mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-24 07:34:10 +08:00
v1.11.0.dev2
655 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
| 75e01157fe |
fix(ci): allow pre-releases when pinning the nightly in migration validation (1.11.0) (#13600)
fix(ci): allow pre-releases when pinning the nightly in migration validation Migration Test: pip/venv (stable -> nightly) failed deterministically on nightly run 27260425158 (twice, including a rerun): hint: langflow-base was requested with a pre-release marker (e.g., langflow-base==1.11.0.dev1), but pre-releases weren't enabled (try: --prerelease=allow) This is the first nightly publishing as a canonical .devN pre-release of the langflow distribution (nightly -> stable bundle cutover). The 'latest' branch of the upgrade step already passes --prerelease=allow, but the pinned-version branches do not. uv implicitly allows the pre-release for the directly requested ==X.Y.Z.devN pin, yet langflow's metadata pins langflow-base==X.Y.Z.devN transitively, and uv rejects transitive pre-releases unless they are enabled - so the install fails after the stable uninstall, sinking the migration test. Add --prerelease=allow to both pinned-version install lines. |
|||
| 086e38898d |
fix(ci): anchor langflow-base version extraction in nightly docker build (1.11.0) (#13592)
fix(ci): anchor langflow-base version extraction in nightly docker build
The first nightly on the 1.11 workspace (tag v1.11.0.dev0, run
27253229568) failed in Build Nightly Base Package within seconds:
'Base version format is incorrect'. The extraction (uv tree, grep
langflow-base unanchored, awk field 3, first line) broke because uv
tree now prints the langflow-base workspace-root line
('langflow-base v1.11.0.dev0', two fields) before any dependency line
('langflow-base[complete] v1.11.0.dev0' under the langflow root, three
fields), so the first match yields an empty field 3 and the format
check exits 1. uv tree's stderr is discarded, which made the real
cause invisible in CI.
Anchor to the root line and take field 2 instead - the exact pattern
the langflow (main package) extraction in this same file already uses,
which is why the main-package builds passed on the same tag. Verified
both extractions print 1.11.0.dev0 against a local checkout of
v1.11.0.dev0.
|
|||
| 17447920f9 |
fix(ci): rebalance backend test splits with measured durations + raise unit-test step timeout (#13583)
Unit Tests - Python 3.12 - Group 3 has been failing at 98-99% on the nightly: the job hits the nick-fields/retry 40-minute per-attempt timeout and pytest is SIGTERM'd mid-test, so it looks like one flaky last test when it is actually a deterministic timeout (and the internal retry plus run-level retries can never succeed). Root cause is twofold: 1. .test_durations was last regenerated ~May 2025 and covered only 2,219 of ~9,500 current unit tests, so pytest-split weighted 77% of the suite at the 0.73s average. The expensive client-fixture tests (test_webhook.py, test_login.py - each pays a full create_app + lifespan boot per test, 60-120s late in a CI run) clustered into group 3's tail, making it ~8-10 minutes slower than its siblings (33:15 on 3.13, >40min on 3.12 which is additionally slowed by astrapy disabling SSL connection reuse on Python 3.12.0-11). The weekly store_pytest_durations workflow that should refresh the file has been dying at the 6-hour GitHub job limit every week (serial full-suite run no longer fits), so the file silently froze. This regenerates the file from real per-test wall-clock measured in the passing Python 3.13 nightly jobs (run 27246228762 attempt 1, all 5 groups, parsed from the -vv xdist logs: per-worker start-to-start deltas). 9,508 tests now have measured durations; old entries are kept where no new measurement exists. Simulated least_duration split goes from one outlier group to 5 even groups (~24.6 min each) with the >50s tests spread 1-2 per group instead of 7 in one. 2. timeout_minutes 40 -> 50 gives headroom for matrix-cell variance (3.12 runs ~20% slower than 3.13) so a slightly slow cell degrades gracefully instead of burning 2x40min and failing the whole run. Follow-ups (not in this PR): fix store_pytest_durations to run with xdist or split groups so it fits the 6h limit; investigate the in-worker degradation that makes client-fixture boots cost 8-12s early in a run but 60-120s after ~30 minutes. |
|||
| 13a937c5b7 |
feat(ci): nightly → stable bundles via canonical pre-releases + decision record [gated] (#13528)
* docs: record nightly→stable bundle cutover plan (gated on lfx 1.10.0) Add src/bundles/NIGHTLY.md documenting why langflow-nightly currently renames the bundles (lfx and lfx-nightly ship the same lfx/ import, so a stable bundle would co-install both and collide) and the deferred cutover (Approach A: canonical pre-releases; B: lfx as a bundle extra), gated on stable lfx 1.10.0 being published to PyPI. Also expand two docstrings in scripts/ci/update_lfx_version.py to state the deeper install-conflict reason, not just the resolve failure. No behavior change. * feat(ci): nightly Approach A — canonical pre-releases, drop nightly bundles [DRAFT/gated] (#13529) feat(ci): nightly Approach A — canonical pre-releases, drop nightly bundles DRAFT reference implementation of the nightly→stable-bundle cutover documented in src/bundles/NIGHTLY.md. Publishes the nightly under CANONICAL package names as .devN pre-releases instead of separate *-nightly distributions, so the stable lfx-* bundles resolve against a single canonical lfx (no dual-lfx install collision) and no nightly bundle packages are produced. - tag scripts (pypi/lfx/sdk_nightly_tag.py): count .devN against the canonical PyPI histories instead of the *-nightly projects - update scripts: stop renaming to *-nightly; set .devN versions; re-pin inter-package deps to exact canonical dev versions; delete the bundle rename/repin (update_lfx_dep_in_bundles, rename_bundles_for_nightly) - release_nightly.yml: publish canonical pre-releases; remove bundle build, dist-nightly-bundles artifact, publish-nightly-bundles job + its gate; verify canonical names; main wheel glob dist/langflow-*.whl - nightly_build.yml: drop the bundle git-add in the tag commit - NIGHTLY.md: Approach A marked implemented + activation gate + A1/A2 follow-ups Held as DRAFT: do not activate until stable lfx 1.10.0 is published AND the nightly base is the next minor (release-1.11.0). A 1.10.0.devN core sorts below 1.10.0 and would fail the bundles' >=1.10.0 floor. Stacked on #13528. (.secrets.baseline: incidental line-number shifts for the two workflows + prune of pre-existing stale Pokédex Agent.json entries.) * docs(ci): drop internal 'Approach A' label from nightly cutover comments Comment- and docstring-only change across scripts/ci/* and the two nightly workflows; no logic change. The two workflow edits stay single-line so .secrets.baseline line numbers are unaffected. src/bundles/NIGHTLY.md keeps its A/B decision-record framing intentionally. * feat(ci): make nightly consumers work with canonical pre-releases Follow-ups from the nightly cutover that are part of its blast radius (the nightly now publishes canonical `.devN` pre-releases, not `*-nightly` distributions): - version.py: derive the "Nightly" label from the `.dev` version marker, since the canonical `langflow`/`langflow-base` distribution matches first in the lookup. Keeps the startup banner and telemetry `package` field identifying nightlies. Adds a canonical-dev test; updates the base-dev assertion. - ci.yml check-nightly-status: query the canonical `langflow` project and pick the latest `.devN` release date instead of `langflow-nightly`'s `.info.version`. - db-migration-validation.yml: install the nightly as `langflow[postgresql]==<dev>` (pre-release) instead of `langflow-nightly[...]`; verify via version("langflow"). - src/lfx/README.md: nightly install is `uv pip install --pre lfx`. - NIGHTLY.md: rewrite the follow-ups section (these are addressed; Docker image, A2 meta-package, and website docs remain deferred by design). The `langflowai/langflow-nightly` Docker image name is intentionally unchanged. * fix(ci): correct nightly verify uv tree parsing + stale base-dep regex Addresses review of #13528: - release_nightly.yml LFX verify: `uv tree | grep lfx | head -n1` matches the bundle `lfx-ibm` first → 'Name lfx-ibm does not match lfx'. Root the tree with `uv tree --package lfx` so the first line is the lfx package itself. - release_nightly.yml base verify: under canonical naming `langflow-base` prints as a top-level `langflow-base v<ver>` line, so the old $2/$3 field parse read name="v0.10.0" and version="". Use `uv tree --package langflow-base` and $1/$2. - update_lf_base_dependency.py update_base_dep: regex only accepted ~=/==, so its CLI entry point couldn't match the current root dep `langflow-base[complete]>=0.10.0`. Add >= (parity with update_uv_dependency.py). The active nightly path uses update_uv_dependency.py and was unaffected. * docs(nightly): point NIGHTLY.md status at the activation gate, not draft state Per review of #13528: this file ships inside #13528 (#13529 was folded in), so the 'stacked on prep #13528' + 'held as a draft' framing is stale and misleading. Reword the status block to state the real guard is the activation gate (stable lfx 1.10.0 published AND next-minor base), not merge/draft state. Also reword the follow-ups heading 'decide before un-drafting' -> 'decide before activating'. |
|||
| 2524604a19 |
fix(ci): make Biome lint non-blocking for release workflow calls (correct implementation using allow-failure input)
- Revert invalid continue-on-error syntax on reusable workflow uses: job - Add allow-failure input to ci.yml lint-frontend call - Define allow-failure input parameter in lint-js.yml workflow_call - Implement conditional exit-code swallow in lint-js.yml when allow-failure=true - When release=true, Biome errors are non-blocking for release pipeline - When release=false/unset, Biome failures block PR merge (existing ci_success gate) |
|||
| 801edf3bab |
Revert "fix(ci): make Biome lint non-blocking for release workflow calls (#13547)"
This reverts commit
|
|||
| a1adb1aa6f |
fix(ci): make Biome lint non-blocking for release workflow calls (#13547)
When ci.yml is called from release.yml (inputs.release == true), a
Biome failure was blocking all downstream publish and docker jobs via
needs.ci.result == 'success'. Biome was already excluded from the
ci_success gate for PR merges, but the reusable CI workflow itself
could still fail when the lint job errored.
Add continue-on-error: ${{ inputs.release == true }} to lint-frontend
so Biome failures are informational-only during release runs, while
remaining visible (and blocking ci_success) on regular PRs.
|
|||
| 6610091697 |
fix(bundles): republish lfx-* at 0.1.1 with corrected pin + relax lfx floor for RC builds (#13542)
* fix(bundles): bump lfx-* bundles to 0.1.1 to republish with corrected lfx pin The published 0.1.0 artifacts on PyPI carry stale lfx pins from before the lfx 0.5.0->1.10.0 version realignment: - lfx-arxiv, lfx-duckduckgo: lfx>=0.5.0,<0.6.0 (hard-broken; the <0.6.0 cap can never resolve lfx 1.10.0) - lfx-docling, lfx-ibm: lfx>=0.5.0 (uncapped floor/cap mismatch) The source pin was already corrected to lfx>=1.10.0,<2.0.0 in #13516, but the bundles were never re-published. PyPI versions are immutable, so shipping the fix requires a version bump. Bump all four to 0.1.1 so the Release Bundles workflow cuts fresh wheels carrying the correct pin. Root pyproject keeps its >=0.1.0 floors (satisfied by 0.1.1); only the bundle dist versions and their uv.lock stamps change. * fix(release): relax bundle lfx floor for pre-release builds + idempotent bundle publish The RC pre-release run builds lfx as 1.10.0rc0, but bundles floor lfx at >=1.10.0. Under PEP 440 a pre-release sorts below the final, so 1.10.0rc0 fails >=1.10.0 and the cross-platform install test cannot resolve the bundle wheels against the RC lfx wheel. build-base/build-main/build-lfx already rewrite their inter-package deps to the pre-release version when pre_release=true; build-bundles was the only release artifact missing that step. Add it: when pre_release=true, rewrite each bundle's lfx floor to the exact pre-release version, keeping the wide <2.0.0 BUNDLE_API cap. Stable source stays at >=1.10.0 -- only RC wheels are relaxed, at build time, so no source churn or re-tag. Also make publish-bundles tolerate 'already exists' duplicate wheels on rerun, matching release_bundles.yml. |
|||
| 0d9f9112ef |
perf(telemetry): batched off-pool writer for transactions + vertex_builds (#13126)
* perf(telemetry): batched off-pool writer for transactions + vertex_builds
Adds TelemetryWriterService that buffers transaction and vertex_build rows
in memory and drains them in batched INSERTs via a dedicated AsyncEngine
(pool_size=1 for SQLite, 2 for Postgres, max_overflow=0). Retention is
amortized in a 60s sweeper instead of running on every insert.
Producers (log_transaction, log_vertex_build) enqueue instead of opening
a DB session, so telemetry traffic no longer competes with the
request-handling pool. Falls back to the legacy direct-write path via
LANGFLOW_TELEMETRY_WRITER_ENABLED=false.
Durability: in-flight rows spill to a diskcache.Deque per PID on shutdown
and are restored on next startup; orphan PID directories left by crashed
workers are adopted.
* perf(telemetry): tighten error handling and add coverage
Review feedback from pr-review-toolkit + silent-failure-hunter:
- Retention sweep snapshots the dirty-flow sets before commit and only
clears them after it lands; a crashed sweep no longer drops the flows on
the floor, so per-flow caps cannot drift unboundedly.
- Producer fall-through is no longer silent. transaction_service and
log_vertex_build each log a one-shot WARNING when telemetry_writer_enabled
is True but the writer is not running.
- Lifespan startup failure now logs ERROR instead of WARNING — if the user
opted into the writer and it didn't come up, that's an error.
- Shutdown drain timeout no longer suppressed silently: logs a WARNING with
pending row count + a hint to raise telemetry_writer_shutdown_drain_s.
- Writer's flush loop catches asyncio.CancelledError separately and
re-prepends the in-flight batch to the buffer so teardown's disk spill
catches it.
- After 6 consecutive batch failures the writer emits a loud ERROR with
buffer depths so operators see sustained data-loss risk.
Added tests:
- test_sanitization_survives_writer_round_trip
- test_retention_failure_preserves_dirty_flows
- test_in_flight_batch_returned_on_cancel
* perf(telemetry): address copilot review
- _restore_from_disk + _adopt_orphan_outboxes now route through _enqueue so a
large disk-spilled or orphan outbox can't bypass telemetry_writer_max_queue
and OOM the process. Oldest rows are dropped and counted via the existing
dropped_transactions / dropped_vertex_builds counters.
- chmod 0o700 the outbox root + per-PID directory so sanitized-but-still-
sensitive payloads aren't exposed cross-user on multi-tenant hosts.
Suppressed on platforms where chmod is a no-op (Windows).
- Added test_adopt_orphan_outboxes_honors_max_queue.
The remaining two copilot notes (private API access to DatabaseService and
diskcache.Cache.close) were also flagged by the in-tree review; tracking
separately. The "diskcache not declared" note is a false positive — the
dependency is at src/backend/base/pyproject.toml:76.
* perf(telemetry): address coderabbit review
- Sweeper hands off dirty sets via capture-and-clear so concurrent
flushes during a retention pass aren't wiped by the post-commit
subtract; failure path restores the snapshot.
- Stress README uses a concrete Postgres DSN matching the docker
example instead of an unset env var.
- Test PID-probe loops bounded via a shared helper with pytest.fail
fallback.
* perf(telemetry): swap diskcache outbox for stdlib sqlite (CVE-2025-69872)
Replaces the diskcache.Deque-backed spill outbox with a stdlib sqlite3
outbox (WAL mode, JSON payloads in TEXT). diskcache 5.6.3 has
CVE-2025-69872 (pickle deserialization RCE for an attacker with write
access to the cache dir), no fixed version released, and was never
declared as a dependency — import failed on Python 3.10.
The replacement is encapsulated in a small _Outbox helper that owns the
connection, schema, JSON codec, and lifecycle. The codec uses tagged
wrappers for datetime and UUID so SQLAlchemy's typed columns accept
restored payloads on the way back out.
Hardening informed by a survey of OTel collector, Fluent Bit, Vector,
Prometheus remote_write, Datadog agent, Logstash, and Filebeat:
- Per-PID outbox dirs now stamp an owner.json (hostname + Linux boot_id
or time()-monotonic() proxy). Adoption only proceeds when host+boot
match; cross-host or pre-owner-file dirs are logged and skipped so a
recycled PID after a container restart cannot pull in a stranger's
spill data.
- PRAGMA synchronous=FULL on the spill connection so the shutdown
commit hits the platter (NORMAL only fsyncs on WAL checkpoint, which
may never run if the process exits immediately after commit).
- Spill honors telemetry_writer_max_queue with drop-oldest, matching
the producer-side overflow policy so a backlogged buffer at shutdown
can neither stall teardown nor fill disk.
- append_all encodes payloads up front and only clears the deque after
the transaction commits — no more partial-drain on mid-flight SQLite
failure. drain collapses to a single DELETE FROM outbox after the
SELECT.
- Exception handlers at the spill/restore/adopt boundaries narrowed to
(sqlite3.Error, OSError) so genuinely unexpected exceptions
propagate rather than being silently logged.
Tests cover: cross-host orphan skipped, missing-owner orphan skipped,
spill cap drops oldest, and a realistic UUID+datetime payload
surviving spill → restore → SQLAlchemy INSERT.
