1122 Commits
Author SHA1 Message Date
zeekay 8670ff6033 Document flow's API under /v1
Claude-Session: https://claude.ai/code/session_011i2AG9nwpiKUCVxAdDzYuU
2026-09-29 18:34:39 -07:00
zooqueenandHanzo Dev 6b38664be3 Home page names the Hanzo Discord and skips the disabled store
The Discord invite and member count pointed at EqksyE2EX9, the upstream
Langflow server; they now use CJCyAsm9Vr, the Hanzo server, in the UI, the
startup banner and the docs site.

The app fetched /v1/store/tags on every load although the store UI is
off, and the store host does not resolve, so each load logged four 500s.
The query now runs only when ENABLE_FLOW_STORE is on.

The welcome logo was offset onto the heading; it now sits above it.

Co-authored-by: Hanzo Dev <[email protected]>
2026-09-15 12:35:21 -07:00
zeekay 8fd0d79ead feat(docs): self-host Zen instead of Geist from Google 2026-08-23 15:04:14 -07:00
zooqueen 33d69aaac5 the bundle page describes Hanzo Datastore
The reference link pointed at clickhouse.com under a Hanzo Datastore label.
docs.hanzo.ai/docs/datastore answers 200.

The slug stays: it is a published URL. versioned_docs are frozen snapshots of
what those releases shipped.
2026-08-14 19:34:22 -07:00
zeekayandHanzo Dev 48990a63bd Point every Discord invite at the current Hanzo server (discord.gg/CJCyAsm9Vr)
Co-authored-by: Hanzo Dev <[email protected]>
2026-08-04 21:47:02 -07:00
zeekayandHanzo Dev 5f360f4132 ci: publish the storybook through our own Sites plane; delete three foreign ones
Three site deploys in this repo published to planes that are not ours.

deploy-storybook.yml handed src/frontend/storybook-static to
actions/deploy-pages. It is a real static site, so it moves:
.hanzo/workflows/storybook.yml builds the export, POSTs
/v1/projects/flow-storybook/deploy, syncs the bytes straight to the S3 prefix
cloud names in the 202, then flips the deployment live — and marks it error if
the run dies after enqueueing, so cloud never records a deployment as "queued"
forever. Modelled on hanzoai/hips. It runs on hanzo-build-linux-amd64, a label
the forge runners actually advertise; a label nothing answers does not fail, it
queues silently until the 24h timeout.

This is a SEPARATE file from .hanzo/workflows/deploy.yml on purpose. That one
builds and pushes ghcr.io/hanzoai/flow — the App the operator runs. An App is a
container the cluster executes, a Site is bytes S3 serves; folding a docs
publish into an image build would couple it to a deployable release.

deploy_gh-pages.yml pushed docs/ to a gh-pages branch via
peaceiris/actions-gh-pages, and deploy-docs-draft.yml published per-PR docs
previews to an AWS S3 bucket behind CloudFront on upstream's account
(DOCS_AWS_ACCESS_KEY_ID, DOCS_DRAFT_CLOUD_FRONT_DISTRIBUTION_ID). Both are gone
with no native replacement, because this repo is not where these docs live:
hanzoai/docs carries them at apps/flow, and standing a second site up here would
be a second source of truth for one set of pages. docs/static/CNAME
(docs.flow.org) and docs/static/.nojekyll go with them — Pages artifacts that
mean nothing to S3.

The docs tree also shipped three third-party trackers: a Google gtag
(G-SLQFLQ3KPT), the consent-mode + TrustArc scripts feeding it, and a Segment
plugin reading SEGMENT_PUBLIC_WRITE_KEY. All removed, along with
@docusaurus/plugin-google-tag-manager, @mendable/search and
docs/src/plugins/segment. Telemetry goes to our own bus or nowhere.

Analytics on the storybook is the ONE hosted tag (cloud apps/analytics/tag.go)
posting to POST /v1/event. Its key is read from the project this run deploys, so
pk- rotation is one server-side change rather than five repo edits, and no key
means no tag: a keyless beacon is accepted 200 into $public, a tenant this org
cannot read.

Every other workflow stays. They are release, image-build, lint and test lanes,
not deploy planes.

Co-authored-by: Hanzo Dev <[email protected]>
2026-08-04 18:25:55 -07:00
zeekayandHanzo Dev 1ce238f12f build: migrate tsconfig to TypeScript 7 (native compiler)
TypeScript 7 is the native Go compiler and removes `baseUrl` and
`moduleResolution: node|node10`. Both appear here, so `tsc` from TS7
refuses the config outright (TS5102 / TS5108) and cannot typecheck.

`paths` targets resolve relative to `baseUrl` when it is set and relative
to the tsconfig file otherwise. Every `baseUrl` folded here already
pointed at the config's own directory, so dropping it moves nothing and
the targets are left byte-identical. Where a baseUrl pointed elsewhere,
each affected target was rewritten as join(baseUrl, target).

`moduleResolution` was chosen from the declared `module`: commonjs ->
node16, esnext/preserve -> bundler. Configs whose `module` is unset or
exotic were left alone rather than guessed at.

The result is accepted by BOTH toolchains, so nothing has to upgrade
TypeScript in lockstep. Verified on hanzo/chat packages/api: tsc 5.9
779 -> 778 errors (no regression), and tsc 7.0.2 now runs the project
in 2s where it previously refused the config.

Co-authored-by: Hanzo Dev <[email protected]>
2026-07-27 17:09:54 -07:00
zeekay a270a374f0 refactor(rebrand): unify hanzoflow -> hanzo-flow (pkg) / flow (module,cmd) / FLOW_ (env)
Cleaned the concurrent session's half-rebrand inconsistency (166 files):
- pip/pypi refs hanzoflow -> hanzo-flow (matches hanzo-flow-base/sdk)
- module paths/commands/devcontainer hanzoflow -> flow (the import name + CLI)
- env vars HANZOFLOW_ -> FLOW_ (was inconsistent with the LANGFLOW_->FLOW_ sweep)
- fixed a stale src/backend/base/hanzoflow/ path that didn't exist
- product display HanzoFlow -> 'Hanzo Flow' in docs; kept HanzoFlow only as a
  code identifier where a space is illegal

Canonical: pip install hanzo-flow / import flow / `flow` CLI. compileall clean.
2026-07-16 10:26:22 -07:00
zeekay 94741a8363 refactor(rebrand): sweep the remaining langflow — env vars, identifiers, stragglers
Completes the rebrand per direction: LANGFLOW_/LANGFLOW -> FLOW_/FLOW (env vars,
headers), langflow_ -> flow_ (settings fields, local vars), camelCase identifiers
(LangflowClient/Logo/HTTPError, builtWithLangflow, getLangflowDesktop) -> Flow*,
and all remaining bare tokens. Fixed the identifier-space hazard (Langflow ->
'Hanzo Flow' is prose-only; in code it collapses to Flow so no identifier gains a
space). compileall of flow + lfx is clean.

Repo-wide langflow now = 4, all the protected MIT attribution to langflow-ai/
langflow in README (legally required; deliberately preserved).

Breaking (per no-backwards-compat / forward-perfection): the LANGFLOW_* env-var
prefix is now FLOW_* — deployments must update their env. CI's uv + frontend
build is the runtime gate.
2026-07-16 10:18:53 -07:00
zeekay d650dd60f0 refactor(rebrand): langflow->flow across docs, starter-project data, CI, tests
Docs corpus (Langflow->Hanzo Flow, upstream URLs langflow-ai/langflow->hanzoai/
flow, docs.langflow.org->docs.hanzo.ai), starter-project template help-URLs, CI
workflows, and test files. Remaining 'langflow' repo-wide is now dominated by
LANGFLOW_* env-var names + langflow_ settings fields — the config-boundary layer
deliberately preserved pending a coordinated FLOW_/HANZO_ alias-with-fallback
(renaming them blind breaks every deployment).
2026-07-16 10:00:51 -07:00
zeekay 88e4947893 refactor(rebrand): finish langflow->flow module rebrand — migrate unique code, repoint all imports
The concurrent rebrand left src/backend/base/langflow alive with 34 UNIQUE
unmigrated files (a flow_events service, the WatsonX-Orchestrate deployment
adapter, the flow_version_deployment_attachment DB model + tests) that flow/
never received, plus 152 files still importing `langflow` and 137 more with
`langflow.<mod>` string module paths (import_module/monkeypatch targets).

