chore: unconstrained lfx version for bundles (#13415)

.github/workflows/release_bundles.yml

@@ -65,9 +65,9 @@ jobs:
           done
           echo "bundles-found=1" >> $GITHUB_OUTPUT
           ls -la bundles-dist/
-      # Bundles pin lfx (e.g. lfx>=0.5.0,<0.6.0). The smoke test below
+      # Bundles floor lfx at >=0.5.0 (no upper bound). The smoke test below
       # installs the bundles in a fresh venv, so it needs an lfx wheel that
-      # satisfies the pin available locally — PyPI may not yet have a
+      # satisfies the floor available locally — PyPI may not yet have a
       # matching lfx published when bundles are released ahead of a main
       # release. We build the lfx wheel from the current ref so the smoke
       # test resolves against it; this artifact is not published.

scripts/ci/update_bundle_versions.py

@@ -23,15 +23,15 @@ from pathlib import Path
 BASE_DIR = Path(__file__).parent.parent.parent
 
 # Matches the lfx dep specifier inside a bundle pyproject's dependencies list.
-# Accepts the bundle default ("lfx>=X.Y.Z,<A.B.C"), legacy ~=/==, and the
-# already-rewritten "lfx-nightly==X.Y.Z" form (idempotent).
+# Accepts the bundle default ("lfx>=X.Y.Z" with an optional upper bound),
+# legacy ~=/==, and the already-rewritten "lfx-nightly==X.Y.Z" form (idempotent).
 _LFX_DEP_PATTERN = re.compile(
     r'"lfx(?:-nightly)?'
     r"(?:"
     r"(?:~=|==)[\d.]+(?:\.(?:post|dev|a|b|rc)\d+)*"
     r"|"
     r">=[\d.]+(?:\.(?:post|dev|a|b|rc)\d+)*"
-    r",\s*<[\d.]+(?:\.(?:post|dev|a|b|rc)\d+)*"
+    r"(?:,\s*<[\d.]+(?:\.(?:post|dev|a|b|rc)\d+)*)?"
     r')"'
 )
 

scripts/ci/update_lfx_version.py

@@ -60,8 +60,8 @@ _BUNDLE_LFX_DEP_PATTERN = re.compile(r'"lfx(?:-nightly)?(?=[<>=!~])[^"]*"')
 def update_lfx_dep_in_bundles(lfx_version: str) -> None:
     """Pin every bundle's `lfx` dep to the renamed `lfx-nightly==<version>`.
 
-    Each `src/bundles/*/pyproject.toml` declares an `lfx>=X.Y,<Z` style pin
-    against the published `lfx` package. During nightly builds the
+    Each `src/bundles/*/pyproject.toml` floors its `lfx` dep at `>=X.Y`
+    (no upper bound) against the published `lfx` package. During nightly builds the
     workspace `lfx` package gets renamed to `lfx-nightly`, so those pins
     no longer resolve against the workspace member — and PyPI may not yet
     ship a matching `lfx` either. Rewrite each bundle's pin to

scripts/migrate/port_bundle.py

@@ -86,8 +86,11 @@ keywords = ["langflow", "lfx", "extension", "bundle", "{bundle}"]
 # Runtime deps: lfx (the BUNDLE_API surface) plus any third-party imports
 # the bundle's components rely on.  REVIEW THIS LIST -- the script ports
 # only ``lfx``; add any other deps the moved component(s) import.
+# lfx is floored at >=0.5.0 (the release that introduced extension bundles)
+# with no upper bound so bundles track the latest lfx; BUNDLE_API compat is
+# enforced via extension.json's lfx.compat list, not an upper version cap.
 dependencies = [
-    "lfx>=0.5.0,<0.6.0",
+    "lfx>=0.5.0",
 ]
 
 [project.urls]

src/bundles/PORTING.md

@@ -67,9 +67,13 @@ src/bundles/<bundle>/
 Copy [`src/bundles/duckduckgo/pyproject.toml`](duckduckgo/pyproject.toml) and
 substitute names + the runtime-dep block. The non-obvious bits:
 
-- `dependencies` lists every runtime dep the component imports. Pin `lfx`
-  to a range that covers the `BUNDLE_API_VERSION` you target
-  (currently `>=0.5.0,<0.6.0`).
+- `dependencies` lists every runtime dep the component imports. Floor `lfx`
+  at `>=0.5.0` (the release that introduced extension bundles) with **no
+  upper bound**, so the bundle always resolves the latest available `lfx` —
+  BUNDLE_API compatibility is enforced separately via `extension.json`'s
+  `"lfx": {"compat": [...]}` contract, not an upper version cap. A bundle
+  author *may* tighten this if a component needs a specific newer `lfx`, but
+  the default carries no ceiling.
 - **Platform-gated deps:** if a runtime dep has no wheel on some platform
   (e.g. `ibm-db` ships none for linux/aarch64), gate it with a PEP 508 marker
   so `pip install langflow` still succeeds there, e.g.

src/bundles/arxiv/pyproject.toml

@@ -15,7 +15,7 @@ keywords = ["langflow", "lfx", "extension", "bundle", "arxiv", "search"]
 # but we list it here as a direct runtime dep so the bundle keeps building
 # even if lfx drops it later.
 dependencies = [
-    "lfx>=0.5.0,<0.6.0",
+    "lfx>=0.5.0",
     "defusedxml>=0.7.1,<1.0.0",
 ]
 

src/bundles/duckduckgo/pyproject.toml

@@ -11,11 +11,14 @@ authors = [
 keywords = ["langflow", "lfx", "extension", "bundle", "duckduckgo", "search"]
 
 # Runtime deps: lfx (the BUNDLE_API surface) and the langchain-community
-# binding that wraps the duckduckgo-search Python client.  We pin lfx to a
-# range that includes the BUNDLE_API_VERSION=1 contract; langchain-community
-# is the same range the lfx tree uses to keep co-installation lockstep.
+# binding that wraps the duckduckgo-search Python client.  lfx is floored
+# at >=0.5.0 -- the release that introduced extension bundles -- with no
+# upper bound, so the bundle resolves the latest available lfx; BUNDLE_API
+# compatibility is enforced separately via extension.json's
+# "lfx": {"compat": [...]} contract.  langchain-community uses the same
+# range the lfx tree does to keep co-installation lockstep.
 dependencies = [
-    "lfx>=0.5.0,<0.6.0",
+    "lfx>=0.5.0",
     "langchain-community>=0.4.1,<1.0.0",
     "ddgs>=9.0.0",
 ]

src/bundles/ibm/pyproject.toml

@@ -22,7 +22,7 @@ keywords = ["langflow", "lfx", "extension", "bundle", "ibm", "db2", "watsonx", "
 #   the marker stays in lockstep with the langflow-base dep block.
 # * ``langchain-community`` provides the helpers DB2VS leans on.
 dependencies = [
-    "lfx>=0.5.0,<0.6.0",
+    "lfx>=0.5.0",
     "langchain-community>=0.4.1,<1.0.0",
     "ibm-db>=3.2.9,<4.0.0; sys_platform != 'linux' or platform_machine != 'aarch64'",
     "ibm-watsonx-ai>=1.3.1,<2.0.0; python_version < '3.14'",