mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-24 16:30:28 +08:00
v1.10.0.dev62
18018 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
| fccb0116bf | Update version and project name v1.10.0.dev62 | |||
| 43f1aa45ba |
fix(logging): keep JSON level field clean when stdlib level names are mutated (#13457)
* fix(logging): keep JSON level field clean when stdlib level names are mutated Third-party libraries (e.g. ibm_watsonx_orchestrate_core) call logging.addLevelName() at import time to wrap stdlib level names in ANSI color codes. structlog's ProcessorFormatter derives a foreign record's level from record.levelname.lower(), so in file-mode JSON logging the mangled, colored string (e.g. "\x1b[0;33m[warning]\x1b[0;0m") landed verbatim in the JSON `level` field, breaking level-based filtering in Grafana/Loki. Derive the level from the immutable record.levelno instead, mirroring the stdout-mode InterceptHandler which was already robust. Add a shared _levelno_to_structlog_name() helper as the single source of truth and a add_stdlib_log_level_from_record() processor for the file-mode foreign_pre_chain. Adds regression coverage that simulates the global addLevelName mutation and asserts clean `level` fields on both the file and stdout paths (restoring level names in teardown so it cannot re-pollute the suite). * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] * fix(logging): fingerprint all inputs in configure() early-return configure()'s early-exit compared only the resolved log level, so a second call at the same level but a different log_env / log_file / log_format / output_file / disable silently no-opped: the file handler was never installed and the renderer never switched. This was a real footgun (e.g. lfx.run.base re-points output_file at fixed levels) and a source of test-isolation flakiness -- a prior same-level configure() made a later file-mode configure() do nothing, surfacing as FileNotFoundError when a test read a log file that was never written. Resolve all env-var fallbacks up front and gate the early-return on a fingerprint of every effective input (resolved level, log_env, log_file, log_format, disable, log_rotation, cache, output_file). The fingerprint is stored on the wrapper_class so structlog.reset_defaults() invalidates it between tests. The optimization is preserved for genuinely identical calls (the per-Graph hot path in Graph.__init__). Adds TestConfigureEarlyReturnFingerprint: a same-level call with a new log_env+log_file now installs the file handler and writes JSON (this assertion fails on the old code), output_file changes take effect, and identical calls still early-return. --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> |
|||
| affa44f487 | Merge release-1.9.5 into release-1.10.0 | |||
| 30c9aaef30 |
feat: mark Text Input and Text Output components as legacy (#13420)
* feat: mark Text Input and Text Output components as legacy Chat Input already handles text input natively, and the current API paradigm forwards all terminal node outputs automatically, making the Text Input and Text Output components redundant. Mark both as legacy and point users to their modern replacements: - TextInput -> ChatInput (replacement = ["input_output.ChatInput"]) - TextOutput -> ChatOutput (replacement = ["input_output.ChatOutput"]) Migrate starter templates off the Text Input component: - Knowledge Retrieval: convert the search-query Text Input to Chat Input - Blog Writer, Instagram Copywriter, Portfolio Website Code Generator, Twitter Thread Generator: inline preset Text Input values directly into their target Prompt/LLM fields and remove the now-redundant input nodes Also drop stale root-level width/height from non-note nodes in Basic Prompting, fixing a pre-existing test_width_height_at_node_level failure. Update .secrets.baseline line numbers for the edited starter templates (component code_hash false positives shifted by the node changes). * [autofix.ci] apply automated fixes * test: enable legacy toggle in Playwright specs that drag Text Input/Output Text Input and Text Output are now legacy, so they are hidden from the component sidebar by default (showLegacy=false). Specs that drag them from the sidebar must first enable the legacy toggle via the existing addLegacyComponents() helper (as freeze.spec.ts already does). Add the helper call to the 8 specs that added Text Input/Output without it, fixing the Playwright shard failures on this PR. * test: fix Blog Writer starter spec for inlined instructions field Blog Writer no longer has a separate "Instructions" Text Input node; the value is now an inlined field on the Prompt component (Text Input is legacy). Fill the Prompt's instructions field (textarea_str_instructions) instead of the removed node's textarea_str_input_value. * test: force clicks past legacy banner overlap in similarity & fileUpload specs Marking Text Input/Output legacy adds a "Legacy" warning bar that increases node height. In these two tightly-packed layouts the bar/body now overlaps an adjacent node's handle/button and intercepts the click. Force the affected clicks past the overlay (consistent with existing force-click usage in fileUploadComponent). Fixes the Shard 34 (similarity) and Shard 43 (fileUpload "use text input for file paths") failures introduced by the legacy marking. * test: dismiss legacy warning bars instead of force-clicking through them The previous force-click fix was wrong: Playwright's force click still dispatches the event at the target's coordinates, which the browser routes to the topmost element there (the overlapping "Legacy" warning bar), so the real click never reached the covered handle/button (similarity's inspection modal never opened). Add a dismissLegacyWarnings() helper and call it before the affected interactions in similarity and fileUpload. Dismissing the bars removes the extra node height, restoring the compact pre-legacy layout so the normal click lands on its intended target. * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 44d43dbeaf |
fix: re-validate redirects against SSRF protection in API Request component (#13394)
* fix: re-validate redirects against SSRF protection in API Request component The API Request component validated only the initial URL and pinned DNS for the initial host, then let httpx auto-follow redirects when follow_redirects was enabled. With SSRF protection enabled, a public URL that redirected to an internal address (loopback, RFC1918, link-local / cloud metadata) was followed without re-validation, bypassing the SSRF block. When SSRF protection is enabled, redirects are now followed manually and every hop's Location is re-validated with the same private/loopback/link-local denylist and DNS pinning applied to the initial request. Redirects are capped (MAX_REDIRECTS=20), non-http(s) schemes are blocked, relative locations are resolved, and sensitive headers (Authorization / Cookie) are dropped on cross-host redirects. make_request now defaults to follow_redirects=False (fail-safe). Behavior is unchanged when SSRF protection is disabled. Adds regression tests for public->localhost, public->RFC1918, public->link-local metadata, scheme changes, chained redirects, redirect to a hostname resolving internal, per-hop DNS pinning, the redirect cap, and cross-host header stripping. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 69982462bb |
fix: add SSRF protection to legacy RSS Reader and SearXNG components (#13395)
* fix: add SSRF protection to legacy RSS Reader and SearXNG components The legacy RSS Reader (data_source/rss.py) and SearXNG tool (tools/searxng.py) called requests.get() directly on user-controlled URLs without any SSRF validation, bypassing the protection applied to the url and api_request components. With SSRF protection enabled (the default), an authenticated user -- or an LLM agent via the tool_mode RSS URL input -- could make the server fetch internal addresses such as cloud metadata (169.254.169.254), loopback, or RFC1918 hosts and read the response. Add a shared ssrf_safe_get() helper for the synchronous requests library that validates the initial URL and re-validates every redirect hop with validate_url_for_ssrf(). requests follows redirects by default, so validating only the initial URL is insufficient; the helper disables automatic redirects, resolves relative Locations, blocks non-http(s) schemes, and caps redirects. RSS Reader and both SearXNG request sites now use it. Validation is a no-op when SSRF protection is disabled, so behavior is unchanged for that configuration. Adds unit tests for the helper (direct internal IP, cloud metadata, redirect-to-internal, public redirect chain, relative redirect, scheme change, redirect cap, protection-disabled passthrough) and component regression tests for RSS Reader and SearXNG. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * [autofix.ci] apply automated fixes * Coderabbit finding * [autofix.ci] apply automated fixes --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 181ed3771d |
fix: restrict builtins and validate code in Python Interpreter components (#13397)
* fix: restrict builtins and validate code in Python Interpreter components
PythonREPLComponent.get_globals() built the exec globals from the global_imports
allow-list but never set __builtins__. CPython's exec() then auto-injects the full
builtins module, so __import__, open, eval, exec and the whole import machinery
stayed reachable regardless of the allow-list -- e.g.
__import__("subprocess").check_output([...]) -- making the "Only modules specified in
Global Imports can be used" claim false. The same get_globals() pattern existed in the
legacy PythonREPLToolComponent.
Add a shared lfx.utils.python_repl_security module:
- safe_builtins(): a curated __builtins__ allow-list that keeps common safe builtins
(print, len, range, container/number types, exceptions, ...) and removes
__import__/eval/exec/compile/open/input/globals/locals/vars/getattr/setattr/...
- validate_code_safety(): an AST check rejecting inline imports, dunder attribute
access (the ().__class__.__subclasses__() escape), frame/traceback introspection,
mro(), and str.format("{0.__globals__}") template traversal.
Both components now set __builtins__ via safe_builtins() and validate the sanitized
code (PythonREPL.sanitize_input) before exec. The tool component builds a fresh globals
namespace per invocation so state cannot leak across tool calls. The core component's
default Global Imports is reduced from "math,pandas" to "math" so the default no longer
bundles a deserialization sink (pandas.read_pickle); pandas can be added back explicitly.
This is defense-in-depth hardening, not a guaranteed sandbox -- Python sandboxing is
hard; the primary control for untrusted access remains authentication.
Adds unit tests for safe_builtins/validate_code_safety and component regression tests
(import bypass, subclasses/frame/format escapes and inline imports blocked; legitimate
code and whitelisted modules still work; per-invocation isolation; default excludes pandas).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* [autofix.ci] apply automated fixes
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
|
|||
| 75efd0a2a4 |
fix: point file manager empty-state link to the files page route (#13450)
The "My Files" shortcut in the file manager empty state linked to a
top-level "/files" route that does not exist. The files page is nested
under "assets" (routes.tsx: assets -> files), so clicking the link
dead-ended instead of opening My Files.
