* Upgrade Firecrawl components to firecrawl-py v2 + add Search component
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Upgrade Firecrawl components to firecrawl-py v2 + add Search component
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Upgrade Firecrawl components to firecrawl-py v2 + add Search component
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Upgrade Firecrawl components to firecrawl-py v2 + add Search component
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Upgrade Firecrawl components to firecrawl-py v2 + add Search component
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Upgrade Firecrawl components to firecrawl-py v2 + add Search component
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Upgrade Firecrawl components to firecrawl-py v2 + add Search component
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs: add Firecrawl Search API to the bundle page
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* [autofix.ci] apply automated fixes
* fix(firecrawl): D205 docstring + defensive .get('data') in crawl
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(firecrawl): D205 docstring in scrape
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* perf(firecrawl): use list.extend in map (PERF401)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test: add unit tests for Firecrawl v2 components
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* [autofix.ci] apply automated fixes
* test: align Firecrawl component tests with lfx _attributes pattern
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* [autofix.ci] apply automated fixes
* refactor(firecrawl): remove deprecated extract endpoint component
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* refactor(firecrawl): remove deprecated extract endpoint component
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* test: drop extract component test (extract endpoint removed)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs: remove Firecrawl Extract API section (deprecated)
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* [autofix.ci] apply automated fixes
* fix(firecrawl): map Search component to Firecrawl icon, drop Extract
The frontend icon map in styleUtils.ts still referenced the removed
FirecrawlExtractApi and lacked the new FirecrawlSearchApi, so the Search
node would not render the Firecrawl logo.
* chore: regenerate component index for Firecrawl v2 (Search added, Extract removed)
* refactor(firecrawl): extract components into the lfx-firecrawl extension bundle
Port the firecrawl provider out of lfx.components into a standalone
Extension Bundle at src/bundles/firecrawl (distribution: lfx-firecrawl),
following src/bundles/PORTING.md:
- Move the v2-SDK components (Scrape, Crawl, Map, Search) to
src/bundles/firecrawl/src/lfx_firecrawl/components/firecrawl/ and
remove the in-tree provider + its lfx.components registration.
- Own the firecrawl-py>=4,<5 pin in the bundle; drop it from
langflow-base.
- Wire the workspace (root pyproject deps/sources/members) and uv.lock.
- Append migration-table entries (bare name, both import paths, pre-a
slot) for the four classes; FirecrawlExtractApi gets no entries since
the v2 SDK removed the extract endpoint and the component was dropped.
- Regenerate the component index (firecrawl category removed) and
locales/en.json (54 firecrawl keys move out of core).
- Bundle-local unit tests + test_pilot_firecrawl_upgrade integration
test; update Dockerfile bundle enumeration comments.
* fix(lfx): repair migration table entry fused during release-1.11.0 merge
The release-1.11.0 back-merge collided the FirecrawlSearchApi legacy_slot
entry with the NextPlaidVectorStoreComponent bare_class_name entry, mashing
both into a single object with duplicate 'target' keys, populating two of
{bare_class_name, import_path, legacy_slot}. That fails the MigrationTable
validator (entries.51) and broke the lfx loader tests.
Split it into the two intended entries so each populates exactly one
key-field. Restores the FirecrawlSearchApi and NextPlaidVectorStoreComponent
quads (60 entries total, +16 vs base). Append-only and bare-name guards pass.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Eric Hare <ericrhare@gmail.com>
* docs: migrate code blocks from CodeSnippet to native Prism
Replace the custom CodeSnippet component (@code-hike/lighter) with
Docusaurus's native @theme/CodeBlock across all MDX files (current and
versioned docs). Add bash to additionalLanguages and swizzle
prism-include-languages.js to add custom token highlighting for shell
commands and flags. Remove @code-hike/mdx dependency.
* docs: improve inline code styling
Darken inline code background, increase horizontal padding to 0.4em,
fix vertical alignment, and remove border in light mode.
* docs: address PR review — fix code slice regression and CSS/regex polish
- Inline RecursiveCharacterTextSplitter inputs and methods as literal
code blocks in concepts-components.mdx (current + 1.8.0 + 1.9.0),
restoring the focused slices lost when migrating from CodeSnippet
- Scope bash-plain Prism regex to unambiguous CLI subcommands only,
removing generic bash builtins (run, add, get, set, start, stop, etc.)
- Merge duplicate .theme-code-block CSS rules into a single declaration
* fix(docs): prevent horizontal scroll on API docs pages
The Redoc two-column layout (sidebar 300px + api-content 1300px)
totals 1600px, expanding .main-wrapper beyond narrower viewports
because it has overflow:visible. Clips at .main-wrapper using the
html.plugin-redoc class that Docusaurus adds on API pages only.
* fix(docs): API docs sidebar and layout fixes
- Disable Redoc built-in search (disableSearch: true)
- Pin sidebar top to navbar height (top: 60px) so it never hides behind navbar
- Remove hardcoded #111 background from dark mode sidebar
* fix(docs): render markdown correctly in API docs descriptions
The _clean_descriptions function was converting newlines to <br> tags,
mixing HTML with Markdown. CommonMark stops parsing Markdown headings
(###) inside HTML blocks, causing them to appear as literal text in Redoc.
Replace the <br> conversion with a simple strip() so descriptions remain
pure Markdown and Redoc renders headings, lists, and code blocks correctly.
