mirror of
https://github.com/langflow-ai/langflow.git
synced 2026-07-24 02:47:59 +08:00
8d01ba4240
* add var to block custom component execution
* [autofix.ci] apply automated fixes
* swaps generic check for a specific legacy name check for prompt
* [autofix.ci] apply automated fixes
* Add missing endpoint checks
* fix language
* Add flow validation and tests
* [autofix.ci] apply automated fixes
* Add a few more tests and validation to other endpoints
* clean up test and import logic
* [autofix.ci] apply automated fixes
* ensure flow is saved after upgrade
* Use hash instead of code
* Fix review issues: type safety, error handling, and test coverage
- Change ComponentCache hash fields to None default (was {}) to make
"not yet loaded" explicit in the type system and eliminate the error-prone
`or None` pattern at 8+ callsites
- Narrow frontend 403 suppression to only match custom component errors,
preventing unrelated auth/permission 403s from being swallowed
- Add console.warn logging to waitForNodeUpdates timeout, saveFlow catch,
and 403 suppression paths for debuggability
- Document security invariants (build_vertex cache-hit, nodes-without-code)
- Add server-side logging to MCP validation failures
- Add TestBuildCodeHashLookups test class (9 tests) for _build_code_hash_lookups
* remove divider when new cust comp button is removed
* syntax fix in ui
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* DRY
* [autofix.ci] apply automated fixes
* fix imports
* add field order to script updates
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* fix: harden custom component lockdown across api, lfx, and editor
- enforce custom-component validation before lfx and backend flow execution
- normalize legacy built-in aliases like Prompt and URL during validation and refresh
- surface blocked custom nodes in the editor without mutating persisted edited state
- prevent empty-flow save/build hangs when custom components are disabled
- add regression coverage for api, lfx, starter project refresh, and frontend guards
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* Add legacy type mapping back for prompt component
* Fix missing import and add real run tests
* fix(flow): Centralize custom component validation
Route payload and prebuilt graph checks through one shared validator so
backend and lfx execution surfaces enforce the same custom-component
policy.
Keep Graph.from_payload as the fresh-build guard, revalidate cached and
script-loaded graphs before execution, and extend coverage for MCP,
workflow reconstruction, agentic flows, and real lfx runs.
Co-Authored-By: OpenAI Codex <noreply@openai.com>
* remove useless function
* remove double validation cases
* remove outdated hash history refs
* fix(frontend): preserve custom component recovery paths
Clear dismissed state after successful bulk restores and make the toolbar Code entrypoint follow config transitions.
Add regressions for bulk restore cleanup, toolbar config changes, and single-node restore of dismissed outdated components.
* fix(frontend): Block uploaded custom components in editor
Surface uploaded CustomComponent nodes as blocked when custom
components are disabled so the editor warns before build
and refresh paths hit backend rejections.
Recompute component warnings when config loads and tighten
the disabled-mode guard so allowed custom components are
not treated as blocked.
* Add parser to legacy type analysis
* fix: update components on render consolidate config reads
Replace scattered useGetConfig reads with useUtilityStore
for a single source of truth.
- chat.py: use elif so request data validation skips stale DB flow;
reorder build_public_tmp to check public access before validation
- flow_validation.py: surface loader failures instead of swallowing them
- use-get-types.ts: recompute componentsToUpdate after templates load
- Frontend: read allowCustomComponents from utilityStore in code area,
sidebar, and node toolbar components
* Add tiny guard to not update on zero length nodes
* DRY ref for compute update function
* Remove redundant validations (for now)
* refactor: replace string-matching error classification with CustomComponentValidationError
Introduce CustomComponentValidationError(ValueError) so API handlers can
catch validation errors by type instead of matching error message strings.
This eliminates the fragile is_custom_component_validation_error_message
function and makes error routing explicit across all endpoints.
- Add CustomComponentValidationError in flow_validation.py
- check_flow_and_raise now raises CustomComponentValidationError
- Replace all is_custom_component_validation_error_message call sites
with except CustomComponentValidationError in chat.py, endpoints.py,
openai_responses.py, mcp_utils.py, and flow_executor.py
- Add except RuntimeError -> 503 in build_flow for startup race
- Remove redundant validation in session/service.py load_session
- Update all test assertions to use the new exception type
* Add beta flag to env var
* Use raw graph data to extract and better exc handling
* [autofix.ci] apply automated fixes
* [autofix.ci] apply automated fixes (attempt 2/3)
* [autofix.ci] apply automated fixes (attempt 3/3)
* obfuscate exceptoin details
* log error message
* ruff
* fix be test
* [autofix.ci] apply automated fixes
* fix tests
* [autofix.ci] apply automated fixes
* tests
* [autofix.ci] apply automated fixes
* enhance hash checks to allow cust components to run
* Add comment
* Add comment
* [autofix.ci] apply automated fixes
* ruff
* Update more tests
* [autofix.ci] apply automated fixes
* be tests
* be tests
* [autofix.ci] apply automated fixes
* revert changes to fe tests that were causing failures'
* comp index?
* comp index?
* comp index?
* changes FE tests to expect 5 necessary updates after prompt comp was added to checks
* update one more fe test with new error message
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: OpenAI Codex <noreply@openai.com>
Langflow is a powerful platform for building and deploying AI-powered agents and workflows. It provides developers with both a visual authoring experience and built-in API and MCP servers that turn every workflow into a tool that can be integrated into applications built on any framework or stack. Langflow comes with batteries included and supports all major LLMs, vector databases and a growing library of AI tools.
✨ Highlight features
- Visual builder interface to quickly get started and iterate.
- Source code access lets you customize any component using Python.
- Interactive playground to immediately test and refine your flows with step-by-step control.
- Multi-agent orchestration with conversation management and retrieval.
- Deploy as an API or export as JSON for Python apps.
- Deploy as an MCP server and turn your flows into tools for MCP clients.
- Observability with LangSmith, LangFuse and other integrations.
- Enterprise-ready security and scalability.
🖥️ Langflow Desktop
Langflow Desktop is the easiest way to get started with Langflow. All dependencies are included, so you don't need to manage Python environments or install packages manually. Available for Windows and macOS.
⚡️ Quickstart
Install locally (recommended)
Requires Python 3.10–3.13 and uv (recommended package manager).
Install
From a fresh directory, run:
uv pip install langflow -U
The latest Langflow package is installed. For more information, see Install and run the Langflow OSS Python package.
Run
To start Langflow, run:
uv run langflow run
Langflow starts at http://127.0.0.1:7860.
That's it! You're ready to build with Langflow! 🎉
📦 Other install options
Run from source
If you've cloned this repository and want to contribute, run this command from the repository root:
make run_cli
For more information, see DEVELOPMENT.md.
Docker
Start a Langflow container with default settings:
docker run -p 7860:7860 langflowai/langflow:latest
Langflow is available at http://localhost:7860/. For configuration options, see the Docker deployment guide.
🛡️ Security
For security information, see our Security Policy.
🚀 Deployment
Langflow is completely open source and you can deploy it to all major deployment clouds. To learn how to deploy Langflow, see our Langflow deployment guides.
⭐ Stay up-to-date
Star Langflow on GitHub to be instantly notified of new releases.
👋 Contribute
We welcome contributions from developers of all levels. If you'd like to contribute, please check our contributing guidelines and help make Langflow more accessible.