Point the link at "/assets/files", matching the sidebar navigation in
sideBarFolderButtons (_navigate("/assets/files")). Add a regression test
asserting the empty-state link's href.
|
|||
| e2d17a6d84 |
feat(logging): production-grade structured logs for Grafana/Loki (#13164)
* feat(logging): production-grade structured logs for Grafana/Loki Make langflow and lfx log output viable for ingestion by Grafana/Loki and other observability tools when run in JSON mode (LANGFLOW_LOG_ENV=container). Core changes in src/lfx/src/lfx/log/logger.py: - Preserve exceptions in JSON output via structlog.processors.ExceptionRenderer with ExceptionDictTransformer. Tracebacks now emit as a structured exception array (exc_type, exc_value, frames) instead of being dropped. - show_locals defaults to OFF; opt-in via LANGFLOW_LOG_TRACE_LOCALS=true so frame locals can't leak API keys, env, or request bodies in shipped logs. - Add service metadata (service / version / environment) from LANGFLOW_SERVICE_NAME / LANGFLOW_VERSION / LANGFLOW_ENVIRONMENT. - Add logger name to every record so Grafana can filter by source. - Add optional OpenTelemetry trace_id / span_id correlation. Import is resolved once at module load; runtime calls are wrapped so a flaky tracer SDK can never break logging. - Add default-on PII redaction for password, token, api_key, authorization, cookie, etc. Walks nested dicts, lists, and tuples up to depth 4. Extra keys via LANGFLOW_LOG_REDACT_KEYS. - Add per-logger level overrides via LANGFLOW_LOG_LEVELS="name=LEVEL,...". Malformed entries (typos like WARN instead of WARNING) raise UserWarning instead of silently dropping. - Use ISO 8601 UTC timestamps. - Install a stdlib InterceptHandler on the root logger in JSON modes so uvicorn, sqlalchemy, httpx, langchain, asyncio etc. emit a single unified JSON stream. Forwards exc_info and stack_info. emit() is wrapped to route any error through handleError so a malformed third-party log call cannot raise into the request path. Install is idempotent: re-running configure() updates the level instead of stacking handlers. Not installed in pretty mode so dev terminals don't get duplicate lines. - Reset cached loggers at the start of configure() so modules that captured a logger before configure() ran pick up the new processor chain. - Preserve the get_logger() name through PrintLogger so add_logger_name can attach it. Tests in src/backend/tests/unit/test_logger.py: - Cover structured tracebacks, PII redaction (top-level, nested, list, tuple, depth limit), logger name, stdlib intercept forwarding exc_info and stack_info, intercept idempotency, intercept-not-installed in pretty mode, malformed-args safety net, service info defaults and env overrides, malformed LANGFLOW_LOG_LEVELS warning, container_csv exception text, show_locals default off (verified by absence of the secret value, not just the key) and opt-in. * docs(observability): Grafana + Loki reference stack and env-var docs Adds a self-contained Loki + Promtail + Grafana docker-compose stack under deploy/observability/grafana-loki/ with a pre-provisioned dashboard that demonstrates the production logging features: structured tracebacks, PII redaction, service/version/environment labels, and the stdlib intercept path. Anyone running Langflow in JSON mode can point Promtail at their log file and get a working board on first run. Also documents the new env vars (LANGFLOW_SERVICE_NAME, LANGFLOW_VERSION, LANGFLOW_ENVIRONMENT, LANGFLOW_LOG_LEVELS, LANGFLOW_LOG_REDACT_KEYS, LANGFLOW_LOG_TRACE_LOCALS) in docs/docs/Develop/logging.mdx and adds a new page docs/docs/Develop/observability-grafana-loki.mdx covering JSON output shape, structured exceptions, stdlib routing, and OpenTelemetry trace correlation. Registered in the Observability sidebar category. * docs(observability): rename dashboard to 'Langflow Logs' * docs(observability): fix broken link from logging guide to Grafana/Loki page The logging guide linked to the new Grafana/Loki page with an absolute path (/observability-grafana-loki). Since the page is new and only exists in the next docs version, the absolute link resolved to a non-existent root-version route and failed the Docusaurus broken-link check. Use a version-aware relative .mdx link instead. * docs(observability): clarify stdout requirement for unified JSON logs The Grafana/Loki guide told users to set LANGFLOW_LOG_FILE, but the stdlib intercept that routes uvicorn/sqlalchemy/httpx/langchain into the JSON stream is only installed on the stdout path, so those library logs landed in the file as plain text and the json parse stage could not label them. Point the guide at stdout (redirected to the scraped file) and note the file-mode limitation. Also document that the JSON format is platform-agnostic and works with any JSON-ingesting backend including IBM Instana, whose OpenTelemetry-based Python tracer (3.0+) correlates logs to traces via trace_id/span_id. * fix(logging): render stdlib logs as redacted JSON in file mode In JSON mode with LANGFLOW_LOG_FILE set, the stdlib intercept was skipped to avoid a recursion loop, so third-party loggers (uvicorn, sqlalchemy, httpx, asyncio) wrote plain text straight to the file. Those lines bypassed both JSON rendering and PII redaction, so secrets in their structured fields landed in the file verbatim and Loki could not parse or label them. Route JSON file output through a structlog ProcessorFormatter on the rotating handler: foreign stdlib records are enriched via foreign_pre_chain (ExtraAdder + redaction) and rendered as JSON alongside application logs, while the RotatingFileHandler keeps log rotation. The stdout path is unchanged. Also forward stdlib extra fields through InterceptHandler so the stdout path redacts them too, keeping both paths consistent. Update the Grafana/Loki deploy guide to reflect that LANGFLOW_LOG_FILE now produces a single redacted JSON stream. * fix(logging): retrieval buffer captures the message text add_serialized stored the rendered message under the 'message' key, but SizedLogBuffer.write only read 'event'/'msg'/'text', so every entry returned by the /logs and /logs-stream endpoints had an empty message. Read 'message' first and keep the other keys as fallbacks for records written in other shapes. |
|||
| fb046c02df |
fix: ibm db2 bulk insert pr 13438 (#13449)
* feat(ibm): add IBM Db2 Vector Search component with comprehensive tests - Add Db2VectorStore component with vector search capabilities - Implement search methods (similarity, MMR, similarity with score) - Add comprehensive test suite covering all search operations - Enhance db2vs.py with improved error handling and connection management * fix(ibm): preserve DB2 bulk insert values --------- Co-authored-by: Dhruv Chaturvedi <dhruv_insights@mac.lkw-in.ibm.com> |
|||
| cc6cdf9297 |
fix(tracing): warn clearly when LangWatch is unavailable on Python 3.14 (Docker) (#13410)
fix(tracing): warn clearly when LangWatch is unavailable on Python 3.14 The official Docker images run Python 3.14, but the `langwatch` package caps its requires-python at <3.14, so it is excluded from the image. With LANGWATCH_API_KEY set, the tracer hit an ImportError and disabled itself with only a cryptic, per-run `logger.exception`, so users saw no traces and no actionable explanation (works on PyPI/desktop, which run Python 3.10-3.13). Emit a single, version-aware warning when the langwatch package is missing despite the API key being set, and document the Python 3.14 / Docker limitation in the LangWatch integration guide. |
|||
| ad54146c9f |
fix: Remove Playwright from Dependencies (#13382)
Remove Playwright from Dependecies Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> |
|||
| 9779214c6d |
fix(db): hold migration advisory lock for create_db_and_tables too (#13393)
The advisory lock added in #13204 only wrapped run_migrations, but initialize_database calls create_db_and_tables first. That path runs table.create(checkfirst=True) for every SQLModel table, which is a SELECT-then-CREATE that's not atomic. Concurrent workers booting against a fresh Postgres still race here: all three see no job_status_enum, all three issue CREATE TYPE, and the losers fail with UniqueViolation on pg_type_typname_nsp_index. The error is re-wrapped as RuntimeError "Error creating table job" before initialize_database's "already exists" swallow ever runs, so the worker exits with code 3. Wrap create_db_and_tables in the same _postgres_migration_lock. On Postgres the DDL now runs in a worker thread so the contended-lock poll does not block the event loop; SQLite preserves the original async path (no advisory locks). Extract _normalize_sync_postgres_url so the lock helper, the new locked DDL path, and check_postgresql_version_sync stop duplicating the same async-to-sync URL normalisation. Verified end to end: against postgres:16-alpine with a fresh volume, N=3/4/6/8 concurrent processes calling initialize_database all complete cleanly. Without this change the same setup deterministically fails 2/3 workers with the UniqueViolation above. |
|||
| 7e321059db |
docs: redis worker queue (#13386)
* docs: remove 1.8 env vars * docs: link out to deployment guide * docs: redis queue * fix-links-and-combine-env-vars-table * docs: cleanup * peer-review * peer-review * Apply suggestions from code review Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com> * move-prereqs --------- Co-authored-by: April I. Murphy <36110273+aimurphy@users.noreply.github.com> |
|||
| 73e49b13a0 |
test: Skip starter-projects shard4 on Windows CI (#13439)
skip shard 4 for windows |
|||
| 3e57126b91 |
fix: remove duplicate uv.lock from workspace member (#13326)
* fix: remove src/backend/base/uv.lock and Dockerfile references - Deleted src/backend/base/uv.lock (monorepo should have only one uv.lock at root) - Removed COPY ./src/backend/base/uv.lock lines from all Dockerfiles: - docker/build_and_push.Dockerfile - docker/build_and_push_base.Dockerfile - docker/build_and_push_ep.Dockerfile - docker/build_and_push_with_extras.Dockerfile - docker/dev.Dockerfile Fixes LE-1093 * fix: remove stale base uv.lock regeneration paths |
|||
| 8179ceac3c |
feat: Hide UI elements in embedded mode (#13099)
* feat(LE-906): Config/settings plumbing - Add 7 new boolean settings: custom_component_admin_only, embedded_mode, hide_logout_button, hide_new_project_button, hide_new_flow_button, hide_starter_projects, mcp_servers_locked (all default: false) - All settings configurable via LANGFLOW_* env vars - Expose all flags through ConfigResponse schema - Fix hide_getting_started_progress to read from settings not env - Add frontend type definitions for all 7 flags - Initialize utility store with all new flags - Implement hydration logic for new flags in config hook * [autofix.ci] apply automated fixes (attempt 2/3) * fix(LE-906): address PR1 review feedback - replace internal ICA wording with neutral embedded-mode language - add settings field for hide_getting_started_progress - map hide_getting_started_progress from settings in ConfigResponse - add regression test for embedded_mode hide-flag cascade - revert unrelated component_index drift from PR scope * fix(LE-906): address remaining PR1 Gabriel comments * docs/test(LE-906): clarify embedded_mode scope for QA - Clarify in settings docs that embedded_mode cascades UI hide flags only - Keep mcp_servers_locked and custom_component_admin_only as explicit opt-ins - Add config test assertions that security flags do not auto-cascade * feat(LE-906): Embedded UI visibility changes - Hide logout button from account menu when hideLogoutButton flag enabled - Hide new flow button from header when hideNewFlowButton flag enabled - Hide new project button from sidebar when hideNewProjectButton flag enabled - Hide starter projects tab from templates modal when hideStarterProjects enabled - All UI gates read from utility store (flags populated from server config) - Supports embedded/iframe mode integration where standalone UI elements are hidden - Pure frontend changes: no backend dependencies, no breaking changes - Respects embedded_mode umbrella flag when individual hide flags set * fix(LE-906): restore overwritten header components and keep embedded UI gates * [autofix.ci] apply automated fixes * feat(LE-906): hide new flow entry points * fix(LE-906): address PR4 review comments from Gabriel * fix(LE-906): resolve PR4 biome lint failures --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| f05aaaf543 |
