mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-24 21:21:31 +08:00
memory-base-component
331 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
| b9e81f6edd | Merge remote-tracking branch 'origin/main' into release-1.10.0 | |||
| 0732423f27 |
chore: security patch (#12725)
* chore: security patch security patch * chore: upgrade package-lock.json * chore: smolagents and transformer update * chore: redis upgrade * chore: litellm upgrade * fix: Pin click to avoid lower versions ## Root cause **litellm 1.83.5+** introduced an exact pin `click==8.1.8` in its `requires_dist` (upstream bug [BerriAI/litellm#26154](https://github.com/BerriAI/litellm/issues/26154) — "Pinning exact dependency versions breaks downstream consumers"). When this branch bumped litellm to 1.83.11, uv was forced to downgrade click from 8.3.2 → 8.1.8. Click 8.2+ captures stderr separately by default; 8.1 merges it — hence `ValueError: stderr not separately captured`. ## Fix - [pyproject.toml:155](pyproject.toml:155) — added `"click>=8.3.0"` to `[tool.uv] override-dependencies` with comment linking the upstream issue. - [src/backend/base/pyproject.toml:112](src/backend/base/pyproject.toml:112) — same override so `langflow-base` Docker builds pick it up too. - Regenerated `uv.lock` (click: 8.1.8 → 8.3.3). - Patched the `click` entry in `src/backend/base/uv.lock` to 8.3.3 (that lockfile is used by `docker/build_and_push_base.Dockerfile` via `uv sync --frozen`; uv treats backend/base as a workspace member so I updated its click block directly — no other references to 8.1.8 remain). - Reverted [src/lfx/tests/unit/cli/test_run_real_flows.py](src/lfx/tests/unit/cli/test_run_real_flows.py) back to its original `result.stderr` usage — now passes cleanly with click 8.3.3. All 19 tests in the file pass. * Update build_and_push_backend.Dockerfile The `uv pip install` command doesn't read `[tool.uv] override-dependencies` from the target packages' pyproject.toml — those overrides only apply during `uv lock`/`uv sync`. The fix is to pass the overrides explicitly via `--overrides`. Now let me verify it works by running the same install locally. Resolution succeeded — click==8.3.3, aiohttp==3.13.5, litellm==1.83.11 all coexist. Let me also test without `--overrides` to confirm I reproduce the original failure. Reproduced the Docker failure locally. Now test with the overrides file: Fix verified — resolution succeeds with the overrides file, failing without. Let me clean up and show the final Dockerfile change. ## Summary **Root cause:** The Dockerfile uses `uv pip install ./src/...` which **does not read** `[tool.uv] override-dependencies` from the target packages' `pyproject.toml` — those overrides only apply during `uv lock`/`uv sync`. On Linux, `cuga>=0.2.20` requires `aiohttp>=3.13.5`, but `litellm==1.83.11` exact-pins `aiohttp==3.13.3` (same upstream bug as the click pin, [BerriAI/litellm#26154](https://github.com/BerriAI/litellm/issues/26154)). Without an active override, resolution fails. **Fix:** Write a `/tmp/uv-overrides.txt` file mirroring the workspace's `override-dependencies` (litellm, python-dotenv, openai, aiohttp, click) and pass `--overrides /tmp/uv-overrides.txt` to `uv pip install`. Verified locally by reproducing the exact failure in an isolated tmp directory (to escape the workspace's pyproject.toml auto-apply), then confirming the overrides file resolves it: - aiohttp==3.13.5 ✓ - click==8.3.3 ✓ - litellm==1.83.11 ✓ - cuga==0.2.22 ✓ * Templates version update * Update .secrets.baseline * chore: update overrides * chore: bump version * chore: bump main version * chore: bump SDK version to 0.1.1 * chore: run uv lock and uv sync after SDK version bump * chore: read the overrides from a single source security patch * chore: add pip check toggle add pip check toggle * chore: litellm base uv.lock update * fix(chore): Pin litellm back to last working release * fix(chore): Pin to 1.83 and higher litellm * Update build_and_push_backend.Dockerfile * chore: update base uv.lock * fix: lazyload toolguard since its an optional extra * Update .secrets.baseline * Update component_index.json * Rebuild component index * Update component_index.json --------- Co-authored-by: Eric Hare <ericrhare@gmail.com> Co-authored-by: vijay kumar katuri <vijay.katuri@ibm.com> (cherry picked from commit 60a8f76c3fde17124057626c671ea8162872837a) |
|||
| 957ade8880 |
chore: upgrade wxo adk to 2.8.0 (#12707)
* chore: update wxo adk (2.8.0)
* make sure all sites use the helper
* revert tests
* remove thin helper and use adk directly
(cherry picked from commit
|
|||
| 9d84ec14d9 |
chore: version bump 1.10.0
version bump langflow: 1.10.0 langflow-base: 0.10.0 lfx: 0.5.0 langflow-sdk: 0.2.0 |
|||
| da516b7045 | Merge release branch | |||
| 38d142a723 |
fix: Upgrade cuga to 0.2.20 to resolve playwright dependency conflict (#12703)
* fix: upgrade playwright to 1.58.0 to address Chromium CVEs - Add playwright>=1.58.0 to override-dependencies in pyproject.toml - Update uv.lock: playwright 1.49.0 -> 1.58.0, pyee 12.0.0 -> 13.0.1 - Fixes CVE-2026-2313, CVE-2026-2314, CVE-2026-2315, CVE-2026-2319, CVE-2026-2321, CVE-2026-2441, CVE-2026-2648, CVE-2026-2649 - Ensures Docker builds download updated Chromium with security patches * fix: update npm to latest version to address brace-expansion CVE-2026-33750 - Add npm update after Node.js installation in Dockerfile - Fixes CVE-2026-33750 in system npm's brace-expansion dependency - System npm had brace-expansion 2.0.2, update gets 5.0.5+ - Low risk change: npm is backward compatible, only affects CLI tool * revert: remove npm update from Dockerfile - npm update attempts were causing CI build failures - Bundled npm has issues but updating it is proving problematic - Focus on playwright CVE fix which is the primary concern - brace-expansion CVE-2026-33750 is lower priority (DoS only) * chore: sync uv.lock files sync uv.lock files * fix(mcp): dedupe edges in connect_components (#12701) * fix(mcp): make add_connection idempotent to avoid duplicate edges connect_components used to append a new edge unconditionally. Because the edge id is deterministic from source/target/handles, calling it for a pair the flow already had wired up (UI-then-MCP, batch retry, or just a repeat call) produced a second edge with the same id, double-wiring the flow at runtime. Before appending, scan the existing edges for one with the same id and return that instead. Different outputs/inputs between the same pair still produce distinct ids and remain supported. * test(mcp): cover dedupe against UI-saved edges, broaden match key Older Langflow UIs saved edges with an `xy-edge__` id prefix instead of the current `reactflow__edge-`, so an id-based dedup would miss the UI-then-MCP case for any flow that came from an older version. Switch the existence check to a structural one (source, target, sourceHandle name, targetHandle fieldName) so the same logical connection dedupes regardless of id format. Add a fixture-driven test that loads MemoryChatbotNoLLM.json (an xy-edge-prefixed flow) and replays each connection through add_connection, asserting the edge count does not grow. * fix(mcp): validate_flow fast-fails and reports partial errors (#12697) * fix(mcp): validate_flow fast-fails and reports partial errors validate_flow polled /monitor/builds for up to 30 seconds waiting for every component to finish before reporting errors. When a component fails early (for example a missing required field), downstream components never run, so the loop waited out the full window and returned just "Build timed out: N/M components completed" with no actionable context. - Short-circuit as soon as any completed build reports valid: false; return those errors immediately instead of polling on. - On timeout, include the errors from the builds that did complete plus a component_count so the caller can see progress. - Extract _collect_build_errors so the poll loop and timeout branch share the same error shape. * fix(mcp): stream validate_flow build inline instead of polling The previous implementation triggered an async build and polled /monitor/builds, which depended on FastAPI BackgroundTasks firing the log_vertex_build calls after the trigger request had returned. Under ASGI test transport these tasks never run, so /monitor/builds stayed empty and validate_flow timed out with component_count=0. Switch to event_delivery=direct so the build streams its events back inside the same request: - Drive the build via client.stream_post and aggregate per-vertex results from end_vertex events. - Fast-fail on the first vertex with valid=false, since downstream vertices depend on it and would not produce useful information. - Surface top-level error events as a single flow-level error. - Replace _collect_build_errors with _extract_vertex_error, which reads the structured error payload from the end_vertex outputs. Update the lfx unit tests to use the streaming shape and tighten the backend integration test to assert real success now that the build actually runs end to end under ASGI. * fix(graph): make end_all_traces_in_context Python 3.10 compatible The implementation called asyncio.create_task(coro, context=context), but the context= keyword was added to create_task in Python 3.11. On 3.10 it raised TypeError. The bug was latent because nothing in the test suite previously consumed a streaming build response far enough for Starlette to dispatch the post-response BackgroundTasks where this code lives. The validate_flow streaming change exposes it. On 3.10, route the create_task call through context.run so the new Task copies the captured context as its current context, matching the isolation the 3.11 path provides via the context= kwarg. Add a regression test that asserts end_all_traces sees the value of a contextvar set before the context was captured, even after the caller mutates that var. * fix: failing wxo list llm test (#12700) patch service layer and update failing test * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * Try to fix the missing typer import --------- Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com> Co-authored-by: Gabriel Luiz Freitas Almeida <gabriel@logspace.ai> Co-authored-by: Hamza Rashid <74062092+HzaRashid@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| 19df4606ae |
chore: update deps (#12657)
* chore: update deps update deps due to sec vuln * chore: langchain-core>=1.2.28 langchain-core>=1.2.28 * chore: update pypdf pypdf 6.10 * chore: pyarrow, openai, litellm, mem0ai, toolguard picomatch, pyarrow, openai, litellm, mem0ai, toolguard * chore: override litellm * chore: match base uv.lock to root * chore: update tool.uv position update tool.uv position * chore: langflow-base[complete]>=0.9.0 langflow-base[complete]>=0.9.0 * chore: revert pyarrow revert pyarrow * chore: revert "lfx~=0.4.0", * chore: lfx white space * chore: remove allow-direct-references = true * chore: uv lock --upgrade after merge |
|||
| 95d4c94ef9 |
fix: upgrade playwright to 1.58.0 to address Chromium CVEs (#12668)
* fix: upgrade playwright to 1.58.0 to address Chromium CVEs - Add playwright>=1.58.0 to override-dependencies in pyproject.toml - Update uv.lock: playwright 1.49.0 -> 1.58.0, pyee 12.0.0 -> 13.0.1 - Fixes CVE-2026-2313, CVE-2026-2314, CVE-2026-2315, CVE-2026-2319, CVE-2026-2321, CVE-2026-2441, CVE-2026-2648, CVE-2026-2649 - Ensures Docker builds download updated Chromium with security patches * fix: update npm to latest version to address brace-expansion CVE-2026-33750 - Add npm update after Node.js installation in Dockerfile - Fixes CVE-2026-33750 in system npm's brace-expansion dependency - System npm had brace-expansion 2.0.2, update gets 5.0.5+ - Low risk change: npm is backward compatible, only affects CLI tool * revert: remove npm update from Dockerfile - npm update attempts were causing CI build failures - Bundled npm has issues but updating it is proving problematic - Focus on playwright CVE fix which is the primary concern - brace-expansion CVE-2026-33750 is lower priority (DoS only) --------- Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> |
|||
| 34886de048 |
fix: Updated Pillow minimum version (#12609)
* fix(frontend): enforce brace-expansion override * fix: enforce handlebars version >=4.7.9 in frontend overrides * fix: update Pillow minimum version to 12.1.1 --------- Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> |
|||
| 499815a630 |
feat: add policies component for tool protection via ToolGuard (#12592)
* feat: add policies component for tool protection via ToolGuard Reintroduce the policies component from #12564 (originally by @boazdavid). Adds policy-based tool protection system with business policy enforcement using ToolGuard, including guard code generation from policy definitions, support for multiple language models, and enhanced tool metadata. Adds toolguard>=0.2.4 dependency and click>=8.3.2 override. * [autofix.ci] apply automated fixes * Update dependencies for new toolguard * Update component_index.json * Update uv.lock --------- Co-authored-by: DAVID BOAZ <DAVIDBO@il.ibm.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 9cdbf1b23d |
Revert: policies component (#12564) (#12585)
* Revert "feat: boazdavid policies component added (#12564)"
This reverts commit
|
|||
| 64f84ab0ea |
feat: boazdavid policies component added (#12564)
* feat: @boazdavid policies component added * Update component_index.json * [autofix.ci] apply automated fixes * Update component_index.json * Update component_index.json --------- Co-authored-by: DAVID BOAZ <DAVIDBO@il.ibm.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| b905ea1c4a |
fix: Added dependency updates for security and bug fixes (#12543)
