mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-24 14:35:50 +08:00
rtce
108 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
| dea7b09257 |
fix(ci): create GitHub releases on the dispatched v-prefixed tag (1.11.0) (#13607)
fix(ci): create GitHub releases on the dispatched v-prefixed tag The create_release job passed the bare version (v stripped) as the release tag with no commit target, so when that tag did not exist GitHub minted a new lightweight tag at the default-branch HEAD -- the wrong commit, still carrying the previous version (main only adopts a release's version via the post-release back-merge). Every release since 1.8.2 shipped a stray bare tag (1.8.2, 1.8.3, 1.9.0-1.9.6, 1.10.0) pointing at a previous-version commit, and the GitHub release had to be manually re-pointed to the real vX.Y.Z tag after each release. - create_release now attaches the release to inputs.release_tag for stable releases; pre-releases keep their computed tag (e.g. 1.10.0rc1) but it is minted at the release commit via 'commit:'. - release-lfx.yml pins the minted lfx-v* tag to github.sha instead of the default branch. The validate-tag-format guard (#12847) only blocks at dispatch time; create_release was re-creating the very duplicates it guards against. |
|||
| 6610091697 |
fix(bundles): republish lfx-* at 0.1.1 with corrected pin + relax lfx floor for RC builds (#13542)
* fix(bundles): bump lfx-* bundles to 0.1.1 to republish with corrected lfx pin The published 0.1.0 artifacts on PyPI carry stale lfx pins from before the lfx 0.5.0->1.10.0 version realignment: - lfx-arxiv, lfx-duckduckgo: lfx>=0.5.0,<0.6.0 (hard-broken; the <0.6.0 cap can never resolve lfx 1.10.0) - lfx-docling, lfx-ibm: lfx>=0.5.0 (uncapped floor/cap mismatch) The source pin was already corrected to lfx>=1.10.0,<2.0.0 in #13516, but the bundles were never re-published. PyPI versions are immutable, so shipping the fix requires a version bump. Bump all four to 0.1.1 so the Release Bundles workflow cuts fresh wheels carrying the correct pin. Root pyproject keeps its >=0.1.0 floors (satisfied by 0.1.1); only the bundle dist versions and their uv.lock stamps change. * fix(release): relax bundle lfx floor for pre-release builds + idempotent bundle publish The RC pre-release run builds lfx as 1.10.0rc0, but bundles floor lfx at >=1.10.0. Under PEP 440 a pre-release sorts below the final, so 1.10.0rc0 fails >=1.10.0 and the cross-platform install test cannot resolve the bundle wheels against the RC lfx wheel. build-base/build-main/build-lfx already rewrite their inter-package deps to the pre-release version when pre_release=true; build-bundles was the only release artifact missing that step. Add it: when pre_release=true, rewrite each bundle's lfx floor to the exact pre-release version, keeping the wide <2.0.0 BUNDLE_API cap. Stable source stays at >=1.10.0 -- only RC wheels are relaxed, at build time, so no source churn or re-tag. Also make publish-bundles tolerate 'already exists' duplicate wheels on rerun, matching release_bundles.yml. |
|||
| 1ab6251164 |
feat: sync langflow and lfx versions (#13176)
* feat(lfx): synchronize LFX onto Langflow major.minor version line (Phase 1) - Bump src/lfx/pyproject.toml from 0.5.0 to 1.10.0 - Tighten langflow-base lfx pin: ~=0.5.0 → ~=1.10.0 - Fix release.yml pre-release boundary from next-major to next-minor (<X.(Y+1).dev0) - Add minor-parity soft check to scripts/release-lfx.sh - Extend make patch to sync lfx version alongside langflow/base/frontend - Document LFX compatibility contract in RELEASE.md Contract: LFX X.Y.N is compatible with any Flow from Langflow X.Y.M. * feat(lfx/upgrade): add compatibility checker (Phase 2) * fix(lfx/upgrade): fix registry_code guard and types order-sensitivity in checker * feat(lfx/upgrade): implement safe-upgrade applier (Phase 2) * feat(lfx): add lfx upgrade command (Phase 2) * feat(lfx/run): add --upgrade-flow option (Phase 2) * feat(lfx/serve): add --upgrade-flow option (Phase 2) * update lfx pyproject version * [autofix.ci] apply automated fixes * test(lfx/upgrade): add v1.9.0 starter flow fixtures for upgrade integration tests * test(lfx/upgrade): add v1.9.0 starter flow fixtures and real-flow integration tests * [autofix.ci] apply automated fixes * fix(lfx/upgrade): use alias-aware registry lookup so renamed components are not falsely blocked * fix(lfx/upgrade): handle outer flow envelope and file-path inputs in upgrade checks * fix(lfx/upgrade): fail-fast on upgrade_flow errors; add regression tests for Bugs 1-3 * chore(tests): remove bug-number labels from test comments * [autofix.ci] apply automated fixes * fix(lfx/upgrade): address PR review comments - Reject .py files early in serve --upgrade-flow with a clear error message - Preserve outer flow envelope metadata (name, description, etc.) when lfx upgrade --write rewrites a file - Move Mapping import under TYPE_CHECKING to satisfy Ruff TC003 - Assert fixture flows and registry are non-empty so parametrized tests cannot pass vacuously - Remove unused capsys arg and replace print with sys.stderr.write (Ruff T201/ARG001) - Add upgrade_flow param to run command docstring * fix(lfx/upgrade): preserve envelope on run, apply nested upgrades (#13200) * fix(lfx/upgrade): preserve envelope on run, apply nested upgrades Three follow-ups on top of the upgrade tooling: - run --upgrade-flow: re-attach the inner graph to the outer envelope before handing the flow to aload_flow_from_json. Previously the upgrade path unwrapped {"data": ...