feat: Gate custom component creation for admins only (#13098)
* feat(LE-906): Custom component admin gating + fix field refresh side effect - Add custom_component_admin_only gate to POST /custom_component endpoint - Only admin users can CREATE new custom component code when flag enabled - Remove admin gate from POST /custom_component/update endpoint * This endpoint handles field metadata refresh (e.g., model provider changes) * Normal users need access to refresh available models/options * Gate on creation prevents harmful code, not on field refresh operations - Use hardened feature-flag checks with getattr(..., False) is True pattern - Fixes side effect where normal users couldn't refresh field metadata (e.g., couldn't change LLM models when provider config changes) - Gate applies only to creation of NEW custom components, not metadata updates * fix(LE-906): address PR3 review feedback - remove stale placeholder commentary from custom_component/update - enforce admin-only restriction for truly custom code updates - keep known-template refresh/update path available for non-admin users - add endpoint tests for allow/block behavior under admin-only mode - revert unrelated component_index drift from PR scope * feat(LE-906): tighten custom component admin gating * fix(LE-906): tighten custom-component admin gate carveouts * [autofix.ci] apply automated fixes * fix(LE-906): address PR3 review comments from Gabriel - Rename create-side known-template refresh test for accurate intent - Strengthen superuser coverage with novel-code create case and update case - Revert unrelated starter project dependency version drift (OpenDsStar) --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 61ad11e530 |
feat: MCP lock enforcement + UI/tests (#13097)
* feat(LE-906): MCP lock enforcement + UI/tests
- Add mcp_servers_locked gate to POST /{project_id}/install endpoint
- Extend lock check to PATCH /{project_id} endpoint for auth settings updates
- Non-superuser requests blocked with 403 when flag is enabled
- Add hardened feature-flag checks using getattr(..., False) is True pattern
to prevent MagicMock truthiness in tests
- Update AddMcpServerModal to show locked message when mcp_servers_locked=true
- Fix JSX structure in modal (missing fragment wrapper)
- All MCP modifications now gated when mcp_servers_locked flag enabled
* fix(LE-906): address PR2 review feedback
- add is_mcp_servers_locked helper with MagicMock-safe semantics and rationale
- add regression tests for explicit-true vs MagicMock placeholder behavior
- add missing mcp.modal.lockedTitle/lockedDescription i18n keys across locales
- remove debug leftover test_page.html
- revert unrelated component_index drift from PR scope
* fix(LE-906): enforce MCP lock in v2 servers
* fix(LE-906): address PR2 review comments from Gabriel
- Remove duplicate is_mcp_servers_locked helper from v1/mcp_projects.py;
import from api/v2/mcp instead so unit tests protect production code
- Retarget test imports to langflow.api.v2.mcp.is_mcp_servers_locked
- Add test_v2_mcp_servers_unlocked_allows_non_superuser_add_patch_delete
to cover the flag-off case (non-superuser can CRUD when gate is off)
* fix(LE-906): make MCP lock configurable in PR2
- Declare mcp_servers_locked in Settings so LANGFLOW_MCP_SERVERS_LOCKED is honored
- Add regression test to assert Settings exposes and reads mcp lock env var
* chore(ci): trigger PR2 CI
|
|||
| 6049fe061c |
feat: Add embedded mode configuration flags (#13095)
* feat(LE-906): Config/settings plumbing - Add 7 new boolean settings: custom_component_admin_only, embedded_mode, hide_logout_button, hide_new_project_button, hide_new_flow_button, hide_starter_projects, mcp_servers_locked (all default: false) - All settings configurable via LANGFLOW_* env vars - Expose all flags through ConfigResponse schema - Fix hide_getting_started_progress to read from settings not env - Add frontend type definitions for all 7 flags - Initialize utility store with all new flags - Implement hydration logic for new flags in config hook * [autofix.ci] apply automated fixes (attempt 2/3) * fix(LE-906): address PR1 review feedback - replace internal ICA wording with neutral embedded-mode language - add settings field for hide_getting_started_progress - map hide_getting_started_progress from settings in ConfigResponse - add regression test for embedded_mode hide-flag cascade - revert unrelated component_index drift from PR scope * fix(LE-906): address remaining PR1 Gabriel comments * docs/test(LE-906): clarify embedded_mode scope for QA - Clarify in settings docs that embedded_mode cascades UI hide flags only - Keep mcp_servers_locked and custom_component_admin_only as explicit opt-ins - Add config test assertions that security flags do not auto-cascade --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 3ff3c576ca |
fix(ci): re-enable migration-pip-venv now that nightly bundles resolve (#13421)
The PyPI langflow-nightly is pip-installable again, so the temporary `if: false` guard added on 2026-05-28 is no longer needed. #13418 (release-1.10.0) and its forward-port #13419 (main) gave the extension bundles their own nightly track: langflow-nightly now depends on lfx-arxiv-nightly / lfx-duckduckgo-nightly / lfx-ibm-nightly, which pin lfx-nightly==0.5.0.dev* instead of an unsatisfiable stable lfx>=0.5.0,<0.6.0. Verified against the published dev57 wheels: a dry-run resolve of langflow-nightly[postgresql] succeeds (549 packages, exit 0), pulling lfx-nightly==0.5.0.dev57 via the *-nightly bundle variants. |
|||
| 2e41b7f3e2 |
fix(i18n): default to English regardless of browser locale (#13324)
Previously, on first load with no saved language preference, the app used navigator.language as the fallback, causing users with Portuguese (pt-PT / pt-BR) or other non-English browser locales to see the UI in that language automatically. The expected behavior is that English is always the default; users can change the language explicitly via settings. Co-authored-by: Antônio Alexandre Borges Lima <104531655+AntonioABLima@users.noreply.github.com> |
|||
| 2dc9e194ed |
fix(tests): patch uuid4 on payloads module in watsonx orchestrate tests
Three name-generation tests monkeypatched `uuid4` on the watsonx_orchestrate `utils` module, but `uuid4` is imported and used in `payloads.py` (build_langflow_wxo_resource_name). Python resolves the name against the defining module's globals, so patching utils raised AttributeError. Point the patches at payloads_module and drop the now-unused utils_module import. |
|||
| 9cb49c2c7d |
fix(i18n): backend locale translation fixes — custom component nodes, Toolset output, RAG template notes, UI banner strings (#13296)
* fix(i18n): translate custom component nodes and fix missing RAG template notes in ja/fr
- Add translate_component_node() helper to i18n.py and call it from
custom_component and custom_component_update endpoints so canvas
interactions (tool mode toggle, field edits) no longer revert node
labels to English when a non-English locale is active.
- Sync ja.json and fr.json from GP: both locales were missing
template_notes.vector_store_rag.* keys, causing the Vector Store RAG
README note to always render in English.
* fix(i18n): translate Toolset output and UpdateAllComponents banner strings
- Extract the shared tool-mode output ("Toolset") via a sentinel norm
"_toolmode" in extract_backend_strings.py so the dynamic output
injected on every component when tool mode is enabled is covered by
a single shared translation key instead of being silently skipped.
- Update translate_component_node() to use the "_toolmode" norm when
the output name is "component_as_tool", resolving the key correctly
for all components.
- Wrap all hardcoded strings in UpdateAllComponents/index.tsx with t()
(summary banner, Dismiss/Dismiss All, Review All/Update All buttons).
- Add 15 new updateComponents.* keys to frontend en.json with i18next
_one/_other plural variants; upload and download all locale files.
- Sync all backend and frontend locale files from GP.
* fix(i18n): sync backend locale files with Toolset translations from GP
* fix(i18n): translate Retry button in server connection error dialog
* [autofix.ci] apply automated fixes
* fix(i18n): inline lfx.base constants in extract_backend_strings to fix CI
The GP script test environment mocks lfx.components but does not install
the full lfx package, so `from lfx.base.tools.constants import ...` raised
ModuleNotFoundError. Inline the two constants directly, matching the pattern
already used in bake_note_keys.py.
* [autofix.ci] apply automated fixes
* fix(i18n): address PR review — blockedPlural scheme, TOOL_OUTPUT_NAME constant, translation error isolation
- I1: Replace {{blockedPlural}} English-suffix hack in UpdateAllComponents with two
separate t() calls (blockedCannotRun + andMustBeUpdated), each driven by its own
count parameter, giving proper _one/_other pluralization for both counts independently.
Remove broken blockedAndMustUpdate_one/other keys from all 6 non-English locales
(de/es/fr/ja/pt/zh-Hans) so they fall back cleanly to English until re-translated
via the GP pipeline.
- I3: Replace magic string "component_as_tool" in i18n.py with TOOL_OUTPUT_NAME
imported from lfx.base.tools.constants — the canonical source of truth.
- I4: Move translate_component_node() calls outside the main try/except in both
custom_component and custom_component_update endpoints; wrap each in a narrow
try/except that logs and falls through to the untranslated node, so an i18n bug
can no longer fail a successful component update with HTTP 400.
* fix(i18n): translate update-components modal strings and preserve custom field display_names
- Translate hardcoded strings in UpdateComponentModal (title, column
headers "Component"/"Update Type", "Breaking" label) — adds 5 new
keys under updateComponent.* and downloads translations for all locales
- Fix custom component field display_names reverting on reload: extend
build_component_display_names to collect all known locale translations
per input field; syncNodeTranslations now checks the known-translation
set before overwriting a field's display_name — user-customized values
(not present in any locale file) are left untouched while standard
translatable values continue to update correctly on locale switch
- Update ComponentDisplayNamesType to include per-field translation sets
* fix(i18n): correct updateComponent.breaking translation key
Change English source from "Breaking" to "Breaking Change" so GP
produces correct translations (all locales were getting "Breaking News"
variants). zh-Hans now correctly shows 重大变更, consistent with the
existing breakingUpdateDesc body text.
* chore(i18n): re-download frontend translations after reverting breaking key to "Breaking"
* fix(i18n): extract and translate FileComponent description
The extraction script silently skipped @property descriptors when reading
description from component classes. Add a fallback to _base_description
for components that use a dynamic @property description.
Unify _base_description with the string used inside get_tool_description()
so there is a single source of truth, then re-run extract/upload/download
to add the missing translations for FileComponent description and Knowledge
component strings across all locales.
* fix(ui): redesign outdated-components banner with title + list layout
Replace long sentence-style summary with bold "Flow needs review" title
and short per-condition bullet lines. Change Dismiss All button from
link to outline variant. Add 3 new i18n keys and sync all locale translations.
* fix(i18n): add missing backend locale translations for de, es, pt, zh-Hans
Regenerated via GP download script after merging release-1.10.0 changes.
