* checkout api handlers
* add missing table
* update to use "version" terminology for flows instead of outdated "history" verbage
* Fix provider account id mapping
* recover a little todo comment
* Add flow version migration and minor exception handling, etc
1. deployments.py — Added AuthenticationError import + handling (401) in all 9 error handler blocks. Added update_deployment_db import + call to persist name changes to local DB after adapter update succeeds.
2. flow_version/exceptions.py — Added FlowVersionDeployedError for blocking deletion of deployed versions.
3. flow_version/crud.py —
- Added has_deployment_attachments() helper that checks if a flow version has any deployment attachments
- delete_flow_version_entry() now raises FlowVersionDeployedError if the version is attached to deployments
- Pruning now excludes deployed versions via a NOT IN subquery on FlowVersionDeplottachment, preventing provider-side snapshot orphaning
4. flow_version/__init__.py — Exports FlowVersionDeployedError
5. flow_version.py (API route) — Imported FlowVersionDeployedError, added it to _translate_version_error as 409 Conflict
6. models/__init__.py — Registered FlowVersionDeploymentAttachment for alembic/SQLModel metadata detection
7. Migration c0d2ce43b315 — Creates flow_version_deployment_attachment table with all columns, FKs (CASCADE), and indexes. Single head, chains off fc7f696a57bf.
* [autofix.ci] apply automated fixes
* address bugs and inconsistencies
* rename column to "provider_snapshot_id"
* harden deployment API: fail loudly on invalid state instead of silently passing
Replace silent fallbacks, warning logs, and dropped values with hard
failures (422/500/502) across the deployment orchestration layer. Adds
logging to bare exception handlers and wraps materialize_snapshots in
the adapter error handler.
* [autofix.ci] apply automated fixes
* add materialize_snapshots to deployment service protocol
Promotes materialize_snapshots from duck-typed getattr usage to a
first-class method on DeploymentServiceProtocol, BaseDeploymentService,
and the no-op DeploymentService stub. Introduces MaterializeSnapshotsResult
schema for typed return values.
Updates deployments.py to call the method through the protocol instead of
getattr, giving static analysis coverage over the contract.
Documents the snapshot abstraction across BaseFlowArtifact, SnapshotItem,
MaterializeSnapshotsResult, and FlowVersionDeploymentAttachment.provider_snapshot_id
— explaining that snapshots are immutable, provider-owned copies of flow data
with opaque provider-assigned identifiers (e.g. wxO tool ID, K8s ConfigMap
name, S3 key).
* deployment sync: extract helpers, server-side type filter, orphan detection
- Extract _fetch_provider_resource_keys helper for provider validation
- Rename _sync_page_with_provider → _list_deployments_synced
- Match resource keys by provider ID only (not name)
- Restore server-side deployment_type filter with guard against
false deletions (skip rows whose type doesn't match the filter
instead of deleting them)
- Add orphan/divergence logging for post-create, post-update,
post-duplicate DB write failures
- Return 422 on invalid UUID in update remove list (was silently ignored)
- Handle NotImplementedError → 501 from provider adapters
- Convert attachment IntegrityError to ValueError with descriptive message
- Add tests for sync helpers (15 cases)
* rebase on release-1.9.0 and align with lfx/services
* refactor(deployments): align provider mapper routing and WXO update payload mapping
Align deployment mapper resolution with adapter-type/provider-key routing and
refactor PATCH update handling to use mapper resolve/shape contracts end-to-end.
Map Langflow flow_version_id references at the API boundary into provider update
operations for Watsonx bind/unbind/remove paths, with expanded mapper tests.
* patch down-revision
* first pass with formalized boundary rules
* fix(deployments): harden watsonx payload boundary contracts
Enforce fail-fast payload slot parsing for required adapter results, split execution create/status slot contracts, and route execution-create mapping through deployment mappers.
Require watsonx flow artifact source_ref and move update reconciliation output to provider_result to keep mapper/adapter boundaries explicit and typed.
* refactor(deployments): modularize watsonx orchestrate create/update flow
Extract create/update logic into dedicated core modules with shared helpers to tighten deployment boundary contracts.
Align backend/lfx payload schema mapping and expand e2e/unit coverage for response mapping and update schema behavior.
* api impl for wxo-specific create payload
* further refactoring. add rollback of existing tools (undo new app bindings) in the create path
* add todo in execution.py
* refactor(deployments): replace snapshot_id/reference_id with source_ref-correlated tool refs
Introduce WatsonxToolRefBinding to correlate source_ref (flow version id)
with provider tool_id across all operation types. This replaces the prior
reference_id and snapshot_id fields with a unified structure that carries
provenance through create, bind, unbind, and remove_tool operations.
Key changes:
- Flatten API operation payloads: hoist flow_version_id onto operations,
remove nested WatsonxApiUpdateToolReference wrapper
- Replace tools.existing_ids with inline tool_id_with_ref on bind operations
- Rename WatsonxCreateSnapshotBinding to WatsonxToolRefBinding (input) and
WatsonxResultToolRefBinding (output, with created flag)
- Add created_app_ids to update results for connection tracking
- Raise HTTPException on contract violations in _to_api_tool_app_bindings
instead of silently dropping unmappable bindings
- Add schema-level validation for conflicting source_ref on same tool_id
- E2E: cache tool_id→source_ref from create results, use helpers to build
refs with distinct source_ref vs tool_id values
* Enforce DeploymentType enum and add description column
Make deployment_type a required column backed by a SQLAlchemy
TypeDecorator that validates on write (rejects None and invalid strings)
and coerces to DeploymentType on read. Add nullable description column
to the deployment model and surface it through the API.
Key changes:
- Add _DeploymentTypeColumn TypeDecorator for enum round-trip fidelity
- Make deployment_type non-optional in Deployment model, DeploymentRead,
CRUD functions, and API layer
- Add description (Text, nullable) to Deployment model and fold its
migration into the existing c0d2ce43b315 revision
- Remove _resolve_deployment_type helper — TypeDecorator handles coercion
- Remove DeploymentType fallbacks and backward-compat shims from API
endpoints, base mapper, and watsonx orchestrate mapper
- Document cross-package coupling: DeploymentType is owned by lfx but
persisted by langflow; member values must never be removed
- Fix pre-existing bug: provider_account_id → deployment_provider_account_id
in get_deployment_status endpoint
Note: deployment_type is nullable=True at the DB level to satisfy the
EXPAND-phase migration validator; NOT NULL is enforced at the application
layer by the _DeploymentTypeColumn TypeDecorator.