* security: upgrade vulnerable dependencies with override enforcement - Add security overrides for orjson, gunicorn, pypdf, nltk, markdown, dynaconf, pillow - Update base pyproject.toml: pillow>=12.0.0, pypdf>=6.9.0 - Selective upgrade: only orjson (3.11.7->3.11.8) and pillow (11.3.0->12.2.0) - Resolves 7/8 flagged CVEs (diskcache awaiting upstream fix) - Defense-in-depth: TOML minimums + override enforcement * chore: update dependencies for security and bug fixes - Update aiohttp to >=3.13.4 (security fix) - Update pyarrow to >=19.0.1,!=22.0.0 (exclude buggy 22.0.0) - Update playwright to ^1.59.1 (from ^1.57.0) - Add picomatch >=4.0.4 to npm overrides - Add cuga upper bound <0.3.0 for stability All tests passing (212 suites, 3,104 tests) * chore: reapply dependency updates after merge - Add aiohttp>=3.13.4 to override-dependencies (security fix) - Maintain pyarrow>=19.0.1,!=22.0.0 (exclude buggy 22.0.0) - Maintain playwright^1.59.1 (updated from ^1.57.0) - Maintain picomatch>=4.0.4 in npm overrides - Maintain cuga>=0.2.10,<0.3.0 for stability * chore: add playwright to npm overrides - Add playwright ^1.59.1 to overrides to ensure consistent version across all dependencies * chore(deps): upgrade litellm to 1.80.0 - Updated litellm from >=1.60.2 to >=1.80.0 in langflow-base - Maintains compatibility with openai 1.x (requires >=1.99.5) - Includes security fixes and performance improvements - All existing security overrides maintained (aiohttp, pillow, picomatch) - pyarrow kept at current version for Google Vertex AI compatibility * chore: regenerate uv.lock after merge with release-1.9.0 - Resolved merge conflict in uv.lock - Regenerated lock file with litellm 1.80.0 - Includes latest component index updates from release-1.9.0 --------- Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com> Co-authored-by: Carlos Coelho <80289056+carlosrcoelho@users.noreply.github.com> |
|||
| 4f9beebc00 |
fix: add trailing newline to component_index.json (#12545)
The build_component_index.py script was generating component_index.json without a trailing newline, causing CI failures when autofix.ci tried to add the missing newline. This fix ensures the generated JSON file always ends with a newline character, following POSIX text file standards. Fixes the 'No newline at end of file' error in the update-component-index workflow job. |
|||
| f557b06c3b |
fix: upgrade vulnerable dependencies with override enforcement (#12526)
security: upgrade vulnerable dependencies with override enforcement - Add security overrides for orjson, gunicorn, pypdf, nltk, markdown, dynaconf, pillow - Update base pyproject.toml: pillow>=12.0.0, pypdf>=6.9.0 - Selective upgrade: only orjson (3.11.7->3.11.8) and pillow (11.3.0->12.2.0) - Resolves 7/8 flagged CVEs (diskcache awaiting upstream fix) - Defense-in-depth: TOML minimums + override enforcement Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> |
|||
| 66c206740e |
fix: upgrade fastmcp to 3.2.0 to fix SSRF vulnerability (CVE) (#12516)
security: upgrade fastmcp to 3.2.0 to fix SSRF vulnerability (CVE) Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> |
|||
| d6c2ec3ab7 |
feat: Remove deprecated Astra Assistants to support latest docling package versions (#12442)
* feat: Latest docling package versions * [autofix.ci] apply automated fixes * Template updates * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * Update uv.lock * Update uv.lock * Template update * Revert the changes to starter projects * Revert the changes to starter projects * Update component_index.json * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * Update test_dynamic_import_integration.py * Update component_index.json * Restore versioned docs * Lessen the scope of the version updates * Update component_index.json * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 63e6a1d269 |
fix: upgrade dependencies to address CVE vulnerabilities (#12470)
security: upgrade dependencies to address CVE vulnerabilities Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> |
|||
| 45325f6376 |
feat: Langflow SDK and Flow DevOps API Toolkit (#12245)
* feat(sdk): add langflow-sdk Python client package * feat(lfx): add Flow DevOps CLI toolkit * feat(api): add flow upsert, export normalization, ZIP upload * chore: CI coverage merge, Docker fixes, dependency updates * Address CQ5 review / import bug * Update test_status_command.py * Update test_status_command.py * Fix more tests * Review edits * Review edits * Fix tests * Follow up review updates * Refactor common client code * Update templates and comp index * [autofix.ci] apply automated fixes * Update test_database.py * Updates from review comments * Fix push interface to match the rest * Update push.py * Update push.py --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 9f255dc851 |
chore: remove mypy from CI (#12448)
chore: remove mypy from CI and dev dependencies mypy hasn't caught issues in a long time due to its lenient config (follow_imports=skip, ignore_missing_imports=true). We evaluated ty as a replacement but it lacks Pydantic and SQLModel support, producing too many false positives. Removing the type checker until a viable alternative matures. |
|||
| 811ac4b3e3 |
chore: bump versions
bump versions |
|||
| 9543d7d31f |
feat: MCP server for operating Langflow via REST API (#12237)
* feat: add pure flow-builder utilities to lfx Add flow_builder subpackage with pure functions for manipulating flow JSON dicts — component ops, edge creation with ReactFlow handle format, topological layout, and dynamic field detection. * feat: add MCP server for operating Langflow via REST API FastMCP server exposing 15 tools across auth, flow, component, connection, and execution groups. Agents can create flows, add and configure components, wire connections, and run flows against a Langflow server through MCP tool calls. * feat: add langflow-mcp-client console script entry point * fix: use dict comprehension in setup.py to fix PERF403 lint * fix: address PR review feedback on MCP client - Add asyncio.Lock to prevent race condition in _client() under concurrent access - Handle 204 No Content responses in delete() instead of calling resp.json() on empty body - Fix weak assertion in test_default_values * feat: auto-enable tool_mode when connecting component_as_tool describe_component_type now shows component_as_tool as an output for any component with tool_mode-capable outputs. When an agent connects via component_as_tool, tool_mode is auto-enabled — no extra step needed. * refactor: move MCP server from langflow-base to lfx The MCP server has no langflow dependencies — only httpx, mcp, and lfx.graph.flow_builder. Moving it to lfx.mcp makes it usable without installing langflow. Entry point: lfx-mcp. * fix: isolate session state and harden MCP server * fix: move test_flow_builder into tests/unit so CI collects coverage * fix: add trailing slash to /api_key endpoint in MCP client login The FastAPI endpoint redirects /api_key to /api_key/ (307) and httpx drops the POST body on redirect, causing API key creation to fail silently during login. * fix: isolate session state and harden MCP server contextvars alone lose state between stdio tool calls. Add module-level fallback so login credentials persist across calls while still supporting per-session isolation for SSE transport. * fix: update test fixture to use contextvars-based server API The mcp_client fixture was accessing mcp_server_module._client and ._registry directly, but these were replaced with contextvars (_client_var, _shared_client, _set_client, etc.) in the server module refactor. * [autofix.ci] apply automated fixes * fix: add connection type validation and fix session isolation - add_connection() now enforces type compatibility using the Graph's types_compatible() when types are resolved from the flow. Explicit types bypass validation (caller takes responsibility). - Session state uses only contextvars, removing _shared_client and _shared_registry globals that leaked between SSE sessions. - login() wraps old client close in contextlib.suppress so a failed close doesn't prevent establishing a new session. --------- Co-authored-by: Eric Hare <ericrhare@gmail.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 4a9866696c |
deps: add official wxo client package to langflow-base complete (#12383)
* feat: add official wxo adk to langflow-base complete * remove stale comment * remove from complete installation. wait for feature flag to be dropped * add extra to complete installation * add core package as explicit dependency because it is used directly * add temporary fix for adk regression |
|||
| b09b3ebae6 |
chore: update deps due to security vulnerabilities (#12371)
* chore: update deps due to security vulnerabilities update deps due to security vulnerabilities found by mend scan done by openrag team * chore: run npm audit fix run npm audit fix * chore: safe uv audit changes safe uv audit changes * chore: safe 2 safe 2 * chore: safe upgrades 3 safe upgrades 3 * chore: pin "langgraph-checkpoint>4.0.0,<5.0.0", pin "langgraph-checkpoint>4.0.0,<5.0.0", |
|||
| 1f7341931b |
ref: add feature flag around BE wxo deployments (#12365)
* Add feature flag around BE wxo deployments * remove old comment * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix: improve consistency in feature flag logging and api - Use consistent DEBUG log level for disabled-flag path in both register_builtin_adapters and register_builtin_deployment_mappers - Remove dead __getattr__ lazy-load hook and deployment_router from __all__ in api/v1/__init__.py (no internal callers remain) - Change _ensure_deployments_enabled_for_filters from 404 to 400 with descriptive error message naming the wxo_deployments feature flag --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Hamza Rashid <hzarashid@gmail.com> |
|||
| 42832d07a5 |
feat: add core deployment implementation (#12108)
* checkout api handlers
* add missing table
* update to use "version" terminology for flows instead of outdated "history" verbage
* Fix provider account id mapping
* recover a little todo comment
* Add flow version migration and minor exception handling, etc
1. deployments.py — Added AuthenticationError import + handling (401) in all 9 error handler blocks. Added update_deployment_db import + call to persist name changes to local DB after adapter update succeeds.
2. flow_version/exceptions.py — Added FlowVersionDeployedError for blocking deletion of deployed versions.
3. flow_version/crud.py —
- Added has_deployment_attachments() helper that checks if a flow version has any deployment attachments
- delete_flow_version_entry() now raises FlowVersionDeployedError if the version is attached to deployments
- Pruning now excludes deployed versions via a NOT IN subquery on FlowVersionDeplottachment, preventing provider-side snapshot orphaning
4. flow_version/__init__.py — Exports FlowVersionDeployedError
5. flow_version.py (API route) — Imported FlowVersionDeployedError, added it to _translate_version_error as 409 Conflict
6. models/__init__.py — Registered FlowVersionDeploymentAttachment for alembic/SQLModel metadata detection
7. Migration c0d2ce43b315 — Creates flow_version_deployment_attachment table with all columns, FKs (CASCADE), and indexes. Single head, chains off fc7f696a57bf.
* [autofix.ci] apply automated fixes
* address bugs and inconsistencies
* rename column to "provider_snapshot_id"
* harden deployment API: fail loudly on invalid state instead of silently passing
Replace silent fallbacks, warning logs, and dropped values with hard
failures (422/500/502) across the deployment orchestration layer. Adds
logging to bare exception handlers and wraps materialize_snapshots in
the adapter error handler.
* [autofix.ci] apply automated fixes
* add materialize_snapshots to deployment service protocol
Promotes materialize_snapshots from duck-typed getattr usage to a
first-class method on DeploymentServiceProtocol, BaseDeploymentService,
and the no-op DeploymentService stub. Introduces MaterializeSnapshotsResult
schema for typed return values.
Updates deployments.py to call the method through the protocol instead of
getattr, giving static analysis coverage over the contract.
Documents the snapshot abstraction across BaseFlowArtifact, SnapshotItem,
MaterializeSnapshotsResult, and FlowVersionDeploymentAttachment.provider_snapshot_id
— explaining that snapshots are immutable, provider-owned copies of flow data
with opaque provider-assigned identifiers (e.g. wxO tool ID, K8s ConfigMap
name, S3 key).
* deployment sync: extract helpers, server-side type filter, orphan detection
- Extract _fetch_provider_resource_keys helper for provider validation
- Rename _sync_page_with_provider → _list_deployments_synced
- Match resource keys by provider ID only (not name)
- Restore server-side deployment_type filter with guard against
false deletions (skip rows whose type doesn't match the filter
instead of deleting them)
- Add orphan/divergence logging for post-create, post-update,
post-duplicate DB write failures
- Return 422 on invalid UUID in update remove list (was silently ignored)
- Handle NotImplementedError → 501 from provider adapters
- Convert attachment IntegrityError to ValueError with descriptive message
- Add tests for sync helpers (15 cases)
* rebase on release-1.9.0 and align with lfx/services
* refactor(deployments): align provider mapper routing and WXO update payload mapping
Align deployment mapper resolution with adapter-type/provider-key routing and
refactor PATCH update handling to use mapper resolve/shape contracts end-to-end.
Map Langflow flow_version_id references at the API boundary into provider update
operations for Watsonx bind/unbind/remove paths, with expanded mapper tests.
* patch down-revision
* first pass with formalized boundary rules
* fix(deployments): harden watsonx payload boundary contracts
Enforce fail-fast payload slot parsing for required adapter results, split execution create/status slot contracts, and route execution-create mapping through deployment mappers.
Require watsonx flow artifact source_ref and move update reconciliation output to provider_result to keep mapper/adapter boundaries explicit and typed.
* refactor(deployments): modularize watsonx orchestrate create/update flow
Extract create/update logic into dedicated core modules with shared helpers to tighten deployment boundary contracts.
Align backend/lfx payload schema mapping and expand e2e/unit coverage for response mapping and update schema behavior.