} and passed the inner dict to the loader, which raised KeyError: 'data'. Adds happy-path tests for envelope and flat file inputs. - applier: recurse into one level of nested flow nodes (node.data.node.flow.data.nodes), matching the checker. Without this, outdated_safe nodes inside grouped components were reported but never written. Adds a regression test. - upgrade --write test: assert the envelope is preserved (name, description, endpoint_name, etc.) instead of the previous unwrapped-output expectation, so the test matches the actual fix in this PR. - Drive-by ruff cleanup: D417 docstring, SIM103, SIM108, E501, RUF059. * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fix(lfx/upgrade): fix loader KeyError, outer-envelope checker gap, and nested-node applier Three bugs from ogabrielluiz's PR review: 1. run/base.py loader KeyError: file-path branch unwrapped the outer envelope for the checker but passed the inner dict to aload_flow_from_json, which does flow_graph["data"] unconditionally. Re-wrap as {"data": flow_dict} before the loader call. Applied consistently to all three input paths (--flow-json, --stdin, file-path). 2. run/base.py zero-node checker for --flow-json/--stdin: those paths stored the raw parsed JSON without unwrapping, so a caller passing an exported flow {"name":..., "data":{...}} caused the checker to see zero nodes and silently pass. Now unwrap with raw.get("data", raw) matching the file-path branch. 3. applier.py nested flows never upgraded: the early `continue` on top-level nodes not in safe_ids prevented the nested-node loop from running. Restructured so the nested check fires unconditionally for every top-level node, mirroring checker.py:160-165. * fix(lfx/run): unify outer-envelope unwrap across all --upgrade-flow input paths File-path reads now call raw.get("data", raw) matching --flow-json and --stdin, so the upgrade checker always sees the inner graph. This also removes the has_envelope/re-wrap machinery that was double-wrapping outer-envelope files when passing to aload_flow_from_json. Fix two test assertions that described the old double-wrapped shape. * fix(lfx/upgrade): inject registry into upgrade_command; fix Makefile lfx pin regex - upgrade_command now accepts an optional registry parameter so tests can pass the dict directly instead of mocking load_registry_from_index - Makefile sed regex broadened from \"lfx~=.*\" to match both ~= and >= forms so make patch works after release.yml rewrites the pin - Echo label changed to LFX (synced) to clarify the variable is the shared Langflow version, not a separate LFX-specific value * fix(make/patch): fix langflow-base sed regex and validation grep The dependency in pyproject.toml is "langflow-base[complete]>=X.Y.Z", not the "langflow-base==X" form the original regex expected, so make patch silently left the pin unchanged and the validation step always failed. The sed pattern now matches any extras/operator combination and rewrites to the canonical [complete]>= form; the grep uses -F so the [complete] brackets are treated literally. * test(lfx): add patch regex tests and symmetric safe-mode envelope tests test_patch_regexes.py — 15 tests covering the Python regexes embedded in the Makefile patch target. Exercises all three substitutions (langflow-base pin, lfx pin, version field) against every realistic pin format including the >=X.Y.Z,<dev0 form that release.yml writes. Would have caught the langflow-base==.* vs [complete]>= mismatch before manual testing. test_base.py — two new TestUpgradeFlowOption tests: test_upgrade_flow_safe_envelope_inline_json_loads_successfully test_upgrade_flow_safe_envelope_stdin_loads_successfully Symmetric to the existing file-path envelope test; verifies that --flow-json and --stdin with an outer-envelope flow also pass {"data": inner} to the loader after safe upgrades, not a double-wrapped {"data": outer_envelope}. * fix(lfx/upgrade): address review: compat checker, shared gate, fail-fast registry Checker correctness: - _outputs_are_compatible: drop cosmetic display_name from the breaking check; treat widened output types as safe (flow types must be a subset of registry types), only narrowing breaks downstream edges. - _input_types_contained: stop flagging widened input_types as breaking; keep narrowing as the only breaking case; fix misleading comments. - check_flow_compatibility now recurses fully into nested grouped components (symmetric with the applier) and accepts a pre-built registry lookup. CLI/run/serve: - New lfx.upgrade.cli_gate (UpgradeFlowMode enum, UpgradeFlowError, apply_upgrade_gate) shared by run_flow and serve_command so the two --upgrade-flow paths can't diverge. - run_flow: extract _materialize_flow_dict and route gating through the shared helper. - run/serve --upgrade-flow options typed as UpgradeFlowMode (check|safe choices). - lfx upgrade: load_registry_from_index fails fast when the bundled registry is empty/missing instead of silently marking every node blocked; ASCII-only report output; new --strict flag; build the registry lookup once and reuse it. Docs/tests: - RELEASE.md: migration note for the lfx 0.5.0 -> 1.10.0 version jump. - Regression tests for the checker fixes, the shared gate, fail-fast registry, --strict, and serve --upgrade-flow parity. * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix(lfx): consolidate flow-envelope handling and fix version-ceiling regex Extract the outer-envelope unwrap/rewrap logic (previously hand-rolled as raw.get("data", raw) with subtly different rules across serve, run, and upgrade) into a single lfx.utils.flow_envelope module with split/merge helpers. This fixes a serve bug where an enveloped flow had its inner graph written bare to the temp file, making the loader's flow_graph["data"] raise KeyError. Also fix release.yml's major.minor extraction: the greedy sed grabbed the upper bound from a range pin (>=1.10.0,<1.11.dev0), drifting the version ceiling up one minor each release cycle. Anchor to the first version instead. * fix(lfx): upgrade-flow gate reads bundled component index, not empty cache The --upgrade-flow=check|safe gate on lfx run and lfx serve rejected every flow as 'blocked'. Both call sites passed component_cache.all_types_dict to apply_upgrade_gate, but that cache is populated lazily after services start, so at gate time it is empty -- an empty registry classifies every node as blocked. The standalone lfx upgrade command was unaffected because it reads the bundled _assets/component_index.json instead. Make the gate own registry loading: apply_upgrade_gate now defaults all_types_dict to None and loads the bundled index (the same source lfx upgrade uses) via a new _load_bundled_registry helper, raising UpgradeFlowError on a missing/empty index so a broken install fails loudly instead of silently blocking every component. Both call sites pass mode= and let the gate load the registry. Existing gate tests mocked component_cache with a populated registry, which is exactly what hid the bug; repoint them at the new _load_bundled_registry seam and add regression tests that do not mock the registry, including an end-to-end run_flow check against a real clean v1.9.0 starter flow. --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Gabriel Luiz Freitas Almeida <gabriel@logspace.ai> |
