* fix(frontend): filter duplicate draft/live connections in deploy modal
Connections with same app_id can exist as both draft and live, causing
both to appear selected simultaneously. Filter to draft-only and add
environment badge for clarity.
LFOSS-3373
* fix: remove connection environment badge
(cherry picked from commit 899f82de5b)
* changed Deployment Provider URL to truncate in the center
* fix: center-truncate deployment provider URL using provider_data.url
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Jordan Frazier <122494242+jordanrfrazier@users.noreply.github.com>
(cherry picked from commit 4f9bd2bcf4)
* feat: add customOpenUrl utility for secure external link handling
Extract window.open with noopener/noreferrer into a reusable customization
utility and use it in ProviderConfigurationForm. Also converts to type-only
imports where applicable.
* fix: use existing function
* fix: use custom open tab function
* fix: upgrade playwright to 1.58.0 to address Chromium CVEs
- Add playwright>=1.58.0 to override-dependencies in pyproject.toml
- Update uv.lock: playwright 1.49.0 -> 1.58.0, pyee 12.0.0 -> 13.0.1
- Fixes CVE-2026-2313, CVE-2026-2314, CVE-2026-2315, CVE-2026-2319,
CVE-2026-2321, CVE-2026-2441, CVE-2026-2648, CVE-2026-2649
- Ensures Docker builds download updated Chromium with security patches
* fix: update npm to latest version to address brace-expansion CVE-2026-33750
- Add npm update after Node.js installation in Dockerfile
- Fixes CVE-2026-33750 in system npm's brace-expansion dependency
- System npm had brace-expansion 2.0.2, update gets 5.0.5+
- Low risk change: npm is backward compatible, only affects CLI tool
* revert: remove npm update from Dockerfile
- npm update attempts were causing CI build failures
- Bundled npm has issues but updating it is proving problematic
- Focus on playwright CVE fix which is the primary concern
- brace-expansion CVE-2026-33750 is lower priority (DoS only)
* chore: sync uv.lock files
sync uv.lock files
* fix(mcp): dedupe edges in connect_components (#12701)
* fix(mcp): make add_connection idempotent to avoid duplicate edges
connect_components used to append a new edge unconditionally. Because
the edge id is deterministic from source/target/handles, calling it for
a pair the flow already had wired up (UI-then-MCP, batch retry, or just
a repeat call) produced a second edge with the same id, double-wiring
the flow at runtime.
Before appending, scan the existing edges for one with the same id and
return that instead. Different outputs/inputs between the same pair
still produce distinct ids and remain supported.
* test(mcp): cover dedupe against UI-saved edges, broaden match key
Older Langflow UIs saved edges with an `xy-edge__` id prefix instead of
the current `reactflow__edge-`, so an id-based dedup would miss the
UI-then-MCP case for any flow that came from an older version. Switch
the existence check to a structural one (source, target, sourceHandle
name, targetHandle fieldName) so the same logical connection dedupes
regardless of id format.
Add a fixture-driven test that loads MemoryChatbotNoLLM.json (an
xy-edge-prefixed flow) and replays each connection through
add_connection, asserting the edge count does not grow.
* fix(mcp): validate_flow fast-fails and reports partial errors (#12697)
* fix(mcp): validate_flow fast-fails and reports partial errors
validate_flow polled /monitor/builds for up to 30 seconds waiting for
every component to finish before reporting errors. When a component
fails early (for example a missing required field), downstream
components never run, so the loop waited out the full window and
returned just "Build timed out: N/M components completed" with no
actionable context.
- Short-circuit as soon as any completed build reports valid: false;
return those errors immediately instead of polling on.
- On timeout, include the errors from the builds that did complete
plus a component_count so the caller can see progress.
- Extract _collect_build_errors so the poll loop and timeout branch
share the same error shape.
* fix(mcp): stream validate_flow build inline instead of polling
The previous implementation triggered an async build and polled
/monitor/builds, which depended on FastAPI BackgroundTasks firing the
log_vertex_build calls after the trigger request had returned. Under
ASGI test transport these tasks never run, so /monitor/builds stayed
empty and validate_flow timed out with component_count=0.