* [autofix.ci] apply automated fixes
* fix(i18n): resolve ruff lint errors in i18n utils and endpoints
* fix(lint): suppress SLF001 for internal class attribute access in FileComponent
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes
* starter templates
* fix(tests): update outdated-banner assertions to match redesigned layout
* [autofix.ci] apply automated fixes
* fix(docs): restore accidentally deleted memory-base docs from release-1.10.0
* fix(credentials): restore DB-first API key resolution and tests from release-1.10.0
* [autofix.ci] apply automated fixes
* fix(i18n): revert fetchErrorComponent key to common.retry (out of scope)
* [autofix.ci] apply automated fixes
* chore(i18n): sync backend and frontend locale files from GP
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Antônio Alexandre Borges Lima <104531655+AntonioABLima@users.noreply.github.com>
|
|||
| 727b73bb7c |
docs: non-feature fixes and updates for 1.10 (#13396)
* docs-clarify-server-vs-tool-precedence * docs: forward key header to nested mcp server * docs: webhook auth default behavior * peer-review |
|||
| 9044b8f0c4 |
fix(ci): give extension bundles a nightly track so langflow-nightly resolves (#13418)
The nightly tagger renames lfx -> lfx-nightly, but the extension bundles
were published as stable lfx-<name> wheels pinning lfx>=0.5.0. So
langflow-nightly depended on the stable lfx-arxiv (etc.), which dragged in
lfx>=0.5.0 -- a version only published under the lfx-nightly name. Installing
the nightly therefore failed:
Because only lfx<=0.4.5 is available and lfx-arxiv==0.1.0 depends on
lfx>=0.5.0, ... your requirements are unsatisfiable.
Give the bundles their own nightly track, mirroring lfx/base/main:
- update_lfx_version.py now renames each src/bundles/* package to
lfx-<name>-nightly, versions it <base>.dev<N> (sharing lfx's dev number),
and repoints the root langflow deps + [tool.uv.sources] workspace entries
at the -nightly names. Each bundle's own lfx dep was already repinned to
lfx-nightly==<dev>. Only the [project] name/version change -- entry points
and the import package stay as lfx_<name>, so extension discovery is intact.
- release_nightly.yml publishes the nightly bundle wheels to PyPI and gates
publish-nightly-main on them, so langflow-nightly's exact == pins always
reference bundles published in the same run.
No build/test/Docker changes needed: the bundles are already built and
committed under the nightly tag, the cross-platform test resolves them via
--find-links, and Docker builds from the regenerated workspace lock.
|
|||
| 3f445d1532 |
fix: add failed login logging with IP tracking and other relevant details (#13409)
* feat(security): add failed login logging with IP tracking and comprehensive tests * fix: remove PII from login logs and fix structlog format * docs: agent improvements (#13269) * docs: add structured output for agents * docs: add structured output note * docs: clarify both agent outputs and add release notes * docs: when langflow sends events to the playground and chat history * fix(playground): expand session checkbox click target to full row height (#13349) * fix(playground): expand session checkbox click target to full row height The selectable-row checkbox wrapper was ``w-4 h-4`` (16x16 px) but the row is ``h-8`` (32 px). The 8 px band above and the 8 px band below the visible icon were dead zones that bubbled to the row's ``toggleVisibility`` and navigated to the session instead of toggling selection — exactly the accidental-navigation UX the bug ticket describes. Grow the wrapper to ``w-4 h-8`` so the click target captures the full row height. Width stays narrow so the text alignment is unchanged; the icon itself stays ``h-4 w-4``, centered via the existing ``flex items-center justify-center``. Visual position is identical. Adds ``__tests__/session-selector-checkbox-click-target.test.tsx`` (3 cases): wrapper className guard (h-8 + w-4, not h-4), click on the wrapper outside the icon triggers selection without bubbling to toggleVisibility, and click on the inner icon still toggles selection. * test(playground): drop checkbox-click-target test file (not needed per review) * [autofix.ci] apply automated fixes * test: align session-selector checkbox assertions with full-height click target --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fix: improve trace search functionality (#13383) * improve trace search functionality * [autofix.ci] apply automated fixes --------- Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * test: fix test_login_logs_real_output_format to use mocking - Updated test to use patch() instead of capsys for consistency - Verifies structlog kwargs format (not nested extra dict) - All 7 login logging tests now passing --------- Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Co-authored-by: keval shah <kevalvirat@gmail.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: olayinkaadelakun <olayinka.adelakun@ibm.com> Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> |
|||
| 42ad7ebf80 |
fix: use Langflow logo on loading screen and remove size jump glitch (#13417)
* change loading to use langflow logo * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| b06f810f53 |
docs: add chroma cloud provider (#13122)
docs-add-chroma-cloud-provider |
|||
| a875c1dfcf |
feat: sync wxO agent name and description with db (#13026)
* feat: add wxO agent name to api list items * feat: expose wxO agent metadata in deployment provider data Add a validated Watsonx Orchestrate deployment item provider_data contract that carries agent name, display name, description, tool IDs, environments, and detail-only LLM metadata. Use that shared contract in the adapter service and API mapper so list, get, sync, and snapshot binding paths parse provider metadata consistently and fail with structured internal errors when the adapter payload is invalid. Update unit coverage for list/get shaping, sync provider_data, optional LLM handling, empty tool IDs, and contract validation failures. * feat(deployments): rename deployment label to display name Rename deployment DB/local contracts from name to display_name so resource_key remains the provider identity and duplicate display labels are allowed. - Add Alembic migration to rename deployment.name, drop provider-scoped display-name uniqueness, preserve resource_key uniqueness, and restore downgraded names safely. - Update Deployment model, CRUD create/update/list/count paths, related attachment queries, validation, and conflict messages for display_name. - Remove deployment display-name conflict checks so duplicate labels can coexist under the same provider account. - Reject local DB names filters unless load_from_provider=true, keeping names as provider technical-name filtering only. - Update deployment API route handling and base/watsonx mapper response shaping to read display_name from local rows. - Update backend unit and integration tests across deployment CRUD, route handlers, mappers, sync, telemetry, flow/project responses, names filters, and attachment paths. * Update deployment API contract to use display_name Rename deployment REST request and response fields from name to display_name for Langflow-tracked deployments while preserving provider-only names filtering for load_from_provider=true. Map display_name through create, update, get, list, and status responses, and document that stored/displayed deployment names are synced from the provider. Update deployment mappers and route tests for the new contract, including rejection of DB-mode names filtering and integration coverage for local display_name responses versus provider name payloads. * feat: sync provider deployment display metadata - Rename deployment-facing name semantics toward display_name while preserving resource_key as the stable provider identity - Add provider metadata extraction contracts for list/get sync and wire routes through shared sync helpers - Sync provider-owned display_name and description into local deployment rows on list/get - Preserve updated_at during provider metadata sync so read reconciliation does not look like a local edit - Decouple wxO technical agent names from user-facing display labels by generating langflow_agent_<id> names - Stop changing wxO technical name when updating display_name or description - Remove duplicated display_name and description from wxO provider_data for Langflow-tracked responses - Require wxO provider display metadata instead of falling back to technical names - Wrap malformed wxO get metadata as deployment errors instead of leaking KeyError - Update deployment attachment listing/counting to ignore orphaned flow-version links - Normalize LFX deployment create/update names with non-empty string constraints - Add real SQLite CRUD coverage for metadata sync and orphaned attachment filtering - Add deployment integration coverage for get/list provider metadata sync into DB rows - Add wxO mapper, service, route, and schema tests for display metadata, generated technical names, and update behavior * feat: align deployment API with provider display names - Move tracked wxO deployment create/update labels out of top-level request fields and into `provider_data.display_name`. - Remove top-level `display_name` from tracked deployment list, get, create, and update responses so provider-owned labels are returned through `provider_data`. - Add wxO `provider_data.name` for the provider technical agent name and `provider_data.display_name` for the user-facing agent label in create/update/get/list response shaping. - Remove deployment-list `names` filtering from the REST route, mapper list params, synced list helper, DB list/count helpers, LFX list schema, and wxO service query params. - Change existing wxO agent onboarding to fetch the provider resource first and create only the local Langflow tracking row. - Reject create-time mutations when `provider_data.existing_agent_id` is used, including display/LLM/tool/flow changes and explicit description updates. - Seed local deployment `display_name` and `description` for existing-agent onboarding from provider metadata instead of request fields. - Add provider-specific mapper hooks to build local `Deployment` models and local update kwargs from validated provider payloads. - Add `create_deployment_from_model` so routes can persist mapper-built deployment rows without duplicating provider-specific field extraction. - Require `provider_data.display_name`, `provider_data.llm`, and at least one flow/tool operation for new wxO agent creation. - Preserve metadata-only update support while routing wxO display-name updates through `provider_data.display_name` and description updates through the public description field. - Include wxO technical deployment names in adapter create/update result payloads so API responses can expose provider technical names alongside display labels. - Truncate provider-synced deployment descriptions to the deployment description limit before storing local metadata. - Remove the tracked deployment status route/schema and mark wxO status lookup as not configured instead of inferring health from draft-agent metadata. - Tighten LFX update validation by rejecting explicit null technical names while still allowing explicit null descriptions. - Keep wxO config and snapshot list responses as validated provider payloads instead of collapsing empty payloads to null. - Update backend and LFX tests for provider-data display labels, removed top-level display names, removed deployment-name filters, existing-agent onboarding, status route removal, metadata sync truncation, and update validation. * add changes from mapper base * feat: generate managed wxO technical names - Generate Langflow-managed wxO agent technical names as `lf_<normalized_display_name>_<short_uuid>` - Reject display labels that cannot contribute a normalized name segment instead of falling back silently - Generate a fresh wxO technical name when an agent display label changes - Keep update payload branching explicit so description, LLM, and name updates only send intended fields - Use update retry semantics for wxO agent updates - Make wxO name validation errors use explicit field labels such as `Connection app id`, `Tool name`, and `Agent name` - Update wxO adapter and mapper tests for managed technical names and resource-specific validation messages * fix: separate wxO deployment technical names from labels - Keep adapter-level deployment name fields as provider technical names. - Move wxO user-facing labels to provider_data.display_name. - Let the wxO adapter generate Langflow-managed technical names when spec.name is omitted. - Use the langflow_ prefix with fresh UUID suffixes for generated wxO technical names. - Strictly validate explicit technical names without rewriting them. - Reject explicit null or blank values for technical name, display name, LLM, and description updates. - Allow symbol-only display names by falling back to the resource type for generated