|||
| fb4dfd49fd |
ci: sync workflow fixes from main into release-1.10.0 (fix broken nightly) (#13400)
ci: sync workflow fixes from main into release-1.10.0 Brings the latest CI/workflow fixes from main into release-1.10.0 so the nightly build is unblocked and the two branches share the same hardening. Most important fix: release_nightly.yml's "Verify Nightly Name and Version" step now uses the anchored grep '^langflow(-nightly)?[[:space:]]' instead of 'grep langflow | grep -v langflow-base | grep -v langflow-sdk'. The old filter started matching two packages once the langflow-stepflow workspace package was added, so the name became multi-line and the check failed (this is what broke the nightly build). Also carries main's fixes for cross-platform install (--prerelease=if-necessary-or-explicit), docker build workflows, db-migration-validation, and the backend test timeout bump (30 -> 40). 3-way merged from the common ancestor, so release-only changes are preserved; no release-only feature workflows are modified. |
|||
| 883872f95f | Update release.yml | |||
| a80cf1c649 |
chore: support Python 3.14 (#13085)
* feat: upgrade Docker images to Python 3.14 (experimental)
- Update pyproject.toml: requires-python from <3.14 to <3.15
- Update all 5 Dockerfiles to use Python 3.14:
- Builder stage: python3.12-trixie-slim → python3.14-trixie-slim
- Runtime stage: python:3.12-slim-trixie → python:3.14-slim-trixie
- src/backend/base/pyproject.toml
- docker/build_and_push_base.Dockerfile
- docker/build_and_push.Dockerfile
- docker/build_and_push_backend.Dockerfile
- docker/build_and_push_with_extras.Dockerfile
- docker/build_and_push_ep.Dockerfile
Python 3.14.5 was released on May 10, 2026. Upgrading to the latest
Python version should help reduce CVE vulnerabilities in Docker images.
This is an experimental change to test Python 3.14 compatibility:
- Docker images will use Python 3.14
- CI/CD workflows still test on Python 3.10-3.13
- Nightly build will validate if dependencies work with 3.14
- Can be reverted quickly if issues are found
- Monitor nightly build for failures
- If successful, update CI/CD workflows to add Python 3.14 to test matrix
- If failures occur, revert and investigate compatibility issues
* chore: support Python 3.14
Bump requires-python upper bound to <3.15 across langflow, langflow-base,
lfx, and langflow-sdk, and add 3.14 to CI test matrices so PRs are gated
on 3.14 compatibility.
Conditional pins for transitive deps without 3.14 wheels at the existing
caps:
- onnxruntime: >=1.26 on 3.14 (existing <1.24 cap retained for 3.10)
- faiss-cpu: >=1.13.2 on 3.14 (existing ==1.9.0.post1 retained for <3.14)
* chore: marker-gate IBM watsonx packages for Python 3.14
ibm-watsonx-ai 1.3.x cannot import on Python 3.14: its StrEnum subclasses
override __init__ in a way that conflicts with 3.14's reworked enum
__set_name__ path (TypeError on KnowledgeBaseFieldRole class creation).
Cap ibm-watsonx-ai, langchain-ibm, and the ibm-watsonx-orchestrate-*
extras at python_version<'3.14' until upstream adapts. Watsonx component
imports are already lazy, so this surfaces only at component-access time
on 3.14, where the existing ImportError handler in
lfx.components.ibm.__init__ degrades it gracefully.
test_model_utils.py imports ChatWatsonx at module top to verify
get_model_name resolves model_id; guard that import so the test
module skips on 3.14 instead of breaking collection.
* [autofix.ci] apply automated fixes
* chore: upgrade remaining Docker images to Python 3.14
build_and_push*.Dockerfile already moved to 3.14 in the merge from
feat/upgrade-python-3.14-docker-images. Apply the same bump to the
dev, devcontainer, and lfx Docker images so all in-repo Dockerfiles
share one Python version.
* [autofix.ci] apply automated fixes
* chore: gate 3.14-broken extras to python_version<'3.14'
cuga (and its transitive fastembed -> py-rust-stemmers source build),
altk/agent-lifecycle-toolkit (re-pulls ibm-watsonx-ai which was already
gated), langchain-pinecone, langwatch, ragstack-ai-knowledge-store, and
OpenDsStar all pin themselves below 3.14 upstream. Without a marker
guard, the workspace lock still tries to install them and a Docker
`uv sync` then attempts source builds that require Rust (CI Docker
test failure with py-rust-stemmers 0.1.5).
Add python_version<'3.14' (or <'3.13' for ragstack) to each pin so
those packages are simply omitted from the 3.14 install set until
upstream catches up. uv pip check is now clean on 3.14.2.
* test: skip test_altk_agent on Python 3.14
altk (agent-lifecycle-toolkit) is gated to python_version<'3.14'
upstream and now via the langflow-base [altk] extra marker. The test
imports altk at module top to exercise ALTKAgentComponent; guard the
import so collection skips on 3.14 instead of failing.
* test: skip remaining altk tests on Python 3.14
Three more test modules import lfx.base.agents.altk_* at module top,
which transitively imports altk. Add the same module-level skip guard
as test_altk_agent.py:
- test_altk_agent_logic.py
- test_altk_agent_tool_conversion.py
- test_conversation_context_ordering.py
* fix(calculator): replace removed ast.Num with ast.Constant for Python 3.14
ast.Num was deprecated in Python 3.8 in favor of ast.Constant and
removed entirely in 3.14. The calculator tool and its core walker
crashed on 3.14 with 'module ast has no attribute Num'.