* [autofix.ci] apply automated fixes
* fix(telemetry): name wait_for inner tasks so pyleak can filter
Integration tests using @pyleak_marker were flagging an inner asyncio
task created by the telemetry writer's `wait_for(Event.wait(), ...)`
loops. The wrapper task is auto-named (Task-N) and lands mid-await
across the test boundary, so pyleak counts it as leaked. The writer
itself shuts down cleanly via teardown; the "leak" is a pattern
mismatch with pyleak's per-test snapshot model, not a real lifecycle
bug.
Wrap Event.wait() in an explicitly named task (`telemetry-writer-tick`,
`telemetry-writer-backoff`, `telemetry-sweeper-tick`) via a small
_wait_or_shutdown helper, and extend pyleak_marker with a task_name_filter
that excludes `telemetry-*` from leak detection. CI was green on earlier
commits in this branch only because the diskcache import error
prevented the writer from starting at all — fixing the import surfaced
this latent pyleak collision.
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* test(telemetry): disable writer in tests so reads see writes synchronously
* perf(telemetry): age out cross-host orphan outboxes on shared volumes
A pod on a shared PV (NFS/RWX) cannot adopt rows from a dead pod on a
different host because the dead pod's hostname doesn't match. Without a
janitor those directories accumulate forever. Add an owner-file mtime
heartbeat from the sweeper plus a prune pass that deletes cross-host
outboxes whose owner file hasn't been touched within
telemetry_writer_orphan_max_age_s (default 1h). Same-host orphans still
flow through the existing adoption path.
* perf(telemetry): add byte-aware flush + drop strategy
Today the writer bounds memory by row count only, so a worker logging fat
vertex_build artifacts can hold tens of MB per row and silently dwarf the
configured max_queue. Add a size_strategy switch ('count' | 'bytes' |
'either', default 'count' for parity) with two byte thresholds:
- batch_size_bytes (256KB) caps per-flush INSERT size when bytes apply
- max_queue_bytes (200MB) drops oldest by bytes when bytes apply
Parallel sizes deques mirror the payload buffers so accounting stays
consistent across drain, spill, restore, and the cancel/retry rollback.
Single rows above the byte budget are still emitted (no row is refused);
operators get dropped_*_bytes counters alongside dropped_*.
* test(telemetry): tighten byte-strategy assertions and cover end-to-end paths
Address gaps in the byte-aware strategy tests:
- pin exact dropped counts and remaining buffer state for the drop-by-bytes
case (was 'greater than zero')
- compute exact drain count from encoded size (was a 1-4 range)
- round-trip bytes through spill+restore to verify size deque is rebuilt
- round-trip bytes through orphan adoption for the same reason
- exercise the sweeper loop end-to-end to confirm heartbeat + prune are
wired in (previously only unit-tested in isolation)
Clarify in the settings docs that the byte caps measure encoded JSON size,
not Python in-memory footprint.
* ref: updates to telemetry writer PR (#13294)
* fix(telemetry-writer): harden error handling and add missing test coverage
Critical:
- teardown() now re-raises CancelledError after awaiting the writer task so the
asyncio cancellation chain propagates correctly on lifespan task kill
- suppress(OSError) on owner file write replaced with explicit error log so
operators know when disk-spilled rows will not be recoverable on restart
High / important:
- Escalation threshold check changed from == to >= so the error log fires on
every failure past the threshold, not just the 6th
- Dead `except OSError` on time.time() - time.monotonic() changed to
`except Exception` since time functions cannot raise OSError
- Removed redundant `from uuid import UUID` inside _run_retention_pass (already
imported at module top)
- Orphan directory cleanup: replaced blanket suppress(OSError) with per-child
suppress so ENOTEMPTY on an individual rmdir doesn't abort the whole loop and
leave the parent directory leaking silently; outer failure now logs at debug
Tests (3 new):
- test_retention_sweep_caps_vertex_builds_per_vertex: inserts 8 builds for a
single vertex with max_per_vertex=3 so the per-vertex DELETE subquery
actually executes (previous test used 8 distinct vertex IDs, bypassing it)
- test_either_strategy_trips_on_bytes_first: verifies bytes can be the first
trigger under 'either' strategy (previous test only covered the count-first path)
- test_writer_retries_on_batch_failure: injects 2 flush failures then success;
confirms failed_batches increments, rows are preserved in the buffer, and
flushed_rows reflects the final successful write
* ci: add stress-tests job to nightly build pipeline
Wires the stress-tests workflow into nightly so telemetry write stress
tests run automatically. Also gates release-nightly-build and
slack-notification on stress-tests result so a stress regression blocks
the nightly release and surfaces in Slack.
* ci: run stress tests in nightly without blocking release
Stress tests are informational for now — a failure is visible in the
workflow run and Slack but does not gate the nightly release or build.
* fix(telemetry-writer): address PR review on cancelled teardown and nightly stress tests
- Add the stress-tests.yml reusable workflow (was untracked, so the
nightly stress-tests job could never resolve)
- Notify Slack on stress-tests failure (add to slack-notification gate
and FAILED_JOB detection as non-blocking)
- Run sweeper cancel, disk spill, and engine dispose in a finally so a
cancelled teardown() still persists the in-memory buffer
- Add tests for the cancelled-teardown spill path and the >= escalation
threshold; drop the misleading wait-loop in the retry test
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Jordan Frazier <122494242+jordanrfrazier@users.noreply.github.com>
|
|||
| 1ab6251164 |
feat: sync langflow and lfx versions (#13176)
* feat(lfx): synchronize LFX onto Langflow major.minor version line (Phase 1) - Bump src/lfx/pyproject.toml from 0.5.0 to 1.10.0 - Tighten langflow-base lfx pin: ~=0.5.0 → ~=1.10.0 - Fix release.yml pre-release boundary from next-major to next-minor (<X.(Y+1).dev0) - Add minor-parity soft check to scripts/release-lfx.sh - Extend make patch to sync lfx version alongside langflow/base/frontend - Document LFX compatibility contract in RELEASE.md Contract: LFX X.Y.N is compatible with any Flow from Langflow X.Y.M. * feat(lfx/upgrade): add compatibility checker (Phase 2) * fix(lfx/upgrade): fix registry_code guard and types order-sensitivity in checker * feat(lfx/upgrade): implement safe-upgrade applier (Phase 2) * feat(lfx): add lfx upgrade command (Phase 2) * feat(lfx/run): add --upgrade-flow option (Phase 2) * feat(lfx/serve): add --upgrade-flow option (Phase 2) * update lfx pyproject version * [autofix.ci] apply automated fixes * test(lfx/upgrade): add v1.9.0 starter flow fixtures for upgrade integration tests * test(lfx/upgrade): add v1.9.0 starter flow fixtures and real-flow integration tests * [autofix.ci] apply automated fixes * fix(lfx/upgrade): use alias-aware registry lookup so renamed components are not falsely blocked * fix(lfx/upgrade): handle outer flow envelope and file-path inputs in upgrade checks * fix(lfx/upgrade): fail-fast on upgrade_flow errors; add regression tests for Bugs 1-3 * chore(tests): remove bug-number labels from test comments * [autofix.ci] apply automated fixes * fix(lfx/upgrade): address PR review comments - Reject .py files early in serve --upgrade-flow with a clear error message - Preserve outer flow envelope metadata (name, description, etc.) when lfx upgrade --write rewrites a file - Move Mapping import under TYPE_CHECKING to satisfy Ruff TC003 - Assert fixture flows and registry are non-empty so parametrized tests cannot pass vacuously - Remove unused capsys arg and replace print with sys.stderr.write (Ruff T201/ARG001) - Add upgrade_flow param to run command docstring * fix(lfx/upgrade): preserve envelope on run, apply nested upgrades (#13200) * fix(lfx/upgrade): preserve envelope on run, apply nested upgrades Three follow-ups on top of the upgrade tooling: - run --upgrade-flow: re-attach the inner graph to the outer envelope before handing the flow to aload_flow_from_json. Previously the upgrade path unwrapped {"data": ...} and passed the inner dict to the loader, which raised KeyError: 'data'. Adds happy-path tests for envelope and flat file inputs. - applier: recurse into one level of nested flow nodes (node.data.node.flow.data.nodes), matching the checker. Without this, outdated_safe nodes inside grouped components were reported but never written. Adds a regression test. - upgrade --write test: assert the envelope is preserved (name, description, endpoint_name, etc.) instead of the previous unwrapped-output expectation, so the test matches the actual fix in this PR. - Drive-by ruff cleanup: D417 docstring, SIM103, SIM108, E501, RUF059. * [autofix.ci] apply automated fixes --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> * fix(lfx/upgrade): fix loader KeyError, outer-envelope checker gap, and nested-node applier Three bugs from ogabrielluiz's PR review: 1. run/base.py loader KeyError: file-path branch unwrapped the outer envelope for the checker but passed the inner dict to aload_flow_from_json, which does flow_graph["data"] unconditionally. Re-wrap as {"data": flow_dict} before the loader call. Applied consistently to all three input paths (--flow-json, --stdin, file-path). 2. run/base.py zero-node checker for --flow-json/--stdin: those paths stored the raw parsed JSON without unwrapping, so a caller passing an exported flow {"name":..., "data":{...}} caused the checker to see zero nodes and silently pass. Now unwrap with raw.get("data", raw) matching the file-path branch. 3. applier.py nested flows never upgraded: the early `continue` on top-level nodes not in safe_ids prevented the nested-node loop from running. Restructured so the nested check fires unconditionally for every top-level node, mirroring checker.py:160-165. * fix(lfx/run): unify outer-envelope unwrap across all --upgrade-flow input paths File-path reads now call raw.get("data", raw) matching --flow-json and --stdin, so the upgrade checker always sees the inner graph. This also removes the has_envelope/re-wrap machinery that was double-wrapping outer-envelope files when passing to aload_flow_from_json. Fix two test assertions that described the old double-wrapped shape. * fix(lfx/upgrade): inject registry into upgrade_command; fix Makefile lfx pin regex - upgrade_command now accepts an optional registry parameter so tests can pass the dict directly instead of mocking load_registry_from_index - Makefile sed regex broadened from \"lfx~=.*\" to match both ~= and >= forms so make patch works after release.yml rewrites the pin - Echo label changed to LFX (synced) to clarify the variable is the shared Langflow version, not a separate LFX-specific value * fix(make/patch): fix langflow-base sed regex and validation grep The dependency in pyproject.toml is "langflow-base[complete]>=X.Y.Z", not the "langflow-base==X" form the original regex expected, so make patch silently left the pin unchanged and the validation step always failed. The sed pattern now matches any extras/operator combination and rewrites to the canonical [complete]>= form; the grep uses -F so the [complete] brackets are treated literally. * test(lfx): add patch regex tests and symmetric safe-mode envelope tests test_patch_regexes.py — 15 tests covering the Python regexes embedded in the Makefile patch target. Exercises all three substitutions (langflow-base pin, lfx pin, version field) against every realistic pin format including the >=X.Y.Z,<dev0 form that release.yml writes. Would have caught the langflow-base==.* vs [complete]>= mismatch before manual testing. test_base.py — two new TestUpgradeFlowOption tests: test_upgrade_flow_safe_envelope_inline_json_loads_successfully test_upgrade_flow_safe_envelope_stdin_loads_successfully Symmetric to the existing file-path envelope test; verifies that --flow-json and --stdin with an outer-envelope flow also pass {"data": inner} to the loader after safe upgrades, not a double-wrapped {"data": outer_envelope}. * fix(lfx/upgrade): address review: compat checker, shared gate, fail-fast registry Checker correctness: - _outputs_are_compatible: drop cosmetic display_name from the breaking check; treat widened output types as safe (flow types must be a subset of registry types), only narrowing breaks downstream edges. - _input_types_contained: stop flagging widened input_types as breaking; keep narrowing as the only breaking case; fix misleading comments. - check_flow_compatibility now recurses fully into nested grouped components (symmetric with the applier) and accepts a pre-built registry lookup. CLI/run/serve: - New lfx.upgrade.cli_gate (UpgradeFlowMode enum, UpgradeFlowError, apply_upgrade_gate) shared by run_flow and serve_command so the two --upgrade-flow paths can't diverge. - run_flow: extract _materialize_flow_dict and route gating through the shared helper. - run/serve --upgrade-flow options typed as UpgradeFlowMode (check|safe choices). - lfx upgrade: load_registry_from_index fails fast when the bundled registry is empty/missing instead of silently marking every node blocked; ASCII-only report output; new --strict flag; build the registry lookup once and reuse it. Docs/tests: - RELEASE.md: migration note for the lfx 0.5.0 -> 1.10.0 version jump. - Regression tests for the checker fixes, the shared gate, fail-fast registry, --strict, and serve --upgrade-flow parity. * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * fix(lfx): consolidate flow-envelope handling and fix version-ceiling regex Extract the outer-envelope unwrap/rewrap logic (previously hand-rolled as raw.get("data", raw) with subtly different rules across serve, run, and upgrade) into a single lfx.utils.flow_envelope module with split/merge helpers. This fixes a serve bug where an enveloped flow had its inner graph written bare to the temp file, making the loader's flow_graph["data"] raise KeyError. Also fix release.yml's major.minor extraction: the greedy sed grabbed the upper bound from a range pin (>=1.10.0,<1.11.dev0), drifting the version ceiling up one minor each release cycle. Anchor to the first version instead. * fix(lfx): upgrade-flow gate reads bundled component index, not empty cache The --upgrade-flow=check|safe gate on lfx run and lfx serve rejected every flow as 'blocked'. Both call sites passed component_cache.all_types_dict to apply_upgrade_gate, but that cache is populated lazily after services start, so at gate time it is empty -- an empty registry classifies every node as blocked. The standalone lfx upgrade command was unaffected because it reads the bundled _assets/component_index.json instead. Make the gate own registry loading: apply_upgrade_gate now defaults all_types_dict to None and loads the bundled index (the same source lfx upgrade uses) via a new _load_bundled_registry helper, raising UpgradeFlowError on a missing/empty index so a broken install fails loudly instead of silently blocking every component. Both call sites pass mode= and let the gate load the registry. Existing gate tests mocked component_cache with a populated registry, which is exactly what hid the bug; repoint them at the new _load_bundled_registry seam and add regression tests that do not mock the registry, including an end-to-end run_flow check against a real clean v1.9.0 starter flow. --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Gabriel Luiz Freitas Almeida <gabriel@logspace.ai> |
|||
| 3e57126b91 |
fix: remove duplicate uv.lock from workspace member (#13326)
* fix: remove src/backend/base/uv.lock and Dockerfile references - Deleted src/backend/base/uv.lock (monorepo should have only one uv.lock at root) - Removed COPY ./src/backend/base/uv.lock lines from all Dockerfiles: - docker/build_and_push.Dockerfile - docker/build_and_push_base.Dockerfile - docker/build_and_push_ep.Dockerfile - docker/build_and_push_with_extras.Dockerfile - docker/dev.Dockerfile Fixes LE-1093 * fix: remove stale base uv.lock regeneration paths |
|||
| 3ff3c576ca |
fix(ci): re-enable migration-pip-venv now that nightly bundles resolve (#13421)
The PyPI langflow-nightly is pip-installable again, so the temporary `if: false` guard added on 2026-05-28 is no longer needed. #13418 (release-1.10.0) and its forward-port #13419 (main) gave the extension bundles their own nightly track: langflow-nightly now depends on lfx-arxiv-nightly / lfx-duckduckgo-nightly / lfx-ibm-nightly, which pin lfx-nightly==0.5.0.dev* instead of an unsatisfiable stable lfx>=0.5.0,<0.6.0. Verified against the published dev57 wheels: a dry-run resolve of langflow-nightly[postgresql] succeeds (549 packages, exit 0), pulling lfx-nightly==0.5.0.dev57 via the *-nightly bundle variants. |
|||
| 9044b8f0c4 |
fix(ci): give extension bundles a nightly track so langflow-nightly resolves (#13418)
The nightly tagger renames lfx -> lfx-nightly, but the extension bundles
were published as stable lfx-<name> wheels pinning lfx>=0.5.0. So
langflow-nightly depended on the stable lfx-arxiv (etc.), which dragged in
lfx>=0.5.0 -- a version only published under the lfx-nightly name. Installing
the nightly therefore failed:
Because only lfx<=0.4.5 is available and lfx-arxiv==0.1.0 depends on
lfx>=0.5.0, ... your requirements are unsatisfiable.
Give the bundles their own nightly track, mirroring lfx/base/main:
- update_lfx_version.py now renames each src/bundles/* package to
lfx-<name>-nightly, versions it <base>.dev<N> (sharing lfx's dev number),
and repoints the root langflow deps + [tool.uv.sources] workspace entries
at the -nightly names. Each bundle's own lfx dep was already repinned to
lfx-nightly==<dev>. Only the [project] name/version change -- entry points
and the import package stay as lfx_<name>, so extension discovery is intact.
- release_nightly.yml publishes the nightly bundle wheels to PyPI and gates
publish-nightly-main on them, so langflow-nightly's exact == pins always
reference bundles published in the same run.
No build/test/Docker changes needed: the bundles are already built and
committed under the nightly tag, the cross-platform test resolves them via
--find-links, and Docker builds from the regenerated workspace lock.
|
|||
| be7edcbda1 | chore: unconstrained lfx version for bundles (#13415) | |||
| dbe482c800 |
fix(ci): lockstep langflow-nightly and langflow-base-nightly versions (#13413)
* fix(ci): lockstep langflow-nightly and langflow-base-nightly versions
The nightly pipeline computed each package's .devN number independently
(pypi_nightly_tag.py queried each package's own PyPI history and
incremented separately), while langflow-nightly pins an exact
langflow-base-nightly[complete]==X.Y.Z.devN dependency. Because
langflow-nightly publishes on more nights than langflow-base-nightly,
the two counters drift (live: dev54 vs dev48). Each time base lags a
publish while main succeeds, the newest langflow-nightly pins a base
dev that does not exist yet, so 'uv pip install langflow-nightly'
becomes unsatisfiable and silently falls back to a weeks-old version.