* api impl for wxo-specific create payload
* further refactoring. add rollback of existing tools (undo new app bindings) in the create path
* add todo in execution.py
* refactor(deployments): replace snapshot_id/reference_id with source_ref-correlated tool refs
Introduce WatsonxToolRefBinding to correlate source_ref (flow version id)
with provider tool_id across all operation types. This replaces the prior
reference_id and snapshot_id fields with a unified structure that carries
provenance through create, bind, unbind, and remove_tool operations.
Key changes:
- Flatten API operation payloads: hoist flow_version_id onto operations,
remove nested WatsonxApiUpdateToolReference wrapper
- Replace tools.existing_ids with inline tool_id_with_ref on bind operations
- Rename WatsonxCreateSnapshotBinding to WatsonxToolRefBinding (input) and
WatsonxResultToolRefBinding (output, with created flag)
- Add created_app_ids to update results for connection tracking
- Raise HTTPException on contract violations in _to_api_tool_app_bindings
instead of silently dropping unmappable bindings
- Add schema-level validation for conflicting source_ref on same tool_id
- E2E: cache tool_id→source_ref from create results, use helpers to build
refs with distinct source_ref vs tool_id values
* Enforce DeploymentType enum and add description column
Make deployment_type a required column backed by a SQLAlchemy
TypeDecorator that validates on write (rejects None and invalid strings)
and coerces to DeploymentType on read. Add nullable description column
to the deployment model and surface it through the API.
Key changes:
- Add _DeploymentTypeColumn TypeDecorator for enum round-trip fidelity
- Make deployment_type non-optional in Deployment model, DeploymentRead,
CRUD functions, and API layer
- Add description (Text, nullable) to Deployment model and fold its
migration into the existing c0d2ce43b315 revision
- Remove _resolve_deployment_type helper — TypeDecorator handles coercion
- Remove DeploymentType fallbacks and backward-compat shims from API
endpoints, base mapper, and watsonx orchestrate mapper
- Document cross-package coupling: DeploymentType is owned by lfx but
persisted by langflow; member values must never be removed
- Fix pre-existing bug: provider_account_id → deployment_provider_account_id
in get_deployment_status endpoint
Note: deployment_type is nullable=True at the DB level to satisfy the
EXPAND-phase migration validator; NOT NULL is enforced at the application
layer by the _DeploymentTypeColumn TypeDecorator.
* refactor(deployments): extract route helpers, harden sync and error handling
Move bulk of deployment route logic into mappers/helpers layer to slim
down deployments.py and enforce clearer boundary between routes, mappers,
and adapters (documented in DEPLOYMENT_BOUNDARY_RULES.md).
Key changes:
- Extract ~700 lines from deployments.py into helpers.py (pagination,
adapter/mapper resolution, attachment management, snapshot sync,
rollback, response shaping)
- Add read-path snapshot-level sync: get_deployment and
list_deployments_synced verify provider_snapshot_ids against the
provider and prune stale attachments, with graceful fallback on error
- Add compensating rollback for create (rollback_provider_create) and
update (rollback_provider_update) when DB commit fails after provider
mutation, using mapper-driven payload reconstruction
- Introduce handle_adapter_errors() context manager centralising
DeploymentServiceError → HTTP status mapping via
http_status_for_deployment_error; sanitise 500 detail to avoid
leaking internals
- Add DeploymentNotConfiguredError → 503 mapping
- Add util_snapshot_ids_to_verify and resolve_rollback_update to base
mapper with WxO overrides for provider-specific snapshot ID extraction
and put_tools-based rollback payloads
- Add put_tools field to WatsonxDeploymentUpdatePayload for full tool
list replacement; early-return in build_provider_update_plan and
validate_operation_references when put_tools is set
- Extract verify_tools_by_ids into core/tools.py helper
- Harden resource_name_prefix with strip_whitespace + min_length=1
- Deduplicate snapshot_ids before provider calls
- Add deterministic order_by(created_at) to attachment CRUD queries
- Add exc_info=True to all best-effort rollback/compensate error logs
- Add session.rollback() in get_deployment snapshot sync error path
- Warn when list_snapshots receives both deployment_ids and snapshot_ids
- Add E2E scenarios for empty snapshot list, mixed snapshot IDs, tools
endpoint, and deployment re-list after update
Tests:
- Add test_deployment_route_handlers.py covering stale-row delete +
commit, non-404 adapter errors, handle_adapter_errors wiring,
snapshot sync (happy path, skip, error fallback), project-scoped
flow version validation for create and update
- Expand test_deployment_sync.py with snapshot-phase tests, rollback
tests, pagination guard, and project-scoped validation
- Add deployment_type assertion to response mapping test
- Add DeploymentNotConfiguredError and bare DeploymentServiceError cases
to exception mapping tests
- Add put_tools schema and update plan tests
* remove pompous performance commentary
* fix(deployments): remove upsert behavior and fail fast on duplicate name
The create_deployment endpoint previously performed a
get_deployment_by_resource_key lookup before inserting the DB row,
silently tolerating duplicates. Since the provider adapter returns a
fresh resource ID on every create, this lookup could never legitimately
match — and if it did, it would mask a data inconsistency bug.
Changes:
- Remove the get-or-create (upsert) pattern; go straight to
create_deployment_db and let the unique constraint surface conflicts.
- Add deployment_name_exists CRUD function and an early 409 guard so
duplicate names are rejected before any provider call, avoiding
costly provider-side rollback for a locally-checkable condition.
- Update existing route-handler tests to reflect the removed lookup.
- Add tests for deployment_name_exists and the 409 duplicate-name path.
* feat: convert provider_key and deployment_type columns to DB-level enums
Replace plain string columns with SQLAlchemy Enum types backed by
Postgres/SQLite enum constraints, enforcing valid values at the DB
layer rather than only in application code.
Migration follows expand-contract pattern (add enum column, backfill,
drop old string column, rename) with index ops outside batch context
to avoid SQLite column-lookup issues. Upgrade and downgrade are fully
atomic.
- Add DeploymentProviderKey enum as single source of truth for
provider identifiers; remove magic strings and _DeploymentTypeColumn
TypeDecorator
- Make provider_key immutable after creation (remove from update
request schema and API handler)
- Fix pre-existing test gap: add missing deployment_type argument to
all TestDeploymentCRUD create_deployment() calls
* feat(flow-versions): add deployment awareness and sync-on-read
Add is_deployed field to flow version responses and provider-verified
sync to the list/get read paths, matching the existing deployment
endpoint sync pattern.
API changes:
- list_flow_versions returns is_deployed per entry and accepts optional
deployment_ids filter to scope by specific deployments
- get_single_flow_version returns is_deployed on the full response
- Both endpoints now use write sessions and run best-effort
snapshot-level sync before returning results
Sync-on-read (helpers.sync_flow_version_attachments):
- Queries all attachments for a flow's versions joined with deployment
and provider account info in a single query
- Groups by provider, resolves adapter/mapper per group, verifies
provider_snapshot_ids via list_snapshots, and prunes stale attachment
rows through the existing sync_attachment_snapshot_ids helper
- Per-provider error handling so one provider outage doesn't block the
response
New CRUD: list_attachments_for_flow_with_provider_info joins
FlowVersionDeploymentAttachment -> Deployment -> DeploymentProviderAccount
to avoid N+1 queries during sync grouping.
Tests: 50 passing (11 new) covering is_deployed indicator, deployment_ids
filtering, stale attachment pruning on list/get, and sync failure
resilience.
* Add user id authentication to a few missing endpoints
* [autofix.ci] apply automated fixes
* Update tests
Removes some mock tests that did nothing
Adds sqlite for true testing of db accessors
Reduces Mock objects usage
* refactor(deployments): enforce ownership boundaries on execution responses
Move provider-owned execution identifiers (execution_id, agent_id,
status, timestamps, errors) out of the top-level API response and into
provider_data, keeping only Langflow-owned fields (deployment_id) at the
top level. This prevents future collisions if Langflow introduces its
own execution tracking.
Key changes:
- Remove execution_id from _ExecutionResponseBase; provider's opaque
run identifier now lives exclusively inside provider_data
- Rename WatsonxExecutionResultData → WatsonxAgentExecutionResultData
(adapter layer) and split the API-layer class into a private base
(_WatsonxApiAgentExecutionResultBase) with dedicated
WatsonxApiAgentExecutionCreateResultData and
WatsonxApiAgentExecutionStatusResultData subclasses
- Translate WXO run_id → execution_id at the adapter boundary
(create_agent_run_result / get_agent_run).
- Collapse util_execution_id + util_execution_deployment_resource_key
into a single util_resource_key_from_execution that trusts the
adapter-provided result.deployment_id directly
- Remove build_orchestrate_runs_query and extra payload fields
(thread_id, llm_params, guardrails, etc.) unused in MVP
- Simplify WxOClient.post_run signature (drop query_suffix)
- Exclude provider_data from flow tool artifact to avoid unexpected
top-level keys in the WxO tool runtime
- Document ownership boundary rules in DEPLOYMENT_BOUNDARY_RULES.md §14
- Add E2E polling for terminal execution status, input format variants,
and missing-deployment negative test
- Expand unit tests for renamed schemas, field mapping, passthrough
validation, and simplified payload builder
* feat: add name column to deployment_provider_account
Add a required, user-chosen display name to provider accounts
(e.g. "staging", "prod") that is unique within a given provider_key.
Includes model, CRUD, API schema/route, mapper, migration with
backfill, and tests.
* fix: replace hand-written migration with Alembic-generated revision
Replace the manually authored migration (b4e6f8a2c1d3) with an
Alembic-generated one (8255e9fc18d9) for the deployment_provider_account
name column.
Fix SQLite compatibility: sa.func.concat() generates a concat() function
call which does not exist in SQLite. Use sa.literal().concat() instead,
which produces the || operator and works on both PostgreSQL and SQLite.
* remove bogus unverified math from migration file
* feat: verify provider credentials before account creation
Add a verify_credentials step to the provider account creation flow
that validates API keys against the provider before persisting them.
This prevents storing invalid or revoked credentials and gives users
immediate feedback.
Key changes:
- Add verify_credentials to the deployment adapter interface (base,
service, protocol) with WXO implementation that obtains a token
via the IBM authenticator
- Add SSRF-hardened URL validation for provider_url (HTTPS-only,
private IP blocklist, localhost rejection, normalization)
- Introduce ValidatedUrl/ValidatedUrlOptional annotated types in
the API schema layer
- Refactor raise_for_status_and_detail to accept an optional cause
parameter for explicit exception chain control
- Use ResourceNotFoundError (parent) instead of DeploymentNotFoundError
in raise_for_status_and_detail for provider-agnostic 404 mapping
- Narrow get_authenticator return type to concrete union
* use whitelist only for valid urls
* feat: BREAKING: move credentials into provider_data and centralize update logic in mapper
- Replace top-level `api_key: SecretStr` with opaque `provider_data: dict` in API schemas;
mapper extracts credentials via `resolve_credential_fields` for DB storage
- Add `resolve_provider_account_update` to base mapper so routes delegate
full update-kwargs assembly (including cross-field logic) to the mapper
- WXO mapper override re-derives `provider_tenant_id` when `provider_url` changes
- Add tenant extraction utilities and `validate_tenant_url_consistency` in
`deployment_provider_account/utils.py` as single source of truth
- Add `model_validator` on `DeploymentProviderAccount` for defense-in-depth
tenant/URL consistency checks
- Rename `DEPLOYMENT_BOUNDARY_RULES.md` → `RULES.md`; document DB-direction
mapper contract, credential flow, and update assembly
- Update all tests for new `provider_data` shape, mapper update methods,
tenant extraction, and model-level consistency validation
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix(deployments): Harden provider account validation and WXO rollback
Use provider_url when resolving WXO credentials and scope provider account names per user within each provider. Re-verify provider account updates before persisting them and return 4xx responses for account conflicts instead of surfacing 500s.
Block deleting provider accounts that still own deployments and extend create rollback so failed WXO writes clean up provider-side resources. Add route, schema, mapper, sync, CRUD, and WXO tests to cover the new behavior.
* [autofix.ci] apply automated fixes
* update url validator docs; remove outdated reference to private url blacklist logic
* fix(deployments): Isolate snapshot sync writes
Use nested transactions around best-effort snapshot cleanup so provider sync failures cannot leak partial attachment deletes into the outer request transaction.
Persist explicit description clears during deployment PATCH requests, and add regression tests for both deployment sync paths and the route handler update flow.
* fix(deployments): Harden delete cleanup and wxO create tests
Treat missing provider agents as stale local cleanup so delete can
finish instead of leaving orphaned deployment rows behind.
Commit local delete operations eagerly, retry once on commit failure,
and move wxO create-path tests toward fake client objects so the real
service logic is exercised without external calls.
* new head
* fix(deployments): stop prefixing wxo raw connection app_ids
Preserve caller app_ids for newly created wxo connections while keeping lf_ prefixing for tool/deployment naming, centralize resource_name_prefix validation, and update mapper/service schema tests and docs to reflect the new behavior.