Switch the isinstance checks to ast.Constant + isinstance(node.value,
(int, float)), and drop the now-dead ast.Num backwards-compat branch
in calculator_core.py (the ast.Constant branch already handles every
input it would have matched). Update the parser unit-test fixtures
to construct ast.Constant nodes.
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* test: skip LangWatch HTTP instrumentation tests on Python 3.14
langwatch is gated to python_version<'3.14' upstream. The
TestLangWatchHttpInstrumentation class patches langwatch.setup and
langwatch.trace inside a fixture, which requires langwatch to be
importable; on 3.14 the test errors with ModuleNotFoundError.
Guard the class with a skipif on langwatch availability.
* test: allow IBM and altk components to be missing on Python 3.14
test_all_modules_importable enforces that every component in __all__
imports cleanly. On 3.14 the ibm-watsonx-ai, langchain-ibm, and altk
packages are gated upstream and intentionally not installed, so the
WatsonxAI, WatsonxEmbeddings, and ALTKAgent components fail to import
as designed.
- test_all_components_in_categories_importable: accept a known-gated
deny-list on 3.14 instead of failing.
- test_all_lfx_component_modules_directly_importable: extend the
existing 'missing optional dependency' allowlist with altk,
langchain_ibm, and ibm_watsonx_ai.
* fix(lfx): pass ensure_exists to user_cache_dir for Python 3.14
Python 3.14 tightened PurePath.__init__ to reject unknown keyword
arguments. The KeyedWorkerLockManager constructor was passing
ensure_exists=True to Path() instead of user_cache_dir(), which
silently worked on 3.10-3.13 but raises TypeError on 3.14 and also
meant the cache directory was never actually being created.
Move the kwarg to user_cache_dir() where it belongs and update the
two unit tests that asserted the buggy call shape.
* [autofix.ci] apply automated fixes
* test: accept either ZIP or JSON error path on Python 3.14
Python 3.14's zipfile.is_zipfile() now validates the central-directory
signature in addition to EOCD, so the garbage+EOCD payload no longer
passes the is_zipfile() dispatch in the /flows/upload/ route. The
endpoint still returns 400 with a descriptive detail (now from the JSON
branch); only the message wording differs, which the test was asserting
verbatim.
* fix(lfx): normalize cors_origins ['*'] back to '*' on Python 3.14
Pydantic-settings on Python 3.14 parses the env var '*' into ['*']
before the cors_origins field validator runs (the list[str] | str union
resolves differently than on 3.10-3.13). Collapse that back to the
bare-string wildcard so downstream consumers — including
warn_about_future_cors_changes and the test suite — see the same shape
on every supported Python version.
---------
Co-authored-by: vijay kumar katuri <vijay.katuri@ibm.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
(cherry picked from commit
|
|||
| 0732423f27 |
chore: security patch (#12725)
* chore: security patch security patch * chore: upgrade package-lock.json * chore: smolagents and transformer update * chore: redis upgrade * chore: litellm upgrade * fix: Pin click to avoid lower versions ## Root cause **litellm 1.83.5+** introduced an exact pin `click==8.1.8` in its `requires_dist` (upstream bug [BerriAI/litellm#26154](https://github.com/BerriAI/litellm/issues/26154) — "Pinning exact dependency versions breaks downstream consumers"). When this branch bumped litellm to 1.83.11, uv was forced to downgrade click from 8.3.2 → 8.1.8. Click 8.2+ captures stderr separately by default; 8.1 merges it — hence `ValueError: stderr not separately captured`. ## Fix - [pyproject.toml:155](pyproject.toml:155) — added `"click>=8.3.0"` to `[tool.uv] override-dependencies` with comment linking the upstream issue. - [src/backend/base/pyproject.toml:112](src/backend/base/pyproject.toml:112) — same override so `langflow-base` Docker builds pick it up too. - Regenerated `uv.lock` (click: 8.1.8 → 8.3.3). - Patched the `click` entry in `src/backend/base/uv.lock` to 8.3.3 (that lockfile is used by `docker/build_and_push_base.Dockerfile` via `uv sync --frozen`; uv treats backend/base as a workspace member so I updated its click block directly — no other references to 8.1.8 remain). - Reverted [src/lfx/tests/unit/cli/test_run_real_flows.py](src/lfx/tests/unit/cli/test_run_real_flows.py) back to its original `result.stderr` usage — now passes cleanly with click 8.3.3. All 19 tests in the file pass. * Update build_and_push_backend.Dockerfile The `uv pip install` command doesn't read `[tool.uv] override-dependencies` from the target packages' pyproject.toml — those overrides only apply during `uv lock`/`uv sync`. The fix is to pass the overrides explicitly via `--overrides`. Now let me verify it works by running the same install locally. Resolution succeeded — click==8.3.3, aiohttp==3.13.5, litellm==1.83.11 all coexist. Let me also test without `--overrides` to confirm I reproduce the original failure. Reproduced the Docker failure locally. Now test with the overrides file: Fix verified — resolution succeeds with the overrides file, failing without. Let me clean up and show the final Dockerfile change. ## Summary **Root cause:** The Dockerfile uses `uv pip install ./src/...` which **does not read** `[tool.uv] override-dependencies` from the target packages' `pyproject.toml` — those overrides only apply during `uv lock`/`uv sync`. On Linux, `cuga>=0.2.20` requires `aiohttp>=3.13.5`, but `litellm==1.83.11` exact-pins `aiohttp==3.13.3` (same upstream bug as the click pin, [BerriAI/litellm#26154](https://github.com/BerriAI/litellm/issues/26154)). Without an active override, resolution fails. **Fix:** Write a `/tmp/uv-overrides.txt` file mirroring the workspace's `override-dependencies` (litellm, python-dotenv, openai, aiohttp, click) and pass `--overrides /tmp/uv-overrides.txt` to `uv pip install`. Verified locally by reproducing the exact failure in an isolated tmp directory (to escape the workspace's pyproject.toml auto-apply), then confirming the overrides file resolves it: - aiohttp==3.13.5 ✓ - click==8.3.3 ✓ - litellm==1.83.11 ✓ - cuga==0.2.22 ✓ * Templates version update * Update .secrets.baseline * chore: update overrides * chore: bump version * chore: bump main version * chore: bump SDK version to 0.1.1 * chore: run uv lock and uv sync after SDK version bump * chore: read the overrides from a single source security patch * chore: add pip check toggle add pip check toggle * chore: litellm base uv.lock update * fix(chore): Pin litellm back to last working release * fix(chore): Pin to 1.83 and higher litellm * Update build_and_push_backend.Dockerfile * chore: update base uv.lock * fix: lazyload toolguard since its an optional extra * Update .secrets.baseline * Update component_index.json * Rebuild component index * Update component_index.json --------- Co-authored-by: Eric Hare <ericrhare@gmail.com> Co-authored-by: vijay kumar katuri <vijay.katuri@ibm.com> (cherry picked from commit 60a8f76c3fde17124057626c671ea8162872837a) |
|||
| b2d4539590 |
fix(ci): prevent duplicate tags and validate tag format in release workflow (#12847)
- Add tag format validation (must start with 'v')
- Check for duplicate tags without 'v' prefix
- Prevent release notes from using wrong base comparison
- Add validate-tag-format job dependency to create_release
Fixes tag duplication issue that caused v1.9.0 release notes to miss 58 commits.