* feat(docs): align API docs colors with Langflow brand
- Set primaryColor to #F471B5 (Langflow pink)
- Add HTTP method badge colors matching Langflow palette
- Set schema.linesColor and requireLabelColor to brand pink
- Set inline code color to pink, headers to #e3e3e3
- Set sidebar background to #18181b (matches frontend dark bg)
- Set rightPanel background to #0d0d0f, codeBlock to #161618
- Refactor: move color config from CSS to theme.theme where safe
- Remove dead search input CSS (search disabled via disableSearch:true)
- Consolidate duplicate .menu-content rules
* wip(docs): API docs styling — colors, components, light/dark themes
* fix(docs): fix Response samples h3 title padding and refactor HTTP method button CSS
* feat(docs): add sidebar dark background, active item styles, and right panel color adjustments
* fix(docs): add sidebar borders and remove operation divider border
* fix(docs): fix expanded response background and align dark/light theme colors
* refactor(docs): standardize selectors, comments and remove duplicate rules in redocusaurus.css
* refactor(docs): apply PR review — CSS custom properties, version pin, dom version comments, fix overflow
* fix(docs): fix Redocly badge visibility covered by sidebar background
* fix(docs): extend sidebar border-right to Redocly badge area
* refactor(docs): replace hardcoded #ffffff label color with --redoc-text-label variable
* fix(docs): lighten inline code background in API docs dark theme
Redoc's default typography.code.backgroundColor (rgba(38, 50, 56, 0.05))
is nearly invisible over the dark background. Override it with
rgba(255, 255, 255, 0.05) in dark theme only, excluding pre > code so
code sample blocks stay unaffected.
* feat(docs): align docs primary pink with API spec brand color
Use #f471b5 (API spec primaryColor) as --ifm-color-primary in dark theme
and #e44fa0 (slightly darkened for contrast on white) in light theme.
Remove dark-theme pink overrides in sidebar.css (#ff6ad0 CTA and
hsla(329, 55%, 68%) active TOC link) — they compensated for the old
muted pink and are redundant now that the primary itself is bright.
* feat(docs): lighten dark theme text colors for better readability
Bump body text (#a8a8b0 -> #bcbcc4), headings (#cdcdd4 -> #dcdce2)
and sidebar menu (#8a8a92 -> #9c9ca4) one step brighter.
* chore(docs): add IBM Equal Access accessibility-checker setup
Add accessibility-checker as devDependency with aceconfig.js (policy
IBM_Accessibility, JSON reports in docs/a11y-results/, gitignored).
Scan with: npx achecker <url> against a built docs site.
* fix(docs): WCAG AA contrast and ARIA fixes across docs and API reference
Validated with IBM Equal Access scans (light theme): home, quickstart and
component pages at 0 violations; /api from 3382 down to 167 (all remaining
are Redoc-internal DOM: schema table headers, svg/select labels).
Docs site:
- Light primary pink #d11074 — passes 4.5:1 on white and inline-code bg
- Light Prism palette darkened per-token to pass 4.5:1 on #f9f9fd
- TabItem swizzled to give tabpanels an accessible name (aria-label)
- codeBlockA11y client module: scrollable code blocks get role=region +
unique label; non-scrollable ones lose the needless tabindex
API reference (Redocusaurus):
- redocA11y client module: role=main on api-content, role=navigation on
sidebar — fixes 1924 aria_content_in_landmark violations
- HTTP method badges and response chips darkened to pass with white text
- Light-theme overrides: accessible pink #cd1072 for links, required
markers, constraint chips, schema tree lines; darker grays for utility
buttons and type labels (incl. 0.7-opacity wrapper fix)
- Sidebar active/hover items use regular text color, method badges keep
their own colors; expandable property names match non-expandable ones
* fix(docs): WCAG AA contrast fixes for dark theme
Validated with IBM Equal Access scans in dark mode (temporary
colorMode.defaultMode flip during scanning): home, quickstart and
component pages at 0 violations; /api matches light at 167 remaining
(all Redoc-internal DOM: table headers, svg/select labels).
- Code block comments/line numbers #4a5060 -> #798197 (4.56:1 on #18181a)
- Redoc dark sample tokens: boolean/null #e95c59, number #5392b8
- Status-code tabs: lift docusaurus-theme-redoc's #303846 !important
selected-tab rule with a higher-specificity override
- oneOf variant buttons: dark text in both themes (their white/pink
backgrounds are theme-independent)
- redocA11y client module: patch response chip colors (success green /
error red) to dark-accessible variants when data-theme=dark — a single
Redoc theme color cannot pass on both light and dark derived
backgrounds, and status is only distinguishable by computed color
* fix(docs): resolve remaining Redoc-internal accessibility violations
Extend the redocA11y client module with semantic patches for Redoc DOM
the theme cannot reach (validated: 0 IBM Equal Access violations on all
scanned pages in both light and dark themes):
- Decorative svg chevrons/arrows: aria-hidden=true (svg_graphics_labelled)
- Content-type dropdowns: aria-label (input_label_exists)
- Schema field tables (2-col name|description layout, no <th> anywhere):
role=presentation — content reads in DOM order; role=rowheader on <td>
is invalid ARIA inside a native table (table_headers_exists/related)
- Semantic patches run on the next animation frame after DOM changes so
Redoc's lazy-rendered operations are covered immediately; the heavier
color patch stays debounced
* ci(docs): gate docs accessibility with IBM Equal Access scans
Add test-docs-accessibility job to docs_test.yml (rides the existing
docs/** path filter from ci.yml): build + scan 4 representative pages
(home, quickstart, component page, /api) in light theme, then flip
colorMode.defaultMode to dark, rebuild and scan again.