- Migrated all 34 unique files langflow/ -> flow/ at matching paths (dropped
  langflow/api/v1/__init__.py, superseded by flow/'s).
- Deleted the emptied src/backend/base/langflow package.
- Repointed every `from langflow`/`import langflow` (152 files) and every
  `langflow.<mod>` string path (137 files) to `flow`.

Verify: 0 `from/import langflow` and 0 `langflow.` module refs remain in *.py;
compileall of src/backend/base/flow + src/lfx/src parses clean. Runtime import
resolution + the uv test suite is the CI gate (the module tree is now internally
consistent: every moved model/service resolves under flow/).

Remaining (follow-on commits): runtime identifier strings (MCP server names),
the langflow-base/langflow-sdk distribution names, and the docs corpus.
2026-07-16 10:00:50 -07:00
zeekay 488de4eb05 merge: upstream/main (sync, brand preserved)
# Conflicts:
#	.github/workflows/docs-update-openapi.yml
#	AGENTS.md
#	AGENTS.md~upstream_main
#	CLAUDE.md
#	CLAUDE.md~upstream_main
#	docker_example/docker-compose.yml
#	src/backend/base/flow/agentic/flows/TranslationFlow.json
#	src/backend/base/flow/agentic/flows/langflow_assistant.py
#	src/backend/base/flow/agentic/helpers/code_security.py
#	src/backend/base/flow/agentic/helpers/input_sanitization.py
#	src/backend/base/flow/agentic/helpers/streaming_retry.py
#	src/backend/base/flow/alembic/versions/8255e9fc18d9_add_name_to_deployment_provider_account.py
#	src/backend/base/flow/alembic/versions/a1b2c3d4e5f6_convert_provider_key_and_deployment_.py
#	src/backend/base/flow/alembic/versions/c0d2ce43b315_add_flow_version_deployment_attachment_.py
#	src/backend/base/flow/alembic/versions/d306e5c17c41_add_api_key_hash_column_to_apikey_table.py
#	src/backend/base/flow/alembic/versions/ef4b036b585d_add_session_metadata_column_to_message_.py
#	src/backend/base/flow/api/utils/flow_utils.py
#	src/backend/base/flow/api/utils/zip_utils.py
#	src/backend/base/flow/api/v1/flow_events.py
#	src/backend/base/flow/api/v1/flows_helpers.py
#	src/backend/base/flow/api/v1/mappers/__init__.py
#	src/backend/base/flow/api/v1/mappers/deployments/RULES.md
#	src/backend/base/flow/api/v1/mappers/deployments/__init__.py
#	src/backend/base/flow/api/v1/mappers/deployments/base.py
#	src/backend/base/flow/api/v1/mappers/deployments/contracts.py
#	src/backend/base/flow/api/v1/mappers/deployments/helpers.py
#	src/backend/base/flow/api/v1/mappers/deployments/registry.py
#	src/backend/base/flow/api/v1/mappers/deployments/sync.py
#	src/backend/base/flow/api/v1/mappers/deployments/watsonx_orchestrate/__init__.py
#	src/backend/base/flow/api/v1/mappers/deployments/watsonx_orchestrate/mapper.py
#	src/backend/base/flow/api/v1/mappers/deployments/watsonx_orchestrate/payloads.py
#	src/backend/base/flow/api/v1/projects_files.py
#	src/backend/base/flow/api/v1/projects_mcp_helpers.py
#	src/backend/base/flow/services/cache/disk.py
#	src/backend/base/flow/services/database/models/deployment/exceptions.py
#	src/backend/base/flow/services/database/models/deployment/guards.py
#	src/backend/base/flow/services/database/models/deployment/orm_guards.py
#	src/backend/base/flow/services/database/models/deployment_provider_account/schemas.py
#	src/backend/base/flow/services/database/models/deployment_provider_account/utils.py
#	src/backend/base/flow/services/tracing/span_sorting.py
#	src/backend/base/flow/tests/api/v1/test_deployment_guard_delete_endpoints.py
#	src/backend/base/flow/tests/services/database/models/deployment/test_deployment_guard_triggers.py
#	src/backend/base/flow/tests/services/database/models/deployment/test_exceptions.py
#	src/backend/base/flow/tests/services/database/models/deployment/test_guards.py
#	src/backend/base/flow/tests/services/database/models/deployment_provider_account/test_utils.py
#	src/backend/base/langflow/api/v1/__init__.py
#	src/backend/tests/unit/agentic/flows/test_langflow_assistant.py
#	src/frontend/Dockerfile
#	src/lfx/src/lfx/base/models/unified_models.py
2026-06-02 10:52:30 -07:00
Eric Hare 6b8935ca4f Merge release-1.9.6 into main 2026-06-02 09:50:54 -07:00
18739d15c6 fix: separate docling chunking dependencies (#13411)
* separate docling chunking

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* fix nitpicks

* [autofix.ci] apply automated fixes

* remove langchain docling dependency

* add docling image description as an optional dep

* [autofix.ci] apply automated fixes

* fix line too long

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

---------

Co-authored-by: Hanzo Dev <[email protected]>
2026-05-29 15:33:49 -03:00
Eric Hare 394d3e7fa8 Merge release-1.9.4 into main
# Conflicts:
#	.secrets.baseline
#	src/lfx/src/lfx/_assets/component_index.json
#	src/lfx/src/lfx/services/settings/base.py
2026-05-27 08:43:43 -07:00
Adam AghiliandAdam-Aghili 1e764f3867 chore: remove dup doc line 2026-05-26 10:59:31 -04:00
Adam AghiliandAdam-Aghili 9856ca9e1a chore: port Remove the diskcache dependency
port of https://github.com/langflow-ai/langflow/pull/12953
2026-05-26 10:59:31 -04:00
Gabriel Luiz Freitas AlmeidaandGitHub 2985af2735 docs: rewrite AGENTS.md as hub with topical project philosophy docs (#13038)
Splits monolithic agent instructions into a slim AGENTS.md hub plus
docs/agents/ topic files (philosophy, architecture, components, contracts,
testing, anti-patterns) so AI coding agents have a single source of truth
for how the project thinks. Removes the .cursor/rules/ directory; AGENTS.md
is now the only agent-facing doc.

Fixes the long-standing pointer to the empty src/backend/base/langflow/components/
stubs (real components live in src/lfx/src/lfx/components/) and corrects
the v2 API description from 'future' to its actual mounted state.
2026-05-18 21:46:08 +00:00
Eric Hare 7c16ba42e9 fix: pin postgres image to bookworm in docker_example (#13027)
* fix: pin postgres image to bookworm in docker_example to prevent collation mismatch

The postgres:16 tag silently moved its base from Debian Bookworm
(glibc 2.36) to Trixie (glibc 2.41), causing a recurring collation
version mismatch warning on existing langflow-postgres volumes.

Pin to postgres:16-bookworm in both docker-compose files and update
the README so existing data volumes keep matching the OS locale data.

Refs: https://github.com/langflow-ai/langflow/issues/9608

* docs: pin postgres image to bookworm in current docs compose snippets

Mirror the docker_example pin in the four current docs that publish
copyable Compose snippets pairing postgres:16 with a persistent
langflow-postgres volume. Prevents the same Bookworm-to-Trixie
collation version mismatch warning when users follow docs instead
of docker_example.

Versioned historical docs are left as-is.

Refs: https://github.com/langflow-ai/langflow/issues/9608

* fix: switch postgres pin from bookworm to trixie for OS consistency

Aligns the pinned postgres base with the langflow runtime image, which
moved to Debian Trixie in #12990. Keeping postgres on bookworm would
have diverged the stack and locked the database to an aging glibc that
will receive fewer security backports as bookworm ages into oldstable.

The pin itself still solves the original bug — postgres:16 cannot
silently roll its OS underneath an existing volume.

Document the one-time REFRESH COLLATION VERSION step for users
upgrading from a bookworm-initialized volume in docker_example/README.md.