* refactor(deployments): extract route helpers, harden sync and error handling
Move bulk of deployment route logic into mappers/helpers layer to slim
down deployments.py and enforce clearer boundary between routes, mappers,
and adapters (documented in DEPLOYMENT_BOUNDARY_RULES.md).
Key changes:
- Extract ~700 lines from deployments.py into helpers.py (pagination,
adapter/mapper resolution, attachment management, snapshot sync,
rollback, response shaping)
- Add read-path snapshot-level sync: get_deployment and
list_deployments_synced verify provider_snapshot_ids against the
provider and prune stale attachments, with graceful fallback on error
- Add compensating rollback for create (rollback_provider_create) and
update (rollback_provider_update) when DB commit fails after provider
mutation, using mapper-driven payload reconstruction
- Introduce handle_adapter_errors() context manager centralising
DeploymentServiceError → HTTP status mapping via
http_status_for_deployment_error; sanitise 500 detail to avoid
leaking internals
- Add DeploymentNotConfiguredError → 503 mapping
- Add util_snapshot_ids_to_verify and resolve_rollback_update to base
mapper with WxO overrides for provider-specific snapshot ID extraction
and put_tools-based rollback payloads
- Add put_tools field to WatsonxDeploymentUpdatePayload for full tool
list replacement; early-return in build_provider_update_plan and
validate_operation_references when put_tools is set
- Extract verify_tools_by_ids into core/tools.py helper
- Harden resource_name_prefix with strip_whitespace + min_length=1
- Deduplicate snapshot_ids before provider calls
- Add deterministic order_by(created_at) to attachment CRUD queries
- Add exc_info=True to all best-effort rollback/compensate error logs
- Add session.rollback() in get_deployment snapshot sync error path
- Warn when list_snapshots receives both deployment_ids and snapshot_ids
- Add E2E scenarios for empty snapshot list, mixed snapshot IDs, tools
endpoint, and deployment re-list after update
Tests:
- Add test_deployment_route_handlers.py covering stale-row delete +
commit, non-404 adapter errors, handle_adapter_errors wiring,
snapshot sync (happy path, skip, error fallback), project-scoped
flow version validation for create and update
- Expand test_deployment_sync.py with snapshot-phase tests, rollback
tests, pagination guard, and project-scoped validation
- Add deployment_type assertion to response mapping test
- Add DeploymentNotConfiguredError and bare DeploymentServiceError cases
to exception mapping tests
- Add put_tools schema and update plan tests
* remove pompous performance commentary
* fix(deployments): remove upsert behavior and fail fast on duplicate name
The create_deployment endpoint previously performed a
get_deployment_by_resource_key lookup before inserting the DB row,
silently tolerating duplicates. Since the provider adapter returns a
fresh resource ID on every create, this lookup could never legitimately
match — and if it did, it would mask a data inconsistency bug.
Changes:
- Remove the get-or-create (upsert) pattern; go straight to
create_deployment_db and let the unique constraint surface conflicts.
- Add deployment_name_exists CRUD function and an early 409 guard so
duplicate names are rejected before any provider call, avoiding
costly provider-side rollback for a locally-checkable condition.
- Update existing route-handler tests to reflect the removed lookup.
- Add tests for deployment_name_exists and the 409 duplicate-name path.
* feat: convert provider_key and deployment_type columns to DB-level enums
Replace plain string columns with SQLAlchemy Enum types backed by
Postgres/SQLite enum constraints, enforcing valid values at the DB
layer rather than only in application code.
Migration follows expand-contract pattern (add enum column, backfill,
drop old string column, rename) with index ops outside batch context
to avoid SQLite column-lookup issues. Upgrade and downgrade are fully
atomic.
- Add DeploymentProviderKey enum as single source of truth for
provider identifiers; remove magic strings and _DeploymentTypeColumn
TypeDecorator
- Make provider_key immutable after creation (remove from update
request schema and API handler)
- Fix pre-existing test gap: add missing deployment_type argument to
all TestDeploymentCRUD create_deployment() calls
* feat(flow-versions): add deployment awareness and sync-on-read
Add is_deployed field to flow version responses and provider-verified
sync to the list/get read paths, matching the existing deployment
endpoint sync pattern.
API changes:
- list_flow_versions returns is_deployed per entry and accepts optional
deployment_ids filter to scope by specific deployments
- get_single_flow_version returns is_deployed on the full response
- Both endpoints now use write sessions and run best-effort
snapshot-level sync before returning results
Sync-on-read (helpers.sync_flow_version_attachments):
- Queries all attachments for a flow's versions joined with deployment
and provider account info in a single query
- Groups by provider, resolves adapter/mapper per group, verifies
provider_snapshot_ids via list_snapshots, and prunes stale attachment
rows through the existing sync_attachment_snapshot_ids helper
- Per-provider error handling so one provider outage doesn't block the
response
New CRUD: list_attachments_for_flow_with_provider_info joins
FlowVersionDeploymentAttachment -> Deployment -> DeploymentProviderAccount
to avoid N+1 queries during sync grouping.
Tests: 50 passing (11 new) covering is_deployed indicator, deployment_ids
filtering, stale attachment pruning on list/get, and sync failure
resilience.
* Add user id authentication to a few missing endpoints
* [autofix.ci] apply automated fixes
* Update tests
Removes some mock tests that did nothing
Adds sqlite for true testing of db accessors
Reduces Mock objects usage
* refactor(deployments): enforce ownership boundaries on execution responses
Move provider-owned execution identifiers (execution_id, agent_id,
status, timestamps, errors) out of the top-level API response and into
provider_data, keeping only Langflow-owned fields (deployment_id) at the
top level. This prevents future collisions if Langflow introduces its
own execution tracking.
Key changes:
- Remove execution_id from _ExecutionResponseBase; provider's opaque
run identifier now lives exclusively inside provider_data
- Rename WatsonxExecutionResultData → WatsonxAgentExecutionResultData
(adapter layer) and split the API-layer class into a private base
(_WatsonxApiAgentExecutionResultBase) with dedicated
WatsonxApiAgentExecutionCreateResultData and
WatsonxApiAgentExecutionStatusResultData subclasses
- Translate WXO run_id → execution_id at the adapter boundary
(create_agent_run_result / get_agent_run).
- Collapse util_execution_id + util_execution_deployment_resource_key
into a single util_resource_key_from_execution that trusts the
adapter-provided result.deployment_id directly
- Remove build_orchestrate_runs_query and extra payload fields
(thread_id, llm_params, guardrails, etc.) unused in MVP
- Simplify WxOClient.post_run signature (drop query_suffix)
- Exclude provider_data from flow tool artifact to avoid unexpected
top-level keys in the WxO tool runtime
- Document ownership boundary rules in DEPLOYMENT_BOUNDARY_RULES.md §14
- Add E2E polling for terminal execution status, input format variants,
and missing-deployment negative test
- Expand unit tests for renamed schemas, field mapping, passthrough
validation, and simplified payload builder
* feat: add name column to deployment_provider_account
Add a required, user-chosen display name to provider accounts
(e.g. "staging", "prod") that is unique within a given provider_key.