Fix: version the two packages in lockstep. pypi_nightly_tag.py now
derives a single shared dev number from max(dev across BOTH packages'
PyPI histories) + 1 (restricted to the root base_version), so main and
base always get the identical tag and main's exact pin always
references a base version built and published in the same run. The tag
is computed in a single invocation ('both' mode) so the release and
base tags cannot drift across separate calls.
Also hardens tag computation: 404 / network / malformed responses for
either package now contribute nothing instead of crashing, a
base-version bump resets the dev counter cleanly, and non-dev/final
releases never advance it.
Adds scripts/ci/test_pypi_nightly_tag.py (unit tests) and a
ci-scripts-test.yml workflow to run scripts/ci tests on PRs.
* fix(ci): fail closed on non-404 PyPI errors in nightly tag computation
_all_dev_numbers() previously returned [] for ANY failure (network error,
non-404 HTTP status, malformed 200), which is unsafe: _shared_nightly_version()
takes max(dev)+1 across both packages, so a transient lookup failure on the
higher-versioned package silently LOWERS the next tag. E.g. if the langflow-nightly
lookup fails while langflow-base-nightly reports dev48, the script would emit
v1.10.0.dev49 even though langflow-nightly already published through dev54 — the
workflow then force-recreates an old git tag and fails publishing an already-existing
PyPI version.
Fail closed: only a true 404 (package has no releases) contributes []; network
errors, 5xx/non-404 statuses, and malformed 200s now raise so the nightly job aborts
before mutating tags. Adds tests for malformed/5xx/network failures and a direct
regression test for the higher-package-lookup-failure scenario.
* Update scripts/ci/test_pypi_nightly_tag.py
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Update test_pypi_nightly_tag.py
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
|
|||
| 58a75ffb0d |
feat(ci): reduce macOS Intel CI matrix and add macOS support documentation (#13328)
feat(ci): reduce macOS Intel CI matrix and add macOS support docs - Remove Python 3.10 from macOS Intel stable CI matrix (keep 3.12 only) - Add comprehensive macOS support documentation - Document Python 3.14 support status (limited on Intel, no PyTorch) - Reduces CI costs by ~$5-7 per run (~$1,800-2,500/year) Implements LE-781 recommendations R2 and R3 from LE-265 investigation. Related: LE-265, PR #12477 |
|||
| f400102088 |
ci: disable pip/venv DB migration test while langflow-nightly is pip-uninstallable
The PyPI langflow-nightly is currently pip-uninstallable: its core bundle deps (lfx-arxiv, lfx-duckduckgo) pin stable lfx>=0.5.0,<0.6.0, but stable lfx tops out at 0.4.4 (the 0.5.0 line ships only as lfx-nightly, a separate package name that cannot satisfy an lfx pin). So the pip/venv migration job fails at the install step. The Docker Compose migration job is unaffected (it runs the prebuilt nightly image) and stays enabled. Re-enable once either a stable lfx 0.5.x is published to PyPI or nightly bundle variants pinning lfx-nightly are published and langflow-nightly depends on them. |
|||
| fb4dfd49fd |
ci: sync workflow fixes from main into release-1.10.0 (fix broken nightly) (#13400)
ci: sync workflow fixes from main into release-1.10.0 Brings the latest CI/workflow fixes from main into release-1.10.0 so the nightly build is unblocked and the two branches share the same hardening. Most important fix: release_nightly.yml's "Verify Nightly Name and Version" step now uses the anchored grep '^langflow(-nightly)?[[:space:]]' instead of 'grep langflow | grep -v langflow-base | grep -v langflow-sdk'. The old filter started matching two packages once the langflow-stepflow workspace package was added, so the name became multi-line and the check failed (this is what broke the nightly build). Also carries main's fixes for cross-platform install (--prerelease=if-necessary-or-explicit), docker build workflows, db-migration-validation, and the backend test timeout bump (30 -> 40). 3-way merged from the common ancestor, so release-only changes are preserved; no release-only feature workflows are modified. |
|||
| cb7b838d45 |
feat: Add DB migration validation workflow for nightly builds (#13249)
* feat: Add DB migration validation workflow for nightly builds (LE-1259) - Implements automated DB migration testing for nightly builds - Tests two scenarios: pip/venv and Docker Compose migrations - Validates migration from stable to nightly versions - Verifies data persistence (witness flows) across migrations - Integrated into nightly_build.yml workflow - Includes Slack notifications for migration test results This addresses the critical blocker identified by QA team for ensuring safe database migrations in production deployments. * docs: Add DB migration validation documentation - Comprehensive guide for LE-1259 implementation - Detailed test scenarios and execution details - Environment configuration and success criteria - Monitoring and troubleshooting guidelines - Placed in docs/docs/Deployment/ for easy access * fix: address PR review comments for DB migration validation - Use actual nightly tag from create-nightly-tag output instead of hardcoded :latest - Wire POSTGRES_VERSION env var into postgres service image tag - Remove unnecessary checkout steps from both migration jobs - Update step name from 'Create witness flow and credentials' to 'Create witness flow' - Add -f flag to curl commands for fail-fast behavior - Add flow creation verification with error handling - Fix version extraction logic to properly test nightly build instead of PyPI latest - Remove deprecated docker-compose version field - Remove duplicate Slack notification job (consolidated in nightly_build.yml) Addresses all 9 issues identified by @ogabrielluiz in PR review * docs: remove implementation summary from user-facing docs Per @ogabrielluiz review feedback, this file reads as an implementation summary (Jira ticket, branch name, 'Next Steps', 'Files Changed: 2') rather than user-facing documentation. The Deployment section is for end-user docs, and this content is better suited for the PR description. Also not added to sidebars.js, so would be an orphan page. * fix(workflows): address 6 issues from Gabriel's second review of DB migration validation Fixes all remaining issues identified in PR #13249 review: 1. Remove schedule trigger - only works on default branch, would cause duplicate runs 2. Fix postgres service image - hardcode to postgres:16 (env context not available in services) 3. Add curl fail-fast flags - use -fsSL for immediate failure on errors 4. Add flow ID verification - check witness data creation succeeded before proceeding 5. Remove orphaned Slack JSON - cleanup leftover from removed notify-results job 6. Fix version extraction - strip 'v' prefix for pip install (${VERSION#v}) 7. Fix Docker image reference in nightly_build.yml - pass full image path with tag 8. Fix success notification - check migration validation didn't fail All changes validated locally: - YAML syntax validation passed - Docker Compose config validated - Tag manipulation logic tested (v prefix handling) - Curl command structure verified - Test credentials marked with pragma allowlist secret comments Related: LE-1259, PR #13249 Depends on: PR #13212 (Docker volume permissions fix) * fix(ci): address all PR review blockers for DB migration validation workflow - Add auto_login token auth to all 4 API call sites (Create/Verify witness in both jobs) - Add credential witness (POST /api/v1/variables/ with type: Credential) to prove encrypted-column migrations ran correctly - Verify witness variable persists after upgrade in both jobs - Strip 'v' prefix from nightly Docker tag before docker-compose sed replacement - Fix langflow.__version__ crash - use importlib.metadata instead - Remove deprecated 'version: 3.8' from inline docker-compose YAML - Remove bogus LANGFLOW_SUPERUSER/LANGFLOW_SUPERUSER_PASSWORD env vars - Remove LANGFLOW_SKIP_AUTH_AUTO_LOGIN (only works on nightly, not stable images) - Fix shellcheck SC2016/SC2102 issues flagged by actionlint - Mark test credential values with pragma allowlist secret (false positives) - Update .secrets.baseline with known false positives in new workflow file * fix(ci): remove duplicate db-migration-validation job after merge * fix(ci): include default_fields in witness variable payloads * fix(ci): handle compressed API responses in witness verification * fix(ci): uninstall stable langflow before installing nightly in pip-venv job langflow and langflow-nightly both own the same site-packages/langflow/ namespace via a shared langflow-base dependency. Without an explicit uninstall, the stable copy wins at runtime and python -m langflow still boots the old version - meaning no nightly migration is exercised and the test produces a false positive. Explicitly uninstall langflow + langflow-base before the nightly install so the namespace is fully handed over to the nightly package. --------- Co-authored-by: Eric Hare <ericrhare@gmail.com> |
|||
| e4d5190be4 |
chore(ci): Fix 403 in DB migration validation witness flow (#13376)
fix auto login migration validation |
|||
| 6b2ca4bcd8 | fix: restore qdrant deps and migration workflow | |||
| 288bc8efe4 | fix(ci): use local bundle wheels in nightly install tests (#13257) | |||
| 5a8c17b22d |
ci: backport bundle/nightly CI fixes from main (#13206, #13207, #13208) (#13210)
* ci: stop publishing -nightly bundle variants; release bundles on demand (#13206) Bundles (lfx-arxiv, lfx-duckduckgo) change infrequently enough that a nightly cadence is overkill. Drop the rename-to-`-nightly` and bundle publish lanes from the nightly pipeline and add a dedicated workflow_dispatch-only release_bundles.yml for purposeful releases. - nightly_build.yml: drop update_bundle_versions.py invocation and the src/bundles/*/pyproject.toml git-add guard. - release_nightly.yml: remove build-nightly-bundles and publish-nightly-bundles jobs; untether test-cross-platform and publish-nightly-main from them. - release_bundles.yml (new): build all src/bundles/* wheels, run a cross-OS install smoke test, then publish to PyPI under their stable names. Tolerates already-published versions so re-runs without a version bump are no-ops. release.yml still owns bundle publishing as part of main releases. Manual follow-up (PyPI admin): delete the lfx-arxiv-nightly and lfx-duckduckgo-nightly projects from PyPI. * ci(release_bundles): build lfx wheel locally for smoke test (#13207) The release_bundles.yml smoke test installs bundle wheels into a fresh venv, which makes uv resolve their `lfx>=X.Y,<Z` pin against PyPI. When bundles are released ahead of a matching lfx (typical case — bundles ship more often than lfx bumps land on PyPI), the resolve fails: Because only lfx<=0.4.3 is available and lfx-arxiv==0.1.0 depends on lfx>=0.5.0,<0.6.0, we can conclude that lfx-arxiv==0.1.0 cannot be used. Build the lfx wheel from the current ref in the build-bundles job and install it alongside the bundle wheels in the smoke test. The lfx wheel ships as a separate `dist-lfx-smoketest` artifact and is NOT included in the publish-bundles step — only the `dist-bundles` artifact gets pushed to PyPI. * ci(nightly): re-pin bundle lfx deps to lfx-nightly during nightly build (#13208) The nightly pipeline renames the workspace `lfx` package to `lfx-nightly` in `src/lfx/pyproject.toml` and the root workspace dep, but leaves each `src/bundles/*/pyproject.toml`'s `"lfx>=X.Y,<Z"` pin unchanged. With the workspace `lfx` gone and PyPI still on lfx 0.4.3, the create-nightly-tag job's `uv lock` fails: × No solution found when resolving dependencies for split [...] ╰─▶ Because only lfx<=0.4.3 is available and lfx-arxiv depends on lfx>=0.5.0,<0.6.0, we can conclude that lfx-arxiv's requirements are unsatisfiable. `update_lfx_version.py` now also rewrites the `lfx` (or already-rewritten `lfx-nightly`) specifier in every `src/bundles/*/pyproject.toml` to `lfx-nightly==<dev version>`, mirroring how `update_lf_base_dependency` re-pins the lfx dep inside `langflow-base`. The lookahead in the regex prevents matching sibling packages like `lfx-arxiv` / `lfx-duckduckgo`. No-op when no bundle pyprojects exist (e.g. on main today), so this is safe to merge ahead of the bundle extraction landing on main. Restored the guarded `git add src/bundles/*/pyproject.toml` step so the modified bundle pyprojects ride the same commit/tag as the rest of the nightly version bumps. Cherry-pick to release-1.10.0 to unblock nightlies cut from that branch. |
|||
| c901602bc2 |
fix(ci): rename bundles to -nightly during nightly build (#13193)
fix: rename bundles for nightly build |
|||
| cc009c9133 |
feat(lfx): Bundle Separation and LFX Extension Framework (#13043)
* feat(lfx): installed-package + seed-directory discovery for production install (LE-1022) Adds the read-only production install path for Modes A, B, and C of the Bundle Separation iteration. Manifest-shipping pip-installed distributions and seed-directory subdirectories are discovered at server startup and registered as Extensions at @official. * discovery.py: walks importlib.metadata.distributions() + the $LANGFLOW_SEED_DIR / /opt/langflow/bundles seed root; produces DiscoveredExtension records and typed errors for malformed manifests / configured-but-missing seed dirs. * registry.py: ExtensionRegistry service with the immutability invariant for installed and seed entries. Mutation verbs (uninstall, disable, enable, install, update_entry) all raise ExtensionImmutableError carrying the typed installed-extension-immutable / seed-directory-immutable code so the invariant is testable today; the CLI uninstall surface ships in B4. * lfx extension list: read-only inspector with text and JSON output for operators inspecting Mode B/C images. * Errors: four new typed codes (installed-extension-immutable, seed-directory-immutable, seed-directory-not-found, duplicate-extension-id) plus snapshot coverage in tests/unit/extension/test_errors.py. * Tests: 165 extension tests pass, including the LE-1022 acceptance cases -- three pip-installed wheels visible at @official, three seed bundles visible at @official, and the parametrized service-layer immutability check across every mutation verb. * Docs: docs/Deployment/deployment-extensions-production.mdx covers the Dockerfile template, k8s deployment notes, the bundle packaging convention (extension.json shipped via package-data), and troubleshooting for the typed error codes. * feat(lfx): add single-Bundle loader and LANGFLOW_COMPONENTS_PATH discovery (#12967) * feat(lfx): add extension manifest schema, validate CLI, and error formatter (LE-1014) Foundation for the Bundle Separation iteration. Defines what a valid extension.json looks like (Pydantic models + Draft 2020-12 JSON Schema), ships the offline `lfx extension validate` command, and ships the single `format_extension_error` function that every other extension-system module will use to render structured errors. What's in lfx.extension: - `ExtensionManifest` / `BundleRef` / `LangflowCompat` Pydantic models with `extra="forbid"` so unknown fields fail loudly. Deferred fields (`services`, `routes`, `hooks`, `starter_projects`, `userConfig`) are reserved as None-only so non-null values produce a dedicated `field-deferred-in-this-milestone` error instead of a generic schema wall. `bundles` accepts a list but rejects length > 1 with `multi-bundle-deferred-in-this-milestone` (validator-enforced; the loader re-checks at install time in LE-1015). - `schema.build_schema()` + `build_schema_json()` produce the publishable artifact at schemas.langflow.org/extension/v1.json. - `ExtensionError` typed envelope and `format_extension_error` -- one branch per discriminant. Codes are registered in `ERROR_CODES`; an `ExtensionError` constructed with an unknown code raises at construction time, preventing producers from shipping without a matching renderer. - `validate_extension` runs four passes: manifest discovery + schema, path-safety (no `..`, no absolute paths, no symlink escape), AST inspection of every `.py` (syntax, Component subclass present, build() declared, top-level `import *`, top-level I/O primitives), and an opt-in `--execute-imports` that runs each module in a subprocess with a temporary HOME / TMPDIR / LANGFLOW_CONFIG_DIR and LANGFLOW_*/LFX_* env vars stripped. - `lfx extension validate` and `lfx extension schema` typer subcommands. Acceptance-criteria coverage in tests/unit/extension/: - Round-trips every v0 manifest field; deferred fields rejected; multi-bundle rejected with the dedicated discriminant. - JSON Schema validates the v0 example and rejects 12 malformed manifests with distinct error paths (>= 10 required by the ticket). - Median default-validate runtime < 100ms on the basic template. - Crafted side-effect bundle: default validate does NOT execute it (canary file is never written); `--execute-imports` DOES execute it and the canary appears, while LANGFLOW_* env vars are NOT inherited by the subprocess. - Snapshot tests for every code in ERROR_CODES; a guard test verifies ERROR_CODES and the snapshot table are in lockstep so future additions cannot ship without a format branch and a snapshot. Wiring: `lfx extension` is a sub-app under the Authoring help panel so future tickets (LE-1016 init/dev, LE-1018 reload) can attach without colliding with the existing `lfx validate` (which validates flow JSON, not extensions). * fix(lfx): fall back to tomli on Python 3.10 in extension manifest loader tomllib is stdlib only on 3.11+, but lfx supports 3.10-3.13. Use the existing tomli runtime dependency as the 3.10 fallback (same API, so the import alias keeps the rest of the module unchanged). Fixes ModuleNotFoundError seen in CI on the 3.10 job. * Update src/lfx/tests/unit/extension/test_schema.py Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update src/lfx/src/lfx/extension/schema.py Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update src/lfx/src/lfx/cli/_extension_commands.py Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * feat(lfx): add single-Bundle loader and LANGFLOW_COMPONENTS_PATH discovery (LE-1015) Introduces lfx.extension.loader: the runtime that turns an Extension on disk into LoadedComponent records keyed by ext:<bundle>:<Class>@<slot>. Two paths in: - load_extension(root): one manifest, one Bundle, registered at @official. Re-checks multi-bundle at runtime (defense-in-depth vs. the schema). - discover_inline_bundles(paths): each subfolder of LANGFLOW_COMPONENTS_PATH is a Bundle at @extra. Walk order is platform-independent (sorted dirs, user-declared path order). First-wins on duplicate names; second emits duplicate-inline-bundle warning that names both paths. Manifest-first precedence helpers (installed_extension_roots, manifest_owning_distributions, filter_plugin_entry_points) let callers of the legacy langflow.plugins entry-point loader skip distributions that ship a manifest, so component entry-points are not double-registered. New typed error codes: module-import-failed, duplicate-component-name, duplicate-distribution, duplicate-inline-bundle, inline-bundle-name-invalid. Each ships with a format branch and a snapshot test. Tests cover the AC: single-bundle happy path, multi-bundle rejection, missing/empty/no-Component bundle, duplicate class names, deterministic walk order, recursive discovery, inline-bundle first-wins + dot-dir skip + bundle.json metadata, manifest-first precedence partition, PEP-503 distribution-name canonicalization. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(lfx): address LE-1015 review feedback - Drop the unproduced duplicate-distribution error code; LE-1022 will add it once startup-time discovery has a place to surface it. Restores the invariant that every code in ERROR_CODES has a producer. - Clarify that intra-bundle relative imports are NOT supported in v0; only absolute references between bundle modules work in this milestone. - Use strict=False when re-resolving bundle_root in the walker; the path was already existence-checked, and a concurrent removal in the narrow window should not raise across the loader's public boundary. - Hoist the json import out of _read_inline_bundle_json's body. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(lfx): split extension loader into a small subpackage (LE-1015) Addresses the file-size feedback from the LE-1015 review. The single 870-line loader.py becomes a flat package keyed off the four section banners that already existed inline: loader/ __init__.py # re-exports the public surface _types.py # SLOT constants, LoadedComponent, LoadResult _discovery.py # filesystem walk + importlib.util orchestration _detection.py # Component subclass identification (MRO heuristic) _orchestrator.py # load_extension, discover_inline_bundles _plugins.py # manifest-first precedence over langflow.plugins Largest file is now _orchestrator.py at 440 LOC (was 870); every file is well under the 800-LOC project guideline. No behavior change: the public import paths from lfx.extension are unchanged, all 38 loader tests still pass. ``_canonicalize_distribution`` is now exported as ``canonicalize_distribution`` from ``loader._plugins`` (it's a stable PEP-503 helper that downstream modules will reach for, so it loses the private underscore). The test suite is split to mirror the package: tests/unit/extension/loader/ conftest.py # shared fixtures, FakeDist, autouse scrub test_load_extension.py # @official slot, identity, failure modes test_inline_bundles.py # LANGFLOW_COMPONENTS_PATH, @extra slot test_plugins.py # manifest-first precedence helpers test_types.py # LoadedComponent, LoadResult, code parity Each test file imports its own slice of the public API and pulls fixtures from conftest, so a reader looking at one banner can read it in isolation. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: LangflowCompat -> LfxCompat * fix: Remove references to ticket * fix: encode maxItems constraint in schema * fix: deferred fields and schema version * Fix ruff errors * fix: align loader tests with renamed manifest API and strip ticket refs The merge of feat/extension-validate brought in the LfxCompat / compat rename, but the loader test fixtures still used LangflowCompat / bundle_api and failed at the manifest layer. Update conftest.py + test_load_extension.py to the post-rename API. Strip 17 LE-XXXX ticket references from loader source files, errors.py loader-specific comments, and the four loader test docstrings, matching the convention applied to LE-1014. Descriptive prose preserved. Promote _BUNDLE_NAME_RE to BUNDLE_NAME_RE on the manifest module so the loader's orchestrator no longer reaches across modules into a private name. * refactor(lfx): clarify broad except, log malformed bundle.json, expand test docstring - Document why _discovery.import_bundle_module catches BaseException (startup-time loader, must surface bad bundles as typed errors rather than abort). - Add debug-level logging when bundle.json is malformed or non-object so a stale-cache footgun is at least observable. - Expand test_skips_re_imported_class docstring so future maintainers don't accidentally weaken the __module__-equality guard if package-style relative imports get added later. Also drops the stale duplicate-distribution claim from the PR description; that code is correctly deferred to LE-1022 along with /all integration. * feat(lfx): wire Extension System into /all, pathsep-split LANGFLOW_COMPONENTS_PATH, emit duplicate-distribution Closes the four AC gaps the previous reviewer flagged on PR #12967: 1. /all integration: get_and_cache_all_types_dict now also calls a new import_extension_components() that loads installed Extensions via load_installed_extensions, loads inline bundles via discover_inline_bundles, and builds frontend-node templates with extension/bundle/extension_version fields stamped on. Failures are logged and skipped per bundle. 2. LANGFLOW_COMPONENTS_PATH is now split on os.pathsep so multi-entry env vars (e.g. /a:/b on POSIX) produce multiple components-path entries instead of one literal non-existent path. Empty segments and missing paths are skipped. 3. duplicate-distribution is a real producer: load_installed_extensions surfaces a typed warning on the winner LoadResult when two distributions share a canonical name, naming every involved manifest path. 4. Manifest-first precedence runtime wiring: new filter_component_entry_points loads each entry-point and only skips ones that resolve to a Component subclass on a manifest-shipping distribution. plugin_routes.load_plugin_routes now applies it so non-component entry-points (route registrars) keep loading per the AC's 'unaffected' promise. Added the previously-missing AC test for same-distribution component+non-component partition. Also makes _distribution_canonical_name defensive against MagicMock test seams. * fix(lfx): register extension components under namespaced ID; promote duplicate-distribution to error Addresses the latest review of PR #12967: P1: /all integration now keys the cache inner dict by LoadedComponent.namespaced_id (ext:<bundle>:<Class>@<slot>) rather than the bare class name. Templates also carry the namespaced_id as an explicit field so consumers that look at the value (not the key) still see the canonical address. This is the form the LE-1020 migration table will rewrite legacy class-name references to. P2: load_installed_extensions now appends duplicate-distribution to result.errors instead of result.warnings, so LoadResult.ok=False when two distributions share a canonical name. The winner's components still appear in result.components so flows already pinned to them keep working; only the conflict status changes. Updated test to assert errors + ok=False; added explicit assertion that the winner's components are still present. * fix(lfx): installed-distribution discovery accepts pyproject.toml manifest form Closes the latest review finding on PR #12967: the installed-distribution scan only looked for extension.json, ignoring distributions whose manifest lives in [tool.langflow.extension] inside pyproject.toml. The AC explicitly treats both as valid manifest forms. _distribution_manifest_path now: - Returns extension.json immediately when present (preserves precedence matching load_manifest's discovery order). - Falls back to pyproject.toml only when extension.json is absent AND the pyproject's [tool.langflow.extension] section is parseable. Validation reuses load_manifest itself so the rule lives in exactly one place; a stray pyproject.toml without the section is correctly ignored. Tests cover: pyproject-only discovery, pyproject-without-section ignored, extension.json wins on collision, end-to-end pyproject load at @official, and pyproject-form manifest-first entry-point suppression. * refactor(lfx): tighten loader invariants, surface silent skips, harden tests Addresses the latest review feedback on PR #12967: Type-level invariants (_types.py): - LoadedComponent.__post_init__ enforces that @extra components must NOT carry a distribution. The reverse (@official without distribution) is permitted because load_extension is also used for dev-mode loads against a working tree before pip install. - LoadResult docstring documents the partial-success contract: components may be non-empty when errors is non-empty (some files imported, others failed). Callers branching on ok get strict success. Silent-failure fixes (_orchestrator.py + settings/base.py): - inline-path-missing: a non-existent / non-dir LANGFLOW_COMPONENTS_PATH entry now produces a typed warning per skipped path so a typo no longer yields zero diagnostics. Settings-layer skip bumped from debug to warning for the same reason. - bundle-json-invalid: a malformed or non-object bundle.json now surfaces a typed warning instead of silently rewriting the user-declared id/version to derived values under the same bundle name. - no-component-subclass gating uses a call-local counter instead of result.errors so the diagnostic stays accurate when a future caller reuses a LoadResult (multi-bundle / batch wrapper scenarios). Test hardening: - test_re_imported_class_is_skipped_via_module_filter rewritten to actually exercise the __module__-equality check via sys.modules injection; previously passed via module-import-failed (relative-import failure), which would silently weaken if package registration changes. - test_user_declared_path_order_is_preserved: AC #8's multi-path order case (distinct bundles in [path_b, path_a]) was unasserted; added. - test_inline_module_import_failure_attributes_identity: AC #10's identity-on-partial-failure was covered for @official but not @extra; added. - test_uses_real_distributions_by_default tightened to assert ep placement (in kept, not in skipped) instead of exact-list equality, so a future Langflow-shipped manifest doesn't silently flip the assertion. bumped 64 -> 175 passing extension tests; 20 backend integration tests still pass. * fix(lfx): malformed pyproject manifests surface manifest-invalid instead of disappearing Closes the latest review finding on PR #12967: a pyproject.toml with a [tool.langflow.extension] section that has missing/invalid required fields was silently dropped because _pyproject_has_extension_section ran full schema validation via load_manifest and returned False on ValueError/TypeError. That conflated 'no section' with 'section malformed'. Fix: detect section presence only. _pyproject_has_extension_section now calls _read_pyproject_extension (TOML parse + key lookup, no schema check). Behavior: - Section absent or pyproject TOML unparseable -> False (treat as regular non-manifest package). - Section present and is a table (valid OR schema-invalid) -> True. - Section present but is not a table -> True; the author intended to declare an extension and load_extension will surface the typed error. This way a typo'd pyproject Extension produces a typed manifest-invalid LoadResult with extension_id attribution, and manifest-first precedence still suppresses its legacy component entry-points -- matching the 'typed load results on success/failure' contract for the supported pyproject manifest form. Tests: two new cases pin the behavior. test_malformed_pyproject_section_ surfaces_manifest_invalid asserts a typed load-failure result with distribution attribution; the second test pins manifest-first suppression for malformed pyproject distributions. * refactor(lfx): emit inline-path-unreadable, document reload contract, trim rot Closes the remaining nits on PR #12967: - inline-path-unreadable (new typed error code): a configured LANGFLOW_COMPONENTS_PATH entry that raises OSError on iterdir (typically permission-denied) now produces a typed LoadResult error carrying str(exc) instead of silently swallowing the message. - duplicate-inline-bundle hint trimmed: removed forward promise about hard-error-in-a-later-release; same actionability, no expiration. - discover_inline_bundles docstring trimmed from three paragraphs to two sentences (per CLAUDE.md anti-multi-paragraph rule). - _distribution_manifest_path docstring trimmed to one-liner. - installed_extension_roots dropped Used-by caller-narration list; manifest_owning_distributions docstring rewritten to call out the shadow-load risk for direct callers and point to load_installed_ extensions for the typed warning surface. - _discovery.import_bundle_module: replaced 'until that lands in a later milestone' rot with a single line ('Absolute imports only between bundle modules; relative imports unsupported.') AND added the single-load-per-process contract note documenting why LE-1018 reload must scrub registry/sys.modules before re-invoking the loader. - load_extension docstring grew a 'Single-load-per-process contract' block telling direct callers not to rely on this function for refresh. Tests: new test_unreadable_path_emits_inline_path_unreadable pins the OSError -> typed-error path. --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(lfx): atomic-swap Bundle reload pipeline + endpoint + CLI (LE-1018) (#12979) * feat(lfx): add single-Bundle loader and LANGFLOW_COMPONENTS_PATH discovery (LE-1015) Introduces lfx.extension.loader: the runtime that turns an Extension on disk into LoadedComponent records keyed by ext:<bundle>:<Class>@<slot>. Two paths in: - load_extension(root): one manifest, one Bundle, registered at @official. Re-checks multi-bundle at runtime (defense-in-depth vs. the schema). - discover_inline_bundles(paths): each subfolder of LANGFLOW_COMPONENTS_PATH is a Bundle at @extra. Walk order is platform-independent (sorted dirs, user-declared path order). First-wins on duplicate names; second emits duplicate-inline-bundle warning that names both paths. Manifest-first precedence helpers (installed_extension_roots, manifest_owning_distributions, filter_plugin_entry_points) let callers of the legacy langflow.plugins entry-point loader skip distributions that ship a manifest, so component entry-points are not double-registered. New typed error codes: module-import-failed, duplicate-component-name, duplicate-distribution, duplicate-inline-bundle, inline-bundle-name-invalid. Each ships with a format branch and a snapshot test. Tests cover the AC: single-bundle happy path, multi-bundle rejection, missing/empty/no-Component bundle, duplicate class names, deterministic walk order, recursive discovery, inline-bundle first-wins + dot-dir skip + bundle.json metadata, manifest-first precedence partition, PEP-503 distribution-name canonicalization. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(lfx): address LE-1015 review feedback - Drop the unproduced duplicate-distribution error code; LE-1022 will add it once startup-time discovery has a place to surface it. Restores the invariant that every code in ERROR_CODES has a producer. - Clarify that intra-bundle relative imports are NOT supported in v0; only absolute references between bundle modules work in this milestone. - Use strict=False when re-resolving bundle_root in the walker; the path was already existence-checked, and a concurrent removal in the narrow window should not raise across the loader's public boundary. - Hoist the json import out of _read_inline_bundle_json's body. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(lfx): split extension loader into a small subpackage (LE-1015) Addresses the file-size feedback from the LE-1015 review. The single 870-line loader.py becomes a flat package keyed off the four section banners that already existed inline: loader/ __init__.py # re-exports the public surface _types.py # SLOT constants, LoadedComponent, LoadResult _discovery.py # filesystem walk + importlib.util orchestration _detection.py # Component subclass identification (MRO heuristic) _orchestrator.py # load_extension, discover_inline_bundles _plugins.py # manifest-first precedence over langflow.plugins Largest file is now _orchestrator.py at 440 LOC (was 870); every file is well under the 800-LOC project guideline. No behavior change: the public import paths from lfx.extension are unchanged, all 38 loader tests still pass. ``_canonicalize_distribution`` is now exported as ``canonicalize_distribution`` from ``loader._plugins`` (it's a stable PEP-503 helper that downstream modules will reach for, so it loses the private underscore). The test suite is split to mirror the package: tests/unit/extension/loader/ conftest.py # shared fixtures, FakeDist, autouse scrub test_load_extension.py # @official slot, identity, failure modes test_inline_bundles.py # LANGFLOW_COMPONENTS_PATH, @extra slot test_plugins.py # manifest-first precedence helpers test_types.py # LoadedComponent, LoadResult, code parity Each test file imports its own slice of the public API and pulls fixtures from conftest, so a reader looking at one banner can read it in isolation. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(lfx): atomic-swap Bundle reload pipeline + endpoint + CLI (LE-1018) Five-stage reload (parallel staging load -> validate -> swap under write lock -> cleanup -> emit) for installed Bundles in Mode A. In-flight flows keep the pre-swap class via existing references; new flows pick up the post-swap class atomically; concurrent reloads on the same Bundle are rejected with reload-in-progress. Adds: * lfx/extension/registry.py -- BundleRegistry with per-bundle reload-in-progress guard and components_index.json writer * lfx/extension/reload.py -- the five-stage pipeline; events emission is stubbed (TODO LE-1017) so the swap mechanics can ship before the events service lands * loader: optional module_namespace param so Stage 1 lands in __reload_staging__.<id> instead of the live _lfx_ext.* namespace * errors: four new typed reload codes (reload-in-progress, reload-bundle-not-installed, reload-bundle-name-mismatch, reload-source-missing) with branch templates and snapshot tests * HTTP: POST /api/v1/extensions/{id}/bundles/{name}/reload, gated by the existing get_current_active_user dependency, returns 409 with a typed body for the in-progress collision case * CLI: lfx extension reload <id> [--bundle <name>] -- HTTP client against the dev server with text/json output and proper exit codes (--all is gated until LE-1019 lands the list endpoint) * tests: 16 reload-pipeline tests covering the AC matrix (rename round-trip, broken-bundle isolation, concurrent readers, in-flight flow, double-reload guard, bundle-name mismatch) plus 9 CLI client tests Mode A only. In Mode B/C bundle changes require a Docker image rebuild and the reload path is not exercised. The events emission in Stage 5 is intentionally stubbed -- the LE-1017 ticket will swap the body of _emit_bundle_reload_event in one place without touching the pipeline core. --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * [autofix.ci] apply automated fixes * feat(lfx): add `extension init` and `extension dev` CLIs (LE-1016) (#12968) * feat(lfx): add extension manifest schema, validate CLI, and error formatter (LE-1014) Foundation for the Bundle Separation iteration. Defines what a valid extension.json looks like (Pydantic models + Draft 2020-12 JSON Schema), ships the offline `lfx extension validate` command, and ships the single `format_extension_error` function that every other extension-system module will use to render structured errors. What's in lfx.extension: - `ExtensionManifest` / `BundleRef` / `LangflowCompat` Pydantic models with `extra="forbid"` so unknown fields fail loudly. Deferred fields (`services`, `routes`, `hooks`, `starter_projects`, `userConfig`) are reserved as None-only so non-null values produce a dedicated `field-deferred-in-this-milestone` error instead of a generic schema wall. `bundles` accepts a list but rejects length > 1 with `multi-bundle-deferred-in-this-milestone` (validator-enforced; the loader re-checks at install time in LE-1015). - `schema.build_schema()` + `build_schema_json()` produce the publishable artifact at schemas.langflow.org/extension/v1.json. - `ExtensionError` typed envelope and `format_extension_error` -- one branch per discriminant. Codes are registered in `ERROR_CODES`; an `ExtensionError` constructed with an unknown code raises at construction time, preventing producers from shipping without a matching renderer. - `validate_extension` runs four passes: manifest discovery + schema, path-safety (no `..