- scripts/a11y-ci.sh: serves the build and runs npx achecker per page
with one retry to absorb Redoc lazy-render timing flakes; any real
violation fails the job (failLevels: violation)
- aceconfig.js: pin ruleArchive to 19May2026 so IBM rule updates don't
break CI without a deliberate bump
* ci(docs): fix Chrome sandbox launch on Ubuntu 24.04 runners
Ubuntu 24.04 restricts unprivileged user namespaces via AppArmor, which
prevents puppeteer's Chrome (used by the IBM checker) from starting its
sandbox. Re-enable them with the documented sysctl workaround instead of
weakening the browser with --no-sandbox.
* fix(docs): align response status code with description text
Redoc sets vertical-align: top and a smaller line-height on the status
code <strong> inside response buttons, leaving "200" visually higher
than "Successful Response". Align both to the shared text baseline.
* refactor(docs): apply PR review feedback
- redocA11y: match only real Redoc routes (/api, /api/workflow) — a bare
startsWith("/api") also matched docs pages like /api-request and
leaked one body MutationObserver per navigation
- codeBlockA11y: also observe the hidden attribute — Docusaurus tabs
toggle panels via hidden (no childList mutation), so scrollable blocks
inside an initially hidden tab were never re-evaluated for tabindex
- Extract Prism themes to src/prismThemes.js (docusaurus.config.js was
past the 600-line red flag)
- concepts-components.mdx (current + 1.9.0 + 1.8.0): comment pointing
hardcoded snippets to recursive_character.py to mitigate drift
Validated: clean build + IBM Equal Access scans 4/4 passing.
* replace-openapi-file-with-1.10
* migrate-prism-changes-to-1.10-version
* a11y-script-dont-block
---------
Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com>
* fix(security): remove the disabled Python Code Structured tool component
Follow-up to #13538, which neutered PythonCodeStructuredTool to a
non-executable stub "for one release cycle, full removal later." This
completes that removal.
- Delete the component and its registration in lfx.components.tools.
- Drop its entry from the component index (num_components 355 -> 354,
sha256 recomputed surgically) and from stable_hash_history.json.
- Remove its 18 i18n keys from every locale file.
- Replace the dedicated stub unit test with a removal test in
test_dynamic_import_integration.py.
- Add a regressions entry to regressions/1.10.x.yaml.
The unauthenticated public-build RCE fix (report H1-3754930) is
unaffected: PythonCodeStructuredTool stays in
CODE_EXECUTION_COMPONENT_TYPES, so build_public_tmp still rejects any
saved or crafted flow that carries the type. instantiate_class execs the
node's stored `code` field regardless of whether the class still exists,
so the type-name block -- not the class -- is what closes the path.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* docs: document removal
* docs: typo
* Apply suggestion from @mendonk
Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com>
* fix(conditional-router): route Text Input when Case True/False are blank
The If-Else component's Case True and Case False fields are optional
overrides. When left blank, the MessageInput resolved them to an empty
Message, so the matched branch emitted a blank message instead of the
original Text Input.
Fall back to input_text when the override message is empty, so the
incoming message is passed through to the True/False branch as expected.
Fixes#13387
* fix(conditional-router): use Message(text=) for empty stopped-branch output
The non-matched (stopped/excluded) branches returned Message(content=""),
but 'content' is not a Message field — it was stored as an arbitrary data
key, leaving .text empty. Use Message(text="") so the empty output is a
proper empty Message.
* [autofix.ci] apply automated fixes
* fix(conditional-router): preserve non-text Message overrides
A Case True/False override can be a real Message with empty .text but a
meaningful payload (files or content blocks). The fallback helper treated
any Message with falsy .text as blank and replaced it with the input text,
dropping that payload.
Only fall back to input_text when the override carries no payload at all
(no text, no files, no content_blocks); otherwise preserve the override
as-is.
* fix: address review comments
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* feat: move docling components to bundle
* chore: auto-bake note keys and regenerate backend locales/en.json [skip ci]
* chore: wake CI
* fix: trim docling chunking extra
* Update test_endpoints.py
* Update test_pilot_docling_upgrade.py
* fix: show friendly component label in build banner for bundle nodes
Extension-bundle components have namespaced node ids of the form ext:<bundle>:<ClassName>@<slot>-<uuid>. The flow-build status banner rendered that raw id, which overflowed the fixed-width (530px) container and collided with the elapsed-time counter.
Collapse namespaced ids to <ComponentName>-<uuid> (matching the built-in ComponentName-UUID label) via a new getRunningNodeLabel helper; built-in node ids are returned unchanged. Covered by unit tests.
---------
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
* Add custom comp exeuction override flag
* fix(settings): handle comma-separated LANGFLOW_COMPONENTS_PATH in override enforcement
CustomSource splits comma-separated env vars into individual list entries before
the field validator runs, so the raw env var string was never found in
self.components_path when multiple paths were specified. Split the env var by
comma and strip each entry individually. Add a test covering the multi-path case.
* update doc
* fix(settings): scope components_index_path stripping to env-sourced value
Mirror the components_path handling and only clear components_index_path
when it matches LANGFLOW_COMPONENTS_INDEX_PATH, addressing review feedback
on the override enforcer.
* feat(logging): production-grade structured logs for Grafana/Loki
Make langflow and lfx log output viable for ingestion by Grafana/Loki and
other observability tools when run in JSON mode (LANGFLOW_LOG_ENV=container).