Includes model, CRUD, API schema/route, mapper, migration with
backfill, and tests.
* fix: replace hand-written migration with Alembic-generated revision
Replace the manually authored migration (b4e6f8a2c1d3) with an
Alembic-generated one (8255e9fc18d9) for the deployment_provider_account
name column.
Fix SQLite compatibility: sa.func.concat() generates a concat() function
call which does not exist in SQLite. Use sa.literal().concat() instead,
which produces the || operator and works on both PostgreSQL and SQLite.
* remove bogus unverified math from migration file
* feat: verify provider credentials before account creation
Add a verify_credentials step to the provider account creation flow
that validates API keys against the provider before persisting them.
This prevents storing invalid or revoked credentials and gives users
immediate feedback.
Key changes:
- Add verify_credentials to the deployment adapter interface (base,
service, protocol) with WXO implementation that obtains a token
via the IBM authenticator
- Add SSRF-hardened URL validation for provider_url (HTTPS-only,
private IP blocklist, localhost rejection, normalization)
- Introduce ValidatedUrl/ValidatedUrlOptional annotated types in
the API schema layer
- Refactor raise_for_status_and_detail to accept an optional cause
parameter for explicit exception chain control
- Use ResourceNotFoundError (parent) instead of DeploymentNotFoundError
in raise_for_status_and_detail for provider-agnostic 404 mapping
- Narrow get_authenticator return type to concrete union
* use whitelist only for valid urls
* feat: BREAKING: move credentials into provider_data and centralize update logic in mapper
- Replace top-level `api_key: SecretStr` with opaque `provider_data: dict` in API schemas;
mapper extracts credentials via `resolve_credential_fields` for DB storage
- Add `resolve_provider_account_update` to base mapper so routes delegate
full update-kwargs assembly (including cross-field logic) to the mapper
- WXO mapper override re-derives `provider_tenant_id` when `provider_url` changes
- Add tenant extraction utilities and `validate_tenant_url_consistency` in
`deployment_provider_account/utils.py` as single source of truth
- Add `model_validator` on `DeploymentProviderAccount` for defense-in-depth
tenant/URL consistency checks
- Rename `DEPLOYMENT_BOUNDARY_RULES.md` → `RULES.md`; document DB-direction
mapper contract, credential flow, and update assembly
- Update all tests for new `provider_data` shape, mapper update methods,
tenant extraction, and model-level consistency validation
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix(deployments): Harden provider account validation and WXO rollback
Use provider_url when resolving WXO credentials and scope provider account names per user within each provider. Re-verify provider account updates before persisting them and return 4xx responses for account conflicts instead of surfacing 500s.
Block deleting provider accounts that still own deployments and extend create rollback so failed WXO writes clean up provider-side resources. Add route, schema, mapper, sync, CRUD, and WXO tests to cover the new behavior.
* [autofix.ci] apply automated fixes
* update url validator docs; remove outdated reference to private url blacklist logic
* fix(deployments): Isolate snapshot sync writes
Use nested transactions around best-effort snapshot cleanup so provider sync failures cannot leak partial attachment deletes into the outer request transaction.
Persist explicit description clears during deployment PATCH requests, and add regression tests for both deployment sync paths and the route handler update flow.
* fix(deployments): Harden delete cleanup and wxO create tests
Treat missing provider agents as stale local cleanup so delete can
finish instead of leaving orphaned deployment rows behind.
Commit local delete operations eagerly, retry once on commit failure,
and move wxO create-path tests toward fake client objects so the real
service logic is exercised without external calls.
* new head
* fix(deployments): stop prefixing wxo raw connection app_ids
Preserve caller app_ids for newly created wxo connections while keeping lf_ prefixing for tool/deployment naming, centralize resource_name_prefix validation, and update mapper/service schema tests and docs to reflect the new behavior.
* fix(deployments): Harden provider account cleanup
Reconcile stale deployment rows before provider-account deletion so
out-of-band provider removals do not leave account cleanup blocked.
* fix: restore py310 compatibility and align payload slot tests
Import Self from typing_extensions in the deployment provider account model to keep backend imports working on Python 3.10, and update payload formalization tests to assert strict rejection of cross-model BaseModel inputs.
* fix(deployments): resolve mypy typing regressions across deployment flows
Normalize SQLModel query expressions for typed SQL operators, make deployment-related model IDs non-nullable where appropriate, and tighten provider mapper/update typing guards. Update deployment tests to align with stricter type contracts.
* fix(deployments): restore py310 test compatibility and migration idempotency
Replace Python 3.11-only UTC imports with timezone.utc in deployment-related tests and the watsonx e2e helper, and make the provider-account name migration safe to re-run when the column and unique constraint are created in separate steps.
* fix(deployments): restore provider account route ownership helpers
Reuse the shared provider-account lookup in update/delete routes so route tests keep the expected ownership path, and use the explicit-field helper when deciding whether to reverify credentials.
* pass name to create_provider_account helper in tests
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
---------
Co-authored-by: Jordan Frazier <jordan.frazier@datastax.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* fix: disable dangerous deserialization by default in FAISS component (#11999)
* fix: disable dangerous deserialization by default in FAISS component
Change the default value of allow_dangerous_deserialization from True
to False to prevent remote code execution via malicious pickle files.
This addresses a security vulnerability where an attacker could upload
a crafted pickle file and trigger arbitrary code execution when the
FAISS component loads the index.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix: set allow_dangerous_deserialization to false in Nvidia Remix starter project and add regression test
- Changed allow_dangerous_deserialization default from true to false in
Nvidia Remix.json starter project to match the FAISS component security fix
- Added regression tests to ensure the default value does not revert to True
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* fix: skip FAISS test gracefully when langchain_community is not installed
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Janardan Singh Kavia <janardankavia@ibm.com>
* [autofix.ci] apply automated fixes
---------
Co-authored-by: Ram Gopal Srikar Katakam <44802869+RamGopalSrikar@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Janardan Singh Kavia <janardankavia@ibm.com>
* fix: replace grep -oP with sed for Node.js version extraction in Docker images (#12330)
* fix: replace grep -oP with sed for Node.js version extraction in Docker builds
The grep -oP (PCRE regex) command fails in the python:3.12.12-slim-trixie
Docker base image because PCRE support is not available in the slim variant.