Switch to event_delivery=direct so the build streams its events back
inside the same request:
- Drive the build via client.stream_post and aggregate per-vertex
results from end_vertex events.
- Fast-fail on the first vertex with valid=false, since downstream
vertices depend on it and would not produce useful information.
- Surface top-level error events as a single flow-level error.
- Replace _collect_build_errors with _extract_vertex_error, which
reads the structured error payload from the end_vertex outputs.
Update the lfx unit tests to use the streaming shape and tighten the
backend integration test to assert real success now that the build
actually runs end to end under ASGI.
* fix(graph): make end_all_traces_in_context Python 3.10 compatible
The implementation called asyncio.create_task(coro, context=context),
but the context= keyword was added to create_task in Python 3.11. On
3.10 it raised TypeError. The bug was latent because nothing in the
test suite previously consumed a streaming build response far enough
for Starlette to dispatch the post-response BackgroundTasks where this
code lives. The validate_flow streaming change exposes it.
On 3.10, route the create_task call through context.run so the new
Task copies the captured context as its current context, matching the
isolation the 3.11 path provides via the context= kwarg.
Add a regression test that asserts end_all_traces sees the value of a
contextvar set before the context was captured, even after the caller
mutates that var.
* fix: failing wxo list llm test (#12700)
patch service layer and update failing test
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* Try to fix the missing typer import
---------
Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local>
Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com>
Co-authored-by: Gabriel Luiz Freitas Almeida <gabriel@logspace.ai>
Co-authored-by: Hamza Rashid <74062092+HzaRashid@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Eric Hare <ericrhare@gmail.com>
* fix(mcp): validate_flow fast-fails and reports partial errors
validate_flow polled /monitor/builds for up to 30 seconds waiting for
every component to finish before reporting errors. When a component
fails early (for example a missing required field), downstream
components never run, so the loop waited out the full window and
returned just "Build timed out: N/M components completed" with no
actionable context.
- Short-circuit as soon as any completed build reports valid: false;
return those errors immediately instead of polling on.
- On timeout, include the errors from the builds that did complete
plus a component_count so the caller can see progress.
- Extract _collect_build_errors so the poll loop and timeout branch
share the same error shape.
* fix(mcp): stream validate_flow build inline instead of polling
The previous implementation triggered an async build and polled
/monitor/builds, which depended on FastAPI BackgroundTasks firing the
log_vertex_build calls after the trigger request had returned. Under
ASGI test transport these tasks never run, so /monitor/builds stayed
empty and validate_flow timed out with component_count=0.
Switch to event_delivery=direct so the build streams its events back
inside the same request:
- Drive the build via client.stream_post and aggregate per-vertex
results from end_vertex events.
- Fast-fail on the first vertex with valid=false, since downstream
vertices depend on it and would not produce useful information.
- Surface top-level error events as a single flow-level error.
- Replace _collect_build_errors with _extract_vertex_error, which
reads the structured error payload from the end_vertex outputs.
Update the lfx unit tests to use the streaming shape and tighten the
backend integration test to assert real success now that the build
actually runs end to end under ASGI.
* fix(graph): make end_all_traces_in_context Python 3.10 compatible
The implementation called asyncio.create_task(coro, context=context),
but the context= keyword was added to create_task in Python 3.11. On
3.10 it raised TypeError. The bug was latent because nothing in the
test suite previously consumed a streaming build response far enough
for Starlette to dispatch the post-response BackgroundTasks where this
code lives. The validate_flow streaming change exposes it.
On 3.10, route the create_task call through context.run so the new
Task copies the captured context as its current context, matching the
isolation the 3.11 path provides via the context= kwarg.
Add a regression test that asserts end_all_traces sees the value of a
contextvar set before the context was captured, even after the caller
mutates that var.