* fix(deployments): Harden provider account cleanup
Reconcile stale deployment rows before provider-account deletion so
out-of-band provider removals do not leave account cleanup blocked.
* fix: restore py310 compatibility and align payload slot tests
Import Self from typing_extensions in the deployment provider account model to keep backend imports working on Python 3.10, and update payload formalization tests to assert strict rejection of cross-model BaseModel inputs.
* fix(deployments): resolve mypy typing regressions across deployment flows
Normalize SQLModel query expressions for typed SQL operators, make deployment-related model IDs non-nullable where appropriate, and tighten provider mapper/update typing guards. Update deployment tests to align with stricter type contracts.
* fix(deployments): restore py310 test compatibility and migration idempotency
Replace Python 3.11-only UTC imports with timezone.utc in deployment-related tests and the watsonx e2e helper, and make the provider-account name migration safe to re-run when the column and unique constraint are created in separate steps.
* fix(deployments): restore provider account route ownership helpers
Reuse the shared provider-account lookup in update/delete routes so route tests keep the expected ownership path, and use the explicit-field helper when deciding whether to reverify credentials.
* pass name to create_provider_account helper in tests
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
---------
Co-authored-by: Jordan Frazier <jordan.frazier@datastax.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
|
|||
| 9deec3084e |
chore: version bump and merge 1.8.2 (#12335)
* fix: replace grep -oP with sed for Node.js version extraction in Docker images (#12330) * fix: replace grep -oP with sed for Node.js version extraction in Docker builds The grep -oP (PCRE regex) command fails in the python:3.12.12-slim-trixie Docker base image because PCRE support is not available in the slim variant. This replaces grep -oP with portable sed -nE in all 5 Dockerfiles and adds an empty version guard to fail fast with a clear error message instead of producing a broken download URL. Fixes the Docker base build failure in the v1.8.2 release workflow. * fix(docker): remove broken npm self-upgrade from Docker images Node.js 22.x now bundles npm 11.x which fails when trying to self-upgrade via 'npm install -g npm@latest' in the slim Docker image. The bundled npm version is sufficient. This is the same fix as PR #12309 on release-1.9.0. * chore: version bump and merge 1.8.2 bump version to 1.8.3, 0.8.3 and 0.3.3 merge changes added to 1.8.2 into 1.8.3 --------- Co-authored-by: vjgit96 <vijay.katuri@ibm.com> |
|||
| 63ad0ec05c |
chore: upgrade versions
upgrade pyproject and package.json versions |
|||
| 7d4ffbcbf5 |
feat: add support for Langchain 1.0 (#11114)
* feat: upgrade to LangChain 1.0 - langchain ~=1.2.0 - langchain-core ~=1.2.3 - langchain-community ~=0.4.1 Updated all langchain-* integration packages to versions compatible with langchain-core 1.0+. * feat(lfx): add langchain-classic dependency for legacy agent classes LangChain 1.0 removed AgentExecutor and related classes to langchain-classic. This adds the dependency to maintain backward compatibility. * refactor(lfx): update imports for LangChain 1.0 compatibility - Move AgentExecutor, agent creators from langchain to langchain_classic - Move AsyncCallbackHandler from langchain.callbacks to langchain_core.callbacks - Move Chain, BaseChatMemory from langchain to langchain_classic - Update LANGCHAIN_IMPORT_STRING for code generation * fix(lfx): make sqlalchemy import lazy in session_scope LangChain 1.0 no longer includes sqlalchemy as a transitive dependency. Move the import inside the function where it's used to avoid import errors when sqlalchemy is not installed. * chore: update uv.lock for langchain-classic * feat: enable nv-ingest optional dependencies for langchain 1.0 - Uncomment nv-ingest-api and nv-ingest-client, update to >=26.1.0 (no longer has openai version conflict) - Bump datasets from <4.0.0 to <5.0.0 to allow fsspec>=2025.5.1 required by nv-ingest - Update mlx-vlm TODO comment with accurate blocking reason * chore: update nv-ingest to 26.1.1 nv-ingest 26.1.1 removes the openai dependency, resolving the conflict with langchain-openai>=1.0.0 (which requires openai>=1.109.1). Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * feat: enable mlx and mlx-vlm dependencies for langchain 1.0 opencv-python 4.13+ now supports numpy>=2, resolving the conflict with langchain-aws>=1.0.0 (which requires numpy>=2.2 on Python 3.12+). Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * style: fix import order in callback.py Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * refactor: update imports to use langchain_classic for agent modules * [autofix.ci] apply automated fixes * fix: remove .item() calls in knowledge_bases.py * fix(lfx): import BaseMemory from langchain_classic for langchain 1.0 * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * refactor: update deprecated langchain imports for langchain 1.0 - langchain.callbacks.base -> langchain_core.callbacks.base - langchain.tools -> langchain_core.tools - langchain.schema -> langchain_core.messages/documents - langchain.chains -> langchain_classic.chains - langchain.retrievers -> langchain_classic.retrievers - langchain.memory -> langchain_classic.memory - langchain.globals -> langchain_core.globals - langchain.docstore -> langchain_core.documents - langchain.prompts -> langchain_core.prompts Also simplified GoogleGenerativeAIEmbeddingsComponent to use native langchain-google-genai 4.x which now supports output_dimensionality. * [autofix.ci] apply automated fixes * fix: add _to_int helper for pandas sum() compatibility across Python versions * fix: update langfuse>=3.8.0 and fix cuga_agent.py (#11519) * fix: update langfuse>=3.8.0 and fix cuga_agent.py * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * feat: implement LangFuseTracer for langfuse v3 API compatibility and add unit tests * fix: upgrade cuga to 0.2.9 for langchain 1.0 compatibility * fix: improve error handling and return value in get_langchain_callback method * fix: update package versions for compatibility and improvements * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes (attempt 3/3) * fix: update langwatch dependency to version 0.10.0 for compatibility * fix: update environment variable for Langfuse host to LANGFUSE_BASE_URL * Update dependency versions in Youtube Analysis project - Downgraded googleapiclient from 2.188.0 to 2.154.0 - Updated langchain_core from 1.2.7 to 1.2.9 - Updated fastapi from 0.128.1 to 0.128.5 - Downgraded youtube_transcript_api from 1.2.4 to 1.2.3 - Changed langchain_core version from 1.2.7 to 0.3.81 - Cleared input_types in model selection # Conflicts: # src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json # src/backend/base/langflow/initial_setup/starter_projects/Basic Prompting.json # src/backend/base/langflow/initial_setup/starter_projects/Blog Writer.json # src/backend/base/langflow/initial_setup/starter_projects/Custom Component Generator.json # src/backend/base/langflow/initial_setup/starter_projects/Document Q&A.json # src/backend/base/langflow/initial_setup/starter_projects/Financial Report Parser.json # src/backend/base/langflow/initial_setup/starter_projects/Hybrid Search RAG.json # src/backend/base/langflow/initial_setup/starter_projects/Image Sentiment Analysis.json # src/backend/base/langflow/initial_setup/starter_projects/Instagram Copywriter.json # src/backend/base/langflow/initial_setup/starter_projects/Invoice Summarizer.json # src/backend/base/langflow/initial_setup/starter_projects/Knowledge Retrieval.json # src/backend/base/langflow/initial_setup/starter_projects/Market Research.json # src/backend/base/langflow/initial_setup/starter_projects/Meeting Summary.json # src/backend/base/langflow/initial_setup/starter_projects/Memory Chatbot.json # src/backend/base/langflow/initial_setup/starter_projects/News Aggregator.json # src/backend/base/langflow/initial_setup/starter_projects/Nvidia Remix.json # src/backend/base/langflow/initial_setup/starter_projects/Pokédex Agent.json # src/backend/base/langflow/initial_setup/starter_projects/Portfolio Website Code Generator.json # src/backend/base/langflow/initial_setup/starter_projects/Price Deal Finder.json # src/backend/base/langflow/initial_setup/starter_projects/Research Agent.json # src/backend/base/langflow/initial_setup/starter_projects/Research Translation Loop.json # src/backend/base/langflow/initial_setup/starter_projects/SEO Keyword Generator.json # src/backend/base/langflow/initial_setup/starter_projects/SaaS Pricing.json # src/backend/base/langflow/initial_setup/starter_projects/Search agent.json # src/backend/base/langflow/initial_setup/starter_projects/Sequential Tasks Agents.json # src/backend/base/langflow/initial_setup/starter_projects/Simple Agent.json # src/backend/base/langflow/initial_setup/starter_projects/Social Media Agent.json # src/backend/base/langflow/initial_setup/starter_projects/Text Sentiment Analysis.json # src/backend/base/langflow/initial_setup/starter_projects/Travel Planning Agents.json # src/backend/base/langflow/initial_setup/starter_projects/Twitter Thread Generator.json # src/backend/base/langflow/initial_setup/starter_projects/Vector Store RAG.json # src/backend/base/langflow/initial_setup/starter_projects/Youtube Analysis.json * fix: handle InvalidRequestError during session rollback * update projects * ⚡️ Speed up method `LangFuseTracer.end` by 141% in PR #11114 (`feat/langchain-1.0`) (#11682) Optimize LangFuseTracer.end The optimized code achieves a **140% speedup** (8.23ms → 3.42ms) through two complementary optimizations: ## 1. Fast-path for Common Primitives in `serialize()` **What changed:** Added an early-exit check that returns immutable primitives (`str`, `int`, `float`, `bool`) directly when no truncation or special handling is needed: ```python if max_length is None and max_items is None and not to_str: if isinstance(obj, (str, int, float, bool)): return obj ``` **Why it's faster:** - The profiler shows `_serialize_dispatcher()` consumed **81.5% of runtime** in the original code (40.4ms out of 49.6ms) - This optimization reduced dispatcher calls from **8,040 to 1,013** (~87% reduction), as primitives now bypass the expensive pattern-matching dispatcher entirely - The fast-path check itself is extremely cheap: just two quick conditionals and an `isinstance()` check against a tuple of built-in types **When it helps:** This optimization is particularly effective for workloads with many primitive values in dictionaries and lists—which is exactly what the tracing use case provides (metadata dicts with strings, numbers, booleans). ## 2. Eliminate Redundant Serialization in `LangFuseTracer.end()` **What changed:** Serialize `inputs`, `outputs`, and `metadata` once each, then reuse the results: ```python inputs_ser = serialize(inputs) outputs_ser = serialize(outputs) metadata_ser = serialize(metadata) if metadata else None ``` **Why it's faster:** - The original code called `serialize()` **6 times total** (3 for `.update()` + 3 for `.update_trace()`) - The optimized version calls it **3 times**, then passes the cached results - Profiler shows the time spent in `serialize()` calls dropped from **72.2ms to 31.2ms** (~57% reduction) - This is pure elimination of redundant work—the same dictionaries were being serialized twice with identical results **Impact on workloads:** The `test_end_multiple_iterations_calls_end_each_time` test (500 iterations) demonstrates this matters in hot paths. If `LangFuseTracer.end()` is called frequently during flow execution, avoiding duplicate serialization provides compounding benefits. ## Combined Effect Both optimizations target the serialization bottleneck from different angles: - The fast-path reduces the cost of *each* serialize call by ~75% for primitive-heavy data - The caching reduces the *number* of serialize calls by 50% Together, they deliver the observed 140% speedup, with the optimization being especially effective for the common case of metadata dictionaries containing mostly primitive types. Co-authored-by: codeflash-ai[bot] <148906541+codeflash-ai[bot]@users.noreply.github.com> * refactor: reorder imports and simplify serialization logic for primitives * [autofix.ci] apply automated fixes * fix: update google dependency version to 0.4.0 in component_index.json * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix: pin z3-solver<4.15.7 to restore Linux wheels for Docker build z3-solver 4.15.7 dropped manylinux wheels, causing the Docker build to fail when trying to compile from source. Temporary pin until codeflash is removed. * [autofix.ci] apply automated fixes * fix: update google dependency version to 0.4.0 * [autofix.ci] apply automated fixes * fix: update langchain_core version to 1.2.17 in multiple starter project JSON files * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix: update deprecated langchain imports to langchain_classic for 1.0 compatibility * fix: align langchain-chroma version in optional chroma dependency group * fix: nightly now properly gets 1.9.0 branch (#12215) before it was attempting to pull release-notes as letters are alphanumerically after numbers when we sort -V then grab tail now we only look at branch names that follow the pattern '^release-[0-9]+\.[0-9]+\.[0-9]+$' * docs: add search icon (#12216) add-back-svg * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * feat: fall back to langchain_classic for pre-1.0 imports in user components Old flows using removed langchain imports (e.g. langchain.memory, langchain.schema, langchain.chains) now resolve via langchain_classic at two levels: module-level for entirely removed modules, and attribute-level for removed attributes in modules that still exist in langchain 1.0. New langchain 1.0 imports are never affected since fallbacks only trigger on import failure. * urllib parse module import bug * Update component_index.json * [autofix.ci] apply automated fixes * chore: rebuild component index * [autofix.ci] apply automated fixes --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Harold Ship <harold.ship@gmail.com> Co-authored-by: codeflash-ai[bot] <148906541+codeflash-ai[bot]@users.noreply.github.com> Co-authored-by: Adam-Aghili <149833988+Adam-Aghili@users.noreply.github.com> Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| a820c6f4db | fix: remove ibm-watsonx extra from complete installation (#12230) | |||
| 43253011ec |
feat: add wxO deployment adapter (#12079)