This replaces grep -oP with portable sed -nE in all 5 Dockerfiles and adds
an empty version guard to fail fast with a clear error message instead of
producing a broken download URL.
Fixes the Docker base build failure in the v1.8.2 release workflow.
* fix(docker): remove broken npm self-upgrade from Docker images
Node.js 22.x now bundles npm 11.x which fails when trying to self-upgrade
via 'npm install -g npm@latest' in the slim Docker image. The bundled npm
version is sufficient.
This is the same fix as PR #12309 on release-1.9.0.
* chore: version bump and merge 1.8.2
bump version to 1.8.3, 0.8.3 and 0.3.3
merge changes added to 1.8.2 into 1.8.3
---------
Co-authored-by: vjgit96 <vijay.katuri@ibm.com>
* fix: prevent overwriting user-selected global variables in provider c… (#12217)
* fix: nightly now properly gets 1.9.0 branch (#12215)
before it was attempting to pull release-notes as letters are alphanumerically after numbers when we sort -V then grab tail
now we only look at branch names that follow the pattern '^release-[0-9]+\.[0-9]+\.[0-9]+$'
* docs: add search icon (#12216)
add-back-svg
* fix: prevent overwriting user-selected global variables in provider config
Previously, the apply_provider_variable_config_to_build_config function would
automatically overwrite field values with environment variable keys whenever
an env var was present, even if the user had already selected a different
global variable.
This fix adds a check to only auto-set the environment variable if:
- The field is currently empty, OR
- The field is not already configured to load from the database
This preserves user selections while still providing automatic configuration
for new/empty fields.
Added comprehensive unit tests to verify:
- Auto-setting env vars for empty fields
- Preserving user-selected global variables
- Overwriting hardcoded values (expected behavior)
- Skipping when env var is not set
- Applying component metadata correctly
* [autofix.ci] apply automated fixes
* style: use dictionary comprehension instead of for-loop
Fixed PERF403 Ruff style warning by replacing for-loop with dictionary
comprehension in update_projects_components_with_latest_component_versions
* chore: retrigger CI build
* test: improve test coverage and clarity for provider config
- Renamed test_apply_provider_config_overwrites_hardcoded_value to
test_apply_provider_config_replaces_hardcoded_with_env_var for clarity
- Added test_apply_provider_config_idempotent_when_already_set to document
idempotent behavior when value already matches env var key
- Removed sensitive value from debug log message to prevent potential
exposure of API keys or credentials
These changes improve test coverage by documenting the no-op scenario
and enhance security by avoiding logging of potentially sensitive data.
* chore: retrigger CI build
---------
Co-Authored-By: Adam-Aghili <149833988+Adam-Aghili@users.noreply.github.com>
Co-Authored-By: Mendon Kissling <59585235+mendonk@users.noreply.github.com>
Co-Authored-By: Steve Haertel <shaertel@ca.ibm.com>
Co-Authored-By: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-Authored-By: Eric Hare <ericrhare@gmail.com>
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* Update test_unified_models.py
---------
Co-authored-by: Adam-Aghili <149833988+Adam-Aghili@users.noreply.github.com>
Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com>
Co-authored-by: Steve Haertel <shaertel@ca.ibm.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: vjgit96 <vijay.katuri@ibm.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
fix: replace grep -oP with sed for Node.js version extraction in Docker images (#12330)
fix as PR #12309 on release-1.9.0.
* fix: disable dangerous deserialization by default in FAISS component
Change the default value of allow_dangerous_deserialization from True
to False to prevent remote code execution via malicious pickle files.
This addresses a security vulnerability where an attacker could upload
a crafted pickle file and trigger arbitrary code execution when the
FAISS component loads the index.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix: set allow_dangerous_deserialization to false in Nvidia Remix starter project and add regression test
- Changed allow_dangerous_deserialization default from true to false in
Nvidia Remix.json starter project to match the FAISS component security fix
- Added regression tests to ensure the default value does not revert to True
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* fix: skip FAISS test gracefully when langchain_community is not installed
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Janardan Singh Kavia <janardankavia@ibm.com>
* fix: replace grep -oP with sed for Node.js version extraction in Docker builds
The grep -oP (PCRE regex) command fails in the python:3.12.12-slim-trixie
Docker base image because PCRE support is not available in the slim variant.
This replaces grep -oP with portable sed -nE in all 5 Dockerfiles and adds
an empty version guard to fail fast with a clear error message instead of
producing a broken download URL.
Fixes the Docker base build failure in the v1.8.2 release workflow.
* fix(docker): remove broken npm self-upgrade from Docker images
Node.js 22.x now bundles npm 11.x which fails when trying to self-upgrade
via 'npm install -g npm@latest' in the slim Docker image. The bundled npm
version is sufficient.
This is the same fix as PR #12309 on release-1.9.0.
Apply cloud defaults when nodes are created so existing values stay visible
and cloud mode remains advisory. Preserve incompatible providers
and warnings in the UI while keeping replacement options filtered.
Propagate cloud compatibility through starter projects and refresh
cloud metadata for file components and generated assets.
* fix(security): prevent path traversal in knowledge base bulk delete
The bulk delete endpoint was constructing file paths directly from
user-supplied kb_names without validation, allowing attackers to
delete knowledge bases belonging to other users via '../victim/kb'
payloads. Fix resolves paths and validates they stay within the
authenticated user's directory before any deletion occurs.
Adds test to validate the path traversal is properly blocked.
* [autofix.ci] apply automated fixes
* fix: address review feedback on kb bulk delete path traversal
- Replace startswith() with Path.is_relative_to() in _resolve_kb_path to
close prefix-ambiguity gap (e.g. activeuser vs activeuser_evil)
- Consolidate path traversal check into _resolve_kb_path helper (DRY),
removing duplicated inline validation from delete_knowledge_bases_bulk
- Add security logging (logger.warning) when traversal attempt is blocked
- Add inline comment explaining the is_relative_to() security rationale
- Fix always-true assertion: `is not False` -> `assert victim_kb.exists()`
- Add edge case tests: multi-level traversal, prefix-ambiguity, encoded
sequences (%2e%2e%2f), and warning log assertion
* fix: replace magic 404 with HTTPStatus.NOT_FOUND
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Replace fixed h-80/min-h-80 on the file list div with flex-1/min-h-0
so it grows to fill the available flex space instead of fighting
overflow-hidden ancestors. Add h-full to the RecentFilesComponent
root div so it fills its flex-1 parent container correctly.