names. - Clarify fallback naming errors when both display name and resource cannot produce a valid segment. - Add display_name support to wxO create and update payload contracts. - Align mapper create and rollback behavior with adapter-owned technical name generation. - Preserve rollback behavior for blank descriptions by mapping them to null. - Update LFX deployment schemas for optional adapter name fields. - Fix the deployment rename migration dependency to keep Alembic on a single head. - Update deployment and wxO tests for the new name contract and validation behavior. * refactor: separate wxO tool display and technical names - Replace user-facing wxO tool label inputs with tool_display_name in create, update, and rename payload contracts. - Remove mapper-side wxO tool technical-name normalization and validation, so user labels are no longer treated as provider technical names. - Add wxO flow-artifact provider-data validation that requires tool_display_name and generates provider_data.tool_name when omitted. - Keep provider_data.tool_name as the adapter-owned wxO technical name and provider_data.tool_display_name as the user-facing label. - Use generated provider_data.tool_name as the raw tool correlation key for tools.raw_payloads and operations[*].tool.name_of_raw. - Keep top-level raw BaseFlowArtifact.name separate from wxO technical names instead of overloading it for provider correlation. - Add mapper-local grouped flow-tool payload data containing display_name, provider_data, and raw_name for each flow version. - Build wxO flow tool provider_data through the adapter payload slot instead of a mapper-owned artifact schema. - Add create/update adapter payload builder helpers that validate provider payloads through the configured adapter slots. - Convert adapter-bound payload validation failures during mapper construction into internal contract errors rather than client 422s. - Remove the generic base mapper create-flow-artifact provider-data helper because wxO now owns provider-specific tool metadata. - Update create flow mapping to derive default tool_display_name from the flow name and generate technical tool names internally. - Update update flow mapping to derive tool_display_name for raw flow payloads and emit rename_tool only for existing attached tools. - Preserve bind, unbind, attach, remove, and rename operation behavior while switching raw selectors to generated technical names. - Add flow-version provider-data shaping that exposes app_ids, technical tool_name, and user-facing tool_display_name. - Require snapshot/list item provider data to include both technical name and display name so corrupt provider data fails fast. - Update deployment flow-version schema documentation to tell clients to display provider_data.tool_display_name and treat provider_data.tool_name as technical metadata. - Update wxO create/update planning to key raw tools by provider_data.tool_name instead of BaseFlowArtifact.name. - Update wxO tool creation to set wxO name from provider_data.tool_name and wxO display_name from provider_data.tool_display_name. - Remove redundant downstream None checks for tool_name and tool_display_name after schema validation guarantees them. - Remove the raw-tool-name helper and direct None filtering now that tool_name is generated by the provider-data schema. - Rename provider rename operation payload from new_name to tool_display_name. - Generate technical names for rename updates from tool_display_name rather than using the display label as the provider name. - Load current agent tools once during update apply and reuse that tool map for connection deltas, renames, and connection pre-seeding. - Consolidate existing-tool connection deltas and renames into one helper with separate delta and rename loops and one provider update batch. - Ensure a tool with both connection changes and a display-name rename is updated once using a single merged writable payload. - Preserve rollback snapshots for existing tools before connection or rename mutations are applied. - Pre-seed resolved connection ids from loaded agent tool bindings while letting explicit operation resolution overwrite provider-seeded values. - Keep later provider binding values for duplicate app ids during pre-seeding, matching explicit update overwrite semantics. - Add snapshot provider-data extraction in the wxO service that carries technical name, display name, and Langflow connection bindings. - Update mapper tests for create raw tool payloads, display-name overrides, generated technical names, raw correlation, and rename operations. - Update adapter schema tests for raw tool pools keyed by generated provider technical names and required display-name provider data. - Update service/update tests for rename batching, loaded-tool reuse, connection delta preservation, rollback behavior, and ownership checks. - Update snapshot and flow-version response tests to assert both technical and display tool metadata. * feat(deployments): sync provider display metadata - BE `api/v1`, `mappers/deployments`: Source local deployment create and update metadata from provider adapter results so `display_name` and `description` stay aligned with authoritative provider state. - BE `mappers/deployments`, `database/models/deployment`: Replace the removed deployment metadata schema with mapper-owned CRUD kwargs for list/get/update sync while preserving flexible provider-specific metadata handling. - BE `mappers/deployments`, `database/models/deployment`: Add description truncation with structured callsite/provider logging and log actual DB metadata sync writes with changed fields and before/after lengths. - BE `database/models/deployment`: Keep DB metadata sync focused on real changes so provider descriptions truncated locally do not cause unnecessary writes when cached values already match. - BE `services/adapters/deployment/watsonx_orchestrate`: Update wxO create/update result contracts to include provider display metadata, technical `name`, descriptions, and snapshot/tool binding details consistently. - BE `services/adapters/deployment/watsonx_orchestrate`: Build wxO create agent payloads once before provider create, carry the resolved provider description into create results, and keep wxO description fallback behavior explicit. - Both BE `services/adapters/deployment/watsonx_orchestrate` and FE `deploymentsPage`: Separate wxO technical names from user-facing display labels across adapter results, UI payloads, and tests. - FE `controllers/API/queries/deployments`, `deploymentsPage`: Move deployment create/update payloads to `provider_data.display_name` and `tool_display_name`, removing stale top-level `name` and `tool_name` usage. - FE `deploymentsPage`, `deploy-choice-dialog`: Default tool display names to the flow name instead of generated technical suffixes, and use keyed selected flow versions to distinguish repeated flow attachments. - FE `deploymentsPage`, `deploy-choice-dialog`: Update deployment attachment and deploy-choice dialog flows to use selected-flow-version keys, provider tool display names, and current flow names consistently. - FE `controllers/API/queries/deployments`, `deploymentsPage`: Remove provider name-check hooks, wxO name-normalization helpers, and related validation tests now that display names are not technical identifiers. - FE `deploymentsPage`: Relax deployment display-name validation to require only non-empty input, allow edit-mode display-name changes, and send changed display labels through `provider_data.display_name`. - FE `deploymentsPage`: Make deployment display/technical-name helpers null-safe when provider data is missing, with resource-key fallbacks for table, details, delete, and test flows. - FE `deploymentsPage`: Update deployments page UI to render display names separately from technical names and avoid exposing descriptions in table rows. - FE `controllers/API/queries/deployments`: Align create, patch, list, and attachment query types with provider metadata and `tool_display_name` contracts. - LFX `services/adapters/deployment`: Align deployment create results with the provider metadata contract by carrying type, technical name, and description instead of stale config/snapshot result fields. - BE `database/models/deployment`: Add a TODO for DB-level length enforcement of provider-synced display metadata. - Tests `src/backend/tests`, `src/frontend/**/__tests__`, `src/lfx/tests`: Add/update coverage for provider metadata sync, truncation, update persistence, response shaping, display-name validation, keyed attachments, and nullable provider data. * fix: tighten watsonx deployment payload contracts - Remove snapshot-name filtering from deployment snapshot listing: - Drop the `names` query parameter from the API route. - Remove `snapshot_names` from `SnapshotListParams`. - Remove wxO snapshot-name normalization and service lookup paths. - Remove direct E2E scenarios and unit coverage for snapshot-name listing. - Make wxO deployment provider data match the provider API contract: - Require wxO agent list/detail payloads to include `tools` and `llm`. - Read `agent["tools"]` and `agent["llm"]` directly instead of defaulting or normalizing missing provider fields. - Include `llm` in deployment list/provider-data shaping. - Preserve provider-owned strings instead of silently stripping or dropping blanks in result payloads. - Tighten wxO API and adapter payload validation: - Replace ad hoc string validators with shared non-empty string annotations where appropriate. - Reject explicit `null` for update scalar fields such as `llm` and `display_name`. - Require non-empty provider ids, tool ids, app ids, model names, environments, and execution ids in wxO payload schemas. - Fix wxO update payload patch semantics: - Build provider update bodies using `model_fields_set` so omitted `llm` and `display_name` stay omitted. - Keep `exclude_unset=True` for validated update payload serialization. - Preserve LLM-only update behavior without emitting omitted scalar fields as explicit nulls. - Simplify wxO update planning and rollback: - Remove `extract_agent_tool_ids` and rely on the wxO agent `tools` field directly. - Fetch only existing tools that update operations mutate or rename. - Stop pre-seeding connection bindings from unrelated attached tools; operation app ids now resolve through explicit update operations. - Adjust wxO deployment listing behavior: - Treat singular `environment` as a strict local filter. - Leave plural provider parameters as provider passthrough. - Rename deployments table header from `Name` to `Display Name`. - Update tests for the new contracts: - Remove snapshot-name route, mapper, service, and E2E coverage. - Add/update coverage for required `llm`, required provider metadata, null update scalar rejection, stale snapshot handling, and provider-owned string preservation. - Update frontend table header expectations. * direct key access in tool logs * fix(deployments): preserve full deployment descriptions - Remove provider metadata sync logging that emitted deployment identifiers and field length changes. - Remove description truncation from deployment mapper contracts and Watsonx metadata mapping. - Remove the deployment description max-length cap from LFX schemas, Langflow API schemas, and database CRUD validation. - Pass provider descriptions through unchanged during create, update, list, and get metadata sync flows. - Update backend, integration, and LFX tests to assert long descriptions are accepted and preserved. * refactor(deployments): centralize mapper payload slot validation - Move shared API request and adapter slot parsing into BaseDeploymentMapper. - Add provider label enforcement so mapper subclasses fail fast when error text cannot identify the provider. - Add outer request validation support for provider_data slots and map validation failures to 422 responses. - Move wxO existing-agent description conflict validation into the wxO create payload contract. - Update wxO mapper call sites to use the shared base parsing helpers. - Add focused tests for provider label enforcement, slot error mapping, outer request validation, and existing-agent description conflicts. * fix downgrade migration to actually recover unique constraint for the name column * fix(deployments): clarify wxo deployment name labels - Rename user-facing wxO deployment display-name labels from "Display Name" to "Name" across the deployment form, review step, table, loading state, and details modal. - Label the provider-backed technical identifier as "Technical Name" in deployment details so it is distinct from the editable display name. - Restore deployment descriptions under the deployment name in the deployments table. - Align validation copy and frontend tests with the updated label behavior. * fix(deployments): validate snapshot patch project scope - Reuse the existing deployment project-scope validator in the snapshot patch route before resolving provider credentials or mutating