Refs: https://github.com/langflow-ai/langflow/issues/9608
(cherry picked from commit 6c83bb0630051f82a2e920650e9f7c8d49bc2862)
2026-05-07 19:39:49 +00:00
Mendon KisslingandGitHub 2e5f415845 docs: SSRF protection enabled by default (#13106)
docs-ssrf-protection-enabled-by-default
2026-05-13 11:30:37 -04:00
9ce3e106d1 fix: update security dependencies (#13053)
* chore: update security dependencies

- Update brace-expansion to ^5.0.5 in docs
- Update picomatch to ^4.0.4 in docs
- Update ip-address to ^10.1.1 in frontend
- Update GitPython to >=3.1.48 in backend
- Add protobuf constraint >=6.33.6,<7.0.0 in backend

* chore: address additional CVEs and add security documentation

- Update lodash from deprecated 4.18.0 to 4.17.21
- Add docs/SECURITY_OVERRIDES.md documenting all CVEs
- Revert mem0ai 2.x upgrade due to compatibility issues

* fix: update dependencies to address CVE vulnerabilities

- Update langchain-core to >=1.3.3 (fixes CVE-2026-44843)
- Update GitPython to >=3.1.50 (partially fixes CVE-2026-44243, CVE-2026-44244, GHSA-mv93-w799-cj2w)
- Update pyarrow constraint to >=23.0.1,<24.0.0 (fixes CVE-2026-25087)
- Add override-dependencies for transitive packages:
  - lxml >=6.1.0 (fixes CVE-2026-41066)
  - mako >=1.3.12 (fixes CVE-2026-44307)
  - urllib3 >=2.7.0 (fixes CVE-2026-44431, CVE-2026-44432)
  - python-liquid >=2.2.0 (fixes CVE-2026-45017)

Total: 9 CVEs addressed
Smoke tests: All imports successful, no breaking changes detected

---------

Co-authored-by: Janardan S Kavia <[email protected]>
2026-05-12 13:09:53 -04:00
Mendon KisslingandGitHub 4d606a62bc docs: add telemetry for deployments endpoints (#12922)
* docs-add-telemetry-for-deployments-endpoints

* peer-review
2026-04-30 13:47:32 +00:00
39740a2915 docs: wxo deployment is behind feature flag (#12937)
* docs-add-release-note-and-tip-for-wxo-feature-flag

* remove-unnecessary-information-from-1.10

* Apply suggestions from code review

Co-authored-by: April I. Murphy <[email protected]>

---------

Co-authored-by: April I. Murphy <[email protected]>
2026-04-29 20:52:40 +00:00
Eric Hare 0b43e416d6 fix(security): default WEBHOOK_AUTH_ENABLE to True (#12845)
* fix(security): default WEBHOOK_AUTH_ENABLE to True (unauth webhook execution)

POST /api/v1/webhook/{flow_id} previously executed any user's flow
without authentication because WEBHOOK_AUTH_ENABLE defaulted to False.
Change the default to True so webhook endpoints require an API key and
validate that the caller owns the flow being executed. Operators who
need the prior behavior can explicitly opt in with
LANGFLOW_WEBHOOK_AUTH_ENABLE=False.

Docs updated to reflect the new secure-by-default behavior.

* test(security): add regression tests for WEBHOOK_AUTH_ENABLE default

Guard against a regression of the unauthenticated webhook execution fix:
one test pins the class-level default to True, the other confirms the
runtime config rejects an unauthenticated POST with 403 under defaults.

(cherry picked from commit 62a6fea1ebd47e64f82cfab22760941f54f8043c)
2026-04-23 17:49:53 -07:00
Mendon KisslingandEric Hare c8c23f5c34 docs: tip for running local ollama models (#12840)
add-tip-about-running-large-models-locally

(cherry picked from commit 94c6649ba382c7df9669f9867a6f68c367f9e233)
2026-04-23 17:49:52 -07:00
Mendon KisslingandEric Hare 2de2ae9a3e docs: concatenate and merge options for dataframe operations component (#12835)
concat-and-merge-table-component

(cherry picked from commit c74868f80b7a7b56e7ec633af409c52fae83589c)
2026-04-23 17:49:52 -07:00
Mendon KisslingandEric Hare 93f43561ee docs: clarify trace storage when multiple providers are enabled (#12816)
clarify-trace-storage-with-multiple-providers

(cherry picked from commit dcd03b17f8e7f92fa81d46a8794acdf5a3db7a8a)
2026-04-23 17:49:52 -07:00
Mendon KisslingandEric Hare f0c46ef687 docs: wxo feature (#12677)
* deployment-sidebars-and-release-note

* fix-sidebars-name

* manage-deployments

* add-requests

* clarify-endpoint-difference

* improve-anchors

* Apply suggestions from code review

Co-authored-by: April I. Murphy <[email protected]>

* Apply suggestions from code review

Co-authored-by: Mendon Kissling <[email protected]>

* clarify-menu

* apply-changes-to-next-and-latest

---------

Co-authored-by: April I. Murphy <[email protected]>
(cherry picked from commit 19343df3569f1f670a2e1dc147a2354feadeee9f)
2026-04-23 17:49:52 -07:00
Mendon KisslingandEric Hare ee64c60f06 docs: add multi-model opensearch component (#12799)
add-opensearch-multi-model

(cherry picked from commit d3b9bff732a7ea8752ac4a498f27255aa29a4428)
2026-04-23 17:49:52 -07:00
Mendon KisslingandEric Hare 48032cdcb9 docs: clarify autosaving and versioned flow saving (#12794)
* add-clarification-to-1.9-and-next

* Apply suggestions from code review

Co-authored-by: April I. Murphy <[email protected]>

---------

Co-authored-by: April I. Murphy <[email protected]>
(cherry picked from commit 18a35ae969c2f71c2e10c231b345b75e04a2a22e)
2026-04-23 17:49:52 -07:00
Arek MateusiakandEric Hare ee4530b6e6 feat: Enhance config loading by applying GUNICORN_CMD_ARGS before programmatic options (#12313)
* feat: Enhance config loading by applying GUNICORN_CMD_ARGS before programmatic options

* docs: Add Gunicorn configuration details to environment variables documentation

* Update src/backend/base/langflow/server.py

Co-authored-by: Hanzo Dev <[email protected]>

* Update src/backend/base/langflow/server.py

Co-authored-by: Hanzo Dev <[email protected]>

* add unit test

---------

Co-authored-by: Hanzo Dev <[email protected]>
Co-authored-by: Gabriel Luiz Freitas Almeida <[email protected]>
Co-authored-by: Jordan Frazier <[email protected]>
Co-authored-by: Jordan Frazier <[email protected]>
(cherry picked from commit 37591184362c4b24627a2c663c99bf86f028ade1)
2026-04-23 17:49:51 -07:00
Mendon KisslingandGitHub 4aa379e4c7 docs: release note typo (#12690)
release-note-typo
2026-04-14 13:59:22 +00:00
2523cebbb9 docs: cut version 1.9.0 (#12681)
* version-1.9.0-docs

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

---------

Co-authored-by: Hanzo Dev <[email protected]>
2026-04-14 02:07:01 +00:00
Adam-AghiliandGitHub ee8e7cf537 chore: update deps (#12657)
* chore: update deps

update deps due to sec vuln

* chore: langchain-core>=1.2.28

langchain-core>=1.2.28

* chore: update pypdf

pypdf 6.10

* chore: pyarrow, openai, litellm, mem0ai, toolguard

picomatch, pyarrow, openai, litellm, mem0ai, toolguard

* chore: override litellm

* chore: match base uv.lock to root

* chore: update tool.uv position

update tool.uv position

* chore: langflow-base[complete]>=0.9.0

langflow-base[complete]>=0.9.0

* chore: revert pyarrow

revert pyarrow

* chore: revert "lfx~=0.4.0",

* chore: lfx white space

* chore: remove allow-direct-references = true

* chore: uv lock --upgrade after merge
2026-04-13 23:23:37 +00:00
da9524772b docs: mcp client and other changes (#12627)
* tools-component

* tools-partial-and-release-notes

* mcp-astra-changes

* tutorial-changes

* client-page-and-release-notes

* langflow-mcp-client-for-coding-agents

* fix-links

* Apply suggestions from code review

Co-authored-by: April I. Murphy <[email protected]>

* include-explanation-for-step-4

---------

Co-authored-by: April I. Murphy <[email protected]>
2026-04-13 22:28:05 +00:00
Mendon KisslingandGitHub f8a30b9674 docs: add flow versioning (#12634)
* add-flow-versioning-and-release-note