* test: add PostgreSQL to migration CI tests
* [autofix.ci] apply automated fixes
* use random pg name
* [autofix.ci] apply automated fixes
* fix: rewrite _get_main_branch_head to use git grep instead of filename parsing
The old approach used --diff-filter=A and extracted revision IDs from
filenames, which broke in two ways: filenames don't always match actual
revision IDs, and modified-only migrations were silently treated as a
no-op. Now uses git grep to read revision/down_revision directly from
origin/main's migration files and computes the head from the chain.
Also skips test_upgrade_from_main_branch with a clear message when main
and branch share the same head, instead of silently doing nothing.
* [autofix.ci] apply automated fixes
* ruff
* Add postgres to install
* [autofix.ci] apply automated fixes
* comp index
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* fix: resolve File Component "no component context" error for non-ASCII files
- Make TracingService.add_log() and set_outputs() gracefully handle
missing component context by logging debug instead of raising
RuntimeError, aligning with other methods in the same class
- Add encoding fallback chain (detected → utf-8 → gb18030 → latin-1)
in read_text_file() and read_text_file_async() to handle files where
chardet misdetects encoding (e.g., Chinese character files)
- Propagate ContextVars to ThreadPoolExecutor workers in
parallel_load_data() via contextvars.copy_context() for Python < 3.12
Closes#11548
* fix: move copy_context() inside thread worker for thread safety
Context.run() cannot be called concurrently on the same context object.
Moving copy_context() inside _run_in_context ensures each thread gets
its own context copy when max_concurrency > 1.
* refactor: extract encoding detection into reusable utility function
Extract the duplicated encoding detection and fallback chain logic from
read_text_file and read_text_file_async into _detect_encoding_with_fallbacks.
* feat: support ZIP file upload for flows and projects endpoints
Add ZIP upload support to both /flows/upload/ and /projects/upload/
endpoints, enabling round-trip download-then-upload workflows. Extract
shared ZIP parsing logic into a dedicated utility with zip bomb
protections (entry count and file size limits). Fix batch flow name
deduplication to avoid infinite loops and DB collisions. Add tests for
ZIP upload, empty ZIP rejection, and download-upload round-trip.
* fix: add type annotation to satisfy mypy union narrowing
* fix: address PR review for ZIP upload (#12253)
- Add BadZipFile handling in extract_flows_from_zip for defense-in-depth
- Wrap blocking ZIP I/O in asyncio.to_thread() to avoid event loop blocking
- Add post-read size check to guard against dishonest ZIP headers
- Add 7 adversarial tests: invalid JSON, max entries, oversized entries,
mixed valid/invalid, filename fallback, corrupt ZIP, batch name dedup
* fix: return 400 instead of 500 for missing, empty, or invalid file uploads
Upload endpoints were returning 500 when no file was provided or when the
file contained empty/invalid content. Now properly validates and returns
400 with descriptive messages for: no file provided, empty file, and
invalid JSON content.
Adds override for tar-fs in package.json to ensure versions prior to
2.1.4 are never resolved. Addresses CVE in tar-fs <2.1.4 (PVR0686558)
where symlink validation bypass was possible with a crafted tarball.
Mark additional incompatible components discovered during deep audit:
- vectorstores/LocalDB (local Chroma with persist_directory)
- nvidia/NvidiaSystemAssist (Windows-only, local GPU driver)
Add cloud_default_overrides to newly identified MIXED components:
- elastic/Elasticsearch (localhost:9200 default)
- litellm/LiteLLMProxy (localhost:4000 default)
Add comprehensive cloud-compatibility-analysis.md documenting the
analysis of all 359 components across 111 directories.
When the cloud toggle is on, components that default to localhost
(Chroma, Qdrant, Weaviate, Redis Chat, ClickHouse, Milvus) now show
empty values with placeholder text like "Enter Qdrant Cloud host"
instead of localhost URLs. This prevents users from accidentally
deploying flows with localhost defaults to cloud environments.
Uses cloud_default_overrides in component metadata, consumed by
the frontend parameterRenderComponent to swap values and placeholders.
The prebuilt component_index.json was generated before the
cloud_compatible attribute was added, so components loaded from the
index were missing the field and the cloud toggle had no effect.
* feat: Add Windows Playwright tests to nightly builds
- Add windows-latest to typescript_test.yml runner options
- Add shell: bash to all script steps for cross-platform compatibility
- Split Playwright installation into OS-aware steps (Linux uses --with-deps, Windows/macOS/self-hosted don't)
- Fix artifact naming with OS prefix to prevent conflicts: blob-report-${{ runner.os }}-${{ matrix.shardIndex }}
- Split frontend-tests into separate Linux and Windows jobs in nightly_build.yml
- Add ref parameter to all test jobs to checkout code from release branch
- Add resolve-release-branch to needs dependencies
- Update Slack notifications to handle both Linux and Windows test results
- Windows tests are non-blocking (not checked in release-nightly-build condition)
- Update .secrets.baseline with new line number (263 -> 347) for LANGFLOW_ENG_SLACK_WEBHOOK_URL
Fixes LE-566
* fix: Use contains() for self-hosted runner detection
- Replace exact string equality (==, !=) with contains() for substring matching
- Fixes issue when inputs.runs-on is array format: '["self-hosted", "linux", "ARM64", ...]'
- Ensures self-hosted Linux runners correctly skip --with-deps flag
Addresses CodeRabbit feedback on PR #12264
* feat: Add Windows Playwright tests to nightly builds
- Add windows-latest to typescript_test.yml runner options
- Add shell: bash to all script steps for cross-platform compatibility
- Split Playwright installation into OS-aware steps (Linux uses --with-deps, Windows/macOS/self-hosted don't)
- Fix artifact naming with OS prefix to prevent conflicts: blob-report-${{ runner.os }}-${{ matrix.shardIndex }}
- Split frontend-tests into separate Linux and Windows jobs in nightly_build.yml
- Add ref parameter to all test jobs to checkout code from release branch
- Add resolve-release-branch to needs dependencies
- Update Slack notifications to handle both Linux and Windows test results
- Windows tests are non-blocking (not checked in release-nightly-build condition)
- Update .secrets.baseline with new line number (263 -> 347) for LANGFLOW_ENG_SLACK_WEBHOOK_URL
Fixes LE-566
* fix: Use contains() for self-hosted runner detection
- Replace exact string equality (==, !=) with contains() for substring matching
- Fixes issue when inputs.runs-on is array format: '["self-hosted", "linux", "ARM64", ...]'
