Three flipped defaults in n8n 2.0 can change a workflow nobody edited

Each of the three default changes has its own setting, and that shapes how you rehearse the upgrade. Task runners are on by default, and Code node executions run on them ^[1]. Environment-variable access from the Code node is blocked by a second setting, `N8N_BLOCK_ENV_ACCESS_IN_NODE=true` ^[3]. Node availability is a third control, `NODES_EXCLUDE`, which is how n8n lets you re-enable ExecuteCommand and LocalFileTrigger when a workflow genuinely needs them ^[5].

The pre-flight advice in the write-up is to set `N8N_RUNNERS_ENABLED=true` on 1.x and test Code nodes there ^[2]. That rehearses one change of the three. A Code node that reads `process.env` passes that dry run and can stop working once the env block is in force ^[3]. Reproducing 2.0 behaviour on 1.x takes the runner flag, the env-access block, and an exclusion entry covering the two disabled nodes ^[14]. The suggested remedy is to stop using the Code node as a secret store and attach secrets to n8n credentials ^[4].

Python is a runtime replacement. n8n 2.0 removes the Pyodide-based Python Code implementation and moves Python execution to the task-runner model, and Python Code nodes require task runners in external mode ^[8]. The native implementation does not support the same built-in variables Pyodide provided, so code that references `_input` has to be reviewed ^[9]. External mode has to be deployed, so this part of the upgrade lands on whoever runs the n8n process.

`$evaluateExpression` no longer works inside the Code node as it did, and the post says n8n documents this as a breaking change ^[6]. An insecure-mode workaround exists, which the post describes as a temporary compatibility option and not the preferred production solution ^[7]. The post sets the migration test as a question: "Does my workflow still execute with the same inputs, permissions, side effects, and outputs?" ^[10]. Opening a workflow in the editor does not answer that.

This is one write-up. It names defaults changing around databases, OAuth, binary data and workflow publishing without itemising them, and it does not date the release ^[12]. The three changes it does itemise are narrow in scope: an instance with no Code nodes, no Python Code nodes, and neither ExecuteCommand nor LocalFileTrigger in use comes through all three unchanged ^[15].