* fix: upgrade playwright to 1.58.0 to address Chromium CVEs
- Add playwright>=1.58.0 to override-dependencies in pyproject.toml
- Update uv.lock: playwright 1.49.0 -> 1.58.0, pyee 12.0.0 -> 13.0.1
- Fixes CVE-2026-2313, CVE-2026-2314, CVE-2026-2315, CVE-2026-2319,
CVE-2026-2321, CVE-2026-2441, CVE-2026-2648, CVE-2026-2649
- Ensures Docker builds download updated Chromium with security patches
* fix: update npm to latest version to address brace-expansion CVE-2026-33750
- Add npm update after Node.js installation in Dockerfile
- Fixes CVE-2026-33750 in system npm's brace-expansion dependency
- System npm had brace-expansion 2.0.2, update gets 5.0.5+
- Low risk change: npm is backward compatible, only affects CLI tool
* revert: remove npm update from Dockerfile
- npm update attempts were causing CI build failures
- Bundled npm has issues but updating it is proving problematic
- Focus on playwright CVE fix which is the primary concern
- brace-expansion CVE-2026-33750 is lower priority (DoS only)
* chore: sync uv.lock files
sync uv.lock files
* fix(mcp): dedupe edges in connect_components (#12701)
* fix(mcp): make add_connection idempotent to avoid duplicate edges
connect_components used to append a new edge unconditionally. Because
the edge id is deterministic from source/target/handles, calling it for
a pair the flow already had wired up (UI-then-MCP, batch retry, or just
a repeat call) produced a second edge with the same id, double-wiring
the flow at runtime.
Before appending, scan the existing edges for one with the same id and
return that instead. Different outputs/inputs between the same pair
still produce distinct ids and remain supported.
* test(mcp): cover dedupe against UI-saved edges, broaden match key
Older Langflow UIs saved edges with an `xy-edge__` id prefix instead of
the current `reactflow__edge-`, so an id-based dedup would miss the
UI-then-MCP case for any flow that came from an older version. Switch
the existence check to a structural one (source, target, sourceHandle
name, targetHandle fieldName) so the same logical connection dedupes
regardless of id format.
Add a fixture-driven test that loads MemoryChatbotNoLLM.json (an
xy-edge-prefixed flow) and replays each connection through
add_connection, asserting the edge count does not grow.
* fix(mcp): validate_flow fast-fails and reports partial errors (#12697)
* fix(mcp): validate_flow fast-fails and reports partial errors
validate_flow polled /monitor/builds for up to 30 seconds waiting for
every component to finish before reporting errors. When a component
fails early (for example a missing required field), downstream
components never run, so the loop waited out the full window and
returned just "Build timed out: N/M components completed" with no
actionable context.
- Short-circuit as soon as any completed build reports valid: false;
return those errors immediately instead of polling on.
- On timeout, include the errors from the builds that did complete
plus a component_count so the caller can see progress.
- Extract _collect_build_errors so the poll loop and timeout branch
share the same error shape.
* fix(mcp): stream validate_flow build inline instead of polling
The previous implementation triggered an async build and polled
/monitor/builds, which depended on FastAPI BackgroundTasks firing the
log_vertex_build calls after the trigger request had returned. Under
ASGI test transport these tasks never run, so /monitor/builds stayed
empty and validate_flow timed out with component_count=0.
Switch to event_delivery=direct so the build streams its events back
inside the same request:
- Drive the build via client.stream_post and aggregate per-vertex
results from end_vertex events.
- Fast-fail on the first vertex with valid=false, since downstream
vertices depend on it and would not produce useful information.
- Surface top-level error events as a single flow-level error.
- Replace _collect_build_errors with _extract_vertex_error, which
reads the structured error payload from the end_vertex outputs.
Update the lfx unit tests to use the streaming shape and tighten the
backend integration test to assert real success now that the build
actually runs end to end under ASGI.