Root cause: Duplicate tags (1.8.3 vs v1.8.3) caused GitHub's generateReleaseNotes
to pick the wrong base tag due to alphabetical sorting.
This ensures future releases will:
1. Only accept tags with 'v' prefix (v1.2.3 format)
2. Detect and reject releases if duplicate tags exist
3. Generate correct release notes with proper commit history
(cherry picked from commit
|
|||
| 38d142a723 |
fix: Upgrade cuga to 0.2.20 to resolve playwright dependency conflict (#12703)
* fix: upgrade playwright to 1.58.0 to address Chromium CVEs - Add playwright>=1.58.0 to override-dependencies in pyproject.toml - Update uv.lock: playwright 1.49.0 -> 1.58.0, pyee 12.0.0 -> 13.0.1 - Fixes CVE-2026-2313, CVE-2026-2314, CVE-2026-2315, CVE-2026-2319, CVE-2026-2321, CVE-2026-2441, CVE-2026-2648, CVE-2026-2649 - Ensures Docker builds download updated Chromium with security patches * fix: update npm to latest version to address brace-expansion CVE-2026-33750 - Add npm update after Node.js installation in Dockerfile - Fixes CVE-2026-33750 in system npm's brace-expansion dependency - System npm had brace-expansion 2.0.2, update gets 5.0.5+ - Low risk change: npm is backward compatible, only affects CLI tool * revert: remove npm update from Dockerfile - npm update attempts were causing CI build failures - Bundled npm has issues but updating it is proving problematic - Focus on playwright CVE fix which is the primary concern - brace-expansion CVE-2026-33750 is lower priority (DoS only) * chore: sync uv.lock files sync uv.lock files * fix(mcp): dedupe edges in connect_components (#12701) * fix(mcp): make add_connection idempotent to avoid duplicate edges connect_components used to append a new edge unconditionally. Because the edge id is deterministic from source/target/handles, calling it for a pair the flow already had wired up (UI-then-MCP, batch retry, or just a repeat call) produced a second edge with the same id, double-wiring the flow at runtime. Before appending, scan the existing edges for one with the same id and return that instead. Different outputs/inputs between the same pair still produce distinct ids and remain supported. * test(mcp): cover dedupe against UI-saved edges, broaden match key Older Langflow UIs saved edges with an `xy-edge__` id prefix instead of the current `reactflow__edge-`, so an id-based dedup would miss the UI-then-MCP case for any flow that came from an older version. Switch the existence check to a structural one (source, target, sourceHandle name, targetHandle fieldName) so the same logical connection dedupes regardless of id format. Add a fixture-driven test that loads MemoryChatbotNoLLM.json (an xy-edge-prefixed flow) and replays each connection through add_connection, asserting the edge count does not grow. * fix(mcp): validate_flow fast-fails and reports partial errors (#12697) * fix(mcp): validate_flow fast-fails and reports partial errors validate_flow polled /monitor/builds for up to 30 seconds waiting for every component to finish before reporting errors. When a component fails early (for example a missing required field), downstream components never run, so the loop waited out the full window and returned just "Build timed out: N/M components completed" with no actionable context. - Short-circuit as soon as any completed build reports valid: false; return those errors immediately instead of polling on. - On timeout, include the errors from the builds that did complete plus a component_count so the caller can see progress. - Extract _collect_build_errors so the poll loop and timeout branch share the same error shape. * fix(mcp): stream validate_flow build inline instead of polling The previous implementation triggered an async build and polled /monitor/builds, which depended on FastAPI BackgroundTasks firing the log_vertex_build calls after the trigger request had returned. Under ASGI test transport these tasks never run, so /monitor/builds stayed empty and validate_flow timed out with component_count=0. Switch to event_delivery=direct so the build streams its events back inside the same request: - Drive the build via client.stream_post and aggregate per-vertex results from end_vertex events. - Fast-fail on the first vertex with valid=false, since downstream vertices depend on it and would not produce useful information. - Surface top-level error events as a single flow-level error. - Replace _collect_build_errors with _extract_vertex_error, which reads the structured error payload from the end_vertex outputs. Update the lfx unit tests to use the streaming shape and tighten the backend integration test to assert real success now that the build actually runs end to end under ASGI. * fix(graph): make end_all_traces_in_context Python 3.10 compatible The implementation called asyncio.create_task(coro, context=context), but the context= keyword was added to create_task in Python 3.11. On 3.10 it raised TypeError. The bug was latent because nothing in the test suite previously consumed a streaming build response far enough for Starlette to dispatch the post-response BackgroundTasks where this code lives. The validate_flow streaming change exposes it. On 3.10, route the create_task call through context.run so the new Task copies the captured context as its current context, matching the isolation the 3.11 path provides via the context= kwarg. Add a regression test that asserts end_all_traces sees the value of a contextvar set before the context was captured, even after the caller mutates that var. * fix: failing wxo list llm test (#12700) patch service layer and update failing test * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * Try to fix the missing typer import --------- Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com> Co-authored-by: Gabriel Luiz Freitas Almeida <gabriel@logspace.ai> Co-authored-by: Hamza Rashid <74062092+HzaRashid@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| b65515f351 |
fix: add uv sync step to SDK version determination job (#12695)
The determine-sdk-version job was missing the 'uv sync' step that creates the cache, causing the 'Post Setup Environment' step to fail with: 'cache path does not exist on disk' This matches the pattern used in determine-lfx-version job (line 247) and the nightly build workflow (line 104-105). Fixes the SDK build failure in release workflow dry run. |
|||
| 9029c4b61e |
fix: Updates the CI workflow to handle known dependency conflicts. (#12691)
* fix: upgrade playwright to 1.58.0 to address Chromium CVEs - Add playwright>=1.58.0 to override-dependencies in pyproject.toml - Update uv.lock: playwright 1.49.0 -> 1.58.0, pyee 12.0.0 -> 13.0.1 - Fixes CVE-2026-2313, CVE-2026-2314, CVE-2026-2315, CVE-2026-2319, CVE-2026-2321, CVE-2026-2441, CVE-2026-2648, CVE-2026-2649 - Ensures Docker builds download updated Chromium with security patches * fix: update npm to latest version to address brace-expansion CVE-2026-33750 - Add npm update after Node.js installation in Dockerfile - Fixes CVE-2026-33750 in system npm's brace-expansion dependency - System npm had brace-expansion 2.0.2, update gets 5.0.5+ - Low risk change: npm is backward compatible, only affects CLI tool * revert: remove npm update from Dockerfile - npm update attempts were causing CI build failures - Bundled npm has issues but updating it is proving problematic - Focus on playwright CVE fix which is the primary concern - brace-expansion CVE-2026-33750 is lower priority (DoS only) * CI: Filter cuga/playwright dependency conflict in release workflow - Filter cuga/playwright conflict (we override playwright>=1.58.0 for CVE fixes) - Still fails CI if other genuine dependency issues are detected - Applied to both base and main package build steps --------- Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> |
|||
| 2fa3d1c759 |
feat: add langflow-sdk support to release workflow (#12679)
* feat: add langflow-sdk build and publish support to release workflow Add support for building and publishing the langflow-sdk package in the release workflow, mirroring the nightly build support added in #12491. Changes: - Add `release_sdk` workflow input for controlling SDK release - Add `determine-sdk-version` job with first-release PyPI handling - Add `build-sdk` job with version verification and import testing - Add `publish-sdk` job that publishes SDK to PyPI before LFX - Update `build-lfx` to download SDK artifact and test both wheels together - Update `build-base` and `build-main` to use SDK wheel as find-links - Pass SDK artifact to cross-platform tests - Add validation: releasing LFX requires releasing SDK - Add pre-release version handling for SDK and LFX's SDK dependency * Update release.yml * Update release.yml * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |
|||
| 68642a8a86 |
fix: Properly grep for the langflow version (#12486)
* fix: Properly grep for the langflow version * Mount the sdk where needed * Skip the sdk |
|||
| bc2da110e5 |
fix: gate PyPI publish jobs on CI completion in release workflow (#12168)
fix: gate PyPI publish jobs on CI completion The publish-base, publish-main, and publish-lfx jobs were not waiting for the CI workflow to complete before publishing to PyPI. This could result in broken packages being published if CI fails. Docker builds already correctly depend on CI. Add 'ci' to the needs array of all three publish jobs so packages are only published after the full test suite passes. |
|||
| c1b423862d |
fix: preserve [complete] extra in langflow-base pre-release constraint (#11931)
* fix: preserve [complete] extra in langflow-base pre-release constraint The sed replacement for pre-release builds was dropping the [complete] extra from the langflow-base dependency, causing the built wheel to depend on bare langflow-base instead of langflow-base[complete]. This meant hundreds of optional dependencies (LLM providers, vector stores, document loaders, etc.) were missing from pre-release installs, breaking the CLI and all cross-platform installation tests. * test: add regression test for sed constraint preservation * [autofix.ci] apply automated fixes * test: add regression test for sed constraint preservation in release workflow * [autofix.ci] apply automated fixes * test: add regression test for sed constraint preservation in release workflow * [autofix.ci] apply automated fixes * fix: move noqa comment to correct line for S603 check * [autofix.ci] apply automated fixes * test: add regression test for sed constraint preservation in release workflow * [autofix.ci] apply automated fixes * test: add regression test for sed constraint preservation in release workflow --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 6e95b7cdcc |
ci: wire pre_release input to cross-platform tests (#11925)
The cross-platform-test.yml references inputs.pre_release in the force-reinstall steps (added in PR #11322) but never declares it as a workflow_call input. release.yml also never passes it. This means inputs.pre_release is always empty, force-reinstall always uses --no-deps, and dependency resolution fails for RC versions. - Add pre_release as a workflow_call boolean input in cross-platform-test.yml - Pass pre_release from release.yml when calling cross-platform-test.yml |
|||
| 0c8c834df3 |
feat: update pre-release flow to be useable for qa (#11322)
* feat: create prerelease dedicated to qa allow prerelease versions dedicated to qa * chore: revert lfx dep to 0.2.1 * chore: lfx pyproject version 0.2.1 for testing * feat: use pythin script to determine rc version use a python script to auto incremenet rc version so we do not have to manually maintain what rc version we are on. add it to both release.yml and docker-build-v2.yml for pypi, docker and ghrc. * [autofix.ci] apply automated fixes * chore: change script vars to more meaningful ones * chore: add meaningful echos * chore: add quotes to pass empty str if no version * test: REVERT always pass ci REVERT * chore: add normalization to built ver tests * chore: remove unused uv environment set up * chore: add back in checkout code * chore: disable caching for ensure-lfx-published * chore: revert changes added after merge * fix: allow prerelase python install flag * chore: test base and main install as 1 * chore: seperate base and main * chore: install main using local base