* fix(mcp): make add_connection idempotent to avoid duplicate edges
connect_components used to append a new edge unconditionally. Because
the edge id is deterministic from source/target/handles, calling it for
a pair the flow already had wired up (UI-then-MCP, batch retry, or just
a repeat call) produced a second edge with the same id, double-wiring
the flow at runtime.
Before appending, scan the existing edges for one with the same id and
return that instead. Different outputs/inputs between the same pair
still produce distinct ids and remain supported.
* test(mcp): cover dedupe against UI-saved edges, broaden match key
Older Langflow UIs saved edges with an `xy-edge__` id prefix instead of
the current `reactflow__edge-`, so an id-based dedup would miss the
UI-then-MCP case for any flow that came from an older version. Switch
the existence check to a structural one (source, target, sourceHandle
name, targetHandle fieldName) so the same logical connection dedupes
regardless of id format.
Add a fixture-driven test that loads MemoryChatbotNoLLM.json (an
xy-edge-prefixed flow) and replays each connection through
add_connection, asserting the edge count does not grow.
The Python function layout_flow_tool was advertised to MCP clients
under its raw function name (layout_flow_tool) while the batch tool
map dispatched it under layout_flow. A caller copying tool names from
the MCP tool list could not drive batch without translating the name.
Pass name="layout_flow" to the decorator so the external MCP name
matches the batch dispatch key. The Python symbol stays layout_flow_tool
to avoid a clash with the layout_flow helper imported from
lfx.graph.flow_builder.layout.
Added a test that asserts every batch tool_map key is an actual MCP
tool name, so future drift between the two surfaces gets caught.
* feat(deployments): verify wxO credentials against instance API
- Probe GET /v1/orchestrate/models after IAM token to validate URL+key
- Add POST /deployments/providers/verify-credentials for connection tests
- Extend unit tests for models probe and WxO client stub
* fix(api): rename verify endpoint and redact 422 request input
Rename the deployment provider credential verification route to /deployments/providers/verify and sanitize RequestValidationError responses so raw request payloads are not echoed back in 422 errors. Update route/tests accordingly, including regression coverage for input redaction.
* revert(api): remove verification endpoint follow-up changes
Keep this PR focused on wxO adapter tenant validation via model-list fetch and drop API-layer validation endpoint and request-redaction changes.
* fix(wxo): resolve list_llms rebase conflict with adapter seam
Keep release default-model merge behavior while preserving fetch_models_adapter usage, and update list_llms expectations in tests.
* [autofix.ci] apply automated fixes
---------
Co-authored-by: Hamza Rashid <hzarashid@gmail.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Hamza Rashid <74062092+HzaRashid@users.noreply.github.com>
* fix(frontend): improve deployment stepper visibility in light mode
Step labels were using text-muted-foreground which is nearly invisible
in light mode. Changed to text-foreground with font-medium for active
steps. Also added overlayClassName prop to DialogContent to allow
per-dialog backdrop customization, used to lighten the deployment
modal backdrop in light mode.
* fix(frontend): add backdrop blur to deployment stepper modal
---------
Co-authored-by: Hamza Rashid <74062092+HzaRashid@users.noreply.github.com>
The determine-sdk-version job was missing the 'uv sync' step that creates
the cache, causing the 'Post Setup Environment' step to fail with:
'cache path does not exist on disk'
This matches the pattern used in determine-lfx-version job (line 247) and
the nightly build workflow (line 104-105).
Fixes the SDK build failure in release workflow dry run.
load_registry iterated data.values(), discarding the category
group keys from /api/v1/all. Every component ended up with
category: "", which made the components(category=...) MCP tool
filter return empty results for every category.
Iterate data.items() instead and inject the category name onto
each component's entry so search_registry's category filter works.
* refactor: rename deployment executions to runs at the API boundary
Rename the deployment sub-resource from "executions" to "runs" across
the API layer, frontend hooks, and tests. Internal adapter/service code
retains its own execution terminology — only the public-facing surface
changes.