* checkout wxo deployment adapter implementation * checkout wxo deps and flow reqs impl * clean up / minor refactor with updated tests * major refactor: split up the implementation into folders and files * clean up logic * refactor and clean up of execution logic, improve type safety of "retry_create" helper, and remove dead code * remove unused wxo service file * remove "provider_name" arg and references * fix: harden watsonx orchestrate deployment adapter for PR readiness - Fix rollback AttributeError when agent_create_response is None - Fix NoneType access on params in list() when called without params - Fix inconsistent error types: use DeploymentNotFoundError in get/update - Fix typo "occured" -> "occurred" in all error prefix messages - Fix variable shadowing of fastapi.status in get_status() - Fix pre-existing test bugs (wrong exception types, stale method refs) - Fix e2e monkey-patching of non-existent service methods - Add structured logging to create, delete, retry, and rollback flows - Add jitter to retry backoff to avoid thundering herd - Add __repr__ to WxOCredentials that fully masks the API key - Extract hard-coded LLM model string to DEFAULT_WXO_AGENT_LLM constant - Remove commented-out snapshot update code - Expand test coverage from 24 to 75 tests covering retry logic, service methods, client auth, utilities, execution/status helpers, and artifact roundtrip * fix(deployment): fix bugs and harden watsonx orchestrate adapter - Fix update method silently discarding changes instead of sending them to the WXO API - Wrap all synchronous SDK calls in asyncio.to_thread to avoid blocking the event loop - Add error handling to get_status (was propagating raw exceptions) - Use DeploymentType enum values instead of raw strings for SUPPORTED_ADAPTER_DEPLOYMENT_TYPES - Fix type annotations in list method (list -> set) - Fix typo in comment (reccomend -> recommend) - Remove dead code: extract_agent_connection_ids, require_exclusive_resource, require_non_empty_string, resolve_health_environment_id, fetch_agent_release_status, normalize_release_status, resolve_lfx_runner_requirement, _pin_requirement_name, sync_langflow_tool_connections, create_langflow_flow_tool, resolve_snapshot_connections, and unused constants - Make assert_create_resources_available and validate_connection async - Make create_agent_run and get_agent_run async - Add tests for list_types, get_status error handling, and update side-effects - Update existing tests for async function signatures * actually remove the dead code from tools.py * properly await "validate_connection" * update e2e test file * add more scenarios to e2e test runner * refactor(watsonx-orchestrate): improve WxOClient encapsulation and error messages Encapsulate SDK private method access and endpoint paths inside WxOClient wrappers so callers never handle raw paths or touch internal _get/_post methods. Route all private HTTP calls through a single _base client auto-created in __post_init__, removing the externally constructed `base` field. Additionally fix double-period and redundant text in error messages produced by the ErrorPrefix + handler pattern, and update E2E/unit assertions to match the sanitised error output. Changes: - types.py: bake endpoint paths into wrapper signatures (post_run, get_run, upload_tool_artifact, get_agents_raw); auto-create _base via __post_init__; remove base from constructor - client.py: drop BaseWXOClient import and base= constructor arg - core/execution.py: pass run_id / query_suffix instead of raw paths - core/tools.py: pass tool_id instead of raw path - service.py: fix double-period in ErrorPrefix interpolation; remove redundant restatements in generic except handlers - tests: update _with_wxo_wrappers helper and test doubles to use _base; update FakeBaseClient._get to accept params - e2e: update rollback scenario detail_contains to match sanitised msg * skip import and tests of wxo adapter if current env is running python 3.10 * clarify random prefix / retry behavior * implement comments * fix: align watsonx adapter with updated deployment schema - Add `deployment_type` parameter to `get`, `update`, `redeploy`, `duplicate`, `delete`, `get_status`, and `undeploy_deployment` in WatsonxOrchestrateDeploymentService to match the updated BaseDeploymentService ABC - Update e2e script to use renamed `add_ids` field on SnapshotDeploymentBindingUpdate * remove non-interface method undeploy_deployment * implement listing configs and snapshots * add update implementation and improve http->deployment error translation and add tests * improve exception handling * checkout payload slot work * custom payload schema for update * new update implementation * stop passing client cache to helpers * add docs for ordereduniquests * improve import patterns and document future risks for wxo dependencies * remove global-variable prefixing of flows * ref: harden typing, DRY helpers, and correctness fixes - Replace `db: Any` with `db: AsyncSession` across client, config, and update_helpers modules - Extract `_ensure_dict` / `ensure_langflow_connections_binding` helpers to eliminate repeated nested-dict safety logic in tools.py and update_helpers.py, with documentation explaining why malformed API payloads are silently corrected rather than rejected - Use `PayloadSlot.parse()` for update payload validation instead of standalone helper; remove `parse_provider_update_payload` - Fix lambda late-binding with default-argument captures in service.py - Use `zip(strict=True)` in update_helpers for defensive mismatch detection - Replace O(n²) duplicate detection with `collections.Counter` in payloads.py - Simplify `dedupe_list` to `list(dict.fromkeys(...))` - Move type-annotation-only imports into TYPE_CHECKING blocks in types.py and config.py - Introduce `UPDATE_MAX_RETRIES` as a distinct constant from `CREATE_MAX_RETRIES` - Fix "watsonX" → "watsonx" casing in error messages - Clarify `get_status` docstring and `validate_connection` error message - Add TODO(deployments-cache) for client cache invalidation on credential updates * ref: drop client cache and adopt typed deployment context across the wxo adapter path, add request-context memoization with strict mixed-context guards, and lazily initialize wxo SDK clients. Add safer credential handling by storing only authenticators in WxOCredentials. Also improve provider error-detail extraction/messages and make the direct wxo E2E conflict scenario diagnostics and expectations more resilient. * use explicit naming for context class; providerId * fix error handling, retry safety, and exception diagnostics in wxo adapter - Raise DeploymentError on empty API responses instead of fabricating fake success in create_agent_run_result and get_agent_run - Elevate rollback failure logging from WARNING to ERROR for alerting - Apply retryable filter to retry_rollback to skip 401/403/409/422 - Preserve exception chains (from exc) instead of suppressing (from None) across service.py, utils.py, execution.py, and update_helpers.py - Broaden credential resolution catch to handle arbitrary DB exceptions - Separate status code dispatch from string heuristics in raise_for_status_and_detail to prevent misclassification - Add tests for all behavioral changes * [autofix.ci] apply automated fixes * fix: harden wxO adapter safety, immutability, and error diagnostics - Make WxOClient and WxOCredentials frozen dataclasses with eager SDK client initialization to eliminate thread-safety races from asyncio.to_thread workers and prevent post-construction mutation - Move instance_url validation and normalization into type __post_init__ - Raise DeploymentError on missing run_id instead of returning partial success with execution_id=None - Preserve exception chains (from exc) instead of suppressing (from None) across create, update, and delete service methods - Add warning logs when _ensure_dict replaces non-dict binding values and when _resolve_lfx_requirement falls back to minimum version - Initialize derived_spec before try block to prevent potential NameError - Log all ToolUploadBatchError errors before re-raising the first - Change SUPPORTED_ADAPTER_DEPLOYMENT_TYPES from mutable set to frozenset - Add tests for 409/422 error mapping in create, unsupported deployment type rejection, empty update rejection, zip artifact extraction paths, validate_connection negative paths, missing run_id, multiple deployment ID rejection, exception chain preservation, and _ensure_dict warning * [autofix.ci] apply automated fixes * fix ruff errors and and todo for status method * fix mypy errors * [autofix.ci] apply automated fixes --------- Co-authored-by: Jordan Frazier <jordan.frazier@datastax.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| facd0b1ea7 |
chore: update pyproject versions 1.9.0
update pyproject versions 1.9.0 |
|||
| f553896a1f |
chore: merge branch release-1.8.1 into main (#12185)
* fix: Fixes Kubernetes deployment crash on runtime_port parsing (#11968) (#11975) * feat: add runtime port validation for Kubernetes service discovery * test: add unit tests for runtime port validation in Settings * fix: improve runtime port validation to handle exceptions and edge cases Co-authored-by: Gabriel Luiz Freitas Almeida <gabriel@logspace.ai> * fix(frontend): show delete option for default session when it has messages (#11969) * feat: add documentation link to Guardrails component (#11978) * feat: add documentation link to Guardrails component * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * feat: traces v0 (#11689) (#11983) * feat: traces v0 v0 for traces includes: - filters: status, token usage range and datatime - accordian rows per trace Could add: - more filter options. Ecamples: session_id, trace_id and latency range * fix: token range * feat: create sidebar buttons for logs and trace add sidebar buttons for logs and trace remove lods canvas control * fix: fix duplicate trace ID insertion hopefully fix duplicate trace ID insertion on windows * fix: update tests and alembic tables for uts update tests and alembic tables for uts * chore: add session_id * chore: allo grouping by session_id and flow_id * chore: update race input output * chore: change run name to flow_name - flow_id was flow_name - trace_id now flow_name - flow_id * facelift * clean up and add testcases * clean up and add testcases * merge Alembic detected multiple heads * [autofix.ci] apply automated fixes * improve testcases * remodel files * chore: address gabriel simple changes address gabriel simple changes in traces.py and native.py * clean up and testcases * chore: address OTel and PG status comments https://github.com/langflow-ai/langflow/pull/11689#discussion_r2854630438 https://github.com/langflow-ai/langflow/pull/11689#discussion_r2854630446 * chore: OTel span naming convention model name is now set using name = f"{operation} {model_name}" if model_name else operation * add traces * feat: use uv sources for CPU-only PyTorch (#11884) * feat: use uv sources for CPU-only PyTorch Configure [tool.uv.sources] with pytorch-cpu index to avoid ~6GB CUDA dependencies in Docker images. This replaces hardcoded wheel URLs with a cleaner index-based approach. - Add pytorch-cpu index with explicit = true - Add torch/torchvision to [tool.uv.sources] - Add explicit torch/torchvision deps to trigger source override - Regenerate lockfile without nvidia/cuda/triton packages - Add required-environments for multi-platform support * fix: update regex to only replace name in [project] section The previous regex matched all lines starting with `name = "..."`, which incorrectly renamed the UV index `pytorch-cpu` to `langflow-nightly` during nightly builds. This caused `uv lock` to fail with: "Package torch references an undeclared index: pytorch-cpu" The new regex specifically targets the name field within the [project] section only, avoiding unintended replacements in other sections like [[tool.uv.index]]. * style: fix ruff quote style * fix: remove required-environments to fix Python 3.13 macOS x86_64 CI The required-environments setting was causing hard failures when packages like torch didn't have wheels for specific platform/Python combinations. Without this setting, uv resolves optimistically and handles missing wheels gracefully at runtime instead of failing during resolution. --------- * LE-270: Hydration and Console Log error (#11628) * LE-270: add fix hydration issues * LE-270: fix disable field on max token on language model --------- * test: add wait for selector in mcp server tests (#11883) * Add wait for selector in mcp server tests * [autofix.ci] apply automated fixes * Add more awit for selectors * [autofix.ci] apply automated fixes --------- * fix: reduce visual lag in frontend (#11686) * Reduce lag in frontend by batching react events and reducing minimval visual build time * Cleanup * [autofix.ci] apply automated fixes * add tests and improve code read * [autofix.ci] apply automated fixes * Remove debug log --------- * feat: lazy load imports for language model component (#11737) * Lazy load imports for language model component Ensures that only the necessary dependencies are required. For example, if OpenAI provider is used, it will now only import langchain_openai, rather than requiring langchain_anthropic, langchain_ibm, etc. * Add backwards-compat functions * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * Add exception handling * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * comp index * docs: azure default temperature (#11829) * change-azure-openai-default-temperature-to-1.0 * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes (attempt 3/3) * [autofix.ci] apply automated fixes --------- * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix unit test? * add no-group dev to docker builds * [autofix.ci] apply automated fixes --------- * feat: generate requirements.txt from dependencies (#11810) * Base script to generate requirements Dymanically picks dependency for LanguageM Comp. Requires separate change to remove eager loading. * Lazy load imports for language model component Ensures that only the necessary dependencies are required. For example, if OpenAI provider is used, it will now only import langchain_openai, rather than requiring langchain_anthropic, langchain_ibm, etc. * Add backwards-compat functions * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * Add exception handling * Add CLI command to create reqs * correctly exclude langchain imports * Add versions to reqs * dynamically resolve provider imports for language model comp * Lazy load imports for reqs, some ruff fixes * Add dynamic resolves for embedding model comp * Add install hints * Add missing provider tests; add warnings in reqs script * Add a few warnings and fix install hint * update comments add logging * Package hints, warnings, comments, tests * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes (attempt 3/3) * Add alias for watsonx * Fix anthropic for basic prompt, azure mapping * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * ruff * [autofix.ci] apply automated fixes * test formatting * ruff * [autofix.ci] apply automated fixes --------- * fix: add handle to file input to be able to receive text (#11825) * changed base file and file components to support muitiple files and files from messages * update component index * update input file component to clear value and show placeholder * updated starter projects * [autofix.ci] apply automated fixes * updated base file, file and video file to share robust file verification method * updated component index * updated templates * fix whitespaces * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * add file upload test for files fed through the handle * [autofix.ci] apply automated fixes * added tests and fixed things pointed out by revies * update