first * chore: try using reinstall * chore: create locl directory and use it first * chore: try --no-deps * chore: langflow-*.whl * [autofix.ci] apply automated fixes * fix: try using unsafe-best-match use ./local-packages --index-strategy unsafe-best-match * fix: add a dynamic constriant for langflow base add a dynamic constriant for langflow base during build-main. if this works I will need to go back and remove any unneeded cross-platform test changes * chore: revert to normal install * fix: add pre-main option to make build * chore: remove hyphen in make var * chore: keep propigation wait for pre-release * chore: revert cross-platform-test.yml changes * chore: use else ifdef and add test echos * chore: remove --no-soruces * chore: use ifeq * chore: revert lfx 0.2.1 * chore: downgrade to python 3.12 ragstack-ai-knowledge-store does not support pythong 3.13 * chore: add else to Makefile * chore: back to ifdef * chore: reset to Makefile to main and add pre again * chore: revert to python 3.13 * chore: set compatability check to 3.12 hopeffuly fixes Found 1 incompatibility The package `ragstack-ai-knowledge-store` requires Python >=3.9, <3.13, but `3.13.11` is installed * [autofix.ci] apply automated fixes * fix: new flow reset. * chore: update LFX Determine version * fix: remove buil-lfx dep on lfx release * chore: remove more inputs.release_lfx if statments * fix: uv pip install --find-links * chore: create uv venv before uv pip install * chire: attempt for reinatll of local whls * fix: add OBJC_DISABLE_INITIALIZE_FORK_SAFETY: YES add OBJC_DISABLE_INITIALIZE_FORK_SAFETY: YES to macos cross-platform test builds * [autofix.ci] apply automated fixes * chore: add back in ci step * fix(ci): correctly generate pre-release rc tags * [autofix.ci] apply automated fixes * feat: update pre-release flow to be useable for qa * Revert "feat: update pre-release flow to be useable for qa" This reverts commit 22737729a2d0ed64ea774a30af070f0010cba9e1. * feat: update pre-release flow to be useable for qa * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * feat: update pre-release flow to be useable for qa * feat: update pre-release flow to be useable for qa * feat: update pre-release flow to be useable for qa * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: vijay kumar katuri <vijaykaturi@vijays-MacBook-Air.local> Co-authored-by: vijay kumar katuri <vijay.katuri@ibm.com> |
|||
| 31d011e3ca |
chore: Update outdated GitHub Actions versions (#11316)
docs: Update outdated GitHub Actions versions |
|||
| 8550f11298 |
feat: Add customizable HTTP headers support to MCPToolsComponent (#11023)
* test(headers): add comprehensive tests for headers functionality in MCP component to ensure correct behavior and validation of header inputs feat(mcp_component.py): add headers input to MCPToolsComponent for customizable HTTP headers in requests This change allows users to specify HTTP headers, such as Authorization, for requests to the MCP server, enhancing authentication and flexibility in server interactions. * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes (attempt 3/3) * fix market research input found * cherry-pick changes * chore(release): Bump version to 1.7.2 (#11208) * change langflow base version * fix: publish amd fe/be images * fix: build-lfx from test-cross-platform needs remove build-lfx from test-cross-platform needs * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes (attempt 3/3) --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com> |
|||
| 5211855941 |
chore: merge 1.7.1 back into main (#11129)
* docs: update component links to individual pages (#10706) * Revert "Revert "docs: update component documentation links to individual pages"" This reverts commit |
|||
| 5cae5ff97f |
fix: main lfx publish (#11091)
* fix: release workflow main version of https://github.com/langflow-ai/langflow/pull/11089 * fix: remove test-lfx-cross-platform remove test-lfx-cross-platform |
|||
| 96db8566a6 |
fix: release workflow (#11090)
main version of https://github.com/langflow-ai/langflow/pull/11089 |
|||
| 12d17dc0db |
fix(ci): Allow prerelease packages and fix runtime type imports (#10945)
Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 79d02f201b | ci: bump actions/checkout to v6 (#10697) | |||
| e6539e1232 |
ci: require main image built before backend/frontend images (#10561)
* Require main image built before backend/frontend images * Right. Skip fe/be when dry run because base images aren't built |
|||
| 732ec1e273 |
ci: publish v2 docker images (#10350)
* ci: publish v2 docker images
since or transition to v2 in 1.6.x we have not been publishing any of our docker images.
* chore: try fixing lfx cleanup error
lfx cleanup error
* chore: address rabbitcode comments
* chore: address rabit uv comment
* chore: remove build-args to see if it passes
* chore: skip ci
* chore: add back in LANGFLOW_IMAGE
* chore: debug inputs.ref and matrix.langflow_image
* chore: add {} to fix InvalidDefaultArgInForm
* chore: try adding quotes
* chore: try ENV LANGFLOW_IMAGE=${LANGFLOW_IMAGE}
* chore: add build args to GitHub Container Registry
* chore: clean up
* chore: seperate out frontend and backend images
* chore: update create-manifest
* chore: remove ci step
* chore: update release
* chore: clean up
* chore: clean up langflow-image
* chore: revert ci removal
* fix: add back in main logic update back/frontend
add main back in
update back/frontend to match orginal man logic more
* chore: more clean up to match main
* chore: remove arch from lagnflowimage for backend
* chore: add misisng - for ghcr.io
* chore: skip ci
* chore: build_main and build_and_push_backend fixes
* chore: seperate ghcr and docker publishing with if
* chore: add back CI step
---------
Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com>
|
|||
| a8334c0079 |
ci: release fixes; add flag to always run full CI during release (#10066)
* Allow skipping lfx for 1.6.1 release
* just remove all lfx for now
* validate deps step
* Make docker builds dependent on CI success
* Wrap release conditionals correctly in {{ }}
* just wrap all conditionals
* Try removing the if in CI job?
