Skip to content

fix: use whitelist approach in cleanWorkflowForUpdate to prevent API errors#927

Open
manato-tajiri wants to merge 1 commit into
czlonkowski:mainfrom
manato-tajiri:fix/whitelist-cleanWorkflowForUpdate
Open

fix: use whitelist approach in cleanWorkflowForUpdate to prevent API errors#927
manato-tajiri wants to merge 1 commit into
czlonkowski:mainfrom
manato-tajiri:fix/whitelist-cleanWorkflowForUpdate

Conversation

@manato-tajiri

Copy link
Copy Markdown

Problem

The function used a blacklist approach that destructured out specific known properties but passed through any unknown properties via the rest spread. n8n cloud instances return properties like , , , , , that were not in the blacklist, causing the n8n API to reject requests with "additional properties" errors.

This affects all operations (updateName, updateNode, addNode, addConnection, removeConnection).

Fix

Changed from a blacklist approach to a whitelist approach. The function now only includes the 6 properties the n8n API accepts in :

Testing

  • All 76 existing unit tests pass
  • Build succeeds with

n8n-mcp@2.28.3 build
tsc -p tsconfig.build.json

Fixes the "additional properties" error on all partial update operations for n8n cloud instances.

Copilot AI review requested due to automatic review settings July 10, 2026 16:34
@manato-tajiri

Copy link
Copy Markdown
Author

Note: The current npm version (2.63.2) already has a whitelist approach but is missing and . This PR adds those missing properties to the whitelist.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates workflow update sanitization to prevent n8n Cloud API rejections caused by unexpected/instance-specific workflow properties being included in update payloads.

Changes:

  • Switch cleanWorkflowForUpdate from a blacklist/rest-spread approach to a strict whitelist of accepted workflow properties.
  • Update unit tests to reflect that active and tags are now preserved for updates.
  • Bump the lockfile version field to 2.28.3.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.

File Description
src/services/n8n-validation.ts Implements a whitelist-based workflow cleaner for update requests to avoid “additional properties” API errors.
tests/unit/services/n8n-validation.test.ts Adjusts expectations for update cleaning to keep active and tags.
package-lock.json Updates lockfile package version metadata to 2.28.3.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines 330 to 333
const cleaned = cleanWorkflowForUpdate(workflow);

// Should remove all these fields
// With whitelist approach, only name, nodes, connections, settings, active, tags are kept
expect(cleaned).not.toHaveProperty('id');
Comment on lines +346 to 349
// active and tags ARE whitelisted, so they should be present
expect(cleaned).toHaveProperty('active');
expect(cleaned).toHaveProperty('tags'); // Should keep name and filter settings to safe properties
expect(cleaned.name).toBe('Updated Workflow');
Comment on lines +138 to +143
const whitelistedProperties = ['name', 'nodes', 'connections', 'settings', 'active', 'tags'] as const;
for (const key of whitelistedProperties) {
if (key in workflow) {
(cleanedWorkflow as any)[key] = (workflow as any)[key];
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants