mirror of https://github.com/langflow-ai/langflow.git synced 2026-07-24 02:05:11 +08:00

Files

Eric Hare 9690e69e86 fix(security): remove the disabled Python Code Structured tool component (#13560 )

* fix(security): remove the disabled Python Code Structured tool component

Follow-up to #13538, which neutered PythonCodeStructuredTool to a
non-executable stub "for one release cycle, full removal later." This
completes that removal.

- Delete the component and its registration in lfx.components.tools.
- Drop its entry from the component index (num_components 355 -> 354,
  sha256 recomputed surgically) and from stable_hash_history.json.
- Remove its 18 i18n keys from every locale file.
- Replace the dedicated stub unit test with a removal test in
  test_dynamic_import_integration.py.
- Add a regressions entry to regressions/1.10.x.yaml.

The unauthenticated public-build RCE fix (report H1-3754930) is
unaffected: PythonCodeStructuredTool stays in
CODE_EXECUTION_COMPONENT_TYPES, so build_public_tmp still rejects any
saved or crafted flow that carries the type. instantiate_class execs the
node's stored `code` field regardless of whether the class still exists,
so the type-name block -- not the class -- is what closes the path.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs: document removal

* docs: typo

* Apply suggestion from @mendonk

Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com>

2026-06-09 10:16:36 -07:00

1.9.x.yaml

feat: regression bucket (#12948 )

2026-05-12 14:13:46 +00:00

1.10.x.yaml

fix(security): remove the disabled Python Code Structured tool component (#13560 )

2026-06-09 10:16:36 -07:00

README.md

feat: regression bucket (#12948 )

2026-05-12 14:13:46 +00:00

README.md

Regression Log

This directory contains one YAML file per release cycle documenting known regressions. Regressions are behaviors that worked in a previous version and broke in a subsequent one. Regressions can be found through manual QA, automated testing, a support ticket, or code review.

The purpose of this YAML is to provide a single source of truth for known breaks before and after release.

When a regression is found, add an entry to the YAML file for the current release cycle and open a pull request. To add a regression to the file, do the following:

Open regressions/<version>.yaml for the version where the regression was discovered. For example, open 1.9.x.yaml if it first broke in 1.9.0. Create the file if it doesn't exist.
Add a new entry under entries: following the schema below.
Set status: triage if the severity and workaround are not yet confirmed.
Open a pull request targeting the active RC branch. The fix PR and the YAML entry may target different branches.

Regression entry schema:

{
  "id": "GH-12345",
  "title": "Short plain-language description",
  "status": "triage",
  "area": "flow_editor",
  "first_bad_version": "1.10.0",
  "last_known_good_version": "1.9.0",
  "resolved_in_version": "1.10.1",
  "fix_pr": "https://github.com/langflow-ai/langflow/pull/12345",
  "workaround": "none"
}

resolved_in_version and fix_pr are optional. You can omit them when first filing and add them when the fix lands.

Status options:

Status	Meaning
`triage`	Found, not yet fully assessed. Default when first filing.
`ship_with_note`	Shipping as-is. Docs must communicate the workaround.
`resolved`	Fixed; add `resolved_in_version` to record which version contains the fix.
`blocking`	Release blocker; requires explicit sign-off before shipping.

When marking an entry resolved, include the version that the regression was resolved in:

  resolved_in_version: 1.10.1

Area options:

Area	Covers
`flow_editor`	The visual builder UI.
`components`	Core components.
`mcp`	MCP server registration, MCP tools, MCP sidebar.
`api`	REST API endpoints.
`lfx`	The `lfx` CLI executor.
`auth`	Login, API keys, user management.
`database`	Migrations, storage, flow persistence.
`integrations`	Third-party components.
`starter_projects`	Bundled example flows.

Review regressions before release

During QA, support engineers keep entries current throughout RC by moving items out of triage, add workarounds, and marked fixed items as resolved with resolved_in_version.

Docs team reviews all ship_with_note entries before release, and ncludes workaround text to update known issues in release notes.

Release captain confirms no unresolved blocking entries exist. If blocking entries exist, they should be signed off on in the GitHub issue by a maintainer.

See RELEASE.md for the full release process.