* add-flow-db-location
2026-04-13 22:20:05 +00:00
Mendon KisslingandGitHub 4667ac99ef docs: generate and bump open API spec to 1.9.0 (#12638)
generate-and-bump-openapi-spec-to-1.9.0
2026-04-13 18:59:43 +00:00
Mendon KisslingandGitHub 74bfb510de docs: components index path env var (#12630)
* env-var

* allowlist-for-custom-components

* clarify-which-wins
2026-04-13 15:06:14 +00:00
Mendon KisslingandGitHub 913d424b08 docs: policies component (#12628)
cleanup-docs-and-add-to-sidebars-and-release-note
2026-04-10 21:27:03 +00:00
Mendon KisslingandGitHub a649a9e46b docs: flow devops toolkit SDK manage multiple environments (#12479)
* flow-devops-sdk-basic-usage

* multiple-environments
2026-04-10 15:56:53 +00:00
3bb1c2169e docs: langflow assistant feature (#12439)
* initial-content

* add-release-note

* move-page-to-flows

* fix-link-error

* table-format

* peer-review

* sidebar-title

* Apply suggestions from code review

Co-authored-by: April I. Murphy <[email protected]>

---------

Co-authored-by: April I. Murphy <[email protected]>
2026-04-10 15:12:24 +00:00
4db6057508 feat: add policies component for tool protection via ToolGuard (#12592)
* feat: add policies component for tool protection via ToolGuard

Reintroduce the policies component from #12564 (originally by @boazdavid).
Adds policy-based tool protection system with business policy enforcement
using ToolGuard, including guard code generation from policy definitions,
support for multiple language models, and enhanced tool metadata.

Adds toolguard>=0.2.4 dependency and click>=8.3.2 override.

* [autofix.ci] apply automated fixes

* Update dependencies for new toolguard

* Update component_index.json

* Update uv.lock

---------

Co-authored-by: DAVID BOAZ <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>
2026-04-09 15:13:20 +00:00
af2d1473a6 Revert: policies component (#12564) (#12585)
* Revert "feat: boazdavid policies component added (#12564)"

This reverts commit 18ff912552.

* [autofix.ci] apply automated fixes

* fix: update component index

* Update uv.lock

---------

Co-authored-by: Hanzo Dev <[email protected]>
2026-04-08 22:59:20 -04:00
18ff912552 feat: boazdavid policies component added (#12564)
* feat: @boazdavid policies component added

* Update component_index.json

* [autofix.ci] apply automated fixes

* Update component_index.json

* Update component_index.json

---------

Co-authored-by: DAVID BOAZ <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>
2026-04-08 21:36:23 +00:00
+20 420fe8e255 chore: merge main into release-1.9.0 (excluding Gemini tool_calling disable) (#12553)
* fix: Fixes Kubernetes deployment crash on runtime_port parsing (#11968) (#11975)

* feat: add runtime port validation for Kubernetes service discovery

* test: add unit tests for runtime port validation in Settings

* fix: improve runtime port validation to handle exceptions and edge cases

Co-authored-by: Gabriel Luiz Freitas Almeida <[email protected]>

* fix(frontend):  show delete option for default session when it has messages (#11969)

* feat: add documentation link to Guardrails component (#11978)

* feat: add documentation link to Guardrails component

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Hanzo Dev <[email protected]>

* feat: traces v0 (#11689) (#11983)

* feat: traces v0

v0 for traces includes:
- filters: status, token usage range and datatime
- accordian rows per trace

Could add:
- more filter options. Ecamples: session_id, trace_id and latency range

* fix: token range

* feat: create sidebar buttons for logs and trace

add sidebar buttons for logs and trace
remove lods canvas control

* fix: fix duplicate trace ID insertion

hopefully fix duplicate trace ID insertion on windows

* fix: update tests and alembic tables for uts

update tests and alembic tables for uts

* chore: add session_id

* chore: allo grouping by session_id and flow_id

* chore: update race input output

* chore: change run name to flow_name - flow_id
was flow_name - trace_id
now flow_name - flow_id

* facelift

* clean up and add testcases

* clean up and add testcases

* merge Alembic detected multiple heads

* [autofix.ci] apply automated fixes

* improve testcases

* remodel files

* chore: address gabriel simple changes

address gabriel simple changes in traces.py and native.py

* clean up and testcases

* chore: address OTel and PG status comments

https://github.com/langflow-ai/langflow/pull/11689#discussion_r2854630438
https://github.com/langflow-ai/langflow/pull/11689#discussion_r2854630446

* chore: OTel span naming convention

model name is now set using name = f"{operation} {model_name}" if model_name else operation

* add traces

* feat: use uv sources for CPU-only PyTorch (#11884)

* feat: use uv sources for CPU-only PyTorch

Configure [tool.uv.sources] with pytorch-cpu index to avoid ~6GB CUDA
dependencies in Docker images. This replaces hardcoded wheel URLs with
a cleaner index-based approach.

- Add pytorch-cpu index with explicit = true
- Add torch/torchvision to [tool.uv.sources]
- Add explicit torch/torchvision deps to trigger source override
- Regenerate lockfile without nvidia/cuda/triton packages
- Add required-environments for multi-platform support



* fix: update regex to only replace name in [project] section

The previous regex matched all lines starting with `name = "..."`,
which incorrectly renamed the UV index `pytorch-cpu` to `langflow-nightly`
during nightly builds. This caused `uv lock` to fail with:
"Package torch references an undeclared index: pytorch-cpu"

The new regex specifically targets the name field within the [project]
section only, avoiding unintended replacements in other sections like
[[tool.uv.index]].

* style: fix ruff quote style

* fix: remove required-environments to fix Python 3.13 macOS x86_64 CI

The required-environments setting was causing hard failures when packages
like torch didn't have wheels for specific platform/Python combinations.
Without this setting, uv resolves optimistically and handles missing wheels
gracefully at runtime instead of failing during resolution.



---------



* LE-270: Hydration and Console Log error (#11628)

* LE-270: add fix hydration issues

* LE-270: fix disable field on max token on language model

---------



* test: add wait for selector in mcp server tests (#11883)

* Add wait for selector in mcp server tests

* [autofix.ci] apply automated fixes

* Add more awit for selectors

* [autofix.ci] apply automated fixes

---------



* fix: reduce visual lag in frontend  (#11686)

* Reduce lag in frontend by batching react events and reducing minimval visual build time

* Cleanup

* [autofix.ci] apply automated fixes

* add tests and improve code read

* [autofix.ci] apply automated fixes

* Remove debug log

---------




* feat: lazy load imports for language model component (#11737)

* Lazy load imports for language model component

Ensures that only the necessary dependencies are required.
For example, if OpenAI provider is used, it will now only
import langchain_openai, rather than requiring langchain_anthropic,
langchain_ibm, etc.

* Add backwards-compat functions

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* Add exception handling

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* comp index

* docs: azure default temperature (#11829)

* change-azure-openai-default-temperature-to-1.0

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* [autofix.ci] apply automated fixes (attempt 3/3)

* [autofix.ci] apply automated fixes

---------



* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* fix unit test?

* add no-group dev to docker builds

* [autofix.ci] apply automated fixes

---------





* feat: generate requirements.txt from dependencies  (#11810)

* Base script to generate requirements

Dymanically picks dependency for LanguageM Comp.
Requires separate change to remove eager loading.

* Lazy load imports for language model component

Ensures that only the necessary dependencies are required.
For example, if OpenAI provider is used, it will now only
import langchain_openai, rather than requiring langchain_anthropic,
langchain_ibm, etc.