Core changes in src/lfx/src/lfx/log/logger.py:
- Preserve exceptions in JSON output via structlog.processors.ExceptionRenderer
with ExceptionDictTransformer. Tracebacks now emit as a structured exception
array (exc_type, exc_value, frames) instead of being dropped.
- show_locals defaults to OFF; opt-in via LANGFLOW_LOG_TRACE_LOCALS=true so
frame locals can't leak API keys, env, or request bodies in shipped logs.
- Add service metadata (service / version / environment) from
LANGFLOW_SERVICE_NAME / LANGFLOW_VERSION / LANGFLOW_ENVIRONMENT.
- Add logger name to every record so Grafana can filter by source.
- Add optional OpenTelemetry trace_id / span_id correlation. Import is
resolved once at module load; runtime calls are wrapped so a flaky tracer
SDK can never break logging.
- Add default-on PII redaction for password, token, api_key, authorization,
cookie, etc. Walks nested dicts, lists, and tuples up to depth 4. Extra
keys via LANGFLOW_LOG_REDACT_KEYS.
- Add per-logger level overrides via LANGFLOW_LOG_LEVELS="name=LEVEL,...".
Malformed entries (typos like WARN instead of WARNING) raise UserWarning
instead of silently dropping.
- Use ISO 8601 UTC timestamps.
- Install a stdlib InterceptHandler on the root logger in JSON modes so
uvicorn, sqlalchemy, httpx, langchain, asyncio etc. emit a single unified
JSON stream. Forwards exc_info and stack_info. emit() is wrapped to route
any error through handleError so a malformed third-party log call cannot
raise into the request path. Install is idempotent: re-running configure()
updates the level instead of stacking handlers. Not installed in pretty
mode so dev terminals don't get duplicate lines.
- Reset cached loggers at the start of configure() so modules that captured
a logger before configure() ran pick up the new processor chain.
- Preserve the get_logger() name through PrintLogger so add_logger_name can
attach it.
Tests in src/backend/tests/unit/test_logger.py:
- Cover structured tracebacks, PII redaction (top-level, nested, list,
tuple, depth limit), logger name, stdlib intercept forwarding exc_info
and stack_info, intercept idempotency, intercept-not-installed in pretty
mode, malformed-args safety net, service info defaults and env overrides,
malformed LANGFLOW_LOG_LEVELS warning, container_csv exception text,
show_locals default off (verified by absence of the secret value, not
just the key) and opt-in.
* docs(observability): Grafana + Loki reference stack and env-var docs
Adds a self-contained Loki + Promtail + Grafana docker-compose stack under
deploy/observability/grafana-loki/ with a pre-provisioned dashboard that
demonstrates the production logging features: structured tracebacks, PII
redaction, service/version/environment labels, and the stdlib intercept
path. Anyone running Langflow in JSON mode can point Promtail at their log
file and get a working board on first run.
Also documents the new env vars (LANGFLOW_SERVICE_NAME, LANGFLOW_VERSION,
LANGFLOW_ENVIRONMENT, LANGFLOW_LOG_LEVELS, LANGFLOW_LOG_REDACT_KEYS,
LANGFLOW_LOG_TRACE_LOCALS) in docs/docs/Develop/logging.mdx and adds a
new page docs/docs/Develop/observability-grafana-loki.mdx covering JSON
output shape, structured exceptions, stdlib routing, and OpenTelemetry
trace correlation. Registered in the Observability sidebar category.
* docs(observability): rename dashboard to 'Langflow Logs'
* docs(observability): fix broken link from logging guide to Grafana/Loki page
The logging guide linked to the new Grafana/Loki page with an absolute
path (/observability-grafana-loki). Since the page is new and only
exists in the next docs version, the absolute link resolved to a
non-existent root-version route and failed the Docusaurus broken-link
check. Use a version-aware relative .mdx link instead.
* docs(observability): clarify stdout requirement for unified JSON logs
The Grafana/Loki guide told users to set LANGFLOW_LOG_FILE, but the stdlib
intercept that routes uvicorn/sqlalchemy/httpx/langchain into the JSON stream
is only installed on the stdout path, so those library logs landed in the file
as plain text and the json parse stage could not label them. Point the guide at
stdout (redirected to the scraped file) and note the file-mode limitation.
Also document that the JSON format is platform-agnostic and works with any
JSON-ingesting backend including IBM Instana, whose OpenTelemetry-based Python
tracer (3.0+) correlates logs to traces via trace_id/span_id.
* fix(logging): render stdlib logs as redacted JSON in file mode
In JSON mode with LANGFLOW_LOG_FILE set, the stdlib intercept was skipped to
avoid a recursion loop, so third-party loggers (uvicorn, sqlalchemy, httpx,
asyncio) wrote plain text straight to the file. Those lines bypassed both JSON
rendering and PII redaction, so secrets in their structured fields landed in the
file verbatim and Loki could not parse or label them.
Route JSON file output through a structlog ProcessorFormatter on the rotating
handler: foreign stdlib records are enriched via foreign_pre_chain (ExtraAdder +
redaction) and rendered as JSON alongside application logs, while the
RotatingFileHandler keeps log rotation. The stdout path is unchanged. Also
forward stdlib extra fields through InterceptHandler so the stdout path redacts
them too, keeping both paths consistent.
Update the Grafana/Loki deploy guide to reflect that LANGFLOW_LOG_FILE now
produces a single redacted JSON stream.