`, no absolute paths, no symlink escape), AST inspection of every `.py` (syntax, Component subclass present, build() declared, top-level `import *`, top-level I/O primitives), and an opt-in `--execute-imports` that runs each module in a subprocess with a temporary HOME / TMPDIR / LANGFLOW_CONFIG_DIR and LANGFLOW_*/LFX_* env vars stripped. - `lfx extension validate` and `lfx extension schema` typer subcommands. Acceptance-criteria coverage in tests/unit/extension/: - Round-trips every v0 manifest field; deferred fields rejected; multi-bundle rejected with the dedicated discriminant. - JSON Schema validates the v0 example and rejects 12 malformed manifests with distinct error paths (>= 10 required by the ticket). - Median default-validate runtime < 100ms on the basic template. - Crafted side-effect bundle: default validate does NOT execute it (canary file is never written); `--execute-imports` DOES execute it and the canary appears, while LANGFLOW_* env vars are NOT inherited by the subprocess. - Snapshot tests for every code in ERROR_CODES; a guard test verifies ERROR_CODES and the snapshot table are in lockstep so future additions cannot ship without a format branch and a snapshot. Wiring: `lfx extension` is a sub-app under the Authoring help panel so future tickets (LE-1016 init/dev, LE-1018 reload) can attach without colliding with the existing `lfx validate` (which validates flow JSON, not extensions). * fix(lfx): fall back to tomli on Python 3.10 in extension manifest loader tomllib is stdlib only on 3.11+, but lfx supports 3.10-3.13. Use the existing tomli runtime dependency as the 3.10 fallback (same API, so the import alias keeps the rest of the module unchanged). Fixes ModuleNotFoundError seen in CI on the 3.10 job. * Update src/lfx/tests/unit/extension/test_schema.py Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update src/lfx/src/lfx/extension/schema.py Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update src/lfx/src/lfx/cli/_extension_commands.py Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * feat(lfx): add single-Bundle loader and LANGFLOW_COMPONENTS_PATH discovery (LE-1015) Introduces lfx.extension.loader: the runtime that turns an Extension on disk into LoadedComponent records keyed by ext:<bundle>:<Class>@<slot>. Two paths in: - load_extension(root): one manifest, one Bundle, registered at @official. Re-checks multi-bundle at runtime (defense-in-depth vs. the schema). - discover_inline_bundles(paths): each subfolder of LANGFLOW_COMPONENTS_PATH is a Bundle at @extra. Walk order is platform-independent (sorted dirs, user-declared path order). First-wins on duplicate names; second emits duplicate-inline-bundle warning that names both paths. Manifest-first precedence helpers (installed_extension_roots, manifest_owning_distributions, filter_plugin_entry_points) let callers of the legacy langflow.plugins entry-point loader skip distributions that ship a manifest, so component entry-points are not double-registered. New typed error codes: module-import-failed, duplicate-component-name, duplicate-distribution, duplicate-inline-bundle, inline-bundle-name-invalid. Each ships with a format branch and a snapshot test. Tests cover the AC: single-bundle happy path, multi-bundle rejection, missing/empty/no-Component bundle, duplicate class names, deterministic walk order, recursive discovery, inline-bundle first-wins + dot-dir skip + bundle.json metadata, manifest-first precedence partition, PEP-503 distribution-name canonicalization. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(lfx): address LE-1015 review feedback - Drop the unproduced duplicate-distribution error code; LE-1022 will add it once startup-time discovery has a place to surface it. Restores the invariant that every code in ERROR_CODES has a producer. - Clarify that intra-bundle relative imports are NOT supported in v0; only absolute references between bundle modules work in this milestone. - Use strict=False when re-resolving bundle_root in the walker; the path was already existence-checked, and a concurrent removal in the narrow window should not raise across the loader's public boundary. - Hoist the json import out of _read_inline_bundle_json's body. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor(lfx): split extension loader into a small subpackage (LE-1015) Addresses the file-size feedback from the LE-1015 review. The single 870-line loader.py becomes a flat package keyed off the four section banners that already existed inline: loader/ __init__.py # re-exports the public surface _types.py # SLOT constants, LoadedComponent, LoadResult _discovery.py # filesystem walk + importlib.util orchestration _detection.py # Component subclass identification (MRO heuristic) _orchestrator.py # load_extension, discover_inline_bundles _plugins.py # manifest-first precedence over langflow.plugins Largest file is now _orchestrator.py at 440 LOC (was 870); every file is well under the 800-LOC project guideline. No behavior change: the public import paths from lfx.extension are unchanged, all 38 loader tests still pass. ``_canonicalize_distribution`` is now exported as ``canonicalize_distribution`` from ``loader._plugins`` (it's a stable PEP-503 helper that downstream modules will reach for, so it loses the private underscore). The test suite is split to mirror the package: tests/unit/extension/loader/ conftest.py # shared fixtures, FakeDist, autouse scrub test_load_extension.py # @official slot, identity, failure modes test_inline_bundles.py # LANGFLOW_COMPONENTS_PATH, @extra slot test_plugins.py # manifest-first precedence helpers test_types.py # LoadedComponent, LoadResult, code parity Each test file imports its own slice of the public API and pulls fixtures from conftest, so a reader looking at one banner can read it in isolation. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(lfx): add `extension init` and `extension dev` CLIs (LE-1016) The two scaffolding CLIs an Extension author types: - `lfx extension init <target>` writes the basic single-Bundle template (manifest with $schema, README, .gitignore, one Component subclass + a pytest smoke test). AC #1: the generated extension validates clean against LE-1014. AC #2: the generated test file is a valid pytest module that exercises the component's build() method. AC #3: any --template other than 'basic' fails with a typed template-deferred-in-this-milestone error and a non-zero exit. Refuses to scaffold over a non-empty target dir. - `lfx extension dev <target>` validates the local extension, records its absolute path in <config_dir>/extensions/dev_extensions.json, prints reload instructions, and execs `langflow run` (or `python -m langflow` when langflow isn't on PATH). --skip-launch registers without launching (used by tests + external dev-server scripts); --skip-validate lets authors register a known-broken manifest to debug it under the loader. Stack: - Wave 0: error codes (extension-target-exists, extension-target-invalid, local-extension-missing) with format branches and snapshot tests. - Wave 1: lfx.extension.init_template -- pure-data scaffolder, no Typer dependency so the CLI is a thin shell over it. - Wave 1: lfx.extension.dev_registry -- atomic JSON state file under the langflow user-cache dir; helpers for register / list / unregister / load_dev_extensions / dev_extension_component_paths. - Wave 2: lfx.cli._extension_commands gains init/dev subcommands. - Wave 2: langflow.main lifespan hook reads the dev registry after bundle loading and extends components_path with each registered bundle dir, so the existing palette discovery picks up dev extensions. Missing paths surface as local-extension-missing warnings (AC #5) without aborting startup. Tests (84 new, 197 total in tests/unit/extension/): - test_init_template.py: AC scenarios + identifier derivation + deterministic file shape. - test_dev_registry.py: register/list/unregister round-trip, idempotent re-register refreshes timestamp, malformed state file treated as empty, missing-path warning, recovery when path reappears, env-var override precedence. - test_cli.py: AC #1 init->validate, AC #3 deferred templates, --skip-launch registers without launching, --skip-validate short-circuits the pre-flight pass. - test_errors.py: snapshot rows for all three new codes; the every-known-code-has-a-snapshot test enforces parity. LE-1018 (reload) reuses load_dev_extensions; LE-1022 (installed-pkg discovery) shares the components_path extension pattern. AC #4 ("boots Langflow with the extension visible in the palette within 5s") is delivered jointly by `extension dev` (registers + execs) and the lifespan hook (loads on startup). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(lfx): address LE-1016 review feedback Fixes the four HIGH issues + the elevated LOW from the review pass: 1. dev_extension_component_paths now forwards EVERY warning, not just local-extension-missing. Previously a duplicate-component-name (or any future warning code) was silently dropped, hiding real signal from the lifespan hook's logs. 2. Defensive emit when a LoadResult has components but source_path is None. The current loader always sets source_path, but a future hand-built LoadResult could violate that contract; we now surface a typed local-extension-missing error rather than dropping the extension silently. 3. Replaced the fragile ``min(len(parts))`` bundle-root selection with a relative-to-source-path measurement. Handles deep-vs-shallow sibling extensions correctly without depending on absolute path depth. 4. Generated README now documents the langflow/lfx prerequisite under the Develop section so authors know `pytest` requires the lfx environment, not just Python. 5. Forced LANGFLOW_LAZY_LOAD_COMPONENTS=false unconditionally in the `extension dev` exec env (was setdefault, which let a developer's global lazy-loading export silently hide their dev components from the palette and miss AC #4's 5s budget). Plus three MEDIUMs: - sys.modules cleanup in test_generated_test_file_runs_against_generated_component so a later test importing the same dotted path doesn't pick up a stale module from a deleted tmp_path. Component instantiation moved inside the try block because Component.__init__ uses inspect.getsourcefile against self.__class__'s still-live module. - Added regex-drift test that pins the init_template patterns to match manifest.py's so a schema regex change can't quietly produce invalid scaffolded manifests. - Added two new dev_registry tests covering the forward-all-warnings contract and the source_path=None defense. Tests: 201 passing (4 new); ruff check + format clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: LangflowCompat -> LfxCompat * fix: Remove references to ticket * fix: encode maxItems constraint in schema * fix: deferred fields and schema version * Fix ruff errors * fix: align loader tests with renamed manifest API and strip ticket refs The merge of feat/extension-validate brought in the LfxCompat / compat rename, but the loader test fixtures still used LangflowCompat / bundle_api and failed at the manifest layer. Update conftest.py + test_load_extension.py to the post-rename API. Strip 17 LE-XXXX ticket references from loader source files, errors.py loader-specific comments, and the four loader test docstrings, matching the convention applied to LE-1014. Descriptive prose preserved. Promote _BUNDLE_NAME_RE to BUNDLE_NAME_RE on the manifest module so the loader's orchestrator no longer reaches across modules into a private name. * fix(lfx): align init template with renamed manifest API After merging feat/extension-loader into this branch, two surfaces fell out of sync with the renamed manifest schema: - init_template generates extension.json with `lfx: {bundle_api: [1]}`, but the validator now requires `lfx: {compat: ["1"]}` per LfxCompat. This made `test_basic_template_validates_clean` fail with manifest-invalid (`lfx.compat: Field required; lfx.bundle_api: Extra inputs are not permitted`). - test_init_template_regexes_match_manifest_schema reads `manifest_mod._BUNDLE_NAME_RE`, but that symbol was promoted to public `BUNDLE_NAME_RE` in |
|||
| d017e156cd |
fix: add stream toggle back to agent (#13155)
* add stream toggle back to agent * chore: auto-bake note keys and regenerate backend locales/en.json [skip ci] * ci: stop transient Windows npm/cache flakes from failing frontend tests The nightly frontend job fails almost every day on a single Windows Playwright shard, never on actual test logic. With fail-fast:false over ~70 Windows shards each making several cache/artifact-service calls, a transient GitHub Actions cache/artifact hiccup on any one shard flips needs.setup-and-test.result to failure and reds the whole nightly (observed steps: Setup Node.js Environment, Cache Playwright Browsers, Upload Playwright Coverage Artifact). - Decouple npm caching from actions/setup-node (its internal cache step can't be made non-fatal) and replace it with a standalone actions/cache@v5 step marked continue-on-error. - Mark Cache Playwright Browsers and the artifact-upload steps continue-on-error so an infra blip can no longer fail a test shard. Only a real test/browser failure can fail a shard now. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * [autofix.ci] apply automated fixes --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| bd35587957 |
chore: Add non-blocking test coverage advisor for PRs (#13148)
add checker to verify tests non blocker |
|||
| 66912d4a53 |
Merge main source updates into release-1.10.0
# Conflicts: # docker/build_and_push.Dockerfile # docker/build_and_push_backend.Dockerfile # docker/build_and_push_base.Dockerfile # docker/build_and_push_ep.Dockerfile # docker/build_and_push_with_extras.Dockerfile |
|||
| 53c62bceb0 |
chore: Block hardcoded Tailwind palette via Biome lint (#13125)
* add biome checker for hardcoded pallete * add biome checker on ci * [autofix.ci] apply automated fixes * lint-js fix * improve CI job * biome fixes * unblock CI on biome job --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 5e9f0c37bc |
Merge branch 'release-1.9.3' into release-1.10.0
# Conflicts: # .secrets.baseline # docs/package.json # pyproject.toml # src/backend/base/langflow/initial_setup/starter_projects/Vector Store RAG.json # src/backend/base/pyproject.toml # src/backend/tests/unit/components/files_and_knowledge/test_retrieval.py # src/frontend/package-lock.json # src/frontend/package.json # src/frontend/src/components/core/parameterRenderComponent/components/modelInputComponent/__tests__/ModelInputComponent.test.tsx # src/frontend/src/components/core/parameterRenderComponent/components/modelInputComponent/index.tsx # src/frontend/src/modals/modelProviderModal/hooks/useProviderConfiguration.ts # src/lfx/pyproject.toml # src/lfx/src/lfx/_assets/component_index.json # src/sdk/pyproject.toml # uv.lock |
|||
| b695f97cd3 | fix: More python 3.14 compatibility cleanup | |||
| 883872f95f | Update release.yml | |||
| a80cf1c649 |
chore: support Python 3.14 (#13085)
* feat: upgrade Docker images to Python 3.14 (experimental)
- Update pyproject.toml: requires-python from <3.14 to <3.15
- Update all 5 Dockerfiles to use Python 3.14:
- Builder stage: python3.12-trixie-slim → python3.14-trixie-slim
- Runtime stage: python:3.12-slim-trixie → python:3.14-slim-trixie
- src/backend/base/pyproject.toml
- docker/build_and_push_base.Dockerfile
- docker/build_and_push.Dockerfile
- docker/build_and_push_backend.Dockerfile
- docker/build_and_push_with_extras.Dockerfile
- docker/build_and_push_ep.Dockerfile
Python 3.14.5 was released on May 10, 2026. Upgrading to the latest
Python version should help reduce CVE vulnerabilities in Docker images.
This is an experimental change to test Python 3.14 compatibility:
- Docker images will use Python 3.14
- CI/CD workflows still test on Python 3.10-3.13
- Nightly build will validate if dependencies work with 3.14
- Can be reverted quickly if issues are found
- Monitor nightly build for failures
- If successful, update CI/CD workflows to add Python 3.14 to test matrix
- If failures occur, revert and investigate compatibility issues
* chore: support Python 3.14
Bump requires-python upper bound to <3.15 across langflow, langflow-base,
lfx, and langflow-sdk, and add 3.14 to CI test matrices so PRs are gated
on 3.14 compatibility.
Conditional pins for transitive deps without 3.14 wheels at the existing
caps:
- onnxruntime: >=1.26 on 3.14 (existing <1.24 cap retained for 3.10)
- faiss-cpu: >=1.13.2 on 3.14 (existing ==1.9.0.post1 retained for <3.14)
* chore: marker-gate IBM watsonx packages for Python 3.14
ibm-watsonx-ai 1.3.x cannot import on Python 3.14: its StrEnum subclasses
override __init__ in a way that conflicts with 3.14's reworked enum
__set_name__ path (TypeError on KnowledgeBaseFieldRole class creation).
Cap ibm-watsonx-ai, langchain-ibm, and the ibm-watsonx-orchestrate-*
extras at python_version<'3.14' until upstream adapts. Watsonx component
imports are already lazy, so this surfaces only at component-access time
on 3.14, where the existing ImportError handler in
lfx.components.ibm.__init__ degrades it gracefully.
test_model_utils.py imports ChatWatsonx at module top to verify
get_model_name resolves model_id; guard that import so the test
module skips on 3.14 instead of breaking collection.
* [autofix.ci] apply automated fixes
* chore: upgrade remaining Docker images to Python 3.14
build_and_push*.Dockerfile already moved to 3.14 in the merge from
feat/upgrade-python-3.14-docker-images. Apply the same bump to the
dev, devcontainer, and lfx Docker images so all in-repo Dockerfiles
share one Python version.
* [autofix.ci] apply automated fixes
* chore: gate 3.14-broken extras to python_version<'3.14'
cuga (and its transitive fastembed -> py-rust-stemmers source build),
altk/agent-lifecycle-toolkit (re-pulls ibm-watsonx-ai which was already
gated), langchain-pinecone, langwatch, ragstack-ai-knowledge-store, and
OpenDsStar all pin themselves below 3.14 upstream. Without a marker
guard, the workspace lock still tries to install them and a Docker
`uv sync` then attempts source builds that require Rust (CI Docker
test failure with py-rust-stemmers 0.1.5).
Add python_version<'3.14' (or <'3.13' for ragstack) to each pin so
those packages are simply omitted from the 3.14 install set until
upstream catches up. uv pip check is now clean on 3.14.2.