- URL paths: /{deployment_id}/executions -> /{deployment_id}/runs
- Path param: execution_id -> run_id
- Route functions: create_deployment_execution -> create_deployment_run,
get_deployment_execution -> get_deployment_run
- Schema classes: ExecutionCreateRequest -> RunCreateRequest,
ExecutionCreateResponse -> RunCreateResponse,
ExecutionStatusResponse -> RunStatusResponse
- provider_data field: execution_id -> id
- Frontend hooks: usePostDeploymentExecution -> usePostDeploymentRun,
useGetDeploymentExecution -> useGetDeploymentRun
- Frontend types: DeploymentExecutionRequest -> DeploymentRunRequest,
DeploymentExecutionResponse -> DeploymentRunResponse
* fix: rename remaining execution references to runs in FE and schema docs
Complete the executions→runs rename at the API layer by updating
local variables, user-facing error strings, test mock names, and
schema docstrings that still referenced "execution".
* make schema for runs to wxo
* harden validation
* clean up stale refs to old /executions endpoint
* fix(loop): drive iteration from item_output when done is not connected
Extract the loop body execution into an idempotent `_iterate` helper
that both `item_output` and `done_output` invoke. On release-1.9.0,
`_should_process_output` only runs outputs whose name is in the
vertex's outgoing edge source names, so `done_output` never ran when
nothing was connected to `done` and the subgraph iteration never
happened.
`_iterate` caches aggregated results and cached exceptions in ctx so
repeat calls (when both outputs are wired) run the subgraph exactly
once and surface the same failure on re-entry. `item_output` is now
async, calls `_iterate` before stopping the item branch, and returns
a Data payload listing the dispatched items so the inspector shows
real content instead of an empty string.
Add regression tests covering the item-only topology, the classic
both-outputs-connected topology, empty input, cached error re-raise,
and per-run ctx isolation.
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix(loop): emit item output as DataFrame so UI renders it as a table
Wrapping the iterated rows in a `Data` payload with `count` / `items`
keys caused the Item inspector to render as JSON instead of as a
tabular view. Return the rows as a DataFrame, mirroring the Mock Data
component pattern, so the inspector uses its table renderer.
* feat(loop): emit summary logs for each run
Add start, complete, skipped, and error log entries from `_iterate` so
the component's Logs tab shows a per-run summary with row counts and
total elapsed time. Failures include the elapsed duration and the
error message.
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix(loop): address review comments
- Refresh Research Translation Loop starter flow's saved item-output
schema (JSON -> Table) to match item_output now returning a DataFrame.
- Clarify the test_ctx_isolation_across_runs docstring: production
rebuilds the graph per request, so ctx is effectively per-run; reusing
a single Graph instance across runs is intentionally not exercised.
- Update _iterate's docstring to describe the actual ctx scope rather
than claiming graph-instance-level reset semantics that the framework
does not provide.
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix(loop): stabilize chat output inspection test
* fix(loop): align starter project with item output contract
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* fix: upgrade playwright to 1.58.0 to address Chromium CVEs
- Add playwright>=1.58.0 to override-dependencies in pyproject.toml
- Update uv.lock: playwright 1.49.0 -> 1.58.0, pyee 12.0.0 -> 13.0.1
- Fixes CVE-2026-2313, CVE-2026-2314, CVE-2026-2315, CVE-2026-2319,
CVE-2026-2321, CVE-2026-2441, CVE-2026-2648, CVE-2026-2649
- Ensures Docker builds download updated Chromium with security patches
* fix: update npm to latest version to address brace-expansion CVE-2026-33750
- Add npm update after Node.js installation in Dockerfile
- Fixes CVE-2026-33750 in system npm's brace-expansion dependency
- System npm had brace-expansion 2.0.2, update gets 5.0.5+
- Low risk change: npm is backward compatible, only affects CLI tool
* revert: remove npm update from Dockerfile
- npm update attempts were causing CI build failures
- Bundled npm has issues but updating it is proving problematic
- Focus on playwright CVE fix which is the primary concern
- brace-expansion CVE-2026-33750 is lower priority (DoS only)
* CI: Filter cuga/playwright dependency conflict in release workflow
- Filter cuga/playwright conflict (we override playwright>=1.58.0 for CVE fixes)
- Still fails CI if other genuine dependency issues are detected
- Applied to both base and main package build steps
---------
Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local>
* feat: validate duplicate tool names at deployment review step
Add early detection of duplicate WXO tool names before deployment,
preventing users from hitting a 409 error only at deploy time.