* fix(logging): retrieval buffer captures the message text
add_serialized stored the rendered message under the 'message' key, but
SizedLogBuffer.write only read 'event'/'msg'/'text', so every entry returned by
the /logs and /logs-stream endpoints had an empty message. Read 'message' first
and keep the other keys as fallbacks for records written in other shapes.
fix(tracing): warn clearly when LangWatch is unavailable on Python 3.14
The official Docker images run Python 3.14, but the `langwatch` package caps
its requires-python at <3.14, so it is excluded from the image. With
LANGWATCH_API_KEY set, the tracer hit an ImportError and disabled itself with
only a cryptic, per-run `logger.exception`, so users saw no traces and no
actionable explanation (works on PyPI/desktop, which run Python 3.10-3.13).
Emit a single, version-aware warning when the langwatch package is missing
despite the API key being set, and document the Python 3.14 / Docker
limitation in the LangWatch integration guide.
* docs: remove 1.8 env vars
* docs: link out to deployment guide
* docs: redis queue
* fix-links-and-combine-env-vars-table
* docs: cleanup
* peer-review
* peer-review
* Apply suggestions from code review
Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>
* move-prereqs
---------
Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com>
feat(ci): reduce macOS Intel CI matrix and add macOS support docs
- Remove Python 3.10 from macOS Intel stable CI matrix (keep 3.12 only)
- Add comprehensive macOS support documentation
- Document Python 3.14 support status (limited on Intel, no PyTorch)
- Reduces CI costs by ~$5-7 per run (~$1,800-2,500/year)
Implements LE-781 recommendations R2 and R3 from LE-265 investigation.
Related: LE-265, PR #12477
* docs: add structured output for agents
* docs: add structured output note
* docs: clarify both agent outputs and add release notes
* docs: when langflow sends events to the playground and chat history
* feat(ibm): add DB2 Vector Store component
Add comprehensive IBM DB2 Vector Store integration for Langflow.
Components Added:
- DB2VectorStoreComponent: Main vector store component
- DB2VS: LangChain-compatible vector store implementation
- DB2 security validators: Input validation and sanitization
Features:
- Vector similarity search (Similarity, MMR, Similarity Score Threshold)
- Secure connection handling with input validation
- Metadata filtering for complex data types
- Duplicate detection support
- Batch document ingestion
Test Coverage:
- 41 unit tests (38 passing, 3 skipped)
- Component integration tests
- Security validation tests
- DB2VS class tests
Documentation:
- Comprehensive developer guidelines
* refactor(db2): simplify component to match Chroma patterns
- Remove complex data ingestion (CSV, DataFrame, dict, Message handling)
- Add _add_documents_to_vector_store() method matching Chroma
- Add similarity_score_threshold search type
- Simplify data ingestion from 220 to 45 lines (80% reduction)
- Add 5 new tests (similarity_search, mmr_search, search_with_different_types, duplicate_handling, metadata_filtering)
- All 41 tests passing (38 passed, 3 skipped)
BREAKING CHANGE: Component now only accepts Data objects for ingestion.
* ci: fix CI failures - update component index and starter projects
- Regenerate component_index.json with DB2 component
- Update all starter projects with new component registry
- Fix ruff formatting issues
* ci: trigger CI re-run to fix merge issue
* ci: add merge conflict resolution for component_index.json in autofix workflow
Handle merge conflicts in the Update Component Index job by:
- Automatically resolving component_index.json conflicts using --theirs strategy
- Failing if non-generated files have conflicts (requires manual resolution)
- Completing the merge after resolving generated file conflicts
This prevents the workflow from failing when component_index.json has conflicts
during PR updates, as this file is auto-generated and can be safely regenerated.
* fix: Remove DB2SQLComponent reference from IBM components
- Removed DB2SQLComponent from __init__.py as the db2_sql.py module doesn't exist
- This fixes the test_all_modules_importable test failure
- Fixes CI failure in Unit Tests - Python 3.14 - Group 5
* revert: Remove unrelated starter project JSON changes
* revert: Remove unrelated CI workflow and formatting changes
* docs: add DB2 Vector Store .mdx documentation following Chroma DB structure
* fix: address CodeRabbit review comments - add __init__.py docstring and implement score threshold filtering
- Added docstring to src/backend/tests/unit/components/__init__.py to fix Ruff INP001 error
- Added FloatInput score_threshold parameter (default 0.5) to DB2 Vector Store component
- Implemented threshold filtering in similarity_score_threshold search mode
- Filters results to only include documents with relevance scores >= threshold
* chore: remove auto-generated and unnecessary files from PR
- Remove uv.lock (dependency lock file - auto-generated)
- Remove src/frontend/package-lock.json (frontend lock file - auto-generated)
- Remove src/lfx/src/lfx/_assets/component_index.json (auto-generated by CI)
- Remove .secrets.baseline (security baseline - auto-generated)
- Remove starter_projects JSON (auto-generated example)
- Remove tweaks_builder.py (unrelated test helper)
Per DEVELOPMENT.md guidelines, these files should not be committed by contributors.
