpeechallApi.credentials.d.ts
@n8n/scan-community-package@0.28.1 besteht alle Checks.
Diese exakte .d.ts-Falschmeldung wurde in n8n PR #34214
behoben und in PR #34391 zurückportiert.

Könntet ihr bitte die Scanner-Version des Creator Portals bestätigen, seinen Prüf-Worker aktualisieren,
das zwischengespeicherte Ergebnis löschen und die Eingabe neu ausführen?

kjooleng · 18. Juli 2026 um 14:06

Hallo @atacan

Um dieses Problem schnell zu lösen, eskaliere diesen Bericht bitte über die folgenden offiziellen Kanäle:

n8n Discord (#community-nodes Kanal): Das ist der schnellste Weg, um die Aufmerksamkeit der Entwickler zu bekommen, die das Community-Node-Ökosystem betreuen. Poste deine Erkenntnisse dort, da die Betreuer manuell ein Worker-Update oder einen Neu-Scan auslösen können.
Support-E-Mail: Sende diesen genauen Bericht an support@n8n.io. Da du die spezifischen PRs zitiert hast, kann das Support-Team diesen direkt an das Core-Team als „bestätigten Bug

Anshul_Namdev · 18. Juli 2026 um 22:36

Hallo @atacan Willkommen!
PR #34214, fix(core): Lint community packages against their provenance-attested source, wurde am 15. Juli 2026 in master gemergt. @n8n/scan-community-package 0.28.0 wurde den nächsten Tag auf npm veröffentlicht, 0.28.1 den Tag danach. Dieser Zeitstrahl stimmt genau mit deinem Bericht überein: 0.27.0, veröffentlicht am 14. Juli, liegt vor dem Fix, 0.28.1 nicht.
Füge die Merge- und Veröffentlichungs-Zeitstempel deinem Bericht an. Das gibt demjenigen, der ihn überprüft, aussagekräftige Beweise für die angeheftete Scanner-Version statt nur deiner lokalen Reproduktion.

github.com/n8n-io/n8n

fix(core): Lint community packages against their provenance-attested source (#34214)

master ← fix-package-scan-source

opened 08:52AM - 15 Jul 26 UTC

garritfra

+342 -22

## Summary `@n8n/scan-community-package` linted only the **compiled** output sh…ipped in published tarballs. The node/credential lint rules are written for `.ts` sources: against `dist/` output they mostly silently no-op (the plugin's own file resolution maps `dist/nodes/Foo.node.js` → `nodes/Foo.node.ts`, which doesn't exist in a tarball) or false-positive (the filename-convention rules can never be satisfied by `.d.ts` files). Since npm provenance is already mandatory for the scan to proceed, the attestation tells us exactly which repo + commit the published artifact was built from. This PR makes the scanner: 1. Parse the provenance attestation (`registry.npmjs.org/-/npm/v1/attestations/…`) to extract the attested GitHub repo and commit. 2. Download that exact source checkout and locate the package root by `package.json` name (monorepo-aware). 3. Lint the source scoped to `package.json` + `nodes/**` + `credentials/**` — the same surface `n8n-node lint` covers at dev time, deliberately excluding repo dev files (gulpfile, test configs, committed `dist/`) that never end up in the published package. 4. **Keep scanning the shipped artifact**: provenance pins the source commit, not the build output — a build step can emit anything into `dist/`. The tarball leg is scoped to compiled `**/*.js` + the published `package.json` (so `no-dangerous-functions`, `no-restricted-imports`, `no-forbidden-lifecycle-scripts`, `no-console` etc. still run against what users actually install); `.ts`/`.d.ts` declarations are covered better by the source scan and only false-positive on filename rules there. 5. **Hard-fail when the source can't be fetched** (unsupported host, unreachable repo, no matching package root) with an actionable message — a tarball-only fallback would silently reintroduce the blind spot this PR removes. Both source-fetch requests are bounded by a 30s timeout so a stalled connection fails fast instead of hanging the gate. Since `.ts`/`.d.ts` files are never linted from tarballs anymore, this supersedes the need for #34203 on this path. ## How to test ```bash cd packages/@n8n/scan-community-package && pnpm vitest run scanner/scanner.test.mjs ``` End-to-end against the package from the ticket: ```bash node packages/@n8n/scan-community-package/scanner/cli.mjs @luzconsulting/n8n-nodes-salessuite ``` - **Before:** fails with the bogus `Rename file to SalesSuiteApi.credentials.ts` false positive; all source-level rules blind. - **After:** `✅ Fetched source from github.com/luzconsulting/n8n-nodes-salessuite@42cdce5` — the false positive is gone, and the scan surfaces 6 real violations in the source (`require-node-api-error`, dynamic-options display-name rules) that the compiled-output scan missed entirely. Note: `test/provenance.test.mjs` fails under vitest on `master` already (it uses `node:test`, which vitest 4 rejects as "no test suite") — pre-existing, untouched here. ## Related Linear tickets, Github issues, and Community forum posts https://linear.app/n8n/issue/CE-1713 ## Review / Merge checklist - [x] I have seen this code, I have run this code, and I take responsibility for this code. - [x] PR title and summary are descriptive. ([conventions](../blob/master/.github/pull_request_title_conventions.md)) - [ ] [Docs updated](https://github.com/n8n-docs) or follow-up ticket created. - [x] Tests included. - [x] PR Labeled with `Backport to Beta`, `Backport to Stable`, or `Backport to v1` (if the PR is an urgent fix that needs to be backported) 🤖 PR Summary generated by AI 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Thema		Antworten	Aufrufe
Creator Portal reports "tests failed" but `scan-community-package` passes on the published package Questions bug:confirmed	5	143	24. Juli 2026
Verification pre-check fails with generic "some tests have failed", but scan-community-package passes Questions bug:unconfirmed	3	141	21. Juli 2026
@n8n/scan-community-package failing for cred filename Questions deployment , community-node , bug:unconfirmed	4	92	22. Juli 2026
Issue with Community Node Submission - n8n-nodes-chainstream Questions node	0	68	17. Oktober 2025
Request to submit a new n8n community node for review Help me Build my Workflow	4	131	17. März 2026

Creator Portal Falsche Ablehnung für n8n-nodes-speechall

Creator Portal Falschmeldung für n8n-nodes-speechall@0.1.5

Verwandte Themen

Creator Portal Falschmeldung für `n8n-nodes-speechall@0.1.5`