- Add `GET /snapshots/check-names` endpoint using SDK's
`get_drafts_by_names()` for fast server-side lookup
- Add `check_tool_names_exist()` to WXO service adapter
- Show inline validation error with alert banner on the review step
card when a tool name already exists in the provider
- Block deploy button while duplicate names exist
- Also detect batch duplicates (same name on multiple flows)
- Use `keepPreviousData` to prevent error flicker on re-validation
* fix: update duplicate tool name error message
* refactor: use snapshot list endpoint with name filter instead of dedicated check-names endpoint
Replace the dedicated `/snapshots/check-names` endpoint with a
`provider_snapshot_names` query parameter on the existing
`GET /deployments/snapshots` endpoint. This keeps the API surface
smaller and follows the existing list-with-filter pattern.
* test: add tests for snapshot name filter and duplicate tool name validation
- Add validation on provider_snapshot_names: min_length=1 on Query param,
strip whitespace and reject empty entries in SnapshotListParams
- Backend unit tests: 5 validation tests + 3 adapter list_snapshots
name-filter tests + 1 route handler test
- Frontend unit tests: 4 tests for useCheckToolNames hook
- Frontend E2E tests: 3 Playwright tests for duplicate tool name
detection, unique name acceptance, and error clearing on edit
- Fix step-review unit test mock to include new context fields
* feat: standardize snapshot name filtering to names query param
Rename deployment snapshot filtering from provider_snapshot_names to names across backend and frontend callers.
Add trimmed non-empty + dedup validation, enforce deployment_id/name-filter mutual exclusivity, and normalize WXO snapshot names with expanded unit coverage.
* chore: restore package-lock.json from release-1.9.0
* fix(frontend): limit deployment creation retry to 1
Reduce usePostDeployment mutation retry from default 3 to 1 to avoid
excessive 409 requests when deploying.
* feat(frontend): check duplicate tool names on deployment update
When editing a deployment, pre-existing flows with renamed tool names
are now validated against the provider for duplicates. Previously only
new flows were checked, allowing renamed tools to collide silently.
Expose initialToolNameByFlow from stepper context so step-review can
detect name changes and include them in the provider duplicate check.
* fix(frontend): replace nested button with div role=button in flow list
Outer button element contained inner detach/undo buttons, causing
"button cannot be a descendant of button" console error.
---------
Co-authored-by: Hamza Rashid <hzarashid@gmail.com>
* fix: agent icon color adjustment
* only show environment selector when more that one, adjust spacing
* adjustments to spacing
* fixed context shift
* added space between connections and scrollbar
* content & small updates
* fix: update test for connection panel
* [autofix.ci] apply automated fixes
* conditional padding change
* fix how visibleDeployments is filtered
* updated test
* fix: update deployments content
* updated content
* queryKey matches the API params
* updated approach to avoid extra API calls
* [autofix.ci] apply automated fixes
* add a small space between available connections
* fix: improve memo deps, simplify empty state, harden formatDate, fix test assertions
- Use providers array instead of providers.length in useMemo dep
- Collapse duplicate DeploymentsEmptyState branches
- Add explicit locale and invalid date guard to formatDate
- Fix add-provider-modal test for split text elements
- Add test asserting providerIdsToQuery is decoupled from selection
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Viktor Avelino <viktor.avelino@gmail.com>
Co-authored-by: Viktor Avelino <64113566+viktoravelino@users.noreply.github.com>
fix(frontend): auto-populate global variable key-value pairs when creating a connection
updateDetectedEnvVars expected objects with key/global_variable_name
fields, but the backend detection endpoint returns a flat string array
of variable names. Simplified the function to accept string[] directly,
using each name as both the env var key and the global variable binding.