component index * fixed test * ruff fixes * Update component_index.json * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes (attempt 3/3) * updated component index * updated component index * removed handle from file input * Added functionality to use multiple files on the File Path, and to allow files on the langflow file system. * [autofix.ci] apply automated fixes * fixed lfx test * build component index --------- * docs: Add AGENTS.md development guide (#11922) * add AGENTS.md rule to project * change to agents-example * remove agents.md * add example description * chore: address cris I1 comment address cris I1 comment * chore: address cris I5 address cris I5 * chore: address cris I6 address cris I6 * chore: address cris R7 address cris R7 * fix testcase * chore: address cris R2 address cris R2 * restructure insight page into sidenav * added header and total run node * restructing branch * chore: address gab otel model changes address gab otel model changes will need no migration tables * chore: update alembic migration tables update alembic migration tables after model changes * add empty state for gropu sessions * remove invalid mock * test: update and add backend tests update and add backend tests * chore: address backend code rabbit comments address backend code rabbit comments * chore: address code rabbit frontend comments address code rabbit frontend comments * chore: test_native_tracer minor fix address c1 test_native_tracer minor fix address c1 * chore: address C2 + C3 address C2 + C3 * chore: address H1-H5 address H1-H5 * test: update test_native_tracer update test_native_tracer * fixes * chore: address M2 address m2 * chore: address M1 address M1 * dry changes, factorization * chore: fix 422 spam and clean comments fix 422 spam and clean comments * chore: address M12 address M12 * chore: address M3 address M3 * chore: address M4 address M4 * chore: address M5 address M5 * chore: clean up for M7, M9, M11 clean up for M7, M9, M11 * chore: address L2,L4,L5,L6 + any test address L2,L4,L5 and L6 + any test * chore: alembic + comment clean up alembic + comment clean up * chore: remove depricated test_traces file remove depricated test_traces file. test have all been moved to test_traces_api.py * fix datetime * chore: fix test_trace_api ge=0 is allowed now fix test_trace_api ge=0 is allowed now * chore: remove unused traces cost flow remove unused traces cost flow * fix traces test * fix traces test * fix traces test * fix traces test * fix traces test * chore: address gabriels otel coment address gabriels otel coment latest --------- Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> Co-authored-by: Olayinka Adelakun <olayinkaadelakun@mac.war.can.ibm.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Ram Gopal Srikar Katakam <44802869+RamGopalSrikar@users.noreply.github.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: olayinkaadelakun <olayinka.adelakun@ibm.com> Co-authored-by: Jordan Frazier <122494242+jordanrfrazier@users.noreply.github.com> Co-authored-by: cristhianzl <cristhian.lousa@gmail.com> Co-authored-by: Hamza Rashid <74062092+HzaRashid@users.noreply.github.com> Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Co-authored-by: Lucas Oliveira <62335616+lucaseduoli@users.noreply.github.com> Co-authored-by: Edwin Jose <edwin.jose@datastax.com> Co-authored-by: Himavarsha <40851462+HimavarshaVS@users.noreply.github.com> * fix(test): Fix superuser timeout test errors by replacing heavy clien… (#11982) fix(test): Fix superuser timeout test errors by replacing heavy client fixture (#11972) * fix super user timeout test error * fix fixture db test * remove canary test * [autofix.ci] apply automated fixes * flaky test --------- Co-authored-by: Cristhian Zanforlin Lousa <cristhian.lousa@gmail.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * refactor(components): Replace eager import with lazy loading in agentics module (#11974) Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fix: add ondelete=CASCADE to TraceBase.flow_id to match migration (#12002) * fix: add ondelete=CASCADE to TraceBase.flow_id to match migration The migration file creates the trace table's flow_id foreign key with ondelete="CASCADE", but the model was missing this parameter. This mismatch caused the migration validator to block startup. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: add defensive migration to ensure trace.flow_id has CASCADE Adds a migration that ensures the trace.flow_id foreign key has ondelete=CASCADE. While the original migration already creates it with CASCADE, this provides a safety net for any databases that may have gotten into an inconsistent state. * fix: dynamically find FK constraint name in migration The original migration did not name the FK constraint, so it gets an auto-generated name that varies by database. This fix queries the database to find the actual constraint name before dropping it. --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> * fix: LE-456 - Update ButtonSendWrapper to handle building state and improve button functionality (#12000) * fix: Update ButtonSendWrapper to handle building state and improve button functionality * fix(frontend): rename stop button title to avoid Playwright selector conflict The "Stop building" title caused getByRole('button', { name: 'Stop' }) to match two elements, breaking Playwright tests in shards 19, 20, 22, 25. Renamed to "Cancel" to avoid the collision with the no-input stop button. * Fix: pydantic fail because output is list, instead of a dict (#11987) pydantic fail because output is list, instead of a dict Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> * refactor: Update guardrails icons (#12016) * Update guardrails.py Changing the heuristic threshold icons. The field was using the default icons. I added icons related to the security theme. * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Viktor Avelino <64113566+viktoravelino@users.noreply.github.com> * feat(ui): Replace Show column toggle with eye icon in advanced dialog (#12028) Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fix(ui): Prevent auto-focus and tooltip on dialog close button (#12027) * fix: reset button (#12024) fix reset button Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> * fix: Handle message inputs when ingesting knowledge (#11988) * fix: Handle message inputs when ingesting knowledge * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes (attempt 3/3) * Update test_ingestion.py * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fix(ui): add error handling for invalid JSON uploads via upload button (#11985) * fix(ui): add error handling for invalid JSON uploads via upload button * feat(frontend): added new test for file upload * feat(frontend): added new test for file upload * fix(ui): Add array validation for provider variables mapping (#12032) * fix: LM span is now properly parent of ChatOpenAI (#12012) * fix: LM span is now properly parent of ChatOpenAI Before LM span and ChatOpenAI span where both considered parents so they where being counted twice in token counts and other sumations Now LM span is properly the parent of ChatOpenAI span so they are not accidently counted twice * chore: clean up comments clean up comments * chore: incase -> incase incase -> incase * fix: Design fix for traces (#12021) * fix: LM span is now properly parent of ChatOpenAI Before LM span and ChatOpenAI span where both considered parents so they where being counted twice in token counts and other sumations Now LM span is properly the parent of ChatOpenAI span so they are not accidently counted twice * chore: clean up comments clean up comments * chore: incase -> incase incase -> incase * design fix * fix testcases * fix header * fix testcase --------- Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com> Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> Co-authored-by: Olayinka Adelakun <olayinkaadelakun@mac.war.can.ibm.com> * fix: Add file upload extension filter for multi-select and folders (#12034) * fix: plaground - inspection panel feedback (#12013) * fix: update layout and variant for file previews in chat messages * fix: update background color to 'bg-muted' in chat header and input wrapper components * refactor(CanvasControls): remove unused inspection panel logic and clean up code * fix: remove 'bg-muted' class from chat header and add 'bg-primary-foreground' to chat sidebar * fix: add Escape key functionality to close sidebar * fix: playground does not scroll down to the latest user message upon … (#12040) fix: playground does not scroll down to the latest user message upon sending (Regression) (#12006) * fixes scroll is on input message * feat: re-engage Safari sticky scroll mode when user sends message Add custom event 'langflow-scroll-to-bottom' to force SafariScrollFix back into sticky mode when user sends a new message. This ensures the chat scrolls to bottom even if user had scrolled up, fixing behavior where Safari's scroll fix would remain disengaged after manual scrolling. Co-authored-by: Deon Sanchez <69873175+deon-sanchez@users.noreply.github.com> * fix: knowledge Base Table — Row Icon Appears Clipped/Cut for Some Ent… (#12039) fix: knowledge Base Table — Row Icon Appears Clipped/Cut for Some Entries (#12009) * removed book and added file. makes more sense * feat: add accent-blue color to design system and update knowledge base file icon - Add accent-blue color variables to light and dark themes in CSS - Register accent-blue in Tailwind config with DEFAULT and foreground variants - Update knowledge base file icon fallback color from hardcoded text-blue-500 to text-accent-blue-foreground Co-authored-by: Deon Sanchez <69873175+deon-sanchez@users.noreply.github.com> * fix: MCP Server Modal Improvements (#12017) (#12038) * fixes to the mcp modal for style * style: convert double quotes to single quotes in baseModal component * style: convert double quotes to single quotes in addMcpServerModal component Co-authored-by: Deon Sanchez <69873175+deon-sanchez@users.noreply.github.com> * fix: change loop description (#12018) (#12037) * fix: change loop description (#12018) * docs: simplify Loop component description in starter project and component index * [autofix.ci] apply automated fixes * style: format Loop component description to comply with line length limits * fixed component index * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * [autofix.ci] apply automated fixes --------- Co-authored-by: Deon Sanchez <69873175+deon-sanchez@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * feat: add mutual exclusivity between ChatInput and Webhook components (#12036) * feat: add mutual exclusivity between ChatInput and Webhook components * [autofix.ci] apply automated fixes * refactor: address PR feedback - add comprehensive tests and constants * [autofix.ci] apply automated fixes * refactor: address PR feedback - add comprehensive tests and constants * [autofix.ci] apply automated fixes --------- Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fix: mcp config issue (#12045) * Only process dict template fields In json_schema_from_flow, guard access to template field properties by checking isinstance(field_data, dict) before calling .get(). This replaces the previous comparison to the string "Component" and prevents attribute errors when template entries are non-dict values, ensuring only dict-type fields with show=True and not advanced are included in the generated schema. * Check and handle MCP server URL changes When skipping creation of an existing MCP server for a user's starter projects, first compute the expected project URL and compare it to URLs found in the existing config args. If the URL matches, keep skipping and log that the server is correctly configured; if the URL differs (e.g., port changed on restart), log the difference and allow the flow to update the server configuration. Adds URL extraction and improved debug messages to support automatic updates when server endpoints change. --------- Co-authored-by: Ram Gopal Srikar Katakam <44802869+RamGopalSrikar@users.noreply.github.com> * fix: langflow breaks when we click on the last level of the chain (#12044) Langflow breaks when we click on the last level of the chain. Co-authored-by: Olayinka Adelakun <olayinkaadelakun@mac.war.can.ibm.com> * fix: standardize "README" title and update API key configuration note… (#12051) fix: standardize "README" title and update API key configuration notes in 3 main flow templates (#12005) * updated for README * chore: update secrets baseline with new line numbers * fixed test Co-authored-by: Deon Sanchez <69873175+deon-sanchez@users.noreply.github.com> * fix: Cherry-pick Knowledge Base Improvements (le-480) into release-1.8.0 (#12052) * fix: improve knowledge base UI consistency and pagination handling - Change quote style from double to single quotes throughout knowledge base components - Update "Hide Sources" button label to "Hide Configuration" for clarity - Restructure SourceChunksPage layout to use xl:container for consistent spacing - Add controlled page input state with validation on blur and Enter key - Synchronize page input field with pagination controls to prevent state drift - Reset page input to "1" when changing page * refactor: extract page input commit logic into reusable function Extract page input validation and commit logic from handlePageInputBlur and handlePageInputKeyDown into a shared commitPageInput function to eliminate code duplication. * fix(ui): ensure session deletion properly clears backend and cache (#12043) * fix(ui): ensure session deletion properly clears backend and cache * fix: resolved PR comments and add new regression test * fix: resolved PR comments and add new regression test * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fix: Check template field is dict before access (#12035) Only process dict template fields In json_schema_from_flow, guard access to template field properties by checking isinstance(field_data, dict) before calling .get(). This replaces the previous comparison to the string "Component" and prevents attribute errors when template entries are non-dict values, ensuring only dict-type fields with show=True and not advanced are included in the generated schema. Co-authored-by: Ram Gopal Srikar Katakam <44802869+RamGopalSrikar@users.noreply.github.com> * fix: hide Knowledge Ingestion component and rename Retrieval to Knowledge Base (#12054) * fix: hide Knowledge Ingestion component and rename Retrieval to Knowledge Base Move ingestion component to deactivated folder so it's excluded from dynamic discovery. Rename KnowledgeRetrievalComponent to KnowledgeBaseComponent with display_name "Knowledge Base". Update all exports, component index, starter project, frontend sidebar filter, and tests. * fix: update test_ingestion import to use deactivated module path * fix: skip deactivated KnowledgeIngestion test suite * [autofix.ci] apply automated fixes * fix: standardize formatting and indentation in StepperModal component --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fix: Embedding Model Field Stuck in Infinite Loading When No Model Provider is Configured (release-1.8.0) (#12053) * fix: add showEmptyState