* chore: restore auto-generated files to keep PR focused on DB2 component
* fix(ci): update auto-generated files and fix docs build
- Update component index with new IBM DB2 components (363 components, 97 modules)
- Update frontend package-lock.json
- Fix docs build by removing reference to missing image in bundles-db2.mdx
Fixes CI failures:
- Update Component Index
- Update Starter Projects
- Test Docs Build
* feat(db2): add SSL/TLS support to DB2 Vector Store component
- Add SSL/TLS encryption support for DB2 database connections
- Add SSL certificate validation and download functionality
- Support local certificate files (.crt, .pem, .cer) and URLs
- Add optional certificate password support for encrypted keystores
- Implement automatic cleanup of temporary downloaded certificates
- Add comprehensive error handling and logging for SSL connections
- Update component_index.json with new SSL configuration inputs
- Update package-lock.json dependencies
Security improvements:
- Validate certificate paths and file permissions
- Support system default CA certificates (recommended for IBM Cloud DB2)
- Redact sensitive information in error messages
- Clean up temporary files on connection failure
This enhancement enables secure encrypted connections to DB2 databases,
which is recommended for production environments.
* [autofix.ci] apply automated fixes
* refactor(db2): minimize metadata storage in DB2 vector store
- Clear metadata before storage to reduce unnecessary data (file_path, filename, etc.)
- Return only text content during retrieval for cleaner results
- Optimize list comprehension for better performance (PERF401, RET504)
* test: remove skipped tests from DB2 vector store test suite
- Removed version compatibility tests for versions where component didn't exist
- Changed file_names_mapping to return empty list for new component
- Overrode base class version tests to prevent skips
- Fixed linting issues (hardcoded passwords, nested with statements)
- All 40 tests now pass with 0 skipped tests
* fix(tests): update DB2 vector store test description format
Fixes test_component_metadata assertion to match the actual component
description format. The test was failing due to line wrapping differences
in the multi-line description string.
Fixes CI failure in PR #13163
* [autofix.ci] apply automated fixes
* chore: trigger CI re-run to resolve flaky test failures
* fix(tests): mark OpenAI-dependent test as api_key_required to prevent CI failures
* restructure as new bundle package
* [autofix.ci] apply automated fixes
* fix(ibm): improve DB2 Vector Store component reliability and validation
* fix: implement SSL/TLS toggle functionality for DB2 Vector Store
- Add update_build_config method to dynamically show/hide SSL certificate fields
- SSL certificate path and password fields now only visible when use_ssl is enabled
- Improves UX by hiding irrelevant fields when SSL is disabled
- Update component_index.json with new component configuration
- All 38 existing tests pass
---------
Co-authored-by: Dhruv Chaturvedi <dhruv_insights@mac.lkw-in.ibm.com>
Co-authored-by: Dhruv Chaturvedi <dhruv_insights@Dhruvs-MacBook-Pro.local>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: priyanshu-krishnan1 <priyanshu.krishnan1@ibm.com>
Co-authored-by: Eric Hare <ericrhare@gmail.com>
* add agentic api backend
* [autofix.ci] apply automated fixes
* add docs to feature
* ruff and test fixes
* ruff fixes
* fix lfx tests
* fix ruff style
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* refactor code improvements
* add rate limit to tests
* [autofix.ci] apply automated fixes
* new canvas control
* chat UI skeleton v0
* add empty state when doesnt have model provider
* add generating code statuses
* assist panel doc
* add stop button to cancel flow generation
* view code dialog
* add translation json flow and stop button on inputchat
* add floating state of the chat
* refacator frontend codes
* assistant docs.
* add execution from .py file
* update docs
* fix verbose error
* improve disabled placeholder
* unify placeholder messages
* start chat state closed
* add canvas behavior
* fix model selection and position chat
* dialog z100
* [autofix.ci] apply automated fixes
* docs update
* change crypto to uuid regular
* fix inexistent assistant
* chore: removed old unused implmentation
remoced old FF and all it's UI components
* add memory to flow..
* add prompt on agent
* [autofix.ci] apply automated fixes
* cherry-pick first commit
* cherry pick commit changes canvas
* code improvements
* fix session id null and close button
* add tests suite
* fix await error
* ruff style and checker
* feat: add pure flow-builder utilities to lfx
Add flow_builder subpackage with pure functions for manipulating
flow JSON dicts — component ops, edge creation with ReactFlow
handle format, topological layout, and dynamic field detection.
* feat: add MCP server for operating Langflow via REST API
FastMCP server exposing 15 tools across auth, flow, component,
connection, and execution groups. Agents can create flows, add
and configure components, wire connections, and run flows against
a Langflow server through MCP tool calls.
* feat: add langflow-mcp-client console script entry point
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix: use dict comprehension in setup.py to fix PERF403 lint
* fix: address PR review feedback on MCP client
- Add asyncio.Lock to prevent race condition in _client() under
concurrent access
- Handle 204 No Content responses in delete() instead of calling
resp.json() on empty body
- Fix weak assertion in test_default_values
* feat: auto-enable tool_mode when connecting component_as_tool
describe_component_type now shows component_as_tool as an output
for any component with tool_mode-capable outputs. When an agent
connects via component_as_tool, tool_mode is auto-enabled — no
extra step needed.
* refactor: move MCP server from langflow-base to lfx
The MCP server has no langflow dependencies — only httpx, mcp,
and lfx.graph.flow_builder. Moving it to lfx.mcp makes it usable
without installing langflow. Entry point: lfx-mcp.
