From dfdc6d2c75a562b135c5c0d3e849d57779d55ebe Mon Sep 17 00:00:00 2001
From: Sandra Zollner <sandra.zollner@n8n.io>
Date: Thu, 9 Apr 2026 18:39:07 +0200
Subject: [PATCH] =?UTF-8?q?feat(core):=20Add=20'verify'=20option=20to=20in?=
 =?UTF-8?q?stallPackage=20handler=20and=20update=20=E2=80=A6=20(#28257)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../community-packages.handler.test.ts          | 17 +++++++++++++++++
 .../community-packages.handler.ts               |  8 ++++++--
 .../schemas/installCommunityPackageRequest.yml  |  5 +++++
 3 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/packages/cli/src/public-api/v1/handlers/community-packages/__tests__/community-packages.handler.test.ts b/packages/cli/src/public-api/v1/handlers/community-packages/__tests__/community-packages.handler.test.ts
index 1508552eabf..a25fc107f8f 100644
--- a/packages/cli/src/public-api/v1/handlers/community-packages/__tests__/community-packages.handler.test.ts
+++ b/packages/cli/src/public-api/v1/handlers/community-packages/__tests__/community-packages.handler.test.ts
@@ -68,6 +68,23 @@ describe('CommunityPackages Handler', () => {
 			expect(mockResponse.json).toHaveBeenCalledWith(mapToCommunityPackage(mockInstalledPackage));
 		});
 
+		it('should forward verify:true to lifecycle when provided', async () => {
+			const req = {
+				body: { name: 'n8n-nodes-test', verify: true },
+				user: mockUser,
+			};
+
+			mockLifecycle.install.mockResolvedValue(mockInstalledPackage as InstalledPackages);
+
+			await handler.installPackage[handler.installPackage.length - 1](req, mockResponse);
+
+			expect(mockLifecycle.install).toHaveBeenCalledWith(
+				{ name: 'n8n-nodes-test', version: undefined, verify: true },
+				mockUser,
+				'publicApi',
+			);
+		});
+
 		it('should return 400 when name is missing', async () => {
 			const req = {
 				body: {},
diff --git a/packages/cli/src/public-api/v1/handlers/community-packages/community-packages.handler.ts b/packages/cli/src/public-api/v1/handlers/community-packages/community-packages.handler.ts
index 7d6276a3472..3419661a606 100644
--- a/packages/cli/src/public-api/v1/handlers/community-packages/community-packages.handler.ts
+++ b/packages/cli/src/public-api/v1/handlers/community-packages/community-packages.handler.ts
@@ -16,14 +16,18 @@ export = {
 	installPackage: [
 		apiKeyHasScope('communityPackage:install'),
 		async (
-			req: AuthenticatedRequest<Record<string, never>, unknown, { name: string; version?: string }>,
+			req: AuthenticatedRequest<
+				Record<string, never>,
+				unknown,
+				{ name: string; version?: string; verify?: boolean }
+			>,
 			res: express.Response,
 		): Promise<express.Response> => {
 			const lifecycle = Container.get(CommunityPackagesLifecycleService);
 
 			try {
 				const installedPackage = await lifecycle.install(
-					{ name: req.body.name, version: req.body.version, verify: false },
+					{ name: req.body.name, version: req.body.version, verify: req.body.verify ?? false },
 					req.user,
 					'publicApi',
 				);
diff --git a/packages/cli/src/public-api/v1/handlers/community-packages/spec/schemas/installCommunityPackageRequest.yml b/packages/cli/src/public-api/v1/handlers/community-packages/spec/schemas/installCommunityPackageRequest.yml
index 05d60431346..8a0e0aa2b06 100644
--- a/packages/cli/src/public-api/v1/handlers/community-packages/spec/schemas/installCommunityPackageRequest.yml
+++ b/packages/cli/src/public-api/v1/handlers/community-packages/spec/schemas/installCommunityPackageRequest.yml
@@ -8,3 +8,8 @@ properties:
   version:
     type: string
     description: Specific semver version to install
+  verify:
+    type: boolean
+    description: >
+      Whether to verify the package against the n8n-vetted package list.
+      Required when the instance has N8N_UNVERIFIED_PACKAGES_ENABLED=false.