* Add backwards-compat functions

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* Add exception handling

* Add CLI command to create reqs

* correctly exclude langchain imports

* Add versions to reqs

* dynamically resolve provider imports for language model comp

* Lazy load imports for reqs, some ruff fixes

* Add dynamic resolves for embedding model comp

* Add install hints

* Add missing provider tests; add warnings in reqs script

* Add a few warnings and fix install hint

* update comments add logging

* Package hints, warnings, comments, tests

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* [autofix.ci] apply automated fixes (attempt 3/3)

* Add alias for watsonx

* Fix anthropic for basic prompt, azure mapping

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* ruff

* [autofix.ci] apply automated fixes

* test formatting

* ruff

* [autofix.ci] apply automated fixes

---------



* fix: add handle to file input to be able to receive text (#11825)

* changed base file and file components to support muitiple files and files from messages

* update component index

* update input file component to clear value and show placeholder

* updated starter projects

* [autofix.ci] apply automated fixes

* updated base file, file and video file to share robust file verification method

* updated component index

* updated templates

* fix whitespaces

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* add file upload test for files fed through the handle

* [autofix.ci] apply automated fixes

* added tests and fixed things pointed out by revies

* update component index

* fixed test

* ruff fixes

* Update component_index.json

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* [autofix.ci] apply automated fixes (attempt 3/3)

* updated component index

* updated component index

* removed handle from file input

* Added functionality to use multiple files on the File Path, and to allow files on the langflow file system.

* [autofix.ci] apply automated fixes

* fixed lfx test

* build component index

---------





* docs: Add AGENTS.md development guide (#11922)

* add AGENTS.md rule to project

* change to agents-example

* remove agents.md

* add example description

* chore: address cris I1 comment

address cris I1 comment

* chore: address cris I5

address cris I5

* chore: address cris I6

address cris I6

* chore: address cris R7

address cris R7

* fix testcase

* chore: address cris R2

address cris R2

* restructure insight page into sidenav

* added header and total run node

* restructing branch

* chore: address gab otel model changes

address gab otel model changes will need no migration tables

* chore: update alembic migration tables

update alembic migration tables after model changes

* add empty state for gropu sessions

* remove invalid mock

* test: update and add backend tests

update and add backend tests

* chore: address backend code rabbit comments

address backend code rabbit comments

* chore: address code rabbit frontend comments

address code rabbit frontend comments

* chore: test_native_tracer minor fix address c1

test_native_tracer minor fix address c1

* chore: address C2 + C3

address C2 + C3

* chore: address H1-H5

address H1-H5

* test: update test_native_tracer

update test_native_tracer

* fixes

* chore: address M2

address m2

* chore: address M1

address M1

* dry changes, factorization

* chore: fix 422 spam and clean comments

fix 422 spam and clean comments

* chore: address M12

address M12

* chore: address M3
 address M3

* chore: address M4

address M4

* chore: address M5

address M5

* chore: clean up for M7, M9, M11

clean up for M7, M9, M11

* chore: address L2,L4,L5,L6 + any test

address L2,L4,L5 and L6 + any test

* chore: alembic + comment clean up

alembic + comment clean up

* chore: remove depricated test_traces file

remove depricated test_traces file. test have all been moved to test_traces_api.py

* fix datetime

* chore: fix test_trace_api ge=0 is allowed now

fix test_trace_api ge=0 is allowed now

* chore: remove unused traces cost flow

remove unused traces cost flow

* fix traces test

* fix traces test

* fix traces test

* fix traces test

* fix traces test

* chore: address gabriels otel coment

address gabriels otel coment latest

---------

Co-authored-by: Olayinka Adelakun <[email protected]>
Co-authored-by: Olayinka Adelakun <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>
Co-authored-by: Ram Gopal Srikar Katakam <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>
Co-authored-by: olayinkaadelakun <[email protected]>
Co-authored-by: Jordan Frazier <[email protected]>
Co-authored-by: cristhianzl <[email protected]>
Co-authored-by: Hamza Rashid <[email protected]>
Co-authored-by: Mendon Kissling <[email protected]>
Co-authored-by: Lucas Oliveira <[email protected]>
Co-authored-by: Edwin Jose <[email protected]>
Co-authored-by: Himavarsha <[email protected]>

* fix(test): Fix superuser timeout test errors by replacing heavy clien… (#11982)

fix(test): Fix superuser timeout test errors by replacing heavy client fixture                                                    (#11972)

* fix super user timeout test error

* fix fixture db test

* remove canary test

* [autofix.ci] apply automated fixes

* flaky test

---------

Co-authored-by: Cristhian Zanforlin Lousa <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>

* refactor(components): Replace eager import with lazy loading in agentics module  (#11974)

Co-authored-by: Hanzo Dev <[email protected]>

* fix: add ondelete=CASCADE to TraceBase.flow_id to match migration (#12002)

* fix: add ondelete=CASCADE to TraceBase.flow_id to match migration

The migration file creates the trace table's flow_id foreign key with
ondelete="CASCADE", but the model was missing this parameter. This
mismatch caused the migration validator to block startup.

Co-authored-by: Hanzo Dev <[email protected]>

* fix: add defensive migration to ensure trace.flow_id has CASCADE

Adds a migration that ensures the trace.flow_id foreign key has
ondelete=CASCADE. While the original migration already creates it
with CASCADE, this provides a safety net for any databases that may
have gotten into an inconsistent state.

* fix: dynamically find FK constraint name in migration

The original migration did not name the FK constraint, so it gets an
auto-generated name that varies by database. This fix queries the
database to find the actual constraint name before dropping it.

---------

Co-authored-by: Hanzo Dev <[email protected]>

* fix: LE-456 - Update ButtonSendWrapper to handle building state and improve button functionality (#12000)

* fix: Update ButtonSendWrapper to handle building state and improve button functionality

* fix(frontend): rename stop button title to avoid Playwright selector conflict

The "Stop building" title caused getByRole('button', { name: 'Stop' })
to match two elements, breaking Playwright tests in shards 19, 20, 22, 25.

Renamed to "Cancel" to avoid the collision with the no-input stop button.

* Fix: pydantic fail because output is list, instead of a dict (#11987)

pydantic fail because output is list, instead of a dict

Co-authored-by: Olayinka Adelakun <[email protected]>

* refactor: Update guardrails icons (#12016)

* Update guardrails.py

Changing the heuristic threshold icons.

The field was using the default icons. I added icons related to the security theme.

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Hanzo Dev <[email protected]>
Co-authored-by: Viktor Avelino <[email protected]>

* feat(ui): Replace Show column toggle with eye icon in advanced dialog                                  (#12028)

Co-authored-by: Hanzo Dev <[email protected]>

* fix(ui): Prevent auto-focus and tooltip on dialog close button (#12027)

* fix: reset button (#12024)

fix reset button

Co-authored-by: Olayinka Adelakun <[email protected]>

* fix: Handle message inputs when ingesting knowledge (#11988)

* fix: Handle message inputs when ingesting knowledge

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* [autofix.ci] apply automated fixes (attempt 3/3)

* Update test_ingestion.py

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Hanzo Dev <[email protected]>

* fix(ui): add error handling for invalid JSON uploads via upload button (#11985)

* fix(ui): add error handling for invalid JSON uploads via upload button

* feat(frontend): added new test for file upload

* feat(frontend): added new test for file upload

* fix(ui): Add array validation for provider variables mapping (#12032)

* fix: LM span is now properly parent of ChatOpenAI (#12012)

* fix: LM span is now properly parent of ChatOpenAI

Before LM span and ChatOpenAI span where both considered parents so they where being counted twice in token counts and other sumations
Now LM span is properly the parent of ChatOpenAI span so they are not accidently counted twice

* chore: clean up comments

clean up comments

* chore: incase -> incase

incase -> incase

* fix: Design fix for traces (#12021)

* fix: LM span is now properly parent of ChatOpenAI

Before LM span and ChatOpenAI span where both considered parents so they where being counted twice in token counts and other sumations
Now LM span is properly the parent of ChatOpenAI span so they are not accidently counted twice

* chore: clean up comments

clean up comments

* chore: incase -> incase

incase -> incase

* design fix

* fix testcases

* fix header

* fix testcase

---------

Co-authored-by: Adam Aghili <[email protected]>
Co-authored-by: Olayinka Adelakun <[email protected]>
Co-authored-by: Olayinka Adelakun <[email protected]>

* fix: Add file upload extension filter for multi-select and folders (#12034)

* fix: plaground - inspection panel feedback (#12013)

* fix: update layout and variant for file previews in chat messages

* fix: update background color to 'bg-muted' in chat header and input wrapper components

* refactor(CanvasControls): remove unused inspection panel logic and clean up code

* fix: remove 'bg-muted' class from chat header and add 'bg-primary-foreground' to chat sidebar

* fix: add Escape key functionality to close sidebar

* fix: playground does not scroll down to the latest user message upon … (#12040)

fix: playground does not scroll down to the latest user message upon sending (Regression) (#12006)

* fixes scroll is on input message

* feat: re-engage Safari sticky scroll mode when user sends message

Add custom event 'langflow-scroll-to-bottom' to force SafariScrollFix back into sticky mode when user sends a new message. This ensures the chat scrolls to bottom even if user had scrolled up, fixing behavior where Safari's scroll fix would remain disengaged after manual scrolling.