* fix(graph): make end_all_traces_in_context Python 3.10 compatible
The implementation called asyncio.create_task(coro, context=context),
but the context= keyword was added to create_task in Python 3.11. On
3.10 it raised TypeError. The bug was latent because nothing in the
test suite previously consumed a streaming build response far enough
for Starlette to dispatch the post-response BackgroundTasks where this
code lives. The validate_flow streaming change exposes it.
On 3.10, route the create_task call through context.run so the new
Task copies the captured context as its current context, matching the
isolation the 3.11 path provides via the context= kwarg.
Add a regression test that asserts end_all_traces sees the value of a
contextvar set before the context was captured, even after the caller
mutates that var.
* fix: failing wxo list llm test (#12700)
patch service layer and update failing test
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* Try to fix the missing typer import
---------
Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local>
Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com>
Co-authored-by: Gabriel Luiz Freitas Almeida <gabriel@logspace.ai>
Co-authored-by: Hamza Rashid <74062092+HzaRashid@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Eric Hare <ericrhare@gmail.com>
The determine-sdk-version job was missing the 'uv sync' step that creates
the cache, causing the 'Post Setup Environment' step to fail with:
'cache path does not exist on disk'
This matches the pattern used in determine-lfx-version job (line 247) and
the nightly build workflow (line 104-105).
Fixes the SDK build failure in release workflow dry run.
* fix: upgrade playwright to 1.58.0 to address Chromium CVEs
- Add playwright>=1.58.0 to override-dependencies in pyproject.toml
- Update uv.lock: playwright 1.49.0 -> 1.58.0, pyee 12.0.0 -> 13.0.1
- Fixes CVE-2026-2313, CVE-2026-2314, CVE-2026-2315, CVE-2026-2319,
CVE-2026-2321, CVE-2026-2441, CVE-2026-2648, CVE-2026-2649
- Ensures Docker builds download updated Chromium with security patches
* fix: update npm to latest version to address brace-expansion CVE-2026-33750
- Add npm update after Node.js installation in Dockerfile
- Fixes CVE-2026-33750 in system npm's brace-expansion dependency
- System npm had brace-expansion 2.0.2, update gets 5.0.5+
- Low risk change: npm is backward compatible, only affects CLI tool
* revert: remove npm update from Dockerfile
- npm update attempts were causing CI build failures
- Bundled npm has issues but updating it is proving problematic
- Focus on playwright CVE fix which is the primary concern
- brace-expansion CVE-2026-33750 is lower priority (DoS only)
* CI: Filter cuga/playwright dependency conflict in release workflow
- Filter cuga/playwright conflict (we override playwright>=1.58.0 for CVE fixes)
- Still fails CI if other genuine dependency issues are detected
- Applied to both base and main package build steps
---------
Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local>
* feat: add langflow-sdk build and publish support to release workflow
Add support for building and publishing the langflow-sdk package in the
release workflow, mirroring the nightly build support added in #12491.
Changes:
- Add `release_sdk` workflow input for controlling SDK release
- Add `determine-sdk-version` job with first-release PyPI handling
- Add `build-sdk` job with version verification and import testing
- Add `publish-sdk` job that publishes SDK to PyPI before LFX
- Update `build-lfx` to download SDK artifact and test both wheels together
- Update `build-base` and `build-main` to use SDK wheel as find-links
- Pass SDK artifact to cross-platform tests
- Add validation: releasing LFX requires releasing SDK
- Add pre-release version handling for SDK and LFX's SDK dependency
* Update release.yml
* Update release.yml
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
fix: gate PyPI publish jobs on CI completion
The publish-base, publish-main, and publish-lfx jobs were not waiting
for the CI workflow to complete before publishing to PyPI. This could
result in broken packages being published if CI fails. Docker builds
already correctly depend on CI.
Add 'ci' to the needs array of all three publish jobs so packages
are only published after the full test suite passes.