* Enforce unique tool to flow version relationship
* fix: harden deployment snapshot attachment conflict handling
- add typed attachment conflict exceptions in attachment CRUD and map only those conflicts to HTTP 409 in deployment create/update routes
- update snapshot patch flow to bulk-update all attachment rows by provider_snapshot_id, commit inside the guarded block, and keep compensating provider rollback on DB failure
- document race-condition caveats around app-level snapshot/flow-version guards and add targeted warning/info logs for conflict and post-provider DB anomalies
- add/expand unit tests for attachment bulk update behavior, typed conflict exceptions, and snapshot route commit-failure compensation path
- align watsonx conflict-detail wording and corresponding mapper tests for tool/connection/agent duplicate-resource messages
---------
Co-authored-by: Hamza Rashid <hzarashid@gmail.com>
* feat: add langflow-sdk build and publish support to release workflow
Add support for building and publishing the langflow-sdk package in the
release workflow, mirroring the nightly build support added in #12491.
Changes:
- Add `release_sdk` workflow input for controlling SDK release
- Add `determine-sdk-version` job with first-release PyPI handling
- Add `build-sdk` job with version verification and import testing
- Add `publish-sdk` job that publishes SDK to PyPI before LFX
- Update `build-lfx` to download SDK artifact and test both wheels together
- Update `build-base` and `build-main` to use SDK wheel as find-links
- Pass SDK artifact to cross-platform tests
- Add validation: releasing LFX requires releasing SDK
- Add pre-release version handling for SDK and LFX's SDK dependency
* Update release.yml
* Update release.yml
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* feat: add SHA-256 hash-based API key lookup
Replace the O(n) full table scan in check_key with an indexed
SHA-256 hash column for O(1) lookup. Legacy keys without a hash
fall back to decrypt-and-compare and get their hash backfilled
on first successful match.
- Add api_key_hash column to ApiKey model (nullable, indexed)
- Hash stored at key creation time
- Migration adds column and backfills hashes for existing keys
- Fail closed when multiple keys share the same hash
- Remove unused fernet_obj parameter from decrypt_api_key
* fix(migration): skip hashing duplicate-plaintext API keys
Two-pass backfill: decrypt all rows, group by plaintext, then hash only
unique-plaintext rows. Duplicate-plaintext groups are left with NULL
hash so the runtime fast-path lookup cannot return multiple matches and
fail closed. The runtime slow-path matches and backfills exactly one
row per group on first use; remaining NULL rows become harmless
orphans.
Logs counts only (no key IDs or plaintexts) to avoid leaking
operational info via deployment logs.
Extracts _backfill_hashes helper for testing; adds 9 unit tests.
---------
Co-authored-by: Eric Hare <ericrhare@gmail.com>
Extract shared `add_base64_padding` and `ensure_fernet_key` functions
to eliminate duplicated key derivation logic between AuthService and
auth/utils.py.
Fix `_add_padding` adding 4 `=` characters instead of 0 when key length
is a multiple of 4, which broke Fernet key derivation for 44-char keys.
Change `%s` to `%r` in decryption failure logs so InvalidToken exceptions
(which have no message string) render as `InvalidToken()` instead of
empty strings.
Replace queue.get_nowait() with asyncio.wait_for(queue.get(), timeout=5.0)
to properly wait for async events in the queue, preventing QueueEmpty errors
in Python 3.13.
Fixes flaky test failure in release workflow.
* fix(ui): refactor connection panel and fix search empty state rendering
Extract connection state management into useConnectionPanelState hook
and search/list UI into ConnectionSearchList component. Fixes bug where
blank list items rendered before the empty state when search returned
no results.
* fix(ui): prevent modal jump when clicking connection items in Chrome
Chrome scrolls the nearest scrollable ancestor when focusing sr-only
inputs inside labels. Adding relative + overflow-hidden to the label
contains the scroll-into-view behavior within the label bounds.