- Ensures self-hosted Linux runners correctly skip --with-deps flag
Addresses CodeRabbit feedback on PR #12264
* fix: Fixes Kubernetes deployment crash on runtime_port parsing (#11968) (#11975)
* feat: add runtime port validation for Kubernetes service discovery
* test: add unit tests for runtime port validation in Settings
* fix: improve runtime port validation to handle exceptions and edge cases
Co-authored-by: Gabriel Luiz Freitas Almeida <gabriel@logspace.ai>
* fix(frontend): show delete option for default session when it has messages (#11969)
* feat: add documentation link to Guardrails component (#11978)
* feat: add documentation link to Guardrails component
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* feat: traces v0 (#11689) (#11983)
* feat: traces v0
v0 for traces includes:
- filters: status, token usage range and datatime
- accordian rows per trace
Could add:
- more filter options. Ecamples: session_id, trace_id and latency range
* fix: token range
* feat: create sidebar buttons for logs and trace
add sidebar buttons for logs and trace
remove lods canvas control
* fix: fix duplicate trace ID insertion
hopefully fix duplicate trace ID insertion on windows
* fix: update tests and alembic tables for uts
update tests and alembic tables for uts
* chore: add session_id
* chore: allo grouping by session_id and flow_id
* chore: update race input output
* chore: change run name to flow_name - flow_id
was flow_name - trace_id
now flow_name - flow_id
* facelift
* clean up and add testcases
* clean up and add testcases
* merge Alembic detected multiple heads
* [autofix.ci] apply automated fixes
* improve testcases
* remodel files
* chore: address gabriel simple changes
address gabriel simple changes in traces.py and native.py
* clean up and testcases
* chore: address OTel and PG status comments
https://github.com/langflow-ai/langflow/pull/11689#discussion_r2854630438https://github.com/langflow-ai/langflow/pull/11689#discussion_r2854630446
* chore: OTel span naming convention
model name is now set using name = f"{operation} {model_name}" if model_name else operation
* add traces
* feat: use uv sources for CPU-only PyTorch (#11884)
* feat: use uv sources for CPU-only PyTorch
Configure [tool.uv.sources] with pytorch-cpu index to avoid ~6GB CUDA
dependencies in Docker images. This replaces hardcoded wheel URLs with
a cleaner index-based approach.
- Add pytorch-cpu index with explicit = true
- Add torch/torchvision to [tool.uv.sources]
- Add explicit torch/torchvision deps to trigger source override
- Regenerate lockfile without nvidia/cuda/triton packages
- Add required-environments for multi-platform support
* fix: update regex to only replace name in [project] section
The previous regex matched all lines starting with `name = "..."`,
which incorrectly renamed the UV index `pytorch-cpu` to `langflow-nightly`
during nightly builds. This caused `uv lock` to fail with:
"Package torch references an undeclared index: pytorch-cpu"
The new regex specifically targets the name field within the [project]
section only, avoiding unintended replacements in other sections like
[[tool.uv.index]].
* style: fix ruff quote style
* fix: remove required-environments to fix Python 3.13 macOS x86_64 CI
The required-environments setting was causing hard failures when packages
like torch didn't have wheels for specific platform/Python combinations.
Without this setting, uv resolves optimistically and handles missing wheels
gracefully at runtime instead of failing during resolution.
---------
* LE-270: Hydration and Console Log error (#11628)
* LE-270: add fix hydration issues
* LE-270: fix disable field on max token on language model
---------
* test: add wait for selector in mcp server tests (#11883)
* Add wait for selector in mcp server tests
* [autofix.ci] apply automated fixes
* Add more awit for selectors
* [autofix.ci] apply automated fixes
---------
* fix: reduce visual lag in frontend (#11686)
* Reduce lag in frontend by batching react events and reducing minimval visual build time
* Cleanup
* [autofix.ci] apply automated fixes
* add tests and improve code read
* [autofix.ci] apply automated fixes
* Remove debug log
---------
* feat: lazy load imports for language model component (#11737)
* Lazy load imports for language model component
Ensures that only the necessary dependencies are required.
For example, if OpenAI provider is used, it will now only
import langchain_openai, rather than requiring langchain_anthropic,
langchain_ibm, etc.
* Add backwards-compat functions
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* Add exception handling
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* comp index
* docs: azure default temperature (#11829)
* change-azure-openai-default-temperature-to-1.0
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* [autofix.ci] apply automated fixes
---------
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix unit test?
* add no-group dev to docker builds
* [autofix.ci] apply automated fixes
---------
* feat: generate requirements.txt from dependencies (#11810)
* Base script to generate requirements
Dymanically picks dependency for LanguageM Comp.
Requires separate change to remove eager loading.
* Lazy load imports for language model component
Ensures that only the necessary dependencies are required.
For example, if OpenAI provider is used, it will now only
import langchain_openai, rather than requiring langchain_anthropic,
langchain_ibm, etc.
* Add backwards-compat functions
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* Add exception handling
* Add CLI command to create reqs
* correctly exclude langchain imports
* Add versions to reqs
* dynamically resolve provider imports for language model comp
* Lazy load imports for reqs, some ruff fixes
* Add dynamic resolves for embedding model comp
* Add install hints
* Add missing provider tests; add warnings in reqs script
* Add a few warnings and fix install hint
* update comments add logging
* Package hints, warnings, comments, tests
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* Add alias for watsonx
* Fix anthropic for basic prompt, azure mapping
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* ruff
* [autofix.ci] apply automated fixes
* test formatting
* ruff
* [autofix.ci] apply automated fixes
---------
* fix: add handle to file input to be able to receive text (#11825)
* changed base file and file components to support muitiple files and files from messages
* update component index
* update input file component to clear value and show placeholder
* updated starter projects
* [autofix.ci] apply automated fixes
* updated base file, file and video file to share robust file verification method
* updated component index
* updated templates
* fix whitespaces
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* add file upload test for files fed through the handle
* [autofix.ci] apply automated fixes
* added tests and fixed things pointed out by revies
* update component index
* fixed test
* ruff fixes
* Update component_index.json
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* updated component index
* updated component index
* removed handle from file input
* Added functionality to use multiple files on the File Path, and to allow files on the langflow file system.