wxO artifacts. - Enforce that replacement flow versions belong to the tracked deployment project while keeping different-flow snapshot updates allowed. - Add route coverage proving project validation uses the deployment row's project_id and short-circuits before provider adapter work. - Update stale wxO mapper and sync test expectations for the current provider-data contract and mapper error messages. - Verified backend deployment tests and isolated lfx deployment tests are green. * test(deployments): align list integration tests with current API Update deployment list integration tests after removal of the names query parameter and list items without a top-level display_name. Assert synced display names via refreshed DB rows and provider entries instead of response fields that no longer exist. * rename test file * rename test file * fix(deployments): tighten wxo provider metadata contract Trust required wxO API fields directly, remove duplicate deployment names from provider_data, and keep mapper output sourcing names from top-level deployment metadata. * fix(deployments): preserve provider display names in db Keep deployment display names exactly as received while still rejecting blank values, and continue normalizing resource keys for DB lookups. * fix(deployments): align patch payload and display_name schema Send provider_data.llm only when changed in deployment PATCH payloads, preserving granular update behavior and no-op fallback semantics. Keep deployment.display_name nullable across migration/model paths and align wxO snapshot tests with the required display_name provider contract. * fix test * chore: remove updates to e2e adapter tests, defer to a follow up PR * refactor(deployments): simplify wxO provider list shaping Flatten provider list entries directly from adapter provider_data and validate once via parse_adapter_slot on deployment_list_result. Remove redundant per-item schema validation, id strip filtering, and description guesswork; require provider_data to be a dict and let canonical item fields override provider payload. * simplify downgrade migration to always append deploymend id to the name * fix(wxo): keep mapper imports free of IBM SDK via payloads Move Watsonx naming and field validation helpers into payloads.py so mapper -> payloads no longer imports utils.py and its IBM client deps. Point core modules and tests at the shared payload helpers and leave utils.py for runtime error/utility helpers only. * fix(watsonx): lazy adapter package imports and explicit registration Move adapter registration into register.py so importing payloads or the mapper does not load optional IBM SDK modules via package __init__.py. Use lazy package exports for service and types, dedupe update result IDs in WatsonxDeploymentUpdateResultData, and use direct BaseFlowArtifact field access in flow tool creation. * fix(test): align Watsonx guards with lazy package imports Skip SDK-backed service tests via importorskip on IBM packages instead of importing the lightweight watsonx_orchestrate package. Run schema and mapper tests against payloads directly and remove obsolete module-level skips so Py 3.10 CI can collect SDK-free Watsonx tests. * fix(test): skip explicit Watsonx modules without IBM SDK Guard Watsonx-named schema and mapper test modules by importing WatsonxOrchestrateDeploymentService, which exercises the lazy package export and fails when optional IBM SDK dependencies are unavailable. * fix(test): align deployment E2E mocks and review-step expectations Add provider_data.display_name to deployment mocks so delete and edit tests match getDeploymentDisplayName. Update review-step Playwright tests for display-name behavior that no longer blocks deploy on duplicates or numeric flow names. * fix ff test * fix(deployments): hide technical name in details and fix migration chain Show only the display name in the deployment info grid. Point the display_name rename migration at f6b3ce6845d4 so Alembic ordering is correct. * fix down revision * fix ruff * fix playwright test * fix(deployments): send only changed PATCH fields and trust API display names Stop re-sending unchanged description on update and skip the PATCH when there are no changes. Resolve UI labels from provider_data.display_name only, without resource_key or technical name fallbacks. * fix(deployments): restore i18n labels and polish edit-save UX Restore deployments.labelName/columnName and related keys instead of hardcoded English. Show an em dash when display_name is missing, remove dead toolNameErrors code, and toast when edit save has no changes. * fix(deployments): scope snapshot list and patch to deployment owner Remove the actor-owned provider lookup before deployment resolution so collaborators with READ on a shared deployment can list snapshots. Validate replacement flow versions under owner_id on snapshot PATCH, not the actor. * fix(test): deployment edit E2E and Biome import order Edit stepper skips PATCH when there are no changes, so the E2E test updates the deployment name before submit. Organize imports in select-gpt-model.ts for Biome. * fix(deployments): align provider metadata sync with RBAC owner scope Match metadata batch updates on (deployment id, owner user_id) so shared deployment list/get sync writes in the owner's namespace. Stop rolling back the outer session when attachment sync fails on GET so provider display_name/description sync is preserved. Group list attachment reconcile by deployment owner and use row.user_id for stale deletes. * fix(test): align deployment sync mocks with row owner scope Add user_id to deployment row mocks so list_deployments_synced tests match per-owner delete and metadata batch behavior. Remove unused imports in the deployment step-type component. * [autofix.ci] apply automated fixes * revert(deployments): restore rollback, direct metadata keys, single-owner list sync Per PR review: bring back outer session rollback on GET attachment-sync failure, fail fast on provider metadata dict access, and use a single user_id for list attachment reconcile (N+1 per-owner grouping deferred). Owner-scoped metadata batch updates in CRUD are unchanged. * update down revision * fix(frontend): remove unused i18n import in step-review utils Drop leftover import after refactor so Biome check passes. --------- Co-authored-by: himavarshagoutham <himavarshajan17@gmail.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| af38e99852 |
fix: Resolve API keys from global variable before .env (#13408)
resolve env variable from global vars or .env |
|||
| 82f3fa10d4 |
docs: memory base feature and component (#13094)
* developer-page * release-notes-and-sidebar * memory-base-component * fix-broken-link * use-absolute-links * peer-review * fix-broken-link * docs: include additional preprocessing examples * docs: memory base typo |
|||
| be7edcbda1 | chore: unconstrained lfx version for bundles (#13415) | |||
| dbe482c800 |
fix(ci): lockstep langflow-nightly and langflow-base-nightly versions (#13413)
* fix(ci): lockstep langflow-nightly and langflow-base-nightly versions
The nightly pipeline computed each package's .devN number independently
(pypi_nightly_tag.py queried each package's own PyPI history and
incremented separately), while langflow-nightly pins an exact
langflow-base-nightly[complete]==X.Y.Z.devN dependency. Because
langflow-nightly publishes on more nights than langflow-base-nightly,
the two counters drift (live: dev54 vs dev48). Each time base lags a
publish while main succeeds, the newest langflow-nightly pins a base
dev that does not exist yet, so 'uv pip install langflow-nightly'
becomes unsatisfiable and silently falls back to a weeks-old version.
Fix: version the two packages in lockstep. pypi_nightly_tag.py now
derives a single shared dev number from max(dev across BOTH packages'
PyPI histories) + 1 (restricted to the root base_version), so main and
base always get the identical tag and main's exact pin always
references a base version built and published in the same run. The tag
is computed in a single invocation ('both' mode) so the release and
base tags cannot drift across separate calls.
Also hardens tag computation: 404 / network / malformed responses for
either package now contribute nothing instead of crashing, a
base-version bump resets the dev counter cleanly, and non-dev/final
releases never advance it.
Adds scripts/ci/test_pypi_nightly_tag.py (unit tests) and a
ci-scripts-test.yml workflow to run scripts/ci tests on PRs.
* fix(ci): fail closed on non-404 PyPI errors in nightly tag computation
_all_dev_numbers() previously returned [] for ANY failure (network error,
non-404 HTTP status, malformed 200), which is unsafe: _shared_nightly_version()
takes max(dev)+1 across both packages, so a transient lookup failure on the
higher-versioned package silently LOWERS the next tag. E.g. if the langflow-nightly
lookup fails while langflow-base-nightly reports dev48, the script would emit
v1.10.0.dev49 even though langflow-nightly already published through dev54 — the
workflow then force-recreates an old git tag and fails publishing an already-existing
PyPI version.
Fail closed: only a true 404 (package has no releases) contributes []; network
errors, 5xx/non-404 statuses, and malformed 200s now raise so the nightly job aborts
before mutating tags. Adds tests for malformed/5xx/network failures and a direct
regression test for the higher-package-lookup-failure scenario.
* Update scripts/ci/test_pypi_nightly_tag.py
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Update test_pypi_nightly_tag.py
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
|
|||
| 58a75ffb0d |
feat(ci): reduce macOS Intel CI matrix and add macOS support documentation (#13328)
feat(ci): reduce macOS Intel CI matrix and add macOS support docs - Remove Python 3.10 from macOS Intel stable CI matrix (keep 3.12 only) - Add comprehensive macOS support documentation - Document Python 3.14 support status (limited on Intel, no PyTorch) - Reduces CI costs by ~$5-7 per run (~$1,800-2,500/year) Implements LE-781 recommendations R2 and R3 from LE-265 investigation. Related: LE-265, PR #12477 |
|||
| 663fa5ed0a |
docs: fixes for consulting advantage (#13300)
* docs: lock mcp server management * docs: restrict custom components to superusers * docs: embedded mode to hide UI elements * docs: add custom component admin restriction |
|||
| d4013e30b8 |
feat(i18n): translate missing frontend strings across Memories, Knowledge Base, toasts, and notifications (#13279)
* feat(i18n): translate missing frontend strings for flow list and DB Providers page - Wrap "Edited X ago" timestamp in flow list with t() using new mainPage.editedAgo and mainPage.timeElapsed.* keys (plural forms) - Add settings.nav.dbProviders and settings.dbProviders.* keys covering page title, description, badges, button labels, and all toast messages - Wire useTranslation into DBProvidersPage, ProviderListItem, ProviderConfigurationPanel, TextFieldRow, BooleanFieldRow, and dbProviderInputComponent - Download updated translations for fr, ja, es, de, pt, zh-Hans Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat(i18n): translate DB provider descriptions and config field labels Add translation keys for all provider descriptions (Chroma Local, Chroma Cloud, OpenSearch, Astra DB, MongoDB Atlas, Postgres pgvector) and all configField labels and helperTexts (API Key, Tenant, Database, Region, Cluster URL, Username, Password, index/vector/text fields, TLS toggles). Use dynamic key lookup with defaultValue fallback so new providers degrade gracefully. Download updated translations for all six locales. * [autofix.ci] apply automated fixes * feat(i18n): translate missing strings in Memories, Knowledge Base, toasts, and notifications - Translate untranslated strings in Knowledge Base upload modal (DB Provider label/description, Metadata section) - Translate all Memories feature strings (sidebar, create modal, detail header, chunk table, empty states) - Wire all hardcoded toast/notification strings through t() across 14 files (flow store, model provider, deployments, update components, shortcuts, file manager, dict/JSON editors, utils) - Delete orphaned alerts_constants.tsx (all imports already removed) - Add ~100 new keys to en.json across memory, errors, deployments, shortcuts, updateComponents, and files namespaces - Upload to GP and download all 6 translated locale files (fr, ja, es, de, pt, zh-Hans) * fix(i18n): translate Memories tooltip in left panel nav * fix(ui): left-align card description text on empty page * feat(i18n): translate hardcoded strings across UI components and update locale files Wraps ~100 hardcoded strings in t() calls across 45 source files covering voice assistant, deployments, flow build, playground, assistant panel, knowledge base ingestion, inspection panel, IO modal, and more. Adds corresponding keys to en.json and syncs all locale files (fr, de, es, pt, ja, zh-Hans) via the GP pipeline. Also fixes a React 19 RefObject<T | null> type mismatch in visual-variants.ts. * [autofix.ci] apply automated fixes * fix(i18n): translate shortcut success/error messages with proper name i18n Added shortcuts.successChanged and shortcuts.successReset keys so success toasts display the translated shortcut name via shortcuts.name.