n8n 2.39.0 stops leaking its MCP auth endpoint when disabled

n8n's 2.39.0 release hides the MCP OAuth discovery endpoint once an instance turns off MCP access. Before this fix, the endpoint kept answering discovery requests no matter the toggle. A client could still find the auth flow for a feature the instance owner thought was off.

The fix, tracked as issue #36726, makes the endpoint stop responding when the feature is disabled. Discovery endpoints exist so a client can find an auth flow without being told the URL in advance. That closes the gap between what the toggle says and what the server does.

Agent workflow tools now handle unpublished, missing, or incompatible workflows without failing outright. When a parent workflow is suspended, tools wait for it instead of raising an error immediately.

Settings responses now redact OpenTelemetry header values unconditionally, where before the behavior depended on configuration. n8n also dropped its dependency on undici v6, which was breaking AI requests on Node 26.