* Always run all tests on release
* Try simplifying the runs-on
* Pass ref correctly in ci for testing
* correct input name
* skip lfx tests
* Fail if version is already published
* Fix nightly docker tags
* update node version to 22
* Fix runners
* Fix comm to get version from uv tree
* Add dry run mode
* That is hilarious. Github only allows 10 inputs
* Fix getting version for base manifest
* Add provenance to ensure attestation manifest is not created with platform tag
* Fix nightly version extraction and attestaion manifest
* Use better version extraction snippet
* Fix repo name for nightly-all
* Add back lfx steps
* reduce github inputs to 10 by making docker-ep dependent on main
* Add warning that lfx is not impl yet
|
|||
| c42b539c1a |
build(deps):(deps): bump actions/download-artifact from 4 to 5 (#9647)
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4 to 5. - [Release notes](https://github.com/actions/download-artifact/releases) - [Commits](https://github.com/actions/download-artifact/compare/v4...v5) --- updated-dependencies: - dependency-name: actions/download-artifact dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
|||
| 4177483cb1 |
ci: fix runner labels (#10088)
Fix runner labels |
|||
| 9992b4e26d |
ci: fix the linux runner group name (#10073)
Fix runner group |
|||
| 6ce943e0b3 |
ci: allow releasing from branch (#9988)
* Try skipping gha cache * simplify docker builds * remove workflow dispatch options from workflows that shouldn't be run manually * Update nightly docker build and add option to skip testing for nightly releases * simplify version fetching for both release workflows * revert docker-build v1 to original * remove removed input * Add push to registry flag for full workflow and add warning in old docker build workflow * Add uv setup * Add uv setup again * Try esbuild js native build * require a valid tag for release * Echo inputs * Reference inputs correctly * Try updating conditional * removes lfx temporarily for the 1.6 release * Fix boolean comparison * Add flag to allow creation of github release after pypi already exists * Add always to make it run * Use correct tag and remove commit since it's the tag for release * allow updates * Revert the lfx removals and flags to allow building without releasing * standardize conditional inputs * clean version check * temporary skip of jobs in release; revert me * Add arm64 to options * Try rustflags env var * echo the should_run_ci as well |
|||
| 7792b7aeaf |
build(deps):(deps): bump actions/checkout from 4 to 5 (#9646)
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gabriel Luiz Freitas Almeida <gabriel@langflow.org> |
|||
| be18541415 | chore: Update CI workflows to use bigger runner (#9915) | |||
| 928e549260 |
ci: change default to ubuntu-latest (#9843)
|
|||
| b42c5f0245 | ci: Add configurable runner options for CI workflows (#9842) | |||
| 2be5d48d83 | ci(cross-platform): add LFX wheel artifact handling and tests (#9703) | |||
| 52856ff964 | ci: Add LFX release workflow and update nightly build script (#9663) | |||
| 860c41bacf | bug: continue to debug cross-platform test issues (#9260) | |||
| e1d3e741fd |
feat: added install matrix before release (#9205)
* added install matrix before release * adds ad-hoc testing * temp enable test * test changes * fix test config * fix package install * commonize code * renamed files * fix issue * remvoe run id * fix base build * revert main package build change * fix build * fix upload * revert ci to main * updated release workflow naming * add cross-platform tests to nightly build |
|||
| 8fdd23a9b6 | chore: update GitHub Actions workflow to inherit secrets (#8922) | |||
| b77351331d |
fix: replace instances of 127.0.0.1 to localhost (#8536)
* Replace instances of 127.0.0.1 to localhost * fix some replace-all issues * fix some replace-all issues * update starterprojects * Upgrade uvlock |
|||
| 4b48b63227 |
build: upgrade langchain-pinecone to be compatible with python 3.13 (#8520)
* Upgrade langchain-pinecone to be compatible with python 3.13 * Add uv pip check to workflow |
|||
| b378eb81d0 |
chore(ci): replace local uv setup action with astral-sh/setup-uv@v6 (#8491)
* chore: remove setup-uv action configuration file as it is no longer needed * chore: update setup-uv action to use the official action across all workflows * chore: disable cache pruning in all workflows to improve build stability * chore: update Python version to 3.13 and add pre-release description in workflows |
|||
| 35bb2a84ef | fix: Remove Docker duplicated build step from release workflow (#8366) | |||
| 3d2f847f5b |
ci: Update Docker build workflow dependencies for releases (#6129)
fix: Update Docker build workflow dependencies in release configurations Modify release workflows to ensure correct dependency order for Docker builds: - In release_nightly.yml, add dependencies for Docker build jobs - In release.yml, reorder Docker build job dependencies to ensure proper build sequence |
|||
| 3f8f7f28c2 |
fix: docker build-main-all (#8182)
* use-with-extras-dockerfile * naming * independent-build-job * build-when-main-is-built * Apply suggestions from code review * remove-build-all-flag |
|||
| 409146151c |
build: add build for docker image with all optional deps (#7957)
* Add build for docker image with all optional deps * Add to release workflows |
|||
| 5124a14f89 |
fix: remove whitespace in version check of release workflow (#7956)
fix: trim whitespace from version check in release workflow |
|||
| dc792004fe |
ci: Fix version check in release workflow (#7676)
fix: Update version check in release workflow to pick the correct line of the output |
|||
| 62aef0b8ed |
chore: Ensure consistent version extraction for langflow-base in workflows (#7352)
fix: ensure consistent version extraction for langflow-base in workflows Updated version extraction commands in multiple workflow files to consistently use 'head -n 1' for retrieving the first occurrence of the langflow-base version. This change improves reliability in version detection across docker-build, nightly_build, python_test, release_nightly, and release workflows. |