* lookup. Updated EditShortcutButton to use existing translated error keys and the new success keys with toCamelCase name resolution. * fix(i18n): translate "or visit" and "+N more" in file upload modal * fix(i18n): translate NoteNode context menu and fix missing vector store RAG note translations - Add t() calls to NoteNode select-items.tsx for Duplicate/Copy/Docs/Delete menu items - Fix docsUnavailable notice string in NoteToolbarComponent - Download missing fr/ja translations for template_notes.vector_store_rag keys from GP * fix(i18n): translate Delete label in edge context menu * fix(i18n): translate Version History Export/Delete menu and preview overlay strings - VersionListItem: replace hardcoded Export/Delete with t("flow.menu.*") - VersionPreviewOverlay: replace hardcoded Current Flow, Previewing, (Read-Only), Loading preview... with t("version.*") calls - Add 4 new keys to en.json; upload to GP and download all locale translations * fix(i18n): translate hardcoded strings in Update Components modal Replace Component/Update Type headers, Breaking label, and modal title with t() calls; add 5 new keys to en.json and sync all locale translations * fix(i18n): translate assistant panel hardcoded strings - model-selector: replace "Loading..." and "Select model" with t() calls - assistant-panel.constants: convert getAssistantPlaceholder() to use i18n.t() with 5 keyed placeholder variants - messages.ts: replace 48 hardcoded progress/thinking strings with i18n key arrays (8 thinking + 5 groups × 8 progress); VALIDATION_FAILED/RETRYING arrays were dead code and removed - Add 55 new keys to en.json; upload to GP and download all locale translations * [autofix.ci] apply automated fixes * fix(i18n): update sidebarSegmentedNav test to expect i18n key for memories The memories nav item was updated to use "memory.sidebarTitle" as its label/tooltip i18n key, but the test still expected the old hardcoded "Memories" string. * fix(i18n): replace deleted alerts_constants import with t() calls in PageComponent The release-1.10.0 merge re-introduced an import from alerts_constants which was deleted in Phase 1 of the i18n migration. This crashed the Vite dev server, causing all Playwright tests to fail on startup. Also fixes Biome import order in use-session-history.ts from the merge conflict resolution. * fix(i18n): restore ASSISTANT_PLACEHOLDERS export and translate formatDate fallback - Re-export ASSISTANT_PLACEHOLDERS as translated strings computed from keys so getAssistantPlaceholder() returns from the array (restores test contract) - formatDate() now returns i18n.t("memory.never") instead of "" for the empty-date fallback --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| fefa4262ae | docs: bump python version reqs to 3.14 and add release note (#13289) | |||
| 31b7a4cd05 |
fix: improve trace search functionality (#13383)
* improve trace search functionality * [autofix.ci] apply automated fixes --------- Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 4a700dc5d1 |
fix(playground): expand session checkbox click target to full row height (#13349)
* fix(playground): expand session checkbox click target to full row height The selectable-row checkbox wrapper was ``w-4 h-4`` (16x16 px) but the row is ``h-8`` (32 px). The 8 px band above and the 8 px band below the visible icon were dead zones that bubbled to the row's ``toggleVisibility`` and navigated to the session instead of toggling selection — exactly the accidental-navigation UX the bug ticket describes. Grow the wrapper to ``w-4 h-8`` so the click target captures the full row height. Width stays narrow so the text alignment is unchanged; the icon itself stays ``h-4 w-4``, centered via the existing ``flex items-center justify-center``. Visual position is identical. Adds ``__tests__/session-selector-checkbox-click-target.test.tsx`` (3 cases): wrapper className guard (h-8 + w-4, not h-4), click on the wrapper outside the icon triggers selection without bubbling to toggleVisibility, and click on the inner icon still toggles selection. * test(playground): drop checkbox-click-target test file (not needed per review) * [autofix.ci] apply automated fixes * test: align session-selector checkbox assertions with full-height click target --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 2f682eb020 |
docs: agent improvements (#13269)
* docs: add structured output for agents * docs: add structured output note * docs: clarify both agent outputs and add release notes * docs: when langflow sends events to the playground and chat history |
|||
| 4e6981368c |
fix(traces): full-height trace panel, and status badge position (#13385)
* fix(traces): full-height trace panel, and status badge position * [autofix.ci] apply automated fixes --------- Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 3f62caff8f |
test(e2e): Replace non-terminal waits to fix flaky Windows specs (#13407)
* fix assistant test on windows * improve slider component test |
|||
| 39bb3a12ca |
ci: isolate bundle installs from the core release gate; lazy-import ibm-db (#13402)
* ci: isolate bundle installs from the core release gate; lazy-import ibm-db
Two follow-ups to wiring lfx-ibm (and future native-dep bundles) into the
nightly/release pipeline.
1. cross-platform-test.yml: split the monolithic "Install packages from
wheel" step (in both the stable and experimental jobs) into three:
- core install (SDK/LFX + langflow-base) -- release gate
- per-bundle bundle install -- NON-BLOCKING (continue-on-error), reports
per-bundle pass/fail to the GitHub step summary
- langflow main install -- release gate
A bundle whose dependency has no wheel on a tested platform is now reported
as "failed (non-blocking)" instead of failing the whole nightly/release
publish. Local bundle wheels are still installed before main, so langflow
resolves its bundle deps from the freshly-built wheels rather than PyPI.
NOTE: a bundle that langflow hard-depends on is still pulled (and thus
gated) by the main install; to make a bundle optional on a platform, also
add a PEP 508 marker to its dependency line in langflow's pyproject.toml.
2. lfx-ibm: import ibm_db_dbi lazily inside DB2VS.__init__ (db2vs.py) instead
of at module top level, mirroring db2_vector.build_vector_store. ibm-db
ships no linux/aarch64 wheel, so the bundle now imports on that arch (only
the DB2 vector store is inert there; the watsonx components keep working).
Guard the driver-dependent test modules (test_db2vs, test_db2_vector) with
a module-level skip when ibm_db_dbi is unavailable, matching the existing
watsonx test pattern so they no longer error at collection on linux/aarch64.
Verified locally: 59 DB2 tests pass with ibm-db present; with ibm-db absent
the bundle imports cleanly, DB2 use raises a clean ImportError, and the
guarded test modules skip (9 passed, 2 skipped, 0 errors). actionlint adds no
new shellcheck findings vs HEAD; ruff check/format clean.
* fix: Remove long comments for bundle deps (#13403)
* [autofix.ci] apply automated fixes
* ci: revert bundle-install restructure to blocking; add ibm-db import regression test
Addresses two review findings on the lfx-ibm bundle changes.
1. Revert the cross-platform-test.yml bundle-install restructure. The
non-blocking per-bundle step could let the main install satisfy a hard-dep
bundle from PyPI (the index was not disabled), masking a broken local build,
and it never actually protected hard-dep bundles -- main re-gates them
anyway. Restore the original blocking, install-by-path step (local bundle
wheels install before main, so the gate is reliable and PyPI cannot
substitute). Document the real isolation lever for a genuinely
platform-optional bundle -- a PEP 508 marker on its dependency line in the
root pyproject -- in src/bundles/PORTING.md.
2. The module-level skip hid the importability regression the lazy import was
meant to guard. Add test_optional_dependency.py: it simulates ibm-db's
absence and asserts db2vs + the bundle package import and that DB2 use
raises a clean ImportError -- it runs on every platform, including the
x86_64 CI runners. Replace the module-level skips in test_db2vs.py /
test_db2_vector.py with class-level skipif on the DB2-driver test classes
only, so the helper tests and the module-level imports still run (and assert
importability) where ibm-db is absent.
Verified: with ibm-db present, 112 bundle tests pass. With ibm-db uninstalled
(the real linux/aarch64 case, find_spec -> None), 67 pass / 45 skip / 0 errors
-- the regression tests and helper tests run, only the driver-dependent classes
skip. actionlint reports no new findings; ruff check/format clean.
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
|
|||
| 60e2ea874d |
feat: add MCP timeout configuration support (#12999)
* feat: add per-component MCP tool execution timeout override - Add mcp_tool_execution_timeout global setting (180s default) - Add FloatInput in MCP component for per-component timeout override - Update MCPStdioClient and MCPStreamableHttpClient to accept timeout parameter - Implement timeout fallback logic: component → global → 180s default - Add comprehensive unit tests for timeout configuration This complements the mcp_server_timeout setting (PR #12996) by allowing per-component customization of tool execution timeouts, supporting long-running MCP operations (>30s). Related to customer issue TS021996258 (Verizon). * fix: preserve client timeout and validate negative values - Only update client timeout when tool_execution_timeout is not None - Properly set timeout on mcp_sse_client when used as alias - Add validation to reject negative timeout values in MCP component - Add comprehensive tests for timeout preservation, SSE client, and validation Fixes issues where: 1. Passing None would overwrite existing client timeouts 2. mcp_sse_client wouldn't receive timeout updates 3. Negative timeout values were accepted without validation * feat: add configurable MCP tool execution timeout with backward compatibility - Add mcp_tool_execution_timeout setting (default: 180s) for long-running MCP tools - Implement 3-tier timeout fallback: component > global setting > max(mcp_server_timeout, 180) - Include timeout in cache keys to prevent stale cached tools from bypassing per-component timeouts - Add comprehensive test suite (33 tests) covering timeout configuration, backward compatibility, and cache behavior - Preserve existing deployments: when mcp_tool_execution_timeout is unset, falls back to max(mcp_server_timeout, 180) Fixes: TS021996258 (Verizon - long-running MCP tool timeouts) Co-authored-by: autofix.ci <autofix@autofix.ci> * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] * [autofix.ci] apply automated fixes (attempt 2/3) * fix: align mcp timeout coverage and component validation * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] * fix(mcp): resolve timeout execution bugs and add validation testing * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] --------- Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local> Co-authored-by: autofix.ci <autofix@autofix.ci> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| f8ada15e2a |
feat(components): Add IBM DB2 Vector Store component (#13237)