* feat: improve MCP server UX for agents
- describe_component_type separates advanced fields from core ones
- search_component_types accepts output_type filter
- list_flows accepts query filter and includes ASCII graph repr
- get_flow_info includes ASCII graph repr
- add duplicate_flow tool
- add list_starter_projects tool
* feat: add use_starter_project tool and tests for new features
- use_starter_project creates a flow from a starter template by name
(starter projects aren't fetchable by ID via /flows/)
- Tests for duplicate_flow, starter projects, graph repr, advanced
fields, and output_type search
* docs: improve MCP tool descriptions for agent clarity
- Add server-level instructions with typical workflow guide
- Remove internal implementation details from tool descriptions
- Add cross-references between related tools
- Mention component_as_tool and graph diagrams where relevant
* docs: address subagent review feedback on tool descriptions
- Document return values for create_flow, add_component
- Clarify empty-query behavior for search_component_types
- Distinguish get_component_info (instance) vs describe_component_type (type)
- Explain connection type compatibility in instructions
- Clarify configure_component trigger field behavior
- State disconnect_components default when filters omitted
* feat: add batch tool for multi-action requests
Execute multiple actions in one call with $N.field references
to chain results. An agent can build a complete flow in a single
request instead of 6+ round trips.
* improvements UIUX
* change css canvas controls
* feat: add create_flow_from_spec tool for compact text-based flow creation
Accepts a compact text spec with nodes, edges (using real port names),
and config sections. Agents generate a simple string instead of
constructing nested JSON. Tool mode auto-enabled for component_as_tool.
Handles Prompt Template dynamic variables by parsing {var} from
template text and creating input fields. Cleans up flows on failure.
Type coercion for numeric/boolean config values.
* feat: add build_flow validation and create_flow_from_spec
build_flow validates flows by building the graph server-side.
create_flow_from_spec accepts a compact text spec with nodes,
edges, and config. Validates by default (optional).
Handles Prompt Template dynamic {variables}, auto-enables tool_mode
for component_as_tool, cleans up on failure, coerces config types.
* fix: isolate session state and harden MCP server
* pannel execution
* [autofix.ci] apply automated fixes
* fix: move test_flow_builder into tests/unit so CI collects coverage
* improve code gen
* [autofix.ci] apply automated fixes
* fix: address PR review feedback
- Fix test fixture to use contextvars instead of stale module attributes
- Raise ValueError on malformed spec lines instead of silently dropping
- Disambiguate duplicate component types in flow_graph_repr
- Narrow except Exception to ImportError in flow_graph_repr
- Add action-index context to batch error messages
- Fix stale/inaccurate docstrings (group count, "| ", field_name, category, build_flow)
- Mention create_flow_from_spec in MCP instructions
* feat: stream run_flow events via MCP progress notifications
run_flow now consumes Langflow's SSE stream and relays token events
to the MCP client via report_progress. Falls back to a regular POST
if the stream yields no result.
* test: add streaming integration tests for run_flow and stream_post
* chore: rebuild component index
* fix: Remove code execution from assistant validation path (#12244)
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* [autofix.ci] apply automated fixes
* fix: handle Message dicts in str field param processing
param_handler's str case called unescape_string on each list element
without checking if the element was a string. On subsequent agent calls,
chat history stores Message dicts in the list, causing
'dict' object has no attribute 'replace'.
Added _coerce_str_value helper that extracts .text from Message/Data/dict
objects before unescaping. Includes 4 regression tests.
* feat: add flow builder tools and propose_field_edit with JSON Patch
- builder.py: builds flow dicts from text specs using local component registry
- flow_builder_tools.py: 9 Langflow components for agent tooling
- propose_field_edit generates validated JSON Patches with dry-run verification
- flow_to_spec_summary converts flow dicts to compact summaries with IDs
- Module-level event queue for real-time UI updates during streaming
* feat: flow builder assistant with intent routing
- flow_builder_assistant.py: Python-based agent flow with 9 tools
- model_config.py: shared model config extracted from translation_flow
- Intent classifier recognizes build_flow, edit, and inspect requests
- Updated LangflowAssistant.json prompt to mention flow building
- 18 tests including graph construction and intent classification
* feat: SSE event pipeline for flow building and editing
- New SSE events: flow_update, flow_preview, flow_action (edit_field)
- assistant_service drains tool events during streaming for real-time updates
- Current flow context injected into all agent requests from DB
- Event consumer forwards flow_preview events through the pipeline
- extract_flow_json for text-based flow detection (fallback path)
* feat: frontend flow preview, edit cards, and real-time canvas updates
- FlowAction type for edit_field proposals with JSON Patch
- FlowEditCarousel: paginated Accept/Dismiss cards for field edits
- AssistantFlowPreview: mini ReactFlow canvas for new flow previews
- SSE handler dispatches flow_update and flow_preview events
- Chat hook applies flow_update events to canvas via setNodes/setEdges
- edit_field events stored as flowActions on messages for user review
- Strips flow_json blocks from visible chat content
* chore: add lfx logger to MCP server, log streaming fallback
* fix: resolve merge issues and harden flow builder state management
- Restore build_flow intent in translation prompt and LangflowAssistant system prompt
- Remove duplicate TYPE_CHECKING block from assistant_service.py (merge artifact)
- Add build_flow to intent classification plaintext fallback
- Add reset_working_flow to streaming finally block (lifecycle leak)
- Replace module-level globals with contextvars for concurrency safety
in both components/tools and mcp flow_builder_tools
- Remove dead _save_working_flow (ThreadPoolExecutor in async antipattern)
- Handle remove_component and configure flow_update actions in frontend
- Log warning when flow JSON fallback triggers instead of tool events
- Add tests for build_flow/off_topic plaintext fallback and contextvar isolation
* feat: improve flow builder UX and consolidate tool implementations
- Add worked examples to flow builder prompt (new flow + edit flow)
- Add build_flow guardrail: returns error when canvas already has components
- Change ConfigureComponent to accept JSON params dict (batch updates)
- Remove duplicate flow_builder_tools.py from components/tools
(was breaking test_get_all); single source in lfx.mcp.flow_builder_tools
- Update prompt to explicitly guide build vs edit tool selection
* fix: set_flow replaces canvas instead of appending, Python 3.10 compat
set_flow was using paste() which appends nodes with new IDs, causing
duplicates. Now uses setNodes/setEdges to replace canvas contents.