* test: skip test_altk_agent on Python 3.14
altk (agent-lifecycle-toolkit) is gated to python_version<'3.14'
upstream and now via the langflow-base [altk] extra marker. The test
imports altk at module top to exercise ALTKAgentComponent; guard the
import so collection skips on 3.14 instead of failing.
* test: skip remaining altk tests on Python 3.14
Three more test modules import lfx.base.agents.altk_* at module top,
which transitively imports altk. Add the same module-level skip guard
as test_altk_agent.py:
- test_altk_agent_logic.py
- test_altk_agent_tool_conversion.py
- test_conversation_context_ordering.py
* fix(calculator): replace removed ast.Num with ast.Constant for Python 3.14
ast.Num was deprecated in Python 3.8 in favor of ast.Constant and
removed entirely in 3.14. The calculator tool and its core walker
crashed on 3.14 with 'module ast has no attribute Num'.
Switch the isinstance checks to ast.Constant + isinstance(node.value,
(int, float)), and drop the now-dead ast.Num backwards-compat branch
in calculator_core.py (the ast.Constant branch already handles every
input it would have matched). Update the parser unit-test fixtures
to construct ast.Constant nodes.
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* test: skip LangWatch HTTP instrumentation tests on Python 3.14
langwatch is gated to python_version<'3.14' upstream. The
TestLangWatchHttpInstrumentation class patches langwatch.setup and
langwatch.trace inside a fixture, which requires langwatch to be
importable; on 3.14 the test errors with ModuleNotFoundError.
Guard the class with a skipif on langwatch availability.
* test: allow IBM and altk components to be missing on Python 3.14
test_all_modules_importable enforces that every component in __all__
imports cleanly. On 3.14 the ibm-watsonx-ai, langchain-ibm, and altk
packages are gated upstream and intentionally not installed, so the
WatsonxAI, WatsonxEmbeddings, and ALTKAgent components fail to import
as designed.
- test_all_components_in_categories_importable: accept a known-gated
deny-list on 3.14 instead of failing.
- test_all_lfx_component_modules_directly_importable: extend the
existing 'missing optional dependency' allowlist with altk,
langchain_ibm, and ibm_watsonx_ai.
* fix(lfx): pass ensure_exists to user_cache_dir for Python 3.14
Python 3.14 tightened PurePath.__init__ to reject unknown keyword
arguments. The KeyedWorkerLockManager constructor was passing
ensure_exists=True to Path() instead of user_cache_dir(), which
silently worked on 3.10-3.13 but raises TypeError on 3.14 and also
meant the cache directory was never actually being created.
Move the kwarg to user_cache_dir() where it belongs and update the
two unit tests that asserted the buggy call shape.
* [autofix.ci] apply automated fixes
* test: accept either ZIP or JSON error path on Python 3.14
Python 3.14's zipfile.is_zipfile() now validates the central-directory
signature in addition to EOCD, so the garbage+EOCD payload no longer
passes the is_zipfile() dispatch in the /flows/upload/ route. The
endpoint still returns 400 with a descriptive detail (now from the JSON
branch); only the message wording differs, which the test was asserting
verbatim.
* fix(lfx): normalize cors_origins ['*'] back to '*' on Python 3.14
Pydantic-settings on Python 3.14 parses the env var '*' into ['*']
before the cors_origins field validator runs (the list[str] | str union
resolves differently than on 3.10-3.13). Collapse that back to the
bare-string wildcard so downstream consumers — including
warn_about_future_cors_changes and the test suite — see the same shape
on every supported Python version.
---------
Co-authored-by: vijay kumar katuri <vijay.katuri@ibm.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
(cherry picked from commit
|
|||
| 1955f8fae5 |
chore: support Python 3.14 (#13085)
* feat: upgrade Docker images to Python 3.14 (experimental) ## Changes - Update pyproject.toml: requires-python from <3.14 to <3.15 - Update all 5 Dockerfiles to use Python 3.14: - Builder stage: python3.12-trixie-slim → python3.14-trixie-slim - Runtime stage: python:3.12-slim-trixie → python:3.14-slim-trixie ## Files Updated - src/backend/base/pyproject.toml - docker/build_and_push_base.Dockerfile - docker/build_and_push.Dockerfile - docker/build_and_push_backend.Dockerfile - docker/build_and_push_with_extras.Dockerfile - docker/build_and_push_ep.Dockerfile ## Rationale Python 3.14.5 was released on May 10, 2026. Upgrading to the latest Python version should help reduce CVE vulnerabilities in Docker images. ## Testing Strategy This is an experimental change to test Python 3.14 compatibility: - Docker images will use Python 3.14 - CI/CD workflows still test on Python 3.10-3.13 - Nightly build will validate if dependencies work with 3.14 - Can be reverted quickly if issues are found ## Next Steps - Monitor nightly build for failures - If successful, update CI/CD workflows to add Python 3.14 to test matrix - If failures occur, revert and investigate compatibility issues * chore: support Python 3.14 Bump requires-python upper bound to <3.15 across langflow, langflow-base, lfx, and langflow-sdk, and add 3.14 to CI test matrices so PRs are gated on 3.14 compatibility. Conditional pins for transitive deps without 3.14 wheels at the existing caps: - onnxruntime: >=1.26 on 3.14 (existing <1.24 cap retained for 3.10) - faiss-cpu: >=1.13.2 on 3.14 (existing ==1.9.0.post1 retained for <3.14) * chore: marker-gate IBM watsonx packages for Python 3.14 ibm-watsonx-ai 1.3.x cannot import on Python 3.14: its StrEnum subclasses override __init__ in a way that conflicts with 3.14's reworked enum __set_name__ path (TypeError on KnowledgeBaseFieldRole class creation). Cap ibm-watsonx-ai, langchain-ibm, and the ibm-watsonx-orchestrate-* extras at python_version<'3.14' until upstream adapts. Watsonx component imports are already lazy, so this surfaces only at component-access time on 3.14, where the existing ImportError handler in lfx.components.ibm.__init__ degrades it gracefully. test_model_utils.py imports ChatWatsonx at module top to verify get_model_name resolves model_id; guard that import so the test module skips on 3.14 instead of breaking collection. * [autofix.ci] apply automated fixes * chore: upgrade remaining Docker images to Python 3.14 build_and_push*.Dockerfile already moved to 3.14 in the merge from feat/upgrade-python-3.14-docker-images. Apply the same bump to the dev, devcontainer, and lfx Docker images so all in-repo Dockerfiles share one Python version. * [autofix.ci] apply automated fixes * chore: gate 3.14-broken extras to python_version<'3.14' cuga (and its transitive fastembed -> py-rust-stemmers source build), altk/agent-lifecycle-toolkit (re-pulls ibm-watsonx-ai which was already gated), langchain-pinecone, langwatch, ragstack-ai-knowledge-store, and OpenDsStar all pin themselves below 3.14 upstream. Without a marker guard, the workspace lock still tries to install them and a Docker `uv sync` then attempts source builds that require Rust (CI Docker test failure with py-rust-stemmers 0.1.5). Add python_version<'3.14' (or <'3.13' for ragstack) to each pin so those packages are simply omitted from the 3.14 install set until upstream catches up. uv pip check is now clean on 3.14.2. * test: skip test_altk_agent on Python 3.14 altk (agent-lifecycle-toolkit) is gated to python_version<'3.14' upstream and now via the langflow-base [altk] extra marker. The test imports altk at module top to exercise ALTKAgentComponent; guard the import so collection skips on 3.14 instead of failing. * test: skip remaining altk tests on Python 3.14 Three more test modules import lfx.base.agents.altk_* at module top, which transitively imports altk. Add the same module-level skip guard as test_altk_agent.py: - test_altk_agent_logic.py - test_altk_agent_tool_conversion.py - test_conversation_context_ordering.py * fix(calculator): replace removed ast.Num with ast.Constant for Python 3.14 ast.Num was deprecated in Python 3.8 in favor of ast.Constant and removed entirely in 3.14. The calculator tool and its core walker crashed on 3.14 with 'module ast has no attribute Num'. Switch the isinstance checks to ast.Constant + isinstance(node.value, (int, float)), and drop the now-dead ast.Num backwards-compat branch in calculator_core.py (the ast.Constant branch already handles every input it would have matched). Update the parser unit-test fixtures to construct ast.Constant nodes. * [autofix.ci] apply automated fixes * [autofix.ci] apply automated fixes (attempt 2/3) * test: skip LangWatch HTTP instrumentation tests on Python 3.14 langwatch is gated to python_version<'3.14' upstream. The TestLangWatchHttpInstrumentation class patches langwatch.setup and langwatch.trace inside a fixture, which requires langwatch to be importable; on 3.14 the test errors with ModuleNotFoundError. Guard the class with a skipif on langwatch availability. * test: allow IBM and altk components to be missing on Python 3.14 test_all_modules_importable enforces that every component in __all__ imports cleanly. On 3.14 the ibm-watsonx-ai, langchain-ibm, and altk packages are gated upstream and intentionally not installed, so the WatsonxAI, WatsonxEmbeddings, and ALTKAgent components fail to import as designed. - test_all_components_in_categories_importable: accept a known-gated deny-list on 3.14 instead of failing. - test_all_lfx_component_modules_directly_importable: extend the existing 'missing optional dependency' allowlist with altk, langchain_ibm, and ibm_watsonx_ai. * fix(lfx): pass ensure_exists to user_cache_dir for Python 3.14 Python 3.14 tightened PurePath.__init__ to reject unknown keyword arguments. The KeyedWorkerLockManager constructor was passing ensure_exists=True to Path() instead of user_cache_dir(), which silently worked on 3.10-3.13 but raises TypeError on 3.14 and also meant the cache directory was never actually being created. Move the kwarg to user_cache_dir() where it belongs and update the two unit tests that asserted the buggy call shape. * [autofix.ci] apply automated fixes * test: accept either ZIP or JSON error path on Python 3.14 Python 3.14's zipfile.is_zipfile() now validates the central-directory signature in addition to EOCD, so the garbage+EOCD payload no longer passes the is_zipfile() dispatch in the /flows/upload/ route. The endpoint still returns 400 with a descriptive detail (now from the JSON branch); only the message wording differs, which the test was asserting verbatim. * fix(lfx): normalize cors_origins ['*'] back to '*' on Python 3.14 Pydantic-settings on Python 3.14 parses the env var '*' into ['*'] before the cors_origins field validator runs (the list[str] | str union resolves differently than on 3.10-3.13). Collapse that back to the bare-string wildcard so downstream consumers — including warn_about_future_cors_changes and the test suite — see the same shape on every supported Python version. --------- Co-authored-by: vijay kumar katuri <vijay.katuri@ibm.com> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> |
|||
| 4f9e0da208 |
feat: regression bucket (#12948)
* initial-plan * create-initial-yaml-files * add-info-to-bug-report * add-regression-stub-workflow * use-create-comment-instead-of-github-script |
|||
| a3723911e6 | fix: Restore resolved release-branch ref in nightly build (#13064) | |||
| 6e4475c139 | fix: Unblock nightly install on macOS x86_64 due OpenDsStar (#13061) | |||
| db5865d674 | fix(tests): Stabilize Windows-only Playwright e2e failures (#13062) | |||
| de148c70b7 | chore: bump backend unit test timeout from 20 to 30 minutes | |||
| a4d875a9a1 | chore: bump backend unit test timeout from 20 to 30 minutes | |||
| 94981c443d |
fix: update Docker base images to Trixie and force pull latest images in nightly builds (#13015)
- Update builder stage: bookworm-slim → trixie-slim (5 Dockerfiles) - Update runtime stage: python:3.12.13-slim-trixie → python:3.12-slim-trixie - Add pull: true to 6 Docker build steps in nightly workflow - Forces pulling latest base images instead of using cached layers This resolves CVE vulnerabilities in Docker images by ensuring we use the latest Debian Trixie base images instead of cached Bookworm layers. |
|||
| af8871cf61 |
fix: force pull latest base images in Docker nightly builds (#13014)
- Add pull: true to all docker build steps in nightly workflow - Forces Docker to pull latest python:3.12-slim-trixie instead of using cached layers - Ensures Debian Trixie base images are used instead of cached Bookworm layers - Resolves issue where Docker layer caching prevented CVE fixes from taking effect |
|||
| f08885f20c |
ci: block PR titles ending in ellipsis (#13004)
Adds a validate-pr-title job to ci.yml that fails on PRs whose title ends with '...' or '…'. Wired into the CI Success aggregate so it acts as a merge gate. Skipped on merge_group, workflow_dispatch, and workflow_call where no PR title is available. |
|||
| 60627bec3a |
chore: Add DESIGN.md for Langflow's visual design system (#12830)
* docs: Add DESIGN.md specification for Langflow's visual design system Machine-readable design tokens (YAML frontmatter) paired with human-readable design rationale following the open-source DESIGN.md format from Google Labs. Intended for AI agents generating UI that must match Langflow's visual identity. Covers 129 color tokens, 15 typography scales, 50 component definitions, spacing/rounding/elevation systems, dark mode strategy, and the 14-hue data type color system used for node port encoding. * ci: Add DESIGN.md lint workflow Runs `@google/design.md lint` against DESIGN.md on pull requests that modify the file. Catches spec violations, broken token references, and WCAG AA contrast failures before merge. CLI version is pinned via env var so format spec changes require a deliberate bump. * ci: Integrate DESIGN.md lint into CI Success pipeline Replaces the standalone workflow with a job inside ci.yml so it gates the "CI Success" aggregate check. Path-filter skips the job on PRs that don't touch DESIGN.md, so cost is near-zero for normal PRs. |
|||
| 9b11f5a383 |
feat: backend i18n — serve translated component metadata via Accept-Language (#12517)
* feat: add IBM Globalization Pipeline integration and i18n setup
- Add GP REST API client with GP-HMAC authentication (scripts/gp/gp_client.py)
- Add upload/download scripts for syncing strings with GP
- Set up i18next + react-i18next with 7 language support (en, fr, ja, es, de, pt, zh-Hans)
- Add 48 UI strings in flat dot notation to en.json (from alerts_constants)
- Add GitHub Actions for automated upload on en.json changes and daily translation download
* [autofix.ci] apply automated fixes
* fix: resolve ruff linting issues in GP scripts
- Fix quote style, import ordering, docstring format
- Use Path instead of os.makedirs/open/os.path.join
- Add missing timeouts to requests calls
- Move noqa comments to correct lines for S501
* feat: migrate all frontend UI strings to i18n for GP localization
- Replace all hardcoded user-facing strings with t() calls across 80+ components, pages, modals, and utilities
- Add 326 translation keys to en.json covering errors, alerts, dialogs, chat, flow, settings, store, table, output, nav, auth, and more
- Add translated locale files for fr, es, de, pt, ja, zh-Hans (downloaded from Globalization Pipeline)
- Migrate alerts_constants.tsx and constants.ts string usages to react-i18next
- Support non-React files (stores, utils) via i18n.t() direct calls
* feat: migrate sidebar strings to i18n (Phase 4)
- Add 56 new translation keys for sidebar categories, nav items, labels, buttons, and empty states
- Convert SIDEBAR_CATEGORIES display_names to i18n key references in styleUtils.ts
- Update 13 sidebar components to use t() for all user-facing strings
- Refresh all 6 locale files from GP (382 total keys)
- Add BACKEND_STRINGS_STRATEGY.md documenting plan for component display_name i18n
* [autofix.ci] apply automated fixes
* fix: add react-i18next mock and fix sidebar nav tests for i18n migration
- Add global react-i18next mock in jest.setup.js using en.json lookups so
t(key) returns English strings instead of raw keys in test environment
- Fix sidebarSegmentedNav tests: update NAV_ITEMS expectations to use i18n
keys, and use en.json lookups for tooltip/accessibility label assertions
* feat: add LanguageSelector dropdown to globalization pipeline
Cherry-picked frontend-only changes from feat/gp-backend-i18n (6ab21559db, 3e274a84e3):
- Add LanguageSelector component with dropdown to switch UI language
- Wire LanguageSelector into AccountMenu header
- Persist language preference to localStorage in i18n.ts
- Send Accept-Language header via useCustomApiHeaders (reactive via useTranslation)
No backend files included.
* [autofix.ci] apply automated fixes
* ci: add GP_TEST environment to gp-download and gp-upload workflows
* temp: add feature branch push trigger for workflow testing
* temp: trigger gp-upload workflow test
* fix: use correct GP_test environment name in workflows
* fix: use vars for GP_INSTANCE and GP_BUNDLE
* [autofix.ci] apply automated fixes
* fix: correct environment name to GP-test (hyphen not underscore)
* chore: update translations from Globalization Pipeline [skip ci]
* [autofix.ci] apply automated fixes
* chore: update translations from Globalization Pipeline [skip ci]
* temp: trigger gp-upload workflow test
* ci: add download-gp-bundle job to nightly build pipeline
Downloads frontend translations from Globalization Pipeline after
create-nightly-tag and before frontend tests run, ensuring tests
always validate the latest translated locale files.
- Frontend tests (Linux/Windows) now depend on download-gp-bundle
- Backend unit tests are unaffected (no frontend locale dependency)
- GP failure blocks release-nightly-build (same severity as linux tests)
* chore: remove temporary dev files from gp scripts directory
Remove BACKEND_STRINGS_STRATEGY.md (internal planning doc), test_auth.py
(GP auth debugging script), and en.json (dev-time string snapshot).