* fix: preserve [complete] extra in langflow-base pre-release constraint
The sed replacement for pre-release builds was dropping the [complete]
extra from the langflow-base dependency, causing the built wheel to
depend on bare langflow-base instead of langflow-base[complete]. This
meant hundreds of optional dependencies (LLM providers, vector stores,
document loaders, etc.) were missing from pre-release installs, breaking
the CLI and all cross-platform installation tests.
* test: add regression test for sed constraint preservation
* [autofix.ci] apply automated fixes
* test: add regression test for sed constraint preservation in release workflow
* [autofix.ci] apply automated fixes
* test: add regression test for sed constraint preservation in release workflow
* [autofix.ci] apply automated fixes
* fix: move noqa comment to correct line for S603 check
* [autofix.ci] apply automated fixes
* test: add regression test for sed constraint preservation in release workflow
* [autofix.ci] apply automated fixes
* test: add regression test for sed constraint preservation in release workflow
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
The cross-platform-test.yml references inputs.pre_release in the
force-reinstall steps (added in PR #11322) but never declares it as a
workflow_call input. release.yml also never passes it. This means
inputs.pre_release is always empty, force-reinstall always uses
--no-deps, and dependency resolution fails for RC versions.
- Add pre_release as a workflow_call boolean input in cross-platform-test.yml
- Pass pre_release from release.yml when calling cross-platform-test.yml
* feat: create prerelease dedicated to qa
allow prerelease versions dedicated to qa
* chore: revert lfx dep to 0.2.1
* chore: lfx pyproject version 0.2.1 for testing
* feat: use pythin script to determine rc version
use a python script to auto incremenet rc version so we do not have to manually maintain what rc version we are on.
add it to both release.yml and docker-build-v2.yml for pypi, docker and ghrc.
* [autofix.ci] apply automated fixes
* chore: change script vars to more meaningful ones
* chore: add meaningful echos
* chore: add quotes to pass empty str if no version
* test: REVERT always pass ci REVERT
* chore: add normalization to built ver tests
* chore: remove unused uv environment set up
* chore: add back in checkout code
* chore: disable caching for ensure-lfx-published
* chore: revert changes added after merge
* fix: allow prerelase python install flag
* chore: test base and main install as 1
* chore: seperate base and main
* chore: install main using local base first
* chore: try using reinstall
* chore: create locl directory and use it first
* chore: try --no-deps
* chore: langflow-*.whl
* [autofix.ci] apply automated fixes
* fix: try using unsafe-best-match
use ./local-packages --index-strategy unsafe-best-match
* fix: add a dynamic constriant for langflow base
add a dynamic constriant for langflow base during build-main. if this works I will need to go back and remove any unneeded cross-platform test changes
* chore: revert to normal install
* fix: add pre-main option to make build
* chore: remove hyphen in make var
* chore: keep propigation wait for pre-release
* chore: revert cross-platform-test.yml changes
* chore: use else ifdef and add test echos
* chore: remove --no-soruces
* chore: use ifeq
* chore: revert lfx 0.2.1
* chore: downgrade to python 3.12
ragstack-ai-knowledge-store does not support pythong 3.13
* chore: add else to Makefile
* chore: back to ifdef
* chore: reset to Makefile to main and add pre again
* chore: revert to python 3.13
* chore: set compatability check to 3.12
hopeffuly fixes
Found 1 incompatibility
The package `ragstack-ai-knowledge-store` requires Python >=3.9, <3.13, but `3.13.11` is installed
* [autofix.ci] apply automated fixes
* fix: new flow reset.
* chore: update LFX Determine version
* fix: remove buil-lfx dep on lfx release
* chore: remove more inputs.release_lfx if statments
* fix: uv pip install --find-links
* chore: create uv venv before uv pip install
* chire: attempt for reinatll of local whls
* fix: add OBJC_DISABLE_INITIALIZE_FORK_SAFETY: YES
add OBJC_DISABLE_INITIALIZE_FORK_SAFETY: YES to macos cross-platform test builds
* [autofix.ci] apply automated fixes
* chore: add back in ci step
* fix(ci): correctly generate pre-release rc tags
* [autofix.ci] apply automated fixes
* feat: update pre-release flow to be useable for qa
* Revert "feat: update pre-release flow to be useable for qa"
This reverts commit 22737729a2d0ed64ea774a30af070f0010cba9e1.