prop to ModelInputComponent for better UX when no models are enabled * style: convert double quotes to single quotes in modelInputComponent * fixes refresh and kb blocker * style: convert double quotes to single quotes in ModelTrigger component * style: convert double quotes to single quotes in model provider components - Convert all double quotes to single quotes in use-get-model-providers.ts and ModelProvidersContent.tsx - Remove try-catch block in getModelProvidersFn to let errors propagate for React Query retry and stale data preservation - Add flex-shrink-0 to provider list container to prevent layout issues * fix: Close model dropdown popover before refresh to prevent width glitch (#12067) fix(test): Reduce response length assertions in flaky integration tests (#12057) * feat: Add PDF and DOCX ingestion support for Knowledge Bases (#12064) * add pdf and docx for knowledge bases * ruff style checker fix * fix jest test * fix: Use global LLM in knowledge retrieval (#11989) Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Cristhian Zanforlin Lousa <cristhian.lousa@gmail.com> fix(test): Reduce response length assertions in flaky integration tests (#12057) * fix: Regenerate the knowledge retrieval template (#12070) * fix: refactor KnowledgeBaseEmptyState to use optimistic updates hook (#12069) * fix: refactor KnowledgeBaseEmptyState to use optimistic updates hook * updated tst * fix: Apply provider variable config to Agent build_config (#12050) * Apply provider variable config to Agent build_config Import and use apply_provider_variable_config_to_build_config in the Agent component so provider-specific variable settings (advanced/required/info/env fallbacks) are applied to the build_config. Provider-specific fields (e.g. base_url_ibm_watsonx, project_id) are hidden/disabled by default before applying the provider config. Updated embedded agent code in starter project JSONs and bumped their code_hashes accordingly. * [autofix.ci] apply automated fixes * update tests --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Himavarsha <40851462+HimavarshaVS@users.noreply.github.com> Co-authored-by: himavarshagoutham <himavarshajan17@gmail.com> * LE-489: KB Metrics calculation batch caculator (#12049) Fixed metric calculator to be more robust and scalable. * fix(ui): Correct AstraDB icon size to use relative units (#12137) * fix(api): Handle Windows ChromaDB file locks when deleting Knowledge Bases (#12132) Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fix: Fix image preview for Windows paths in playground (#12136) Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * chore: update fastapi dep (#12141) update fastapi dependency * fix: Properly propagate max tokens param to Agent (#12151) * fix: Properly Propagate max_tokens param * Update tests and templates * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes (attempt 3/3) --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fix: include uv/uvx in runtime Docker image (#12127) * fix: include uv/uvx in runtime Docker image add uv/uvx to runtime image so uvx is available in container i did this for all images which might be too much * chore: address supply chain attack addres ram's supply chain attack comment * chore: upgrade pyproject versions upgrade pyproject versions * fix: preserve api key configuration on flow export (#12129) * fix: preserve api key configuration on flow export Made-with: Cursor * fix individual component's field * [autofix.ci] apply automated fixes * unhide var name * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fetch relevant provider keys * update starter projects * update based on env var * [autofix.ci] apply automated fixes * fetch only env variables * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * update starter projects * fix ruff errors * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * don't remove api keys if chosen by user * remove redundant code * [autofix.ci] apply automated fixes * fix update build config * remove api keys refactor * only load values when exists in db * modify other components * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * Template updates * [autofix.ci] apply automated fixes * Component index update * Fix frontend test * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * preserve var names * [autofix.ci] apply automated fixes * update caution for saving api keys --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> * Fix: Tweaks override ENV VARIABLES (#12152) Modified tweak behaviour to be overridable if env variable is set on the GUI. * fix(mcp): Handle missing config file in MCP client availability detection (#12172) * Handle missing config file in MCP client availability detection * code improvements * [autofix.ci] apply automated fixes * code improvements review * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * chore: clean up after merge * [autofix.ci] apply automated fixes * Component index update * [autofix.ci] apply automated fixes --------- Co-authored-by: Gabriel Luiz Freitas Almeida <gabriel@logspace.ai> Co-authored-by: keval shah <kevalvirat@gmail.com> Co-authored-by: Antônio Alexandre Borges Lima <104531655+AntonioABLima@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> Co-authored-by: Olayinka Adelakun <olayinkaadelakun@mac.war.can.ibm.com> Co-authored-by: Ram Gopal Srikar Katakam <44802869+RamGopalSrikar@users.noreply.github.com> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> Co-authored-by: olayinkaadelakun <olayinka.adelakun@ibm.com> Co-authored-by: Jordan Frazier <122494242+jordanrfrazier@users.noreply.github.com> Co-authored-by: cristhianzl <cristhian.lousa@gmail.com> Co-authored-by: Hamza Rashid <74062092+HzaRashid@users.noreply.github.com> Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Co-authored-by: Lucas Oliveira <62335616+lucaseduoli@users.noreply.github.com> Co-authored-by: Edwin Jose <edwin.jose@datastax.com> Co-authored-by: Himavarsha <40851462+HimavarshaVS@users.noreply.github.com> Co-authored-by: Viktor Avelino <64113566+viktoravelino@users.noreply.github.com> Co-authored-by: Lucas Democh <ldgoularte@gmail.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> Co-authored-by: Debojit Kaushik <Kaushik.debojit@gmail.com> Co-authored-by: Deon Sanchez <69873175+deon-sanchez@users.noreply.github.com> Co-authored-by: Janardan Singh Kavia <janardankavia@ibm.com> Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> Co-authored-by: himavarshagoutham <himavarshajan17@gmail.com> |
|||
| e1e131356e |
fix: include uv/uvx in runtime Docker image (#12127)
* fix: include uv/uvx in runtime Docker image add uv/uvx to runtime image so uvx is available in container i did this for all images which might be too much * chore: address supply chain attack addres ram's supply chain attack comment * chore: upgrade pyproject versions upgrade pyproject versions |
|||
| e0a63ecd19 |
chore: update fastapi dep (#12141)
update fastapi dependency |
|||
| efb041ffd7 |
feat: deployments api surface (#12041)
* deployment api schemas
* clean up deployments API surface
- Strip internal implementation details from public-facing Field
descriptions and endpoint docstrings (adapter routing, provider
snapshots, binding payloads, lazy sync)
- Rename flow_versions to flow_version_ids in DeploymentCreateRequest
and DeploymentUpdateRequest for clarity
- Remove redundant match_limit query parameter from list_deployments;
page size already caps results
* fix(api): decouple deployment API schemas from service-layer ID domains
The API schema file inherited from and directly embedded service-layer
types whose identifier fields use IdLike (UUID | str) for provider-owned
IDs. This conflated provider-owned opaque identifiers with Langflow
DB-managed UUIDs at the API boundary.
- Rewrite RedeployResponse as standalone BaseModel instead of inheriting
from DeploymentOperationResult (which carried id: IdLike)
- Replace ConfigItem with API-local DeploymentConfigCreate
(reference_id: str, explicitly provider-owned)
- Replace ConfigDeploymentBindingUpdate with API-local
DeploymentConfigBindingUpdate (config_id: str, not IdLike union)
- Add module docstring documenting the two identifier domains
(Langflow DB UUIDs vs provider-owned opaque strings)
- Annotate all id/provider_* fields with their ownership domain
- Keep BaseDeploymentData/BaseDeploymentDataUpdate imports
(no ID fields, stable shapes)
* align naming with recent db work
* docs: clarify deployment ownership boundaries in v1 schemas
* Update deployment model hierarchy
_DeploymentResponseBase → id, name, type, created_at, updated_at, provider_data
├─ DeploymentSummary → + description
│ ├─ DeploymentGetResponse
│ └─ DeploymentDuplicateResponse
├─ DeploymentListItem → + resource_key, attached_count
├─ DeploymentCreateResponse → + description
├─ DeploymentUpdateResponse → + description
├─ DeploymentStatusResponse
└─ RedeployResponse
* move description to base class
* [autofix.ci] apply automated fixes
* Update naming to match persistence layer
* [autofix.ci] apply automated fixes
* Add API layer-specific strict wrapper forbid extra fields
* update docs
* language
* use annotation for non empty str
* Clarify shared object pattern in docs
* Add test validate api keys not in response
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
---------
Co-authored-by: Jordan Frazier <jordan.frazier@datastax.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Jordan Frazier <122494242+jordanrfrazier@users.noreply.github.com>
|
|||
| 3d4be16c61 |
security: update NLTK to 3.9.3 to fix path traversal vulnerability (#12090)
Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> |
|||
| ed199d99e1 |
feat: add basic types and database accessors for wxo integration (#12011)
* Add basic deployment persistence migrations and types * ruff * Rename db fields * Encryption updates, alembic ids, schema relationships Critical Issues Fixed 1. is_encrypted removed — update_provider_account now always encrypts, matching create_provider_account. No more heuristic that could store plaintext keys. 2. Proper Alembic revision IDs — a1b2c3d4e5f6 → 8106300be7aa, c3d4e5f6a7b8 → 2a5defa5ddc0 (randomly generated). 3. Folder ↔ Deployment relationship — Added folder on Deployment and deployments on Folder with "all, delete, delete-orphan" cascade. Important Issues Fixed 4. Schema layering — Added DeploymentRead, DeploymentProviderAccountCreate, DeploymentProviderAccountRead (no api_key!), DeploymentProviderAccountUpdate. 5. Cascade config — DeploymentProviderAccount.deployments now uses "all, delete, delete-orphan" (matching Folder.flows pattern). 6. UUID validation standardized — Both CRUDs now use _parse_uuid() that raises ValueError with context (field name + value). No moent return None/return 0 on bad input. 7. encrypt_api_key error context — Wrapped in try/except raising RuntimeError with clear message about encryption config. Suggestions Fixed 8. Field validators — name, resource_key (Deployment) and provider_key, provider_url (DeploymentProviderAccount) now validated non-empty with .strip(). 9. (provider_account_id, resource_key) uniqueness — Added to both model and migration. 10. account_id NULL documented — Comment explaining unique constraint behavior with NULLs. 11. or 0 removed from count_deployment_rows. * Bit more verbose naming, but follows existing standards * Add crud tests * Harden validation, error handling, and test coverage for deployment persistence - Extract shared validators (validate_non_empty_string) to database/utils.py - Add DeploymentCreate schema with field validators - Add _UNSET sentinel to update_provider_account for nullable field handling - Extract _encrypt_api_key helper with broadened exception handling - Add empty-string validation in CRUD create functions before DB round-trip - Escalate IntegrityError and None rowcount logging to aerror with rollback - Fix parse_uuid to chain exceptions with `from exc` - Fix folder relationship nullability (Folder, not Folder | None) - Add tests for 5 previously untested CRUD functions and new validation paths * refactor: improve deployment CRUD naming, helpers, and documentation - Rename count_deployments to count_deployments_by_provider - Add update_deployment CRUD function and DeploymentUpdate schema - Extract _strip_or_raise helper to deduplicate input validation - Clarify IntegrityError messages to describe conflicts generically - Document cascade semantics on User model relationships, double- validation rationale in CRUD, and model_fields_set usage on DeploymentProviderAccountUpdate - Add missing get_deployment and update_deployment tests * fix: harden deployment model validation, logging, and SQLAlchemy compatibility - Validate pagination bounds (offset >= 0, limit > 0) in list_deployments_page - Normalize blank provider_tenant_id to None on create, matching update behavior - Centralize normalization via normalize_string_or_none utility and model validators - Remove raw exception objects from IntegrityError log messages to avoid leaking SQL - Reject unsupported types in parse_uuid with a clear TypeError - Remove `from __future__ import annotations` from table models to fix SQLAlchemy relationship mapper errors at runtime * update parent of deployment provider account migration to flow history migration * Add documentation and in-memory tests for deployment tables - Add inline comment on api_key column in migration noting it is stored encrypted - Add comment on DeploymentProviderAccount.api_key model field documenting encryption requirement - Add in-memory SQLite test suite covering both deployment and deployment_provider_account tables: unique constraints, CASCADE deletes, relationship loading, FK enforcement, and CRUD operations * Add missing test files * mypy * [autofix.ci] apply automated fixes * remove unused test --------- Co-authored-by: Hamza Rashid <hzarashid@gmail.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 14e3cf7e38 |
feat: add flow version control (#11859)