Co-authored-by: Deon Sanchez <[email protected]>

* fix: knowledge Base Table — Row Icon Appears Clipped/Cut for Some Ent… (#12039)

fix: knowledge Base Table — Row Icon Appears Clipped/Cut for Some Entries (#12009)

* removed book and added file. makes more sense

* feat: add accent-blue color to design system and update knowledge base file icon

- Add accent-blue color variables to light and dark themes in CSS
- Register accent-blue in Tailwind config with DEFAULT and foreground variants
- Update knowledge base file icon fallback color from hardcoded text-blue-500 to text-accent-blue-foreground

Co-authored-by: Deon Sanchez <[email protected]>

* fix: MCP Server Modal Improvements (#12017) (#12038)

* fixes to the mcp modal for style

* style: convert double quotes to single quotes in baseModal component

* style: convert double quotes to single quotes in addMcpServerModal component

Co-authored-by: Deon Sanchez <[email protected]>

* fix: change loop description (#12018) (#12037)

* fix: change loop description (#12018)

* docs: simplify Loop component description in starter project and component index

* [autofix.ci] apply automated fixes

* style: format Loop component description to comply with line length limits

* fixed component index

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Hanzo Dev <[email protected]>

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Deon Sanchez <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>

* feat: add mutual exclusivity between ChatInput and Webhook components (#12036)

* feat: add mutual exclusivity between ChatInput and Webhook components

* [autofix.ci] apply automated fixes

* refactor: address PR feedback - add comprehensive tests and constants

* [autofix.ci] apply automated fixes

* refactor: address PR feedback - add comprehensive tests and constants

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Janardan S Kavia <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>

* fix: mcp config issue (#12045)

* Only process dict template fields

In json_schema_from_flow, guard access to template field properties by checking isinstance(field_data, dict) before calling .get(). This replaces the previous comparison to the string "Component" and prevents attribute errors when template entries are non-dict values, ensuring only dict-type fields with show=True and not advanced are included in the generated schema.

* Check and handle MCP server URL changes

When skipping creation of an existing MCP server for a user's starter projects, first compute the expected project URL and compare it to URLs found in the existing config args. If the URL matches, keep skipping and log that the server is correctly configured; if the URL differs (e.g., port changed on restart), log the difference and allow the flow to update the server configuration. Adds URL extraction and improved debug messages to support automatic updates when server endpoints change.

---------

Co-authored-by: Ram Gopal Srikar Katakam <[email protected]>

* fix: langflow breaks when we click on the last level of the chain (#12044)

Langflow breaks when we click on the last level of the chain.

Co-authored-by: Olayinka Adelakun <[email protected]>

* fix: standardize "README" title and update API key configuration note… (#12051)

fix: standardize "README" title and update API key configuration notes in 3 main flow templates (#12005)

* updated for README

* chore: update secrets baseline with new line numbers

* fixed test

Co-authored-by: Deon Sanchez <[email protected]>

* fix: Cherry-pick Knowledge Base Improvements (le-480) into release-1.8.0 (#12052)

* fix: improve knowledge base UI consistency and pagination handling

- Change quote style from double to single quotes throughout knowledge base components
- Update "Hide Sources" button label to "Hide Configuration" for clarity
- Restructure SourceChunksPage layout to use xl:container for consistent spacing
- Add controlled page input state with validation on blur and Enter key
- Synchronize page input field with pagination controls to prevent state drift
- Reset page input to "1" when changing page

* refactor: extract page input commit logic into reusable function

Extract page input validation and commit logic from handlePageInputBlur and handlePageInputKeyDown into a shared commitPageInput function to eliminate code duplication.

* fix(ui): ensure session deletion properly clears backend and cache (#12043)

* fix(ui): ensure session deletion properly clears backend and cache

* fix: resolved PR comments and add new regression test

* fix: resolved PR comments and add new regression test

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Hanzo Dev <[email protected]>

* fix: Check template field is dict before access (#12035)

Only process dict template fields

In json_schema_from_flow, guard access to template field properties by checking isinstance(field_data, dict) before calling .get(). This replaces the previous comparison to the string "Component" and prevents attribute errors when template entries are non-dict values, ensuring only dict-type fields with show=True and not advanced are included in the generated schema.

Co-authored-by: Ram Gopal Srikar Katakam <[email protected]>

* fix: hide Knowledge Ingestion component and rename Retrieval to Knowledge Base (#12054)

* fix: hide Knowledge Ingestion component and rename Retrieval to Knowledge Base

Move ingestion component to deactivated folder so it's excluded from
dynamic discovery. Rename KnowledgeRetrievalComponent to
KnowledgeBaseComponent with display_name "Knowledge Base". Update all
exports, component index, starter project, frontend sidebar filter,
and tests.

* fix: update test_ingestion import to use deactivated module path

* fix: skip deactivated KnowledgeIngestion test suite

* [autofix.ci] apply automated fixes

* fix: standardize formatting and indentation in StepperModal component

---------

Co-authored-by: Hanzo Dev <[email protected]>

* fix: Embedding Model Field Stuck in Infinite Loading When No Model Provider is Configured (release-1.8.0) (#12053)

* fix: add showEmptyState prop to ModelInputComponent for better UX when no models are enabled

* style: convert double quotes to single quotes in modelInputComponent

* fixes refresh and kb blocker

* style: convert double quotes to single quotes in ModelTrigger component

* style: convert double quotes to single quotes in model provider components

- Convert all double quotes to single quotes in use-get-model-providers.ts and ModelProvidersContent.tsx
- Remove try-catch block in getModelProvidersFn to let errors propagate for React Query retry and stale data preservation
- Add flex-shrink-0 to provider list container to prevent layout issues

* fix: Close model dropdown popover before refresh to prevent width glitch (#12067)

fix(test): Reduce response length assertions in flaky integration tests (#12057)

* feat: Add PDF and DOCX ingestion support for Knowledge Bases  (#12064)

* add pdf and docx for knowledge bases

* ruff style checker fix

* fix jest test

* fix: Use global LLM in knowledge retrieval (#11989)

Co-authored-by: Hanzo Dev <[email protected]>
Co-authored-by: Cristhian Zanforlin Lousa <[email protected]>
fix(test): Reduce response length assertions in flaky integration tests (#12057)

* fix: Regenerate the knowledge retrieval template (#12070)

* fix: refactor KnowledgeBaseEmptyState to use optimistic updates hook (#12069)

* fix: refactor KnowledgeBaseEmptyState to use optimistic updates hook

* updated tst

* fix: Apply provider variable config to Agent build_config (#12050)

* Apply provider variable config to Agent build_config

Import and use apply_provider_variable_config_to_build_config in the Agent component so provider-specific variable settings (advanced/required/info/env fallbacks) are applied to the build_config. Provider-specific fields (e.g. base_url_ibm_watsonx, project_id) are hidden/disabled by default before applying the provider config. Updated embedded agent code in starter project JSONs and bumped their code_hashes accordingly.

* [autofix.ci] apply automated fixes

* update tests

---------

Co-authored-by: Hanzo Dev <[email protected]>
Co-authored-by: Himavarsha <[email protected]>
Co-authored-by: himavarshagoutham <[email protected]>

* LE-489: KB Metrics calculation batch caculator (#12049)

Fixed metric calculator to be more robust and scalable.