* feat: update pre-release flow to be useable for qa
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* feat: update pre-release flow to be useable for qa
* feat: update pre-release flow to be useable for qa
* feat: update pre-release flow to be useable for qa
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: vijay kumar katuri <vijaykaturi@vijays-MacBook-Air.local>
Co-authored-by: vijay kumar katuri <vijay.katuri@ibm.com>
* ci: publish v2 docker images
since or transition to v2 in 1.6.x we have not been publishing any of our docker images.
* chore: try fixing lfx cleanup error
lfx cleanup error
* chore: address rabbitcode comments
* chore: address rabit uv comment
* chore: remove build-args to see if it passes
* chore: skip ci
* chore: add back in LANGFLOW_IMAGE
* chore: debug inputs.ref and matrix.langflow_image
* chore: add {} to fix InvalidDefaultArgInForm
* chore: try adding quotes
* chore: try ENV LANGFLOW_IMAGE=${LANGFLOW_IMAGE}
* chore: add build args to GitHub Container Registry
* chore: clean up
* chore: seperate out frontend and backend images
* chore: update create-manifest
* chore: remove ci step
* chore: update release
* chore: clean up
* chore: clean up langflow-image
* chore: revert ci removal
* fix: add back in main logic update back/frontend
add main back in
update back/frontend to match orginal man logic more
* chore: more clean up to match main
* chore: remove arch from lagnflowimage for backend
* chore: add misisng - for ghcr.io
* chore: skip ci
* chore: build_main and build_and_push_backend fixes
* chore: seperate ghcr and docker publishing with if
* chore: add back CI step
---------
Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com>
* Allow skipping lfx for 1.6.1 release
* just remove all lfx for now
* validate deps step
* Make docker builds dependent on CI success
* Wrap release conditionals correctly in {{ }}
* just wrap all conditionals
* Try removing the if in CI job?
* Always run all tests on release
* Try simplifying the runs-on
* Pass ref correctly in ci for testing
* correct input name
* skip lfx tests
* Fail if version is already published
* Fix nightly docker tags
* update node version to 22
* Fix runners
* Fix comm to get version from uv tree
* Add dry run mode
* That is hilarious. Github only allows 10 inputs
* Fix getting version for base manifest
* Add provenance to ensure attestation manifest is not created with platform tag
* Fix nightly version extraction and attestaion manifest
* Use better version extraction snippet
* Fix repo name for nightly-all
* Add back lfx steps
* reduce github inputs to 10 by making docker-ep dependent on main
* Add warning that lfx is not impl yet
* Try skipping gha cache
* simplify docker builds
* remove workflow dispatch options from workflows that shouldn't be run manually
* Update nightly docker build and add option to skip testing for nightly releases
* simplify version fetching for both release workflows
* revert docker-build v1 to original
* remove removed input
* Add push to registry flag for full workflow and add warning in old docker build workflow
* Add uv setup
* Add uv setup again
* Try esbuild js native build
* require a valid tag for release
* Echo inputs
* Reference inputs correctly
* Try updating conditional
* removes lfx temporarily for the 1.6 release
* Fix boolean comparison
* Add flag to allow creation of github release after pypi already exists
* Add always to make it run
* Use correct tag and remove commit since it's the tag for release
* allow updates
* Revert the lfx removals and flags to allow building without releasing
* standardize conditional inputs
* clean version check
* temporary skip of jobs in release; revert me
* Add arm64 to options
* Try rustflags env var
* echo the should_run_ci as well
* chore: remove setup-uv action configuration file as it is no longer needed
* chore: update setup-uv action to use the official action across all workflows
* chore: disable cache pruning in all workflows to improve build stability
* chore: update Python version to 3.13 and add pre-release description in workflows
fix: Update Docker build workflow dependencies in release configurations
Modify release workflows to ensure correct dependency order for Docker builds:
- In release_nightly.yml, add dependencies for Docker build jobs
- In release.yml, reorder Docker build job dependencies to ensure proper build sequence
fix: ensure consistent version extraction for langflow-base in workflows
Updated version extraction commands in multiple workflow files to consistently use 'head -n 1' for retrieving the first occurrence of the langflow-base version. This change improves reliability in version detection across docker-build, nightly_build, python_test, release_nightly, and release workflows.
