pengjunjie/langflow
1
0
Fork 1
mirror of https://github.com/langflow-ai/langflow.git synced 2026-07-24 04:47:23 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
ba2546c6c19a235ee20cb66dfb4d79c8e2a50f2e
langflow/pyproject.toml
Gabriel Luiz Freitas Almeida 0d9f9112ef perf(telemetry): batched off-pool writer for transactions + vertex_builds (#13126) 
* perf(telemetry): batched off-pool writer for transactions + vertex_builds

Adds TelemetryWriterService that buffers transaction and vertex_build rows
in memory and drains them in batched INSERTs via a dedicated AsyncEngine
(pool_size=1 for SQLite, 2 for Postgres, max_overflow=0). Retention is
amortized in a 60s sweeper instead of running on every insert.

Producers (log_transaction, log_vertex_build) enqueue instead of opening
a DB session, so telemetry traffic no longer competes with the
request-handling pool. Falls back to the legacy direct-write path via
LANGFLOW_TELEMETRY_WRITER_ENABLED=false.

Durability: in-flight rows spill to a diskcache.Deque per PID on shutdown
and are restored on next startup; orphan PID directories left by crashed
workers are adopted.

* perf(telemetry): tighten error handling and add coverage

Review feedback from pr-review-toolkit + silent-failure-hunter:

- Retention sweep snapshots the dirty-flow sets before commit and only
  clears them after it lands; a crashed sweep no longer drops the flows on
  the floor, so per-flow caps cannot drift unboundedly.
- Producer fall-through is no longer silent. transaction_service and
  log_vertex_build each log a one-shot WARNING when telemetry_writer_enabled
  is True but the writer is not running.
- Lifespan startup failure now logs ERROR instead of WARNING — if the user
  opted into the writer and it didn't come up, that's an error.
- Shutdown drain timeout no longer suppressed silently: logs a WARNING with
  pending row count + a hint to raise telemetry_writer_shutdown_drain_s.
- Writer's flush loop catches asyncio.CancelledError separately and
  re-prepends the in-flight batch to the buffer so teardown's disk spill
  catches it.
- After 6 consecutive batch failures the writer emits a loud ERROR with
  buffer depths so operators see sustained data-loss risk.

Added tests:
- test_sanitization_survives_writer_round_trip
- test_retention_failure_preserves_dirty_flows
- test_in_flight_batch_returned_on_cancel

* perf(telemetry): address copilot review

- _restore_from_disk + _adopt_orphan_outboxes now route through _enqueue so a
  large disk-spilled or orphan outbox can't bypass telemetry_writer_max_queue
  and OOM the process. Oldest rows are dropped and counted via the existing
  dropped_transactions / dropped_vertex_builds counters.
- chmod 0o700 the outbox root + per-PID directory so sanitized-but-still-
  sensitive payloads aren't exposed cross-user on multi-tenant hosts.
  Suppressed on platforms where chmod is a no-op (Windows).
- Added test_adopt_orphan_outboxes_honors_max_queue.

The remaining two copilot notes (private API access to DatabaseService and
diskcache.Cache.close) were also flagged by the in-tree review; tracking
separately. The "diskcache not declared" note is a false positive — the
dependency is at src/backend/base/pyproject.toml:76.

* perf(telemetry): address coderabbit review

- Sweeper hands off dirty sets via capture-and-clear so concurrent
  flushes during a retention pass aren't wiped by the post-commit
  subtract; failure path restores the snapshot.
- Stress README uses a concrete Postgres DSN matching the docker
  example instead of an unset env var.
- Test PID-probe loops bounded via a shared helper with pytest.fail
  fallback.

* perf(telemetry): swap diskcache outbox for stdlib sqlite (CVE-2025-69872)

Replaces the diskcache.Deque-backed spill outbox with a stdlib sqlite3
outbox (WAL mode, JSON payloads in TEXT). diskcache 5.6.3 has
CVE-2025-69872 (pickle deserialization RCE for an attacker with write
access to the cache dir), no fixed version released, and was never
declared as a dependency — import failed on Python 3.10.

The replacement is encapsulated in a small _Outbox helper that owns the
connection, schema, JSON codec, and lifecycle. The codec uses tagged
wrappers for datetime and UUID so SQLAlchemy's typed columns accept
restored payloads on the way back out.

Hardening informed by a survey of OTel collector, Fluent Bit, Vector,
Prometheus remote_write, Datadog agent, Logstash, and Filebeat:

- Per-PID outbox dirs now stamp an owner.json (hostname + Linux boot_id
  or time()-monotonic() proxy). Adoption only proceeds when host+boot
  match; cross-host or pre-owner-file dirs are logged and skipped so a
  recycled PID after a container restart cannot pull in a stranger's
  spill data.
- PRAGMA synchronous=FULL on the spill connection so the shutdown
  commit hits the platter (NORMAL only fsyncs on WAL checkpoint, which
  may never run if the process exits immediately after commit).
- Spill honors telemetry_writer_max_queue with drop-oldest, matching
  the producer-side overflow policy so a backlogged buffer at shutdown
  can neither stall teardown nor fill disk.
- append_all encodes payloads up front and only clears the deque after
  the transaction commits — no more partial-drain on mid-flight SQLite
  failure. drain collapses to a single DELETE FROM outbox after the
  SELECT.
- Exception handlers at the spill/restore/adopt boundaries narrowed to
  (sqlite3.Error, OSError) so genuinely unexpected exceptions
  propagate rather than being silently logged.

Tests cover: cross-host orphan skipped, missing-owner orphan skipped,
spill cap drops oldest, and a realistic UUID+datetime payload
surviving spill → restore → SQLAlchemy INSERT.