* fix(ui): Correct AstraDB icon size to use relative units (#12137)

* fix(api): Handle Windows ChromaDB file locks when deleting Knowledge Bases (#12132)

Co-authored-by: Hanzo Dev <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>

* fix: Fix image preview for Windows paths in playground (#12136)

Co-authored-by: Hanzo Dev <[email protected]>

* chore: update fastapi dep (#12141)

update fastapi dependency

* fix: Properly propagate max tokens param to Agent (#12151)

* fix: Properly Propagate max_tokens param

* Update tests and templates

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* [autofix.ci] apply automated fixes (attempt 3/3)

---------

Co-authored-by: Hanzo Dev <[email protected]>

* fix: include uv/uvx in runtime Docker image (#12127)

* fix: include uv/uvx in runtime Docker image

add uv/uvx to runtime image so uvx is available in container
i did this for all images which might be too much

* chore: address supply chain attack

addres ram's supply chain attack comment

* chore: upgrade pyproject versions

upgrade pyproject versions

* fix: preserve api key configuration on flow export (#12129)

* fix: preserve api key configuration on flow export


* fix individual component's field

* [autofix.ci] apply automated fixes

* unhide var name

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* fetch relevant provider keys

* update starter projects

* update based on env var

* [autofix.ci] apply automated fixes

* fetch only env variables

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* update starter projects

* fix ruff errors

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* don't remove api keys if chosen by user

* remove redundant code

* [autofix.ci] apply automated fixes

* fix update build config

* remove api keys refactor

* only load values when exists in db

* modify other components

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* Template updates

* [autofix.ci] apply automated fixes

* Component index update

* Fix frontend test

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* preserve var names

* [autofix.ci] apply automated fixes

* update caution for saving api keys

---------

Co-authored-by: Hanzo Dev <[email protected]>
Co-authored-by: Eric Hare <[email protected]>

* Fix: Tweaks override ENV VARIABLES (#12152)

Modified tweak behaviour to be overridable if env variable is set on the GUI.

* fix(mcp): Handle missing config file in MCP client availability detection (#12172)

* Handle missing config file in MCP client availability detection

* code improvements

* [autofix.ci] apply automated fixes

* code improvements review

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Hanzo Dev <[email protected]>

* fix: nightly now properly gets 1.9.0 branch (#12215)

before it was attempting to pull release-notes as letters are alphanumerically after numbers when we sort -V then grab tail
now we only look at branch names that follow the pattern '^release-[0-9]+\.[0-9]+\.[0-9]+$'

* docs: add search icon (#12216)

add-back-svg

* fix: Avoid foreign key violation on span table with topological sort (#12242)

* fix: Topological sort on child spans

* Update test_native_tracer.py

* address review comments

* fix: Disable tool calling for Gemini 3 models (#12238)

* chore: upgrade versions

upgrade pyproject and package.json versions

* feat: Add Windows Playwright tests to nightly builds (#12264)

* feat: Add Windows Playwright tests to nightly builds

- Add windows-latest to typescript_test.yml runner options
- Add shell: bash to all script steps for cross-platform compatibility
- Split Playwright installation into OS-aware steps (Linux uses --with-deps, Windows/macOS/self-hosted don't)
- Fix artifact naming with OS prefix to prevent conflicts: blob-report-${{ runner.os }}-${{ matrix.shardIndex }}
- Split frontend-tests into separate Linux and Windows jobs in nightly_build.yml
- Add ref parameter to all test jobs to checkout code from release branch
- Add resolve-release-branch to needs dependencies
- Update Slack notifications to handle both Linux and Windows test results
- Windows tests are non-blocking (not checked in release-nightly-build condition)
- Update .secrets.baseline with new line number (263 -> 347) for LANGFLOW_ENG_SLACK_WEBHOOK_URL

Fixes LE-566

* fix: Use contains() for self-hosted runner detection

- Replace exact string equality (==, !=) with contains() for substring matching
- Fixes issue when inputs.runs-on is array format: '["self-hosted", "linux", "ARM64", ...]'
- Ensures self-hosted Linux runners correctly skip --with-deps flag

Addresses CodeRabbit feedback on PR #12264

* docs: docling dependencies for langflow desktop and updated Desktop env vars (#12273)

* release-note

* docs-update-docling-page-and-move-release-note

* docs-update-env-file-for-desktop

* Apply suggestions from code review

Co-authored-by: April I. Murphy <[email protected]>
Co-authored-by: Mendon Kissling <[email protected]>

---------

Co-authored-by: April I. Murphy <[email protected]>

* docs: contribute to next release candidate branch and not main (#12247)

docs-contribute-to-rc-not-main

* docs: gemini3 tool calling is temporarily disabled (#12274)

docs-gemini3-toolcalling-disabled

* fix: replace grep -oP with sed for Node.js version extraction in Docker images (#12330)

* fix: replace grep -oP with sed for Node.js version extraction in Docker builds

The grep -oP (PCRE regex) command fails in the python:3.12.12-slim-trixie
Docker base image because PCRE support is not available in the slim variant.

This replaces grep -oP with portable sed -nE in all 5 Dockerfiles and adds
an empty version guard to fail fast with a clear error message instead of
producing a broken download URL.

Fixes the Docker base build failure in the v1.8.2 release workflow.

* fix(docker): remove broken npm self-upgrade from Docker images

Node.js 22.x now bundles npm 11.x which fails when trying to self-upgrade
via 'npm install -g npm@latest' in the slim Docker image. The bundled npm
version is sufficient.

This is the same fix as PR #12309 on release-1.9.0.

* fix: Add ephemeral file upload and credential env fallback (#12333)

Co-authored-by: vjgit96 <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>
fix: replace grep -oP with sed for Node.js version extraction in Docker images (#12330)
fix as PR #12309 on release-1.9.0.

* fix: prevent overwriting user-selected global variables in provider c… (#12329)

* fix: prevent overwriting user-selected global variables in provider c… (#12217)

* fix: nightly now properly gets 1.9.0 branch (#12215)

before it was attempting to pull release-notes as letters are alphanumerically after numbers when we sort -V then grab tail
now we only look at branch names that follow the pattern '^release-[0-9]+\.[0-9]+\.[0-9]+$'

* docs: add search icon (#12216)

add-back-svg

* fix: prevent overwriting user-selected global variables in provider config

Previously, the apply_provider_variable_config_to_build_config function would
automatically overwrite field values with environment variable keys whenever
an env var was present, even if the user had already selected a different
global variable.

This fix adds a check to only auto-set the environment variable if:
- The field is currently empty, OR
- The field is not already configured to load from the database

This preserves user selections while still providing automatic configuration
for new/empty fields.

Added comprehensive unit tests to verify:
- Auto-setting env vars for empty fields
- Preserving user-selected global variables
- Overwriting hardcoded values (expected behavior)
- Skipping when env var is not set
- Applying component metadata correctly

* [autofix.ci] apply automated fixes

* style: use dictionary comprehension instead of for-loop

Fixed PERF403 Ruff style warning by replacing for-loop with dictionary
comprehension in update_projects_components_with_latest_component_versions

* chore: retrigger CI build

* test: improve test coverage and clarity for provider config

- Renamed test_apply_provider_config_overwrites_hardcoded_value to
  test_apply_provider_config_replaces_hardcoded_with_env_var for clarity
- Added test_apply_provider_config_idempotent_when_already_set to document
  idempotent behavior when value already matches env var key
- Removed sensitive value from debug log message to prevent potential
  exposure of API keys or credentials

These changes improve test coverage by documenting the no-op scenario
and enhance security by avoiding logging of potentially sensitive data.

* chore: retrigger CI build

---------

Co-Authored-By: Adam-Aghili <[email protected]>
Co-Authored-By: Mendon Kissling <[email protected]>
Co-Authored-By: Steve Haertel <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>
Co-Authored-By: Eric Hare <[email protected]>

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* [autofix.ci] apply automated fixes (attempt 3/3)

* Update test_unified_models.py

---------

Co-authored-by: Adam-Aghili <[email protected]>
Co-authored-by: Mendon Kissling <[email protected]>
Co-authored-by: Steve Haertel <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>

* chore: version bump and merge 1.8.2 (#12335)

* fix: replace grep -oP with sed for Node.js version extraction in Docker images (#12330)

* fix: replace grep -oP with sed for Node.js version extraction in Docker builds

The grep -oP (PCRE regex) command fails in the python:3.12.12-slim-trixie
Docker base image because PCRE support is not available in the slim variant.

This replaces grep -oP with portable sed -nE in all 5 Dockerfiles and adds
an empty version guard to fail fast with a clear error message instead of
producing a broken download URL.