* initial implementation of flow history * Save and restore correctly * Fit to screen when restoring * Change confirmation to pop up * correectly export even when version is not selected * remove unused code * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * use auto snapshot from activate in fe * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * Remove flow state -- not needed until integration with deploymnet * [autofix.ci] apply automated fixes * Strip keys from exported history; add some deepcopies for safety * [autofix.ci] apply automated fixes * Unique version numbers and tests for stripping keys * rename flow history entry * [autofix.ci] apply automated fixes * Add prune warning dialog, add domain-specific exceptions * Move version control to left side bar * fix remove_api_key function, remove dupe code * Remove full-history download for now, cleanup * merged updated FE * Remove the keep building from version page, fix double save, remove not needed timeout * fixes keep buildig * merge migrations * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * hide log canvas controls and flow toolbar when preview is active * [autofix.ci] apply automated fixes * updated styles * initial implementation of flow history * Save and restore correctly * Fit to screen when restoring * Change confirmation to pop up * correectly export even when version is not selected * remove unused code * [autofix.ci] apply automated fixes * use auto snapshot from activate in fe * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * Remove flow state -- not needed until integration with deploymnet * [autofix.ci] apply automated fixes * Strip keys from exported history; add some deepcopies for safety * [autofix.ci] apply automated fixes * Unique version numbers and tests for stripping keys * rename flow history entry * [autofix.ci] apply automated fixes * Add prune warning dialog, add domain-specific exceptions * Move version control to left side bar * fix remove_api_key function, remove dupe code * merged updated FE * Remove full-history download for now, cleanup * Remove the keep building from version page, fix double save, remove not needed timeout * fixes keep buildig * merge migrations * hide log canvas controls and flow toolbar when preview is active * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * updated styles * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * removed keep building button * Workflow history branch 1 (#11946) * Update language from history to version * more language updates history -> version * more language updates history -> version * capture original draft at mount / restore * Renames files from history to version * clean up dead code, some more renames * more naming fixes * more naming fixes * Fix API endpoint language * [autofix.ci] apply automated fixes * version -> versions * ignore warning --------- Co-authored-by: Deon Sanchez <69873175+deon-sanchez@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * Update migration table naming * fix import and update log to error on prune failure * more import fixes * fix migration paths * more his->ver naming updates * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * Add checkbox to save draft or not * add scroll, leave saved * [autofix.ci] apply automated fixes * fix migration path and some merge conflicts * ruff * remove max flow version size * [autofix.ci] apply automated fixes * Add index to created_at --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Deon Sanchez <69873175+deon-sanchez@users.noreply.github.com> |
|||
| 2fc6ca8561 |
fix: update pydantic to 2.12.5 for fastapi-pagination compatibility (#11566)
* fix: update pydantic dependency to version 2.12.5 to silence fastapi pagination warning * fix: bump sqlmodel to 0.0.32 for pydantic 2.12 compatibility SQLModel 0.0.32 includes bug fix for Annotated field handling with Pydantic 2.12+ (PR #1607 by @vimota). Without this fix, runtime type- mapping errors occur when using Annotated type hints with SQLModel models. * fix: add model_config to TransactionReadResponse for pydantic 2.12 compat With pydantic 2.12+, model_validate with from_attributes=True requires populate_by_name=True when using field aliases. Without this config, pydantic looks for the alias name (transaction_id) on the source object instead of the actual field name (id). * fix: update pydantic version to 2.12.5 in starter project JSON files * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix: update sqlmodel dependency version to 0.0.37 * fix: enhance migration validation tests and add schema verification * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes (attempt 3/3) * fix: update expected tables and refine SQLite diff filtering in migration tests --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| a5c8bf2079 |
chore: remove CodeFlash integration (#11670)
Remove CodeFlash dependency, CI workflow, and configuration as it is no longer used. |
|||
| d602738a6d |
feat: KnowledgeBase Enhancements + Knowledge Ingestion flow + Polymorphic Job Tracking (#11541)
* updated columns name * fixed root issue * fixed chunks * fix: Remove title case transformation from knowledge base names and improve UI layout - Remove .title() transformation from knowledge base names in API endpoints - Add textTransform: none to knowledge base name column in grid - Improve source chunks page layout with proper overflow handling - Enhance chunk card UI with badges, better spacing, and copy feedback - Add pagination controls with first/last page buttons and page number input - Preserve original chunk indices when filtering - Fix whit * added kb dialog for added knowledg * added styles, need BE supprot * [autofix.ci] apply automated fixes * added more styles * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes * merge updated code * clean up stores and styles * fixed height on stepper * simplified init step * fixed minor issues in summary * code clean up with claude * moved kb files to the correct folder * added chunks endpoint * updated form * updated form * updated form to include column table * side panel style for multiple items * fixed placeholder and flipped modal settings config * [autofix.ci] apply automated fixes * fix for product styles and form update for hiding advanced mode * regex and dynamic error height adjustment * validation for file sizes * Move file size limit text to Configure Sources header and update conditional rendering * Paginated the chunk response. * Sync/Async ingestions endpoint for KnowledgeBases. Streamlining job execution for LF, internal status endpoint for jobs/tasks. * [autofix.ci] apply automated fixes * fix height jump and preview jump and added max h for dd * [autofix.ci] apply automated fixes * Paginated the chunk response. * Sync/Async ingestions endpoint for KnowledgeBases. Streamlining job execution for LF, internal status endpoint for jobs/tasks. * Modified migration file to handle downgrades. * committing changes for demo. * big updates * fixed chunks page * creating kb in canvas adds value and fixes updates functionality * fix ingestion for canvas * [autofix.ci] apply automated fixes * Added metadata file caching to speed up KB listing API call. # Conflicts: # src/backend/base/langflow/api/v1/knowledge_bases.py * Fixed linting and formatting issues. Tested caching for KB list call. * [autofix.ci] apply automated fixes * fixed icons * [autofix.ci] apply automated fixes * fixed jest test * fixed playwright test * updated ingestion format * fixes from qa * [autofix.ci] apply automated fixes * fix placeholder * fix deepclone * updated templates * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * updates templates * fix fe test * Added file locking to avoid lock contention and SQLite connection starvation. * fixed column config * persist the column config * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * added back metadata * Resolve locking error by force creating a fresh ChromaClient on every KB creation. This avoids the Read-Only 1032 Zombie Client error. Fixed ChromaClient creation to be only on creation, and reuse the client otherwise. * cris's fixes * reorganize KnowledgeBaseUploadModal file structure and update imports * [autofix.ci] apply automated fixes * tests * update google dependency version from 2.30.0 to 1.139.0 in component index * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * Addressed PR comments: refactored existing code to break bigger implmentations into more testable blocks, refactored helpers into class base helpers, fixed code smells, added exhautive unit tests, extracted constant values into a separate file. * hide col details and open table * Addressed PR comments. * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * updated test yaml * revert yml * revert yml * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Debojit Kaushik <kaushik.debojit@gmail.com> |
|||
| a75b127812 |
fix: upgrade opentelemetry stack (#11933)
* fix: upgrade opentelemetry stack upgrade opentelemetry stack * chore: add opentelemetry-exporter-prometheus back add opentelemetry-exporter-prometheus back * test: test_token_with_extra_claims asyncio add asyncio marker to test_token_with_extra_claims * test: add shutdown to OT tests add shutdown to OT tests |
|||
| d7eb29e853 |
feat: Add Openlayer Integration (#10699)
feat: Add Openlayer tracing integration Add Openlayer as a tracing provider for Langflow, enabling users to monitor and evaluate their LLM pipelines through the Openlayer platform. - Implement OpenlayerTracer following the BaseTracer interface - Support both Chat flows and Agent-only flows - Add integration documentation - Register openlayer as an optional dependency Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> |
|||
| 86078b23ae |
feat: lazy load imports for language model component (#11737)
* Lazy load imports for language model component Ensures that only the necessary dependencies are required. For example, if OpenAI provider is used, it will now only import langchain_openai, rather than requiring langchain_anthropic, langchain_ibm, etc. * Add backwards-compat functions * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * Add exception handling * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * comp index * docs: azure default temperature (#11829) * change-azure-openai-default-temperature-to-1.0 * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes (attempt 3/3) * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix unit test? * add no-group dev to docker builds * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Hamza Rashid <74062092+HzaRashid@users.noreply.github.com> Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com> |
|||
| 97e52e977a |
feat: use uv sources for CPU-only PyTorch (#11884)
* feat: use uv sources for CPU-only PyTorch Configure [tool.uv.sources] with pytorch-cpu index to avoid ~6GB CUDA dependencies in Docker images. This replaces hardcoded wheel URLs with a cleaner index-based approach. - Add pytorch-cpu index with explicit = true - Add torch/torchvision to [tool.uv.sources] - Add explicit torch/torchvision deps to trigger source override - Regenerate lockfile without nvidia/cuda/triton packages - Add required-environments for multi-platform support Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: update regex to only replace name in [project] section The previous regex matched all lines starting with `name = "..."`, which incorrectly renamed the UV index `pytorch-cpu` to `langflow-nightly` during nightly builds. This caused `uv lock` to fail with: "Package torch references an undeclared index: pytorch-cpu" The new regex specifically targets the name field within the [project] section only, avoiding unintended replacements in other sections like [[tool.uv.index]]. * style: fix ruff quote style * fix: remove required-environments to fix Python 3.13 macOS x86_64 CI The required-environments setting was causing hard failures when packages like torch didn't have wheels for specific platform/Python combinations. Without this setting, uv resolves optimistically and handles missing wheels gracefully at runtime instead of failing during resolution. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> |
|||
| 1ba1f0990c |
feat: token usage tracking in responses api (#11302)
* token usage tracking in responses api * add endpoint test * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * Assert only response.chunk events in stream test Update test_openai_error_propagation to ignore response.completed events emitted by the stream and only validate response.chunk entries. The stream can send a response.completed event containing a nested response id, but per OpenAI spec only response.chunk messages have top-level id/object/delta. Filter chunks accordingly, require at least one response.chunk, and assert the presence of id/object fields. * [autofix.ci] apply automated fixes * Include 'usage' in ChatInput test payload Update TestChatInput expected payload to include the new "usage": None field. This aligns the test with the component's output shape and prevents assertion failures when the component exposes a usage property (even when it's null). * Update component_index.json * [autofix.ci] apply automated fixes --------- Co-authored-by: Edwin Jose <edwin.jose@datastax.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 7f9d2a6fa4 |
chore: onnxruntime<=1.23 (#11889)
* chore: onnxruntime<=1.23 onnxruntime<=1.23 * Add comment * chore: use ~= instead * chore: added lower bound instead --------- Co-authored-by: Jordan Frazier <jordan.frazier@datastax.com> Co-authored-by: Jordan Frazier <122494242+jordanrfrazier@users.noreply.github.com> |
|||
| 4358e257af |
Revert "feat: use uv sources for CPU-only PyTorch (#11833)" (#11882)
This reverts commit
|
|||
| 355a4aa7fc |
feat: use uv sources for CPU-only PyTorch (#11833)
* feat: use uv sources for CPU-only PyTorch Configure [tool.uv.sources] with pytorch-cpu index to avoid ~6GB CUDA dependencies in Docker images. This replaces hardcoded wheel URLs with a cleaner index-based approach. - Add pytorch-cpu index with explicit = true - Add torch/torchvision to [tool.uv.sources] - Add explicit torch/torchvision deps to trigger source override - Regenerate lockfile without nvidia/cuda/triton packages * fix: address CodeRabbit review issues for PR #11833 - Add Windows AMD64 platform support to required-environments - Add inline comments explaining architecture naming differences across OSes - Document why loose version ranges are used (avoid conflicts with transitive deps like altk) - Exclude Windows ARM64 due to missing wheels for dependencies like faiss-cpu - Update comments to reflect multi-platform support (Linux, macOS, Windows) Resolves CodeRabbit issues: 1. Windows platform missing from required-environments 2. Clarifies rationale for loose torch/torchvision version ranges The loose version ranges (>=2.0.0) are intentional to avoid conflicts with transitive dependencies (e.g., agent-lifecycle-toolkit requires torch==2.2.2). The uv sources configuration ensures CPU-only PyTorch wheels are used for all platforms (verified in lockfile: torch 2.10.0+cpu for Linux/Windows). * fixed * fix: reduce Node.js heap size to 4GB in Docker builds to prevent OOM The Vite frontend build was configured with --max-old-space-size=12288 (12GB), which exceeds available RAM on ARM64 CI runners, causing the build process to be OOM-killed during the transform phase. Reduced to 4GB (4096MB) which is sufficient for the Vite build and prevents OOM kills in memory-constrained Docker BuildKit environments. * fix: avoid redundant recursive chown on /app in backend Dockerfile The recursive chown -R on /app was re-owning the entire .venv (~2.6GB, 40k+ files) which was already correctly owned via COPY --chown=1000:0. This was causing the build to be killed on ARM64 runners. Changed to non-recursive chown on /app since only the directory itself needs ownership set. /app/data still gets recursive chown (it's empty). * fix: add Docker cleanup between image builds to prevent disk full The 40GB ARM64 runner runs out of disk when building 3 Docker images sequentially. Each image (main ~8GB layers, backend ~5GB, frontend) accumulates build cache and layers that exhaust the disk. Added cleanup steps between builds that: - Remove the tested image (no longer needed) - Prune all unused Docker data and buildx cache - Log disk usage before/after for debugging --------- Co-authored-by: vijay kumar katuri <vijay.katuri@ibm.com> |