Also add venv/ to .gitignore to prevent accidental commits of the local virtualenv.
* [autofix.ci] apply automated fixes
* chore: update translations from Globalization Pipeline [skip ci]
* [autofix.ci] apply automated fixes
* chore: update translations from Globalization Pipeline [skip ci]
* feat(i18n): move language selector from account menu to Settings > General
- Add LanguageForm card component in GeneralPage following the existing
Card pattern (ProfilePictureForm), with immediate language switching
- English marked as "(Recommended)" via i18n key
- Remove Language row from AccountMenu dropdown
- Add settings.languageTitle/Description/Recommended keys to en.json
for upload to Globalization Pipeline
* feat(i18n): refactor language constants and improve GP pipeline
- Extract SUPPORTED_LANGUAGES into src/frontend/src/constants/languages.ts
- Update LanguageForm to import from shared constants, add aria-label
- Add settings.languageSelectAriaLabel key to en.json
- Update LanguageSelector component to use shared SUPPORTED_LANGUAGES
- Fix gp_client and download_translations scripts
- Update GP upload/download/nightly GitHub Actions workflows
- Add GP script tests
* [autofix.ci] apply automated fixes
* ci(gp): trigger upload on release branches, download via dispatch only
- Upload now triggers on push to release-* branches (instead of main)
so translators get strings once they're finalized on the release branch
- Download removes the daily cron schedule; workflow_dispatch only
since the nightly build already handles scheduled runs
* chore: update translations from Globalization Pipeline
* fix(i18n): address PR review comments — tests, nightly build decoupling, GP test workflow
- Add pytest tests for gp_client.py (HMAC auth, HTTP errors, timeout)
- Add pytest tests for upload_strings.py and download_translations.py
- Add conftest.py to set sys.path so GP scripts can be imported from repo root
- Add scripts/gp/__init__.py to make gp a proper package for test imports
- Add gp-test.yml workflow to run GP script tests on PRs touching scripts/gp/**
- Decouple download-gp-bundle from nightly build chain:
- Add continue-on-error: true so GP failure never blocks the build
- Remove download-gp-bundle from needs/if of frontend-tests-linux,
frontend-tests-windows, and release-nightly-build
- Add warning annotation step that fires on GP download failure
* feat(i18n): lazy-load non-English locale files via Vite dynamic imports
- Remove 6 static locale imports from i18n.ts; only en.json is bundled
- Export loadLanguage() which dynamically imports a locale chunk on demand
and caches it via i18n.hasResourceBundle (no-op on repeat calls)
- Update index.tsx to await loadLanguage(detectedLang) before rendering,
preventing an English flash for non-English users
- Make handleChange async in LanguageForm and LanguageSelector to await
loadLanguage before calling i18n.changeLanguage
- Add i18n.test.ts covering loadLanguage: en no-op, new language load,
cache hit, and multiple independent languages
- Update LanguageForm.test.tsx to mock @/i18n and assert loadLanguage
is called before changeLanguage on language switch
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix: add ruff ignores for scripts/gp/tests
- Add per-file ignores for scripts/gp/tests/* to fix CI failures
- Ignore S101 (assert usage), TRY003, EM101 for test files
- Follows existing pattern for other test directories
* [autofix.ci] apply automated fixes
* fix(ci): run GP translation download before nightly tag creation
Previously download-gp-bundle ran after create-nightly-tag, so fresh
translations were committed to the branch after the tag was already
created. The nightly Docker image builds from the tag, meaning it never
included the day's translations.
Fix: move download-gp-bundle to run before create-nightly-tag so the
tag is created on a commit that already includes the latest translations.
* fix(ui): replace native select with Radix UI Select in LanguageForm
Swaps the native <select> element for the existing Radix UI Select
component to get consistent padding on both sides of the chevron,
removing reliance on browser-rendered chevron positioning.
* feat: backend i18n — serve translated component metadata via Accept-Language
- Add locale middleware (set_locale) in main.py to parse Accept-Language header
- Add translate_component_dict() in utils/i18n.py to substitute display_names
- Add backend locale files (en/fr/es/de/pt/ja/zh-Hans) with 4,748 keys
- Add GP scripts: extract_backend_strings.py, upload_backend_strings.py, download_backend_translations.py
- Add CI workflows: gp-backend-check.yml (PR validation + auto-commit), gp-backend-upload.yml (release branch upload)
- /api/v1/all returns translated component metadata for non-English locales
* chore: auto-regenerate backend locales/en.json [skip ci]
* chore: auto-regenerate backend locales/en.json [skip ci]
* refactor: simplify GP backend workflows to remove duplication
- gp-backend-check: drop redundant --check job, keep only auto-commit
- gp-backend-upload: remove extraction/commit steps, trigger on en.json
path change, and add latest-release-branch guard (mirrors gp-upload.yml)
* feat: add nightly backend translation download job to gp-download workflow
Mirrors the existing frontend download job — resolves latest release branch,
runs download_backend_translations.py, and opens an auto-merge PR.
* [autofix.ci] apply automated fixes
* fix: skip backend translation download on nightly schedule
Backend download only runs on workflow_dispatch — the nightly cron is
for the frontend build pipeline only.
* fix: remove backend GP download from nightly build workflow
Backend translations are now downloaded via workflow_dispatch in
gp-download.yml, not as part of the nightly build pipeline.
* fix: remove frontend GP download from nightly build workflow
Frontend translations are now downloaded via nightly cron in
gp-download.yml, not as part of the nightly build pipeline.
* fix: remove en.json from check workflow trigger paths
The extraction script only reads from lfx.components — en.json is never
edited directly, so triggering on it was redundant and would silently
overwrite any intentional manual edits.
* fix: mock lfx.components in sys.modules for collect_strings test
The test was failing because collect_strings() imports lfx.components
before reaching the pkgutil/importlib mocks. Injecting fake modules into
sys.modules lets the import succeed so the mocks can take over.
* fix: resolve ruff violations in GP scripts and main.py
- Use .values() instead of .items() when attr_name is unused (B007/PERF102)
- Split long print f-string to stay under 120 chars (E501)
- Add blank line in docstring between summary and description (D205)
- Use ternary operator for locale assignment in main.py (SIM108)
* feat(i18n): sync canvas node translations on language change
Add syncNodeTranslations() to flowStore that patches translatable
metadata (display_name, description, template field display_names,
output display_names) on all canvas nodes when the types catalog is
refreshed with a new language. Field values are never touched. Nodes
whose type is absent from the catalog (custom-code, group nodes) are
skipped.
Called from two places to handle the race between flow loading and
types fetching:
- use-get-types.ts after setTypes(data) — covers the case where nodes
are already on canvas when translations arrive
- resetFlow — covers the case where translations are already loaded
when the flow mounts
* feat(i18n): translate Templates modal and starter flow metadata
## Backend
- Extend extraction script (`scripts/gp/extract_backend_strings.py`) to
auto-discover all `initial_setup/starter_projects/*.json` files and emit
`starter_flows.{safe_key}.name` / `starter_flows.{safe_key}.description`
keys — no manual work needed when new starter flows are added.
- Add `translate_starter_flows()` to `utils/i18n.py`, mirroring the
existing `translate_component_dict()` pattern. Derives a stable
`name_key` (slug) from the English name and attaches it to each
`FlowRead` so the frontend can match flows by identity regardless of
locale.
- Update `FlowRead` model to expose `name_key: str | None`.
- Refactor `read_basic_examples()` endpoint (`api/v1/flows.py`):
- Accept `Request` parameter to read `request.state.locale` (set by
existing `set_locale` middleware).
- Cache the raw `flow_reads` list instead of the compressed response so
the same DB result can be translated per-request (cheap: ~33 dict
lookups, no additional DB hit).
- Call `translate_starter_flows()` on every request so `name_key` is
always populated.
- Update all 7 backend locale files (en, fr, de, es, ja, pt, zh-Hans)
with new `starter_flows.*` keys from GP.
## Frontend
- Templates modal (`modals/templatesModal/`):
- Translate sidebar title, category group labels ("Use Cases",
"Methodology"), and all nav item labels.
- Translate "Get started" header and description.
- Translate card category badges (PROMPTING, RAG, AGENTS).
- Translate search placeholder and "No templates found" empty state.
- Translate "Start from scratch" footer and "Blank Flow" button.
- Use `flow.name_key` (stable slug) for example lookup in
`GetStartedComponent` so matching is locale-independent.
- Refetch examples on language change: add `i18n.language` to the
`useGetBasicExamplesQuery` cache key so React Query re-fetches
translated flow data whenever the UI language switches.
- Add `name_key?: string | null` to `FlowType`.
- Empty state pages (`emptyPage`, `emptyFolder`): translate "Empty
project", "Start building", description, and "New Flow" button.
- Update all 7 frontend locale files with new `templatesModal.*` and
`emptyPage.*` keys from GP.
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* feat(i18n): translate MCP Server tab and fix sidebar category truncation
- Translate all strings in McpServerTab, McpFlowsSection, McpAuthSection:
title, description, guide link, Flows/Tools label + tooltip, Edit Tools
button, Auth label, None (public), Edit/Add Auth, Auto install tab,
Loading state, config error messages
- Use stable id/label split for Auto install / JSON tabs so mode
comparison is locale-independent
- Add truncate to sidebar category label span to prevent long translated
names (e.g. French "Mannequins et agents") from wrapping to two lines
- Update all 7 frontend locale files with new mcp.* keys from GP
* feat(i18n): translate Knowledge, Files pages and fix sidebar overflow
- Translate Knowledge page (empty state, search, loading, alerts, chunks page)
- Translate My Files page (title, empty state, table columns, upload/delete)
- Fix sidebar category label overflow with min-w-0 truncate on flex spans
- Fix "Discover more components" button text truncation
- Fix empty page CTA button max-width for longer translations
- Remove duplicate language selector from account menu (browser auto-detection already in i18n.ts)
- Upload 471 strings to GP and download translations for fr/ja/es/de/pt/zh-Hans
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* [autofix.ci] apply automated fixes
* feat(i18n): translate delete confirmation modal and fix CTA button overflow
- Translate DeleteConfirmationModal (title, body, buttons, "can't be undone")
- Translate flow/folder/component description labels via use-description-modal
- Translate "and its message history" and folder delete note at call sites
- Fix empty page CTA button overflow with whitespace-normal w-auto
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(i18n): translate Create Knowledge Base modal and flow dropdown menu
* [autofix.ci] apply automated fixes
* fix(i18n): use min-height for Knowledge Base modal to prevent scroll on translated text
* [autofix.ci] apply automated fixes
* feat(i18n): translate StepperModal footer buttons (Next Step, Back, Need Help?)
* feat(i18n): translate model input dropdown (No Models Enabled, Refresh List, Manage Model Providers)
* feat(i18n): translate Model Providers modal (config form, model selection, disconnect warning, multiselect placeholder)
* feat(i18n): translate starter template note/README nodes at serve-time
- Extend extract_backend_strings.py to extract noteNode descriptions as
template_notes.{flow_key}.{index} keys (64 notes across 32 templates)
- Add translate_flow_notes() to i18n.py to substitute translated markdown
per-request without mutating the cached template data
- Wire translate_flow_notes() into the /starter-projects/ endpoint using
the same request.state.locale pattern as the flows endpoint
- Update all 6 backend locale files via GP pipeline (4858 keys total)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(i18n): translate canvas note nodes on language change via dedicated endpoint
- Add stamp_note_keys() to i18n.py: stamps i18n_key onto noteNodes of
starter templates when a user copy is created, enabling stable lookup
- Call stamp_note_keys() in _new_flow() (flows_helpers.py) so keys are
persisted to DB at copy-creation time
- Add GET /flows/{flow_id}/note_translations endpoint returning
{ node_id: translated_text } for the request locale; falls back to
positional recompute for flows without stamped keys
- Add useGetNoteTranslationsQuery (React Query) keyed on [flowId, language]
so it auto-refetches on language change without explicit invalidation
- Apply translations in NoteNode via useEffect on query data
- Rewrite syncNoteTranslations to accept Record<string, string> (node_id map)
- Remove old syncNoteTranslations(FlowType[]) approach and all debug
console.warn/console.error [i18n-debug] statements
- Suppress i18next Locize promotional console.info by temporarily replacing
console.info around the synchronous init() call
- Add i18n_key?: string to noteClassType frontend type
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(i18n): fix Playground/Share button overlap and translate Share button
- Remove fixed w-[7.2rem] from SimpleSidebarTrigger and DisabledButton so
the Playground button grows to fit translated text in any language
- Add misc.share i18n key and replace hardcoded "Share" string in
deploy-dropdown with t("misc.share")
- Download GP translations for de/pt/zh-Hans
* feat(i18n): translate input placeholder and info fields for backend components
Extend the backend i18n pipeline to cover placeholder and info (tooltip)
text in addition to display_name and description:
- extract_backend_strings.py: extract placeholder from input fields
- i18n.py (translate_component_dict): translate placeholder and info at
request time alongside display_name
- Regenerate en.json (6700 keys, +179 placeholders, +info keys)
- Download translated locale files for de, es, fr, ja, pt, zh-Hans
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(i18n): translate Share dropdown items (API access, Export, MCP Server, Embed, Shareable Playground)
* fix(i18n): stamp i18n_key in translate_flow_notes and remove dead stamp_note_keys
- Stamp i18n_key onto noteNodes inside translate_flow_notes() using the
original English name_key so the key travels with the node when a user
copies a template — fixes translation failure for duplicate copies like
"Simple Agent (2)" where the frontend sends the translated name
- Remove stamp_note_keys() and its call in _new_flow(): now a no-op since
i18n_key is always stamped by translate_flow_notes at /basic_examples/
- Remove positional fallback from get_note_translations: only use stamped
i18n_key; drop unused _safe_flow_key import and note_index counter
- Fix read_basic_examples to pass name_key (original English) instead of
the already-translated flow.name to translate_flow_notes
* refactor(i18n): bake i18n_key into template noteNodes, remove runtime stamping
Replaces fragile positional indexing with keys baked directly into the source
JSON files, so keys are stable regardless of node order changes.
- scripts/gp/bake_note_keys.py: new script that stamps template_notes.{flow}.{n}
onto each noteNode missing an i18n_key; idempotent and --dry-run safe
- scripts/gp/extract_backend_strings.py: Tier 4 reads i18n_key from node data
instead of positional index; warns if any noteNode is missing a key
- utils/i18n.py: translate_flow_notes() simplified — reads baked key, translates,
no more flow_name param or index counter or stamping logic
- api/v1/flows.py, starter_projects.py: drop flow_name arg from call sites
- test_i18n_note_translation.py: tests updated for key-read behavior
- starter_projects/*.json: 64 noteNodes across 32 templates stamped with i18n_key
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* ci(i18n): auto-bake note keys on template JSON changes in CI
Extends gp-backend-check.yml to trigger on starter_projects/** changes
and runs bake_note_keys.py before extract_backend_strings.py so any new
noteNodes get i18n_key stamped automatically on PR branches.
* refactor(i18n): replace index-based note keys with content-hash keys
bake_note_keys.py now derives i18n_key from sha256[:8] of the
noteNode description instead of a positional counter. Keys are
stable on reorder, auto-rotate when content changes, and never
silently reuse an old index after a note is deleted.
All 64 note keys across 32 starter templates restamped to the
new template_notes.{flow_key}.{hash8} format. Script is idempotent —
running twice on unchanged content produces no changes.
* fix(i18n): thread-safe translation loading and correct falsy key check
- _load_translations(): add double-checked locking with threading.Lock to
prevent race condition under concurrent requests at cold start
- translate(): use `is not None` instead of truthiness check so empty-string
translations are not silently dropped in favour of the fallback chain
* feat(i18n): translate Settings page UI strings across multiple sections
- Profile picture chooser: translate People/Space category labels
- MCP Servers page: translate title, description, button, status labels, dropdown items, and all Add MCP Server modal strings
- API Keys page: translate column headers (Name, Key, Created, Last Used, Total Uses) and Create API Key dialog (title, description, labels, buttons, generated key message)
- Shortcuts page: translate all 27 shortcut display names via valueFormatter
- Messages page: translate title and description
- Base modal: translate shared Cancel button
* fix(i18n): replace fixed card heights with min-h to prevent layout issues with longer translations
Cards with h-[84px] would overflow/misalign when translated text wrapped to
multiple lines. Using min-h-[84px] keeps the minimum size while allowing
cards to grow naturally for longer translations.
* feat(i18n): translate SaveChangesModal (unsaved changes popup)
Translates all strings in the unsaved-changes dialog shown when
navigating away from a flow with pending changes:
- title, saving spinner, last saved, exit/save buttons
- unsaved changes warning and auto-saving help link
* chore(i18n): download updated frontend and backend translations from GP
Frontend: 704 strings across fr, ja, es, de, pt, zh-Hans
Backend: updated note keys (hash-based) across fr, ja, es, de, pt, zh-Hans
* feat(i18n): translate ToolsModal (URL/tools selection popup)
Translates all strings in the tools modal including:
- search placeholder, column headers (Name, Description, Slug/Tool)
- sidebar labels, input placeholders, hint text
- Parameters section title and subtitle
- Close button
* chore(i18n): download updated frontend translations from GP
724 strings across fr, ja, es, de, pt, zh-Hans including new
toolsModal and saveChangesModal keys.