Fixes the Docker base build failure in the v1.8.2 release workflow.

* fix(docker): remove broken npm self-upgrade from Docker images

Node.js 22.x now bundles npm 11.x which fails when trying to self-upgrade
via 'npm install -g npm@latest' in the slim Docker image. The bundled npm
version is sufficient.

This is the same fix as PR #12309 on release-1.9.0.

* chore: version bump and merge 1.8.2

bump version to 1.8.3, 0.8.3 and 0.3.3
merge changes added to 1.8.2 into 1.8.3

---------

Co-authored-by: vjgit96 <[email protected]>

* fix: disable dangerous deserialization by default in FAISS component … (#12334)

* fix: disable dangerous deserialization by default in FAISS component (#11999)

* fix: disable dangerous deserialization by default in FAISS component

Change the default value of allow_dangerous_deserialization from True
to False to prevent remote code execution via malicious pickle files.

This addresses a security vulnerability where an attacker could upload
a crafted pickle file and trigger arbitrary code execution when the
FAISS component loads the index.

Co-authored-by: Hanzo Dev <[email protected]>

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* fix: set allow_dangerous_deserialization to false in Nvidia Remix starter project and add regression test

- Changed allow_dangerous_deserialization default from true to false in
  Nvidia Remix.json starter project to match the FAISS component security fix
- Added regression tests to ensure the default value does not revert to True

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* fix: skip FAISS test gracefully when langchain_community is not installed

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Hanzo Dev <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>
Co-authored-by: Janardan Singh Kavia <[email protected]>

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Ram Gopal Srikar Katakam <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>
Co-authored-by: Janardan Singh Kavia <[email protected]>

* fix: replace removed Langflow-runner with ubuntu-latest for AMD64 Docker builds

* revert: restore Langflow-runner for AMD64 Docker builds

Runner group has been restored by Chris. Reverting ubuntu-latest back to
Langflow-runner for faster Docker image builds.

* fix(deps): pin tar-fs to >=2.1.4 to fix symlink following vulnerabili… (#12419)

fix(deps): pin tar-fs to >=2.1.4 to fix symlink following vulnerability (#12078)

Adds override for tar-fs in package.json to ensure versions prior to
2.1.4 are never resolved. Addresses CVE in tar-fs <2.1.4 (PVR0686558)
where symlink validation bypass was possible with a crafted tarball.

Co-authored-by: Ram Gopal Srikar Katakam <[email protected]>

* chore: bump versions

bump versions

* fix: Fix shareable playground build events and message rendering (#12421)

Co-authored-by: Hanzo Dev <[email protected]>

* fix: restore langflow-logo-color-black-solid.svg removed in docs release (#12445)

* fix: Cherry-pick nightly SDK build fixes to main (#12491)

* fix: Build and install the langflow-sdk for lfx (fixes nightly) (#12481)

* fix: Build and install the langflow-sdk for lfx

* Publish sdk as a nightly

* Update ci.yml

* Update python_test.yml

* Update ci.yml

* fix: Properly grep for the langflow version (#12486)

* fix: Properly grep for the langflow version

* Mount the sdk where needed

* Skip the sdk

* [autofix.ci] apply automated fixes

* Update setup.py

* fix(docker): Remove broken npm self-upgrade from Docker images (#12309)

* fix: replace grep -oP with sed for Node.js version extraction in Docker builds (#12331)

The grep -oP (PCRE regex) command fails in the python:3.12.12-slim-trixie
Docker base image because PCRE support is not available in the slim variant.

This replaces grep -oP with portable sed -nE in all 5 Dockerfiles and adds
an empty version guard to fail fast with a clear error message instead of
producing a broken download URL.

---------

Co-authored-by: Hanzo Dev <[email protected]>
Co-authored-by: Cristhian Zanforlin Lousa <[email protected]>
Co-authored-by: vjgit96 <[email protected]>

---------

Co-authored-by: Adam-Aghili <[email protected]>
Co-authored-by: Gabriel Luiz Freitas Almeida <[email protected]>
Co-authored-by: keval shah <[email protected]>
Co-authored-by: Antônio Alexandre Borges Lima <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>
Co-authored-by: Olayinka Adelakun <[email protected]>
Co-authored-by: Olayinka Adelakun <[email protected]>
Co-authored-by: Ram Gopal Srikar Katakam <[email protected]>
Co-authored-by: Hanzo Dev <[email protected]>
Co-authored-by: olayinkaadelakun <[email protected]>
Co-authored-by: Jordan Frazier <[email protected]>
Co-authored-by: cristhianzl <[email protected]>
Co-authored-by: Hamza Rashid <[email protected]>
Co-authored-by: Mendon Kissling <[email protected]>
Co-authored-by: Lucas Oliveira <[email protected]>
Co-authored-by: Edwin Jose <[email protected]>
Co-authored-by: Himavarsha <[email protected]>
Co-authored-by: Viktor Avelino <[email protected]>
Co-authored-by: Lucas Democh <[email protected]>
Co-authored-by: Eric Hare <[email protected]>
Co-authored-by: Adam Aghili <[email protected]>
Co-authored-by: Debojit Kaushik <[email protected]>
Co-authored-by: Deon Sanchez <[email protected]>
Co-authored-by: Janardan Singh Kavia <[email protected]>
Co-authored-by: Janardan S Kavia <[email protected]>
Co-authored-by: himavarshagoutham <[email protected]>
Co-authored-by: April I. Murphy <[email protected]>
Co-authored-by: Steve Haertel <[email protected]>
Co-authored-by: Tarcio <[email protected]>
2026-04-08 16:23:41 +00:00
vjgit96andGitHub 2d89869270 docs: investigate deprecated macOS support and impact on Langflow (LE-265) (#12477)
docs: add deprecated macOS support investigation (LE-265)
2026-04-06 22:07:51 +00:00
vjgit96andGitHub 3a13f96488 docs: investigate PyTorch macOS AMD64 + Python 3.13 CI failure (LE-172) (#12469)
* docs: add PyTorch macOS AMD64 + Python 3.13 investigation (LE-172)

Investigate why the experimental CI job fails on macOS x86_64 + Python 3.13.

Root cause: PyTorch dropped macOS Intel wheel builds after v2.2.2 (before
Python 3.13 existed). The altk and langchain-huggingface extras pull in
torch without platform guards, causing installation failures.

Includes analysis of dependency chains, lockfile resolution behavior,
and 4 actionable options (A-D) with tradeoffs for the team to decide on.

* fix: exclude torch-dependent extras on macOS x86_64 (LE-172)

Add platform exclusion markers to altk and langchain-huggingface extras
to prevent torch from being pulled in on macOS Intel where no wheel exists.

This matches the existing pattern used for easyocr and docling extras.
PyTorch dropped macOS x86_64 binary support after v2.2.2, so these
features cannot work on Intel Macs regardless.
2026-04-06 21:52:06 +00:00
ec1dbc1864 feat: Remove deprecated Astra Assistants to support latest docling package versions (#12442)
* feat: Latest docling package versions

* [autofix.ci] apply automated fixes

* Template updates

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* Update uv.lock

* Update uv.lock

* Template update

* Revert the changes to starter projects

* Revert the changes to starter projects

* Update component_index.json

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* Update test_dynamic_import_integration.py

* Update component_index.json

* Restore versioned docs

* Lessen the scope of the version updates

* Update component_index.json

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Hanzo Dev <[email protected]>
2026-04-04 17:53:59 +00:00
1c82ea516c docs: enhance Agentics documentation with embedded video (#12272)
docs: enhance Agentics documentation with embedded video and full paper citations

- Add embedded YouTube tutorial video at the top of the page
- Add introductory text for the video
- Group research papers under Publications section
- Add full academic citations for both Agentics papers
- Remove redundant schema table from introduction
- Improve overall readability and structure

Co-authored-by: Alfio Gliozzo <[email protected]>
Co-authored-by: Mendon Kissling <[email protected]>
2026-04-03 18:54:25 +00:00
Mendon KisslingandGitHub d08a6138b8 docs: Flow DevOps Toolkit SDK (#12472)
* flow-devops-sdk-basic-usage

* peer-review

* shorthand-for-sidebars
2026-04-03 18:42:42 +00:00