* Use pyproject standardized dependency-groups
* fix: update Python version requirement to support up to 3.14
---------
Co-authored-by: Gabriel Luiz Freitas Almeida <gabriel@langflow.org>
* chore: update Python version requirement and remove deprecated dependencies in pyproject.toml files
* Updated Python version requirement to allow up to 3.14 in both main and base pyproject.toml files.
* Removed deprecated dependencies: cohere and pyautogen from the main dependencies list.
* chore: update Python version requirements and add support for Python 3.13 in uv.lock
* Updated the required Python version to allow up to 3.14.
* Adjusted resolution markers for Python versions to include 3.13.
* Added markers for the 'typing-extensions' dependency to restrict it for Python versions below 3.13.
* Included additional wheel files for various packages to support Python 3.13 compatibility.
* Update Python version requirements in README files to support Python 3.13
* Update Python version in GitHub Actions workflow to 3.13
* Update Python version in GitHub Actions workflows to include 3.13
* Update installation documentation to support Python 3.13 and clarify troubleshooting steps
* revert changes to docs until we release
* chore: add ag2 dependency and update uv.lock for Python 3.13 compatibility
* Added ag2 version 0.3.2 and 0.5.2 to pyproject.toml and uv.lock with appropriate resolution markers for Python versions.
* Included flaml version 2.3.2 in uv.lock to ensure compatibility with the new ag2 dependency.
* Updated dependency specifications to support Python 3.13 and above.
* starting realocating components FE
* tagging tests
* 📝 (.github/workflows/typescript_test.yml): remove unnecessary comment before the Playwright test execution step to improve readability and maintainability
* 📝 (.github/changes-filter.yaml): Update paths in changes-filter.yaml to categorize different sections of the project for testing purposes
🔧 (.github/workflows/typescript_test.yml): Refactor workflow to use paths-filter action for determining test suites based on changes in different project sections
* ✨ (changes-filter.yaml): reorganize and update paths for test categories, starter projects, components, workspace, api, and database
✨ (components): add new components for GradientWrapper, pageLayout, and paginatorComponent
🔧 (MainPage): update import path for PageLayout component
🔧 (SettingsPage): update import path for PageLayout component
🔧 (StorePage): update import path for PageLayout component
* ✨ (frontend): Update import paths for components to use common directory instead of core directory for better organization and consistency
🔧 (frontend): Remove duplicate import of PaginatorComponent in various files and import it from the common directory to reduce redundancy and improve maintainability
* 🔧 (changes-filter.yaml): remove unnecessary release section from changes-filter.yaml
🔧 (typescript_test.yml): refactor workflow to support input suites and release flag for test runs
* 📝 (changes-filter.yaml): remove unnecessary entries from components section and add missing entries to workspace section for better organization and filtering of changes
🔧 (changes-filter.yaml): update changes-filter.yaml to include missing utils files in the frontend/src/utils directory
🔧 (typescript_test.yml): remove redundant code block that sets SUITES variable to default values as it is no longer needed due to changes in the changes-filter.yaml file
* ✨ (actionsMainPage-shard-1.spec.ts): Update test tags to remove unnecessary tags for better organization and clarity
📝 (store-shard-2.spec.ts): Update test tags to remove unnecessary tags for better organization and clarity
📝 (generalBugs-shard-4.spec.ts): Update test tags to remove unnecessary tags for better organization and clarity
📝 (generalBugs-shard-9.spec.ts): Update test tags to remove unnecessary tags for better organization and clarity
📝 (deleteComponents.spec.ts): Update test tags to remove unnecessary tags for better organization and clarity