Also fixes asyncio.Barrier usage (3.11+) in concurrency test and
makes ConfigureComponent accept params as dict or JSON string since
tool frameworks may pass either.
* fix: soften build_flow guardrail and harden intent fallback parser
build_flow no longer hard-blocks on non-empty canvas. Users can now
create new flows while an existing one is open -- the prompt already
guides the agent to prefer edit tools when components exist.
Intent classification fallback now uses a strict regex pattern matching
quoted JSON values ("intent": "build_flow") instead of bare substring
matching, preventing prompt-echo misroutes on weaker models.
* feat: lock canvas while assistant is processing
Syncs the assistant panel's isProcessing state to the
assistantManagerStore so the canvas locks (effectiveLocked) while the
assistant is building or modifying the flow, preventing the user from
dragging nodes during real-time updates.
* feat: flow builder assistant with real-time canvas updates
Add flow builder assistant that builds and modifies flows directly on
the user's canvas via agent tools. SSE event pipeline streams
flow_update and flow_preview events for real-time canvas rendering.
- Flow builder tools: search, describe, add, remove, connect, configure,
build_flow, propose_field_edit with JSON Patch
- Intent classification with build_flow routing
- Per-request state isolation via contextvars
- Strict regex fallback parser for intent classification
- Canvas lock while assistant is processing
- Frontend handles add, remove, connect, configure, set_flow actions
- Flow preview and edit card components
* fix connection llm mcp
* [autofix.ci] apply automated fixes
* add flow visualization on assistant
* add manage files to assistant
* [autofix.ci] apply automated fixes
* update documentation about file
* [autofix.ci] apply automated fixes (attempt 2/3)
* reasoning thinking v0
* flow builder improvement
* [autofix.ci] apply automated fixes
* add patch to canvas, improve cache and harness
* ruff style and checker fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix tests
* fix jest tests
* UI ux improvements
* [autofix.ci] apply automated fixes
* ruff style and checker
* improve sec and harness
* ux warning banner tag assistant
* improve flow builder UI UX
* json updates
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* disable preview for many component
* fix message preview
* MCP and agent improvements
* ruff style and chceker
* fix ux display on generating artifacts
* guard rails and deterministic results improvements
* ruff style and checker
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* split flow_builder_tools, force per-user file isolation, add timeouts and guard rails
* ruff style and checker
* ruff style and checker
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* add model alert
* add padding on warning text
* [autofix.ci] apply automated fixes
* fix frontend tests
* fix credentials detection
* refactor playwright tests: remove duplicate tests and add good practices
* add send playground rule
* fix import dotenv
* fix fe tests
* fix light mode
* fix run flow test
* fix tests failing
* fix folder deletion test
* fix e2e tests
* constant text on tests
* fix publish test
* fix publish tests
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* test: standardize new-project-flow helper into utils/flow
Follow-up to the cz/playwright-tests-refactor merge — align the
new-project-flow helper our branch added with the refactor's directory
and constants conventions:
- Move tests/utils/new-project-flow.ts -> tests/utils/flow/, next to the
refactor's open-blank-flow / open-starter-project helpers; update the
15 import sites.
- Use TID / TIMEOUTS constants inside the helper instead of raw
test-id strings and literal 30000 timeouts, matching open-blank-flow.
- Drop an unused zoomOut import in auto-login-off.spec.ts.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test: assert New Flow button by test-id, not substring text match
The merge resolution kept the refactor's `expect(...).toBeVisible()`
assertion but on `getByText("New Flow")`, which is a substring match —
it also matches flow cards named "New Flow (N)" and throws a strict-mode
violation once such flows exist. Our previous side used a no-op
`.isVisible()` that silently masked it.
Assert on `getByTestId(TID.newProjectBtn)` instead: unambiguous,
DB-state independent, and consistent with the refactor's test-id-first
convention. Verified — actionsMainPage-shard-1 (3/3) and run-flow now
pass against a populated database.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix windows utf open
* assistant message fixes
* [autofix.ci] apply automated fixes
* add tests to validate
* [autofix.ci] apply automated fixes
* bugfixes round 2
* ruff style and checker
* qa fixes
* parse serialized model
* improvement on agent tool usage
* [autofix.ci] apply automated fixes
* ruff style and checker
* [autofix.ci] apply automated fixes
* fix sidebar nav test
* backend tests fixes
* fix tests and change model provider to open dialog
* performance improvements
* [autofix.ci] apply automated fixes
* ruff style and checker fix
* tests fixes
* fix error handling test
* test user overlay
* fix test tool mixin
* last improvements
* ruff style fix
* [autofix.ci] apply automated fixes
* fix user test agentic
* QA fixes round 7
* fix assistant gpt 5.4
* [autofix.ci] apply automated fixes
---------
Co-authored-by: cristhianzl <cristhian.lousa@gmail.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Edwin Jose <edwin.jose@datastax.com>
Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com>
Co-authored-by: Rodrigo Nader <rodrigonader@MacBook-Pro-de-Rodrigo.local>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
