chore: Bump Axios, Hono, fast-xml-parser and more (#29828)

Co-authored-by: aikido-autofix[bot] <119856028+aikido-autofix[bot]@users.noreply.github.com>
Co-authored-by: Matsuuu <huhta.matias@gmail.com>

package.json

@@ -94,7 +94,6 @@
       "@mistralai/mistralai": "^1.10.0",
       "@n8n/typeorm>@sentry/node": "catalog:",
       "@types/node": "^20.17.50",
-      "axios": "1.15.0",
       "chokidar": "4.0.3",
       "esbuild": "^0.25.0",
       "expr-eval@2.0.2": "npm:expr-eval-fork@3.0.0",
@@ -115,7 +114,6 @@
       "tmp": "0.2.4",
       "nodemailer": "7.0.11",
       "validator": "13.15.26",
-      "zod": "3.25.67",
       "js-yaml": "4.1.1",
       "lodash": "4.18.0",
       "body-parser": "2.2.1",
@@ -135,7 +133,6 @@
       "@rudderstack/rudder-sdk-node@<=3.0.0": "3.0.0",
       "@smithy/config-resolver": ">=4.4.0",
       "word-wrap@<=1.2.4": "1.2.4",
-      "langsmith@<=0.4.6": "0.4.6",
       "minimatch@<=5.1.8": "5.1.8",
       "multer": "2.1.1",
       "express-rate-limit@<=8.2.2": "8.2.2",
@@ -148,16 +145,17 @@
       "@xmldom/xmldom@<=0.8.13": "0.8.13",
       "handlebars": "4.7.9",
       "defu@<=6.1.5": "6.1.5",
-      "hono@<=4.12.14": "4.12.14",
       "follow-redirects@<=1.16.0": "1.16.0",
       "@hono/node-server@<=1.19.13": "1.19.13",
       "yaml@<=2.8.3": "2.8.3",
       "undici@<=7.24.1": "7.24.1",
-      "fast-xml-parser": "5.5.7",
       "picomatch@<=4.0.4": "4.0.4",
-      "brace-expansion@1": "1.1.12",
-      "brace-expansion@2": "2.0.3",
-      "brace-expansion@5": "5.0.5"
+      "hono@<=4.12.16": "4.12.16",
+      "brace-expansion@<=2.1.0": "2.1.0",
+      "axios": "1.16.0",
+      "zod": "3.25.67",
+      "fast-xml-parser": "5.7.2",
+      "openai": "6.21.0"
     },
     "patchedDependencies": {
       "bull@4.16.4": "patches/bull@4.16.4.patch",

packages/@n8n/nodes-langchain/nodes/vendors/GoogleGemini/helpers/utils.ts

@@ -104,7 +104,8 @@ export async function transferFile(
 			responseType: 'stream',
 		});
 
-		mimeType = downloadResponse.headers['content-type']?.split(';')?.[0] ?? fallbackMimeType;
+		const contentType = downloadResponse.headers['content-type'] as string | undefined;
+		mimeType = contentType?.split(';')?.[0] ?? fallbackMimeType ?? 'application/octet-stream';
 		stream = downloadResponse.data;
 	} else {
 		const binaryPropertyName = this.getNodeParameter('binaryPropertyName', i, 'data');

packages/cli/package.json

@@ -113,7 +113,7 @@
     "@n8n_io/ai-assistant-sdk": "catalog:",
     "@n8n_io/license-sdk": "2.24.1",
     "@parcel/watcher": "^2.5.1",
-    "@rudderstack/rudder-sdk-node": "3.0.0",
+    "@rudderstack/rudder-sdk-node": "3.0.5",
     "@sentry/node": "catalog:",
     "aws4": "1.11.0",
     "axios": "catalog:",

packages/core/src/execution-engine/node-execution-context/utils/__tests__/request-helper-functions.test.ts

@@ -353,7 +353,7 @@ describe('Request Helper Functions', () => {
 					hostname: 'example.de',
 					href: requestObject.uri,
 				};
-				axiosOptions.beforeRedirect!(redirectOptions, mock());
+				axiosOptions.beforeRedirect!(redirectOptions, mock(), mock());
 				expect(redirectOptions.agent).toEqual(redirectOptions.agents.https);
 				expect((redirectOptions.agent as HttpsAgent).options).toMatchObject({
 					servername: 'example.de',

packages/core/src/execution-engine/node-execution-context/utils/request-helper-functions.ts