📝 (deleteFlows.spec.ts): Update test tags to remove unnecessary tags for better organization and clarity
✨ (dragAndDrop.spec.ts): Refactor drag and drop test to improve readability and maintainability
✨ (flowPage.spec.ts): Refactor save test in Flow Page to improve readability and maintainability
✨ (store-shard-0.spec.ts): Refactor Store test to improve readability and maintainability
✨ (store-shard-1.spec.ts): Refactor Store test to improve readability and maintainability
✨ (store-shard-3.spec.ts): Remove unnecessary tags from test descriptions to improve clarity and consistency
✨ (userSettings.spec.ts): Remove unnecessary tags from test descriptions to improve clarity and consistency
✨ (general-bugs-shard-3909.spec.ts): Remove unnecessary tags from test descriptions to improve clarity and consistency
📝 (frontend): Update test tags in regression tests to remove unnecessary tags for better organization and clarity
📝 (frontend): Update test file paths in tsconfig.json to match the new file structure for consistency and maintainability
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* Update paths-filter action to v3 and adjust filter configuration file
* Add logging to matrix setup in TypeScript test workflow
* Refactor decisionFlow.spec.ts to improve test setup and execution flow
* Refactor import paths for genericIconComponent and shadTooltipComponent in PlaygroundButton component
* feat: add release input to CI workflows for enhanced deployment control
* Fix: Correct 'release' input type in CI workflow configuration
* [autofix.ci] apply automated fixes
* Refactor Blog Writer test: streamline setup and interaction steps
* Refactor test cases to improve modal handling and streamline API key input logic
* Add test grep pattern to GitHub Actions workflow for targeted test execution
- Introduced `test_grep` output in the `determine-test-suite` job to generate a grep pattern based on changed files or input suites.
- Updated Playwright test execution to use the generated grep pattern, allowing for more targeted test runs.
- Enhanced the `Set Matrix` step to include tag processing for test filtering.
* Enhance tag filtering in test workflow with regex lookaheads
* Fix syntax for default suite input in GitHub Actions workflow
* Update GitHub Actions to handle empty suite input for release builds
* Escape regex lookaheads and quotes for GitHub Actions in test workflow
* Update regex pattern and quote escaping in TypeScript test workflow
* Use single quotes for echo command in GitHub Actions script
* Refactor tag handling in GitHub Actions to use OR logic for grep patterns
* 🔧 (FlowPage/index.tsx): Remove unnecessary empty line to improve code readability and consistency
* 📝 (FlowPage/index.tsx): add missing line break for better code readability
* Refactor import path and reorder CSS classes for consistency in UpdateAllComponents component
* [autofix.ci] apply automated fixes
* Update import path for PaginatorComponent in AdminPage index.tsx
* ✨ (logs.spec.ts): introduce a new variable 'modalCount' to keep track of the number of modals opened in the test suite
* 📝 (filterSidebar.spec.ts): remove unnecessary test steps related to filter removal and sidebar interactions to simplify and improve test focus on main functionality
* ✅ (logs.spec.ts): add tests to ensure proper interaction with logs feature in the frontend application
* ✅ (similarity.spec.ts): add a test tag for release and components to categorize the test case
💡 (similarity.spec.ts): add a comment to explain the purpose of the test case and the condition for skipping the test
* ✅ (decisionFlow.spec.ts): add missing newline before async function declaration to improve code readability
* ✅ (textInputOutput.spec.ts): skip the test for TextInputOutputComponent to exclude it from the test suite temporarily
---------
Co-authored-by: Gabriel Luiz Freitas Almeida <gabriel@langflow.org>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