* feat(ibm): add DB2 Vector Store component Add comprehensive IBM DB2 Vector Store integration for Langflow. Components Added: - DB2VectorStoreComponent: Main vector store component - DB2VS: LangChain-compatible vector store implementation - DB2 security validators: Input validation and sanitization Features: - Vector similarity search (Similarity, MMR, Similarity Score Threshold) - Secure connection handling with input validation - Metadata filtering for complex data types - Duplicate detection support - Batch document ingestion Test Coverage: - 41 unit tests (38 passing, 3 skipped) - Component integration tests - Security validation tests - DB2VS class tests Documentation: - Comprehensive developer guidelines * refactor(db2): simplify component to match Chroma patterns - Remove complex data ingestion (CSV, DataFrame, dict, Message handling) - Add _add_documents_to_vector_store() method matching Chroma - Add similarity_score_threshold search type - Simplify data ingestion from 220 to 45 lines (80% reduction) - Add 5 new tests (similarity_search, mmr_search, search_with_different_types, duplicate_handling, metadata_filtering) - All 41 tests passing (38 passed, 3 skipped) BREAKING CHANGE: Component now only accepts Data objects for ingestion. * ci: fix CI failures - update component index and starter projects - Regenerate component_index.json with DB2 component - Update all starter projects with new component registry - Fix ruff formatting issues * ci: trigger CI re-run to fix merge issue * ci: add merge conflict resolution for component_index.json in autofix workflow Handle merge conflicts in the Update Component Index job by: - Automatically resolving component_index.json conflicts using --theirs strategy - Failing if non-generated files have conflicts (requires manual resolution) - Completing the merge after resolving generated file conflicts This prevents the workflow from failing when component_index.json has conflicts during PR updates, as this file is auto-generated and can be safely regenerated. * fix: Remove DB2SQLComponent reference from IBM components - Removed DB2SQLComponent from __init__.py as the db2_sql.py module doesn't exist - This fixes the test_all_modules_importable test failure - Fixes CI failure in Unit Tests - Python 3.14 - Group 5 * revert: Remove unrelated starter project JSON changes * revert: Remove unrelated CI workflow and formatting changes * docs: add DB2 Vector Store .mdx documentation following Chroma DB structure * fix: address CodeRabbit review comments - add __init__.py docstring and implement score threshold filtering - Added docstring to src/backend/tests/unit/components/__init__.py to fix Ruff INP001 error - Added FloatInput score_threshold parameter (default 0.5) to DB2 Vector Store component - Implemented threshold filtering in similarity_score_threshold search mode - Filters results to only include documents with relevance scores >= threshold * chore: remove auto-generated and unnecessary files from PR - Remove uv.lock (dependency lock file - auto-generated) - Remove src/frontend/package-lock.json (frontend lock file - auto-generated) - Remove src/lfx/src/lfx/_assets/component_index.json (auto-generated by CI) - Remove .secrets.baseline (security baseline - auto-generated) - Remove starter_projects JSON (auto-generated example) - Remove tweaks_builder.py (unrelated test helper) Per DEVELOPMENT.md guidelines, these files should not be committed by contributors. * chore: restore auto-generated files to keep PR focused on DB2 component * fix(ci): update auto-generated files and fix docs build - Update component index with new IBM DB2 components (363 components, 97 modules) - Update frontend package-lock.json - Fix docs build by removing reference to missing image in bundles-db2.mdx Fixes CI failures: - Update Component Index - Update Starter Projects - Test Docs Build * feat(db2): add SSL/TLS support to DB2 Vector Store component - Add SSL/TLS encryption support for DB2 database connections - Add SSL certificate validation and download functionality - Support local certificate files (.crt, .pem, .cer) and URLs - Add optional certificate password support for encrypted keystores - Implement automatic cleanup of temporary downloaded certificates - Add comprehensive error handling and logging for SSL connections - Update component_index.json with new SSL configuration inputs - Update package-lock.json dependencies Security improvements: - Validate certificate paths and file permissions - Support system default CA certificates (recommended for IBM Cloud DB2) - Redact sensitive information in error messages - Clean up temporary files on connection failure This enhancement enables secure encrypted connections to DB2 databases, which is recommended for production environments. * [autofix.ci] apply automated fixes * refactor(db2): minimize metadata storage in DB2 vector store - Clear metadata before storage to reduce unnecessary data (file_path, filename, etc.) - Return only text content during retrieval for cleaner results - Optimize list comprehension for better performance (PERF401, RET504) * test: remove skipped tests from DB2 vector store test suite - Removed version compatibility tests for versions where component didn't exist - Changed file_names_mapping to return empty list for new component - Overrode base class version tests to prevent skips - Fixed linting issues (hardcoded passwords, nested with statements) - All 40 tests now pass with 0 skipped tests * fix(tests): update DB2 vector store test description format Fixes test_component_metadata assertion to match the actual component description format. The test was failing due to line wrapping differences in the multi-line description string. Fixes CI failure in PR #13163 * [autofix.ci] apply automated fixes * chore: trigger CI re-run to resolve flaky test failures * fix(tests): mark OpenAI-dependent test as api_key_required to prevent CI failures * restructure as new bundle package * [autofix.ci] apply automated fixes * fix(ibm): improve DB2 Vector Store component reliability and validation * fix: implement SSL/TLS toggle functionality for DB2 Vector Store - Add update_build_config method to dynamically show/hide SSL certificate fields - SSL certificate path and password fields now only visible when use_ssl is enabled - Improves UX by hiding irrelevant fields when SSL is disabled - Update component_index.json with new component configuration - All 38 existing tests pass --------- Co-authored-by: Dhruv Chaturvedi <dhruv_insights@mac.lkw-in.ibm.com> Co-authored-by: Dhruv Chaturvedi <dhruv_insights@Dhruvs-MacBook-Pro.local> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: priyanshu-krishnan1 <priyanshu.krishnan1@ibm.com> Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| f400102088 |
ci: disable pip/venv DB migration test while langflow-nightly is pip-uninstallable
The PyPI langflow-nightly is currently pip-uninstallable: its core bundle deps (lfx-arxiv, lfx-duckduckgo) pin stable lfx>=0.5.0,<0.6.0, but stable lfx tops out at 0.4.4 (the 0.5.0 line ships only as lfx-nightly, a separate package name that cannot satisfy an lfx pin). So the pip/venv migration job fails at the install step. The Docker Compose migration job is unaffected (it runs the prebuilt nightly image) and stays enabled. Re-enable once either a stable lfx 0.5.x is published to PyPI or nightly bundle variants pinning lfx-nightly are published and langflow-nightly depends on them. |
|||
| fb4dfd49fd |
ci: sync workflow fixes from main into release-1.10.0 (fix broken nightly) (#13400)
ci: sync workflow fixes from main into release-1.10.0 Brings the latest CI/workflow fixes from main into release-1.10.0 so the nightly build is unblocked and the two branches share the same hardening. Most important fix: release_nightly.yml's "Verify Nightly Name and Version" step now uses the anchored grep '^langflow(-nightly)?[[:space:]]' instead of 'grep langflow | grep -v langflow-base | grep -v langflow-sdk'. The old filter started matching two packages once the langflow-stepflow workspace package was added, so the name became multi-line and the check failed (this is what broke the nightly build). Also carries main's fixes for cross-platform install (--prerelease=if-necessary-or-explicit), docker build workflows, db-migration-validation, and the backend test timeout bump (30 -> 40). 3-way merged from the common ancestor, so release-only changes are preserved; no release-only feature workflows are modified. |
|||
| b70acb9f9a |
test: cover cross-user cache pollution on deprecated vertices endpoint (supplied-data path) (#13398)
The deprecated POST /api/v1/build/{flow_id}/vertices endpoint was reported to let an
authenticated non-owner write attacker-controlled graph data into another flow's
server-side cache (cross-user graph cache pollution). On release-1.10.0 this is already
remediated: retrieve_vertices_order and build_vertex gained a current_user parameter, an
owner-or-public flow lookup, and ensure_flow_permission(EXECUTE) that run before the
build-and-cache branch (added in #13153). The modern /build/{flow_id}/flow consumer path
is owner-gated as well.
Existing tests cover the cross-user no-data path. This adds explicit coverage for the
reported supplied-data path: a second user POSTing a schema-valid FlowDataRequest for
another user's private flow receives 404 because the ownership guard fires before
build_and_cache_graph_from_data / set_cache(str(flow_id), ...), so no graph is cached
under the victim flow id.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
|||
| cb7b838d45 |
feat: Add DB migration validation workflow for nightly builds (#13249)
* feat: Add DB migration validation workflow for nightly builds (LE-1259) - Implements automated DB migration testing for nightly builds - Tests two scenarios: pip/venv and Docker Compose migrations - Validates migration from stable to nightly versions - Verifies data persistence (witness flows) across migrations - Integrated into nightly_build.yml workflow - Includes Slack notifications for migration test results This addresses the critical blocker identified by QA team for ensuring safe database migrations in production deployments. * docs: Add DB migration validation documentation - Comprehensive guide for LE-1259 implementation - Detailed test scenarios and execution details - Environment configuration and success criteria - Monitoring and troubleshooting guidelines - Placed in docs/docs/Deployment/ for easy access * fix: address PR review comments for DB migration validation - Use actual nightly tag from create-nightly-tag output instead of hardcoded :latest - Wire POSTGRES_VERSION env var into postgres service image tag - Remove unnecessary checkout steps from both migration jobs - Update step name from 'Create witness flow and credentials' to 'Create witness flow' - Add -f flag to curl commands for fail-fast behavior - Add flow creation verification with error handling - Fix version extraction logic to properly test nightly build instead of PyPI latest - Remove deprecated docker-compose version field - Remove duplicate Slack notification job (consolidated in nightly_build.yml) Addresses all 9 issues identified by @ogabrielluiz in PR review * docs: remove implementation summary from user-facing docs Per @ogabrielluiz review feedback, this file reads as an implementation summary (Jira ticket, branch name, 'Next Steps', 'Files Changed: 2') rather than user-facing documentation. The Deployment section is for end-user docs, and this content is better suited for the PR description. Also not added to sidebars.js, so would be an orphan page. * fix(workflows): address 6 issues from Gabriel's second review of DB migration validation Fixes all remaining issues identified in PR #13249 review: 1. Remove schedule trigger - only works on default branch, would cause duplicate runs 2. Fix postgres service image - hardcode to postgres:16 (env context not available in services) 3. Add curl fail-fast flags - use -fsSL for immediate failure on errors 4. Add flow ID verification - check witness data creation succeeded before proceeding 5. Remove orphaned Slack JSON - cleanup leftover from removed notify-results job 6. Fix version extraction - strip 'v' prefix for pip install (${VERSION#v}) 7. Fix Docker image reference in nightly_build.yml - pass full image path with tag 8. Fix success notification - check migration validation didn't fail All changes validated locally: - YAML syntax validation passed - Docker Compose config validated - Tag manipulation logic tested (v prefix handling) - Curl command structure verified - Test credentials marked with pragma allowlist secret comments Related: LE-1259, PR #13249 Depends on: PR #13212 (Docker volume permissions fix) * fix(ci): address all PR review blockers for DB migration validation workflow - Add auto_login token auth to all 4 API call sites (Create/Verify witness in both jobs) - Add credential witness (POST /api/v1/variables/ with type: Credential) to prove encrypted-column migrations ran correctly - Verify witness variable persists after upgrade in both jobs - Strip 'v' prefix from nightly Docker tag before docker-compose sed replacement - Fix langflow.__version__ crash - use importlib.metadata instead - Remove deprecated 'version: 3.8' from inline docker-compose YAML - Remove bogus LANGFLOW_SUPERUSER/LANGFLOW_SUPERUSER_PASSWORD env vars - Remove LANGFLOW_SKIP_AUTH_AUTO_LOGIN (only works on nightly, not stable images) - Fix shellcheck SC2016/SC2102 issues flagged by actionlint - Mark test credential values with pragma allowlist secret (false positives) - Update .secrets.baseline with known false positives in new workflow file * fix(ci): remove duplicate db-migration-validation job after merge * fix(ci): include default_fields in witness variable payloads * fix(ci): handle compressed API responses in witness verification * fix(ci): uninstall stable langflow before installing nightly in pip-venv job langflow and langflow-nightly both own the same site-packages/langflow/ namespace via a shared langflow-base dependency. Without an explicit uninstall, the stable copy wins at runtime and python -m langflow still boots the old version - meaning no nightly migration is exercised and the test produces a false positive. Explicitly uninstall langflow + langflow-base before the nightly install so the namespace is fully handed over to the nightly package. --------- Co-authored-by: Eric Hare <ericrhare@gmail.com> |