@@ -420,8 +420,12 @@ export async function proxyRequestToAxios(
 	options?: IRequestOptions,
 ): Promise<any> {
 	let axiosConfig: AxiosRequestConfig = {
-		maxBodyLength: Infinity,
-		maxContentLength: Infinity,
+		// -1 is the Axios sentinel for "no limit". Infinity also means no limit but
+		// Axios 1.15.1+ treats any value > -1 as a finite cap, wrapping stream responses
+		// in Readable.from() even when the limit is Infinity. That breaks the downstream
+		// `instanceof IncomingMessage` checks in parseIncomingMessage / prepareBinaryData.
+		maxBodyLength: -1,
+		maxContentLength: -1,
 	};
 	let configObject: IRequestOptions;
 	if (typeof uriOrObject === 'string') {
@@ -510,8 +514,8 @@ export function convertN8nRequestToAxios(n8nRequest: IHttpRequestOptions): Axios
 		timeout,
 		auth,
 		url,
-		maxBodyLength: Infinity,
-		maxContentLength: Infinity,
+		maxBodyLength: -1,
+		maxContentLength: -1,
 	} as AxiosRequestConfig;
 
 	axiosRequest.params = n8nRequest.qs;

packages/nodes-base/nodes/Code/JavaScriptSandbox.ts

@@ -10,6 +10,7 @@ import {
 import type { SandboxContext } from './Sandbox';
 import { Sandbox } from './Sandbox';
 import { ValidationError } from './ValidationError';
+import { generateScript } from './utils';
 
 const { NODE_FUNCTION_ALLOW_BUILTIN: builtIn, NODE_FUNCTION_ALLOW_EXTERNAL: external } =
 	process.env;
@@ -53,9 +54,8 @@ export class JavaScriptSandbox extends Sandbox {
 	}
 
 	async runCode<T = unknown>(): Promise<T> {
-		const script = `module.exports = async function() {${this.jsCode}\n}()`;
 		try {
-			const executionResult = (await this.vm.run(script, __dirname)) as T;
+			const executionResult = (await this.vm.run(generateScript(this.jsCode), __dirname)) as T;
 			return executionResult;
 		} catch (error) {
 			throw new ExecutionError(error);
@@ -65,12 +65,10 @@ export class JavaScriptSandbox extends Sandbox {
 	async runCodeAllItems(options?: {
 		multiOutput?: boolean;
 	}): Promise<INodeExecutionData[] | INodeExecutionData[][]> {
-		const script = `module.exports = async function() {${this.jsCode}\n}()`;
-
 		let executionResult: INodeExecutionData | INodeExecutionData[] | INodeExecutionData[][];
 
 		try {
-			executionResult = await this.vm.run(script, __dirname);
+			executionResult = await this.vm.run(generateScript(this.jsCode), __dirname);
 		} catch (error) {
 			// anticipate user expecting `items` to pre-exist as in Function Item node
 			mapItemsNotDefinedErrorIfNeededForRunForAll(this.jsCode, error);
@@ -101,14 +99,12 @@ export class JavaScriptSandbox extends Sandbox {
 	}
 
 	async runCodeEachItem(itemIndex: number): Promise<INodeExecutionData | undefined> {
-		const script = `module.exports = async function() {${this.jsCode}\n}()`;
-
 		validateNoDisallowedMethodsInRunForEach(this.jsCode, itemIndex);
 
 		let executionResult: INodeExecutionData;
 
 		try {
-			executionResult = await this.vm.run(script, __dirname);
+			executionResult = await this.vm.run(generateScript(this.jsCode), __dirname);
 		} catch (error) {
 			// anticipate user expecting `item` to pre-exist as in Function Item node
 			mapItemNotDefinedErrorIfNeededForRunForEach(this.jsCode, error);

packages/nodes-base/nodes/Code/utils.ts

@@ -1,4 +1,5 @@
 import type { INodeExecutionData, IDataObject, IExecuteFunctions } from 'n8n-workflow';
+import { VMScript } from 'vm2';
 
 export function isObject(maybe: unknown): maybe is { [key: string]: unknown } {
 	return (
@@ -53,3 +54,28 @@ export const addPostExecutionWarning = (
 		});
 	}
 };
+
+const PREPARE_STACKTRACE = `
+Error.prepareStackTrace = (err, structuredStackTrace) => {
+	return "Error: " + err + "\\n" + structuredStackTrace
+		.filter(callSite => callSite.getLineNumber())
+		.map(callSite => {
+			return "	at Code:" + callSite.getLineNumber() + ":" + callSite.getColumnNumber()
+		})
+		.join("\\n");
+};
+`;
+
+export function generateScript(jsCode: string) {
+	return new VMScript(
+		`module.exports = async function() {${jsCode}\n}() ${PREPARE_STACKTRACE}`,
+		'Code',
+	);
+}
+
+export function generateSortingScript(jsCode: string) {
+	return new VMScript(
+		`module.exports = items.sort((a, b) => { ${jsCode} }) ${PREPARE_STACKTRACE}`,
+		'Code',
+	);
+}