* [autofix.ci] apply automated fixes
* fixed lfx test
* build component index
---------
* docs: Add AGENTS.md development guide (#11922)
* add AGENTS.md rule to project
* change to agents-example
* remove agents.md
* add example description
* chore: address cris I1 comment
address cris I1 comment
* chore: address cris I5
address cris I5
* chore: address cris I6
address cris I6
* chore: address cris R7
address cris R7
* fix testcase
* chore: address cris R2
address cris R2
* restructure insight page into sidenav
* added header and total run node
* restructing branch
* chore: address gab otel model changes
address gab otel model changes will need no migration tables
* chore: update alembic migration tables
update alembic migration tables after model changes
* add empty state for gropu sessions
* remove invalid mock
* test: update and add backend tests
update and add backend tests
* chore: address backend code rabbit comments
address backend code rabbit comments
* chore: address code rabbit frontend comments
address code rabbit frontend comments
* chore: test_native_tracer minor fix address c1
test_native_tracer minor fix address c1
* chore: address C2 + C3
address C2 + C3
* chore: address H1-H5
address H1-H5
* test: update test_native_tracer
update test_native_tracer
* fixes
* chore: address M2
address m2
* chore: address M1
address M1
* dry changes, factorization
* chore: fix 422 spam and clean comments
fix 422 spam and clean comments
* chore: address M12
address M12
* chore: address M3
address M3
* chore: address M4
address M4
* chore: address M5
address M5
* chore: clean up for M7, M9, M11
clean up for M7, M9, M11
* chore: address L2,L4,L5,L6 + any test
address L2,L4,L5 and L6 + any test
* chore: alembic + comment clean up
alembic + comment clean up
* chore: remove depricated test_traces file
remove depricated test_traces file. test have all been moved to test_traces_api.py
* fix datetime
* chore: fix test_trace_api ge=0 is allowed now
fix test_trace_api ge=0 is allowed now
* chore: remove unused traces cost flow
remove unused traces cost flow
* fix traces test
* fix traces test
* fix traces test
* fix traces test
* fix traces test
* chore: address gabriels otel coment
address gabriels otel coment latest
---------
Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local>
Co-authored-by: Olayinka Adelakun <olayinkaadelakun@mac.war.can.ibm.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Ram Gopal Srikar Katakam <44802869+RamGopalSrikar@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: olayinkaadelakun <olayinka.adelakun@ibm.com>
Co-authored-by: Jordan Frazier <122494242+jordanrfrazier@users.noreply.github.com>
Co-authored-by: cristhianzl <cristhian.lousa@gmail.com>
Co-authored-by: Hamza Rashid <74062092+HzaRashid@users.noreply.github.com>
Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com>
Co-authored-by: Lucas Oliveira <62335616+lucaseduoli@users.noreply.github.com>
Co-authored-by: Edwin Jose <edwin.jose@datastax.com>
Co-authored-by: Himavarsha <40851462+HimavarshaVS@users.noreply.github.com>
* fix(test): Fix superuser timeout test errors by replacing heavy clien… (#11982)
fix(test): Fix superuser timeout test errors by replacing heavy client fixture (#11972)
* fix super user timeout test error
* fix fixture db test
* remove canary test
* [autofix.ci] apply automated fixes
* flaky test
---------
Co-authored-by: Cristhian Zanforlin Lousa <cristhian.lousa@gmail.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* refactor(components): Replace eager import with lazy loading in agentics module (#11974)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* fix: add ondelete=CASCADE to TraceBase.flow_id to match migration (#12002)
* fix: add ondelete=CASCADE to TraceBase.flow_id to match migration
The migration file creates the trace table's flow_id foreign key with
ondelete="CASCADE", but the model was missing this parameter. This
mismatch caused the migration validator to block startup.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* fix: add defensive migration to ensure trace.flow_id has CASCADE
Adds a migration that ensures the trace.flow_id foreign key has
ondelete=CASCADE. While the original migration already creates it
with CASCADE, this provides a safety net for any databases that may
have gotten into an inconsistent state.
* fix: dynamically find FK constraint name in migration
The original migration did not name the FK constraint, so it gets an
auto-generated name that varies by database. This fix queries the
database to find the actual constraint name before dropping it.
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
* fix: LE-456 - Update ButtonSendWrapper to handle building state and improve button functionality (#12000)
* fix: Update ButtonSendWrapper to handle building state and improve button functionality
* fix(frontend): rename stop button title to avoid Playwright selector conflict
The "Stop building" title caused getByRole('button', { name: 'Stop' })
to match two elements, breaking Playwright tests in shards 19, 20, 22, 25.
Renamed to "Cancel" to avoid the collision with the no-input stop button.
* Fix: pydantic fail because output is list, instead of a dict (#11987)
pydantic fail because output is list, instead of a dict
Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local>
* refactor: Update guardrails icons (#12016)
* Update guardrails.py
Changing the heuristic threshold icons.
The field was using the default icons. I added icons related to the security theme.
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Viktor Avelino <64113566+viktoravelino@users.noreply.github.com>
* feat: Clean up the modelinput unification
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* Update test_embedding_model_component.py
* [autofix.ci] apply automated fixes
* Revert to main for other files
* More reversions
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* Handle first run more elegantly in astra
* [autofix.ci] apply automated fixes
* Fix knowledge embedding dialog (#12071)
* fix: Handle message inputs when ingesting knowledge
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* Update test_ingestion.py
* [autofix.ci] apply automated fixes
* fix: Unify the knowledge creation model selector
* Revert tracing
* Update ingestion.py
* Rebuild comp index
* [autofix.ci] apply automated fixes
* Update test_ingestion.py
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* Update test_ingestion.py
* Update component_index.json
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* [autofix.ci] apply automated fixes
* Update comp index
* Update test_astradb_base_component.py
* Update Knowledge Ingestion.json
* [autofix.ci] apply automated fixes
* Fix broken tests
* Cleanup from claude
* [autofix.ci] apply automated fixes
* Fix failing tests
* Update test_unified_models.py
* [autofix.ci] apply automated fixes
* Update Nvidia Remix.json
* Refactor ingest
* Rebuild templates and component index
* Fix test
* [autofix.ci] apply automated fixes
* Update component_index.json
* [autofix.ci] apply automated fixes
* test: add update_build_config visibility tests and PR review fixes (#12114)
- Add update_build_config field-visibility tests to LanguageModelComponent,
ToolCallingAgentComponent, and BatchRunComponent covering Ollama, WatsonX,
OpenAI, and no-model-selected cases
- Remove 16 stale @pytest.mark.skip tests from test_agent_component.py
- Wire up validate_model_selection in agent.py for early input validation
- Document AstraDB intentional use of lower-level update_model_options_in_build_config
- Clarify model_kwargs info text to note provider-specific support
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* Update embedding_model.py