* feat(i18n): translate MCP Client settings page, shareable playground label, and Global Variable modal
- McpClientPage: add useTranslation, move all hardcoded strings (title,
description, steps, config file label, API key notice) to
settings.mcpClient.* keys
- deploy-dropdown: fix unpublished "Shareable Playground" label that was
missed when the published branch already used t()
- GlobalVariableModal: add useTranslation, translate all UI strings
(title, description, type/name/value/fields labels & placeholders,
save/update button, success and error toasts)
- en.json: add 13 settings.mcpClient.* keys and 23 globalVars.modal.* keys
- All locale files (de, es, fr, ja, pt, zh-Hans) updated from GP
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(i18n): translate MCP Server Auth modal (authModal)
- Add useTranslation to authModal/index.tsx
- Translate all hardcoded strings: title, auth type label, radio labels
(None/API Key/OAuth), no-auth warning, API Key description, OAuth
field labels/placeholders, Save button, reinstall warning (with and
without installed clients interpolation)
- Add 30 authModal.* keys to en.json
- Update all locale files (de, es, fr, ja, pt, zh-Hans) from GP (776 strings)
* feat: add translation keys for MCP JSON configuration
* feat(i18n): translate project delete notification, MCP install notification, and McpJsonContent
- main-page.tsx: translate "Project deleted successfully" and "Error
deleting project" success/error toasts
- useMcpServer.ts: translate "MCP Server installed successfully on
{{client}}..." success toast using i18n.t()
- McpJsonContent.tsx: translate "Add this config..." hint, Transport
label, and Generate/API key generated button labels
- Add 3 new keys (mcp.installedSuccessfully, project.deletedSuccessfully,
project.errorDeleting) + 5 mcpJson.* keys to en.json
- Update locale files from GP
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(i18n): translate default flow/project names and delete notifications
- reactflowUtils.ts: use i18n.t("flow.defaultName") for new flow default name
- use-add-flow.ts: use t() for "Starter Project" and "New Project" names at creation time
- sideBarFolderButtons: use t("project.newName") when creating a new project
- main-page.tsx: translate project deleted success/error toasts
- useMcpServer.ts: translate MCP install success toast
- list/index.tsx: translate flow deleted success/error toasts
- Add keys: flow.defaultName, project.newName, project.starterName,
project.deletedSuccessfully, project.errorDeleting,
flow.deletedSuccessfully, flow.errorDeleting, flow.errorDeletingRetry,
mcp.installedSuccessfully
- Update all locale files from GP (790 strings)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* refactor(i18n): content-hash component keys and normalize frontend lookup
Backend locale keys for components now use a hybrid format:
components.{norm_name}.{field_path}.{sha256[:8]}
e.g. components.prompttemplate.display_name.8cd80ebe
The 8-char hash suffix is derived from the English source value, so any
change to a component string produces a new key, forcing GP to issue a
fresh translation. The human-readable prefix keeps keys debuggable.
Component names are normalized (spaces removed, lowercased) in both the
key prefix and the runtime hash computation, so renames like
"PromptTemplate" → "Prompt Template" don't break existing translations.
Frontend syncNodeTranslations() now builds a normalized lookup map so
that nodes stored with old-style type names (e.g. "PromptTemplate") are
correctly resolved against the live registry key ("Prompt Template"),
fixing untranslated Prompt Template nodes in starter template flows.
Also adds chunked uploading to upload_backend_strings.py to avoid
read timeouts when pushing large payloads to GP.
* feat(i18n): fix legacy component alias translation and translate file manager UI
Frontend:
- syncNodeTranslations() now falls back to templates store to resolve legacy
node.data.type aliases (e.g. "Prompt" → Prompt Template, "parser" →
ParserComponent), fixing untranslated nodes in starter templates like
Vector Store RAG
- Translate "Flow saved successfully!" toast in FlowPage
- Translate file manager modal: "Select files" button, error/success toasts,
drag-and-drop zone labels, folder selection strings (13 new keys)
Backend:
- check_backend_status.py: new script to check GP translation progress
- upload_backend_strings.py: single PUT with 5min timeout, bundle name logged
- download_backend_translations.py: bundle name logged on start
- All locale files updated with latest GP translations (langflow-ui-backend-v2)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat(i18n): translate canvas controls and Model Providers page strings
- Add useTranslation to MemoizedCanvasControls for Flow Locked, Agent Working, Saving, Lock/Unlock flow labels
- Add useTranslation to CanvasControlsDropdown for Zoom In/Out/To 100%/To Fit and tooltips
- Add useTranslation to ModelProvidersPage for page title and description
- Add canvas.* and modelProviders.page* keys to en.json
- Sync all locale files (fr, ja, es, de, pt, zh-Hans) via GP pipeline
* feat(i18n): translate upload folder button and model trigger strings
- UploadFolderButton: replace hardcoded "Upload a flow" tooltip with t("folder.uploadFlow")
- ModelTrigger: replace hardcoded "No models enabled" and "Select a model" with t() calls
* feat(i18n): cache /basic_examples/ translations per locale
Add _starter_flows_translated_cache keyed by locale so translate_starter_flows
and translate_flow_notes run at most once per locale per 5 minutes instead of
on every request.
* feat(i18n): translate NoteNode empty placeholder text
* feat(i18n): translate slider labels, model trigger, dropdown loading, and loading component
- Translate Precise/Balanced/Creative/Wild slider labels and min/max labels
- Translate "Setup Provider" placeholder in ModelTrigger
- Translate "Loading options" in dropdownComponent (both occurrences)
- Translate "Loading..." in loadingComponent (used by LoadingPage)
- Add syncNodeTranslations() call after model refresh to re-apply translations
- Add 8 new keys to en.json and download translated locale files
* feat(i18n): translate model provider toast notifications
Replace hardcoded English strings in useProviderConfiguration with t()
calls: configuration saved, activated, disconnected success toasts, and
all error titles/messages for save, activate, disconnect, and model
toggle operations.
* fix(i18n): address PR review — DRY key functions, locale allow-list, dead code, silent failures
- Extract safe_flow_key/normalize_component_key/content_hash/component_field_key into
langflow/utils/i18n_keys.py so runtime translator and extract script share one
source of truth (C1)
- Validate Accept-Language against supported locales in set_locale middleware;
unknown values fall back to "en" to prevent cache pollution (C2)
- Delete dead `remaining = ...` block in check_backend_status.py that made a
redundant network call and never used the result (I2)
- Log logger.warning instead of silently swallowing OSError/JSONDecodeError in
_load_translations (I3)
- Rename test_strips_dedup_suffix → test_parentheses_in_name_become_underscores
with corrected comment (I5)
- Remove redundant `import copy as _copy` inside translate_flow_notes (R2)
- Move translate_flow_notes/translate_starter_flows import to flows.py module top (R1)
- Add # Why: comments on max_size=16, uncompressed cache, and verify=False (R5/I8/M3)
- Wrap loadLanguage dynamic import in try/catch so unknown locales don't crash
React with an unhandled rejection; add i18n.test.ts to cover the fallback
* refactor(gp): consolidate upload/download scripts with --target flag
Replaces four separate scripts (upload_strings, upload_backend_strings,
download_translations, download_backend_translations) with two unified
entry points: upload.py and download.py, each taking --target frontend|backend.
Updates gp-upload.yml to a single workflow with two jobs, updates
gp-download.yml run lines, and removes the now-redundant
gp-backend-upload.yml workflow.
* [autofix.ci] apply automated fixes
* chore(starter-projects): sync starter project snapshots with release-1.10.0
Updates dependency versions (langchain_core 1.2.29 → 1.2.27) and minor
JSON formatting differences across 21 starter project files following
merge from release-1.10.0.
* chore: auto-bake note keys and regenerate backend locales/en.json [skip ci]
* feat(i18n): restore LanguageForm component in Settings > General page
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix(projects): always use English for new project names
Translated project names (e.g. Japanese '新規プロジェクト') caused MCP
server name collisions because sanitize_mcp_name() strips non-ASCII
chars and all names fell back to 'lf-unnamed'. Hardcode 'New Project'
and 'Starter Project' instead of passing them through t() so the
names sent to the backend are always ASCII.
* chore(i18n): download missing Vector Store RAG note translations
README and Load Data Flow note keys were missing from all non-English
locales. Uploaded to GP and downloaded translations for fr, ja, es,
de, pt, zh-Hans.
* [autofix.ci] apply automated fixes
* fix(canvas): fix zoom dropdown shortcut layout on Windows
The shortcut container had a fixed w-[25px] which fits the single-char
Mac modifier key (⌘) but clips the 4-char Windows modifier key (Ctrl).
Remove the fixed width and use gap-0.5 so the container sizes to its
content on all platforms.
* fix(i18n): sync tooltip info and placeholder fields for existing canvas nodes
syncNodeTranslations() was only updating display_name from fresh component
definitions, leaving baked-in English info (tooltip) and placeholder strings
on nodes loaded from saved flows and starter templates. Extend the merge to
also overlay info and placeholder for template fields, and info for output
fields. Also adds info?: string to OutputFieldType to match what the backend
already sends.
* fix(i18n): persist language selection across page refreshes
loadLanguage() was only adding the resource bundle but never calling
i18n.changeLanguage(), so the active language stayed "en" on every page
load even when a preference was saved in localStorage. Move the
changeLanguage() call into loadLanguage() so both startup (index.tsx)
and runtime language switches activate the language after loading the bundle.
* fix(sidebar): add tooltip to truncated category header labels
Category headers use truncate but had no tooltip, making long translated
names (e.g. French) unreadable. Wrap the label span with ShadTooltip
matching the pattern used by sidebar draggable items.
* fix(sidebar): add tooltip to truncated discover more components button
* fix(sidebar): add tooltips to footer buttons (new custom component, MCP)
* fix(login): center-align title to handle wrapped translations gracefully
* fix(signup): center-align title to handle wrapped translations gracefully
* fix: remove tooltips from form field labels and add tooltip to sign-in button for consistency
* [autofix.ci] apply automated fixes
* chore: auto-bake note keys and regenerate backend locales/en.json [skip ci]
* [autofix.ci] apply automated fixes
* fix: resolve ruff violations in gp scripts and i18n util
- FBT001: make dry_run keyword-only in bake_note_keys._bake_file
- S112: add S112 to noqa comments in extract_backend_strings.py
- PLW2901: rename shadowed loop variable in i18n.translate_note_nodes
* [autofix.ci] apply automated fixes
* fix: lazy-import langflow in extract_backend_strings to fix GP test collection
The top-level `from langflow.utils.i18n_keys import ...` caused an
ImportError in CI where the GP test job runs without langflow installed.
Move the imports inside collect_strings() so the module is importable
without langflow — all tests mock collect_strings anyway.
* fix(tests): mock langflow.utils.i18n_keys in test_collect_strings_skips_deactivated_modules
The test calls collect_strings() directly, which now lazy-imports
langflow.utils.i18n_keys. Patch a minimal fake module into sys.modules
so the test runs without langflow installed. Also fix the key assertion
to match the lowercased output of normalize_component_key.
* fix(frontend): restore missing modal height constant imports in KnowledgeBaseUploadModal
The i18n commit (
|
|||
| 4dfe24ab20 |
ci: unblock community PRs from spurious CI failures (#12916)
Three failures consistently flip community/fork PRs red even when every substantive check passes (observed on PR #9941): - Update Component Index: actions/checkout was given only the head ref, defaulting the repository to the upstream where the fork branch does not exist. Pass head.repo.full_name + head.ref so the head can be checked out from the fork. Continue using the pull_request trigger so fork code never runs in a privileged context. - Merge Frontend Jest + Playwright Coverage Reports: codecov-action ran with fail_ci_if_error: true and an empty token (forks can't read repo secrets), turning a reporting step into a hard merge blocker. Skip the upload when CODECOV_TOKEN is unavailable and match the python coverage job's fail_ci_if_error: false. - CI Success: roll-up gate cascading from the two above; clears automatically once they pass. |
|||
| 0732423f27 |
chore: security patch (#12725)
* chore: security patch security patch * chore: upgrade package-lock.json * chore: smolagents and transformer update * chore: redis upgrade * chore: litellm upgrade * fix: Pin click to avoid lower versions ## Root cause **litellm 1.83.5+** introduced an exact pin `click==8.1.8` in its `requires_dist` (upstream bug [BerriAI/litellm#26154](https://github.com/BerriAI/litellm/issues/26154) — "Pinning exact dependency versions breaks downstream consumers"). When this branch bumped litellm to 1.83.11, uv was forced to downgrade click from 8.3.2 → 8.1.8. Click 8.2+ captures stderr separately by default; 8.1 merges it — hence `ValueError: stderr not separately captured`. ## Fix - [pyproject.toml:155](pyproject.toml:155) — added `"click>=8.3.0"` to `[tool.uv] override-dependencies` with comment linking the upstream issue. - [src/backend/base/pyproject.toml:112](src/backend/base/pyproject.toml:112) — same override so `langflow-base` Docker builds pick it up too. - Regenerated `uv.lock` (click: 8.1.8 → 8.3.3). - Patched the `click` entry in `src/backend/base/uv.lock` to 8.3.3 (that lockfile is used by `docker/build_and_push_base.Dockerfile` via `uv sync --frozen`; uv treats backend/base as a workspace member so I updated its click block directly — no other references to 8.1.8 remain). - Reverted [src/lfx/tests/unit/cli/test_run_real_flows.py](src/lfx/tests/unit/cli/test_run_real_flows.py) back to its original `result.stderr` usage — now passes cleanly with click 8.3.3. All 19 tests in the file pass. * Update build_and_push_backend.Dockerfile The `uv pip install` command doesn't read `[tool.uv] override-dependencies` from the target packages' pyproject.toml — those overrides only apply during `uv lock`/`uv sync`. The fix is to pass the overrides explicitly via `--overrides`. Now let me verify it works by running the same install locally. Resolution succeeded — click==8.3.3, aiohttp==3.13.5, litellm==1.83.11 all coexist. Let me also test without `--overrides` to confirm I reproduce the original failure. Reproduced the Docker failure locally. Now test with the overrides file: Fix verified — resolution succeeds with the overrides file, failing without. Let me clean up and show the final Dockerfile change. ## Summary **Root cause:** The Dockerfile uses `uv pip install ./src/...` which **does not read** `[tool.uv] override-dependencies` from the target packages' `pyproject.toml` — those overrides only apply during `uv lock`/`uv sync`. On Linux, `cuga>=0.2.20` requires `aiohttp>=3.13.5`, but `litellm==1.83.11` exact-pins `aiohttp==3.13.3` (same upstream bug as the click pin, [BerriAI/litellm#26154](https://github.com/BerriAI/litellm/issues/26154)). Without an active override, resolution fails. **Fix:** Write a `/tmp/uv-overrides.txt` file mirroring the workspace's `override-dependencies` (litellm, python-dotenv, openai, aiohttp, click) and pass `--overrides /tmp/uv-overrides.txt` to `uv pip install`. Verified locally by reproducing the exact failure in an isolated tmp directory (to escape the workspace's pyproject.toml auto-apply), then confirming the overrides file resolves it: - aiohttp==3.13.5 ✓ - click==8.3.3 ✓ - litellm==1.83.11 ✓ - cuga==0.2.22 ✓ * Templates version update * Update .secrets.baseline * chore: update overrides * chore: bump version * chore: bump main version * chore: bump SDK version to 0.1.1 * chore: run uv lock and uv sync after SDK version bump * chore: read the overrides from a single source security patch * chore: add pip check toggle add pip check toggle * chore: litellm base uv.lock update * fix(chore): Pin litellm back to last working release * fix(chore): Pin to 1.83 and higher litellm * Update build_and_push_backend.Dockerfile * chore: update base uv.lock * fix: lazyload toolguard since its an optional extra * Update .secrets.baseline * Update component_index.json * Rebuild component index * Update component_index.json --------- Co-authored-by: Eric Hare <ericrhare@gmail.com> Co-authored-by: vijay kumar katuri <vijay.katuri@ibm.com> (cherry picked from commit 60a8f76c3fde17124057626c671ea8162872837a) |
|||
| 0659105762 |
fix: allow backend/frontend Docker builds when main version exists (#12854)
Backend and frontend images (langflowai/langflow-backend and
langflowai/langflow-frontend) are separate from the main image
(langflowai/langflow), so they should not be skipped when the
main version already exists on Docker Hub.
This fixes the issue where backend/frontend builds for 1.9.0
were skipped because the main 1.9.0 image was already published,
preventing these critical images from being available on Docker Hub.
Fixes: Backend and frontend Docker images not published in 1.9.0 release
(cherry picked from commit
|
|||
| b2d4539590 |
fix(ci): prevent duplicate tags and validate tag format in release workflow (#12847)
- Add tag format validation (must start with 'v')
- Check for duplicate tags without 'v' prefix
- Prevent release notes from using wrong base comparison
- Add validate-tag-format job dependency to create_release
Fixes tag duplication issue that caused v1.9.0 release notes to miss 58 commits.
Root cause: Duplicate tags (1.8.3 vs v1.8.3) caused GitHub's generateReleaseNotes
to pick the wrong base tag due to alphabetical sorting.
This ensures future releases will:
1. Only accept tags with 'v' prefix (v1.2.3 format)
2. Detect and reject releases if duplicate tags exist
3. Generate correct release notes with proper commit history
(cherry picked from commit
|
|||
| 5d6a7a0f31 |
chore: address eric's comment 1
address eric's comment 1 |