packages/nodes-base/nodes/Function/Function.node.ts

@@ -11,6 +11,7 @@ import type {
 import { NodeConnectionTypes, deepCopy, NodeOperationError } from 'n8n-workflow';
 
 import { vmResolver } from '../Code/JavaScriptSandbox';
+import { generateScript } from '../Code/utils';
 
 export class Function implements INodeType {
 	description: INodeTypeDescription = {
@@ -166,7 +167,7 @@ return items;`,
 
 		try {
 			// Execute the function code
-			items = await vm.run(`module.exports = async function() {${functionCode}\n}()`, __dirname);
+			items = await vm.run(generateScript(functionCode), __dirname);
 			items = this.helpers.normalizeItems(items);
 
 			// Do very basic validation of the data

packages/nodes-base/nodes/FunctionItem/FunctionItem.node.ts

@@ -11,6 +11,7 @@ import type {
 import { NodeConnectionTypes, deepCopy, NodeOperationError } from 'n8n-workflow';
 
 import { vmResolver } from '../Code/JavaScriptSandbox';
+import { generateScript } from '../Code/utils';
 
 export class FunctionItem implements INodeType {
 	description: INodeTypeDescription = {
@@ -174,10 +175,7 @@ return item;`,
 				let jsonData: IDataObject;
 				try {
 					// Execute the function code
-					jsonData = await vm.run(
-						`module.exports = async function() {${functionCode}\n}()`,
-						__dirname,
-					);
+					jsonData = await vm.run(generateScript(functionCode), __dirname);
 				} catch (error) {
 					if (this.continueOnFail()) {
 						returnData.push({ json: { error: error.message } });

packages/nodes-base/nodes/HttpRequest/test/binaryData/HttpRequest.test.ts

@@ -4,7 +4,7 @@ import nock from 'nock';
 describe('Test Binary Data Download', () => {
 	const baseUrl = 'https://dummy.domain';
 
-	beforeAll(async () => {
+	beforeAll(() => {
 		nock(baseUrl)
 			.persist()
 			.get('/path/to/image.png')

packages/nodes-base/nodes/ItemLists/V3/helpers/utils.ts

@@ -6,6 +6,7 @@ import type {
 	GenericValue,
 } from 'n8n-workflow';
 import { ApplicationError, NodeOperationError } from 'n8n-workflow';
+import { generateSortingScript } from '../../../Code/utils';
 
 export const prepareFieldsArray = (fields: string | string[], fieldName = 'Fields') => {
 	if (typeof fields === 'string') {
@@ -43,7 +44,7 @@ export function sortByCode(
 		sandbox: { items },
 	});
 
-	return vm.run(`module.exports = items.sort((a, b) => { ${code} })`);
+	return vm.run(generateSortingScript(code));
 }
 
 type PartialBinaryData = Omit<IBinaryData, 'data'>;

packages/nodes-base/nodes/Transform/Sort/utils.ts

@@ -1,6 +1,7 @@
 import { NodeVM } from 'vm2';
 import type { IExecuteFunctions, INodeExecutionData } from 'n8n-workflow';
 import { NodeOperationError } from 'n8n-workflow';
+import { generateSortingScript } from '../../Code/utils';
 
 const returnRegExp = /\breturn\b/;
 export function sortByCode(
@@ -21,5 +22,5 @@ export function sortByCode(
 		sandbox: { items },
 	});
 
-	return vm.run(`module.exports = items.sort((a, b) => { ${code} })`);
+	return vm.run(generateSortingScript(code));
 }

pnpm-workspace.yaml

@@ -21,7 +21,7 @@ catalog:
   '@types/uuid': ^10.0.0
   '@types/xml2js': ^0.4.14
   '@vitest/coverage-v8': 3.2.4
-  axios: 1.15.1
+  axios: 1.16.0
   basic-auth: 2.0.1
   callsites: 3.1.0
   chokidar: 4.0.3
@@ -51,8 +51,8 @@ catalog:
   tsx: ^4.19.3
   typescript: 5.9.2
   uuid: 10.0.0
-  vite: npm:rolldown-vite@latest
-  vm2: ^3.10.5
+  vite: npm:rolldown-vite@7.1.16
+  vm2: 3.11.2
   vite-plugin-dts: ^4.5.4
   vitest: ^3.1.3
   vitest-mock-extended: ^3.1.0