* fix: address PR review recommendations for feat-unify-models++ (#12116)
- Fix 9 skipped tests in test_batch_run_component.py by replacing model
list with _MockLLM instances, following the existing pattern used by
test_with_config_failure_handling
- Fix test_agent_component.py: set component.model to a valid list before
calling get_agent_requirements() in the three max_tokens tests, since
validate_model_selection now requires a list-format model
- Replace os.environ direct reads in apply_provider_variable_config_to_build_config
with get_all_variables_for_provider() (DB-first, env fallback), and pass
user_id through from handle_model_input_update
- Add deprecated stubs for update_provider_fields_visibility, _update_watsonx_fields,
and _update_ollama_fields in model_config.py with DeprecationWarning pointing
to handle_model_input_update
- Fix typo: "deault" -> "default" in structured_output.py TODO comment
- Add 4 new KnowledgeIngestionComponent tests: new-format model_selection
metadata path, allow_duplicates=True, missing metadata file error, and
_build_embedding_metadata without API key
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* Ruff errors
* Update test_ingestion.py
* Update component index
* Test updates
* Update component_index.json
* Update stable_hash_history.json
* Template updates
* Update batch_run.py
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* Update Youtube Analysis.json
* Fix tests
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* Some cleanup and refactoring
* [autofix.ci] apply automated fixes
* Update Nvidia Remix.json
* Update Nvidia Remix.json
* Update unified_models.py
* Coderabbit AI review comments
* Component index update
* [autofix.ci] apply automated fixes
* Template updates
* [autofix.ci] apply automated fixes
* Template update
* [autofix.ci] apply automated fixes
* Review comments addressed
* [autofix.ci] apply automated fixes
* Update component_index.json
* Update stable_hash_history.json
* [autofix.ci] apply automated fixes
* Test updates
* Update test_ingestion.py
* Update test_ingestion.py
* Update test_ingestion.py
* [autofix.ci] apply automated fixes
* More clear tooltip text
* [autofix.ci] apply automated fixes
* Template updates
* Index and templates
* [autofix.ci] apply automated fixes
* Fix lambda build
* Template updates
* Rebuild comp index
* [autofix.ci] apply automated fixes
* Fix templates
* Fix failing test
* Update templates
* Update comp index
* [autofix.ci] apply automated fixes
* API key field in astra db
* Update starter
* Update comp index
* Starter proj update
* Add api key to field order
* Update test_unified_models.py
* Update test_unified_models.py
* [autofix.ci] apply automated fixes
* Update setup.py
* Update setup.py
* Update component_index.json
* [autofix.ci] apply automated fixes
* Return embedding models directly in KB
* [autofix.ci] apply automated fixes
* Update component_index.json
* fix: Refactor the unified models code
* Ruff checks
* Update flow_preparation.py
* [autofix.ci] apply automated fixes
* Update test_language_model_component.py
* fix: prevent overwriting user-selected global variables in provider c… (#12217)
* fix: nightly now properly gets 1.9.0 branch (#12215)
before it was attempting to pull release-notes as letters are alphanumerically after numbers when we sort -V then grab tail
now we only look at branch names that follow the pattern '^release-[0-9]+\.[0-9]+\.[0-9]+$'
* docs: add search icon (#12216)
add-back-svg
* fix: prevent overwriting user-selected global variables in provider config
Previously, the apply_provider_variable_config_to_build_config function would
automatically overwrite field values with environment variable keys whenever
an env var was present, even if the user had already selected a different
global variable.
This fix adds a check to only auto-set the environment variable if:
- The field is currently empty, OR
- The field is not already configured to load from the database
This preserves user selections while still providing automatic configuration
for new/empty fields.
Added comprehensive unit tests to verify:
- Auto-setting env vars for empty fields
- Preserving user-selected global variables
- Overwriting hardcoded values (expected behavior)
- Skipping when env var is not set
- Applying component metadata correctly
* [autofix.ci] apply automated fixes
* style: use dictionary comprehension instead of for-loop
Fixed PERF403 Ruff style warning by replacing for-loop with dictionary
comprehension in update_projects_components_with_latest_component_versions
* chore: retrigger CI build
* test: improve test coverage and clarity for provider config
- Renamed test_apply_provider_config_overwrites_hardcoded_value to
test_apply_provider_config_replaces_hardcoded_with_env_var for clarity
- Added test_apply_provider_config_idempotent_when_already_set to document
idempotent behavior when value already matches env var key
- Removed sensitive value from debug log message to prevent potential
exposure of API keys or credentials
These changes improve test coverage by documenting the no-op scenario
and enhance security by avoiding logging of potentially sensitive data.
* chore: retrigger CI build
---------
Co-authored-by: Adam-Aghili <149833988+Adam-Aghili@users.noreply.github.com>
Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com>
Co-authored-by: Steve Haertel <shaertel@ca.ibm.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Eric Hare <ericrhare@gmail.com>
* Update build_config.py
* [autofix.ci] apply automated fixes
* Update build_config.py
* Fix tests
* fix: Dropdown issue with field population
* Update test_unified_models.py
* Clean up key config
* [autofix.ci] apply automated fixes
* fix tests
* Fix tests
* fix: Update tests
* Update tests
* Update test_tool_calling_agent.py
* Update test_unified_models.py
* Update test_tool_calling_agent.py
* Update tests
* Google AI generative embeddings fixes
* [autofix.ci] apply automated fixes
* Merge release branch
* Template update
* Merge release branch
* [autofix.ci] apply automated fixes
* Update openai_constants.py
* Update openai_constants.py
---------
Co-authored-by: Adam-Aghili <149833988+Adam-Aghili@users.noreply.github.com>
Co-authored-by: Gabriel Luiz Freitas Almeida <gabriel@logspace.ai>
Co-authored-by: keval shah <kevalvirat@gmail.com>
Co-authored-by: Antônio Alexandre Borges Lima <104531655+AntonioABLima@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local>
Co-authored-by: Olayinka Adelakun <olayinkaadelakun@mac.war.can.ibm.com>
Co-authored-by: Ram Gopal Srikar Katakam <44802869+RamGopalSrikar@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: olayinkaadelakun <olayinka.adelakun@ibm.com>
Co-authored-by: Jordan Frazier <122494242+jordanrfrazier@users.noreply.github.com>
Co-authored-by: cristhianzl <cristhian.lousa@gmail.com>
Co-authored-by: Hamza Rashid <74062092+HzaRashid@users.noreply.github.com>
Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com>
Co-authored-by: Lucas Oliveira <62335616+lucaseduoli@users.noreply.github.com>
Co-authored-by: Edwin Jose <edwin.jose@datastax.com>
Co-authored-by: Himavarsha <40851462+HimavarshaVS@users.noreply.github.com>
Co-authored-by: Viktor Avelino <64113566+viktoravelino@users.noreply.github.com>
Co-authored-by: Lucas Democh <ldgoularte@gmail.com>
Co-authored-by: Steve Haertel <stevehaertel@users.noreply.github.com>
Co-authored-by: Steve Haertel <shaertel@ca.ibm.com>
Pass github.event.pull_request.head.ref through env: instead of
interpolating it directly into run: shell steps. This prevents bash
from evaluating command substitutions embedded in malicious branch names
before input validation runs.
Co-authored-by: Janardan Singh Kavia <janardankavia@ibm.com>