* [autofix.ci] apply automated fixes

* fix(telemetry): name wait_for inner tasks so pyleak can filter

Integration tests using @pyleak_marker were flagging an inner asyncio
task created by the telemetry writer's `wait_for(Event.wait(), ...)`
loops. The wrapper task is auto-named (Task-N) and lands mid-await
across the test boundary, so pyleak counts it as leaked. The writer
itself shuts down cleanly via teardown; the "leak" is a pattern
mismatch with pyleak's per-test snapshot model, not a real lifecycle
bug.

Wrap Event.wait() in an explicitly named task (`telemetry-writer-tick`,
`telemetry-writer-backoff`, `telemetry-sweeper-tick`) via a small
_wait_or_shutdown helper, and extend pyleak_marker with a task_name_filter
that excludes `telemetry-*` from leak detection. CI was green on earlier
commits in this branch only because the diskcache import error
prevented the writer from starting at all — fixing the import surfaced
this latent pyleak collision.

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* test(telemetry): disable writer in tests so reads see writes synchronously

* perf(telemetry): age out cross-host orphan outboxes on shared volumes

A pod on a shared PV (NFS/RWX) cannot adopt rows from a dead pod on a
different host because the dead pod's hostname doesn't match. Without a
janitor those directories accumulate forever. Add an owner-file mtime
heartbeat from the sweeper plus a prune pass that deletes cross-host
outboxes whose owner file hasn't been touched within
telemetry_writer_orphan_max_age_s (default 1h). Same-host orphans still
flow through the existing adoption path.

* perf(telemetry): add byte-aware flush + drop strategy

Today the writer bounds memory by row count only, so a worker logging fat
vertex_build artifacts can hold tens of MB per row and silently dwarf the
configured max_queue. Add a size_strategy switch ('count' | 'bytes' |
'either', default 'count' for parity) with two byte thresholds:

- batch_size_bytes (256KB) caps per-flush INSERT size when bytes apply
- max_queue_bytes (200MB) drops oldest by bytes when bytes apply

Parallel sizes deques mirror the payload buffers so accounting stays
consistent across drain, spill, restore, and the cancel/retry rollback.
Single rows above the byte budget are still emitted (no row is refused);
operators get dropped_*_bytes counters alongside dropped_*.

* test(telemetry): tighten byte-strategy assertions and cover end-to-end paths

Address gaps in the byte-aware strategy tests:
- pin exact dropped counts and remaining buffer state for the drop-by-bytes
  case (was 'greater than zero')
- compute exact drain count from encoded size (was a 1-4 range)
- round-trip bytes through spill+restore to verify size deque is rebuilt
- round-trip bytes through orphan adoption for the same reason
- exercise the sweeper loop end-to-end to confirm heartbeat + prune are
  wired in (previously only unit-tested in isolation)

Clarify in the settings docs that the byte caps measure encoded JSON size,
not Python in-memory footprint.

* ref: updates to telemetry writer PR (#13294)

* fix(telemetry-writer): harden error handling and add missing test coverage

Critical:
- teardown() now re-raises CancelledError after awaiting the writer task so the
  asyncio cancellation chain propagates correctly on lifespan task kill
- suppress(OSError) on owner file write replaced with explicit error log so
  operators know when disk-spilled rows will not be recoverable on restart

High / important:
- Escalation threshold check changed from == to >= so the error log fires on
  every failure past the threshold, not just the 6th
- Dead `except OSError` on time.time() - time.monotonic() changed to
  `except Exception` since time functions cannot raise OSError
- Removed redundant `from uuid import UUID` inside _run_retention_pass (already
  imported at module top)
- Orphan directory cleanup: replaced blanket suppress(OSError) with per-child
  suppress so ENOTEMPTY on an individual rmdir doesn't abort the whole loop and
  leave the parent directory leaking silently; outer failure now logs at debug

Tests (3 new):
- test_retention_sweep_caps_vertex_builds_per_vertex: inserts 8 builds for a
  single vertex with max_per_vertex=3 so the per-vertex DELETE subquery
  actually executes (previous test used 8 distinct vertex IDs, bypassing it)
- test_either_strategy_trips_on_bytes_first: verifies bytes can be the first
  trigger under 'either' strategy (previous test only covered the count-first path)
- test_writer_retries_on_batch_failure: injects 2 flush failures then success;
  confirms failed_batches increments, rows are preserved in the buffer, and
  flushed_rows reflects the final successful write

* ci: add stress-tests job to nightly build pipeline

Wires the stress-tests workflow into nightly so telemetry write stress
tests run automatically. Also gates release-nightly-build and
slack-notification on stress-tests result so a stress regression blocks
the nightly release and surfaces in Slack.

* ci: run stress tests in nightly without blocking release

Stress tests are informational for now — a failure is visible in the
workflow run and Slack but does not gate the nightly release or build.

* fix(telemetry-writer): address PR review on cancelled teardown and nightly stress tests

- Add the stress-tests.yml reusable workflow (was untracked, so the
  nightly stress-tests job could never resolve)
- Notify Slack on stress-tests failure (add to slack-notification gate
  and FAILED_JOB detection as non-blocking)
- Run sweeper cancel, disk spill, and engine dispose in a finally so a
  cancelled teardown() still persists the in-memory buffer
- Add tests for the cancelled-teardown spill path and the >= escalation
  threshold; drop the misleading wait-loop in the retry test

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Jordan Frazier <122494242+jordanrfrazier@users.noreply.github.com>
2026-06-05 17:32:47 +00:00

504 lines
17 KiB
TOML
Raw Blame History

[project]
name = "langflow"
version = "1.10.0"
description = "A Python package with a built-in web application"
requires-python = ">=3.10,<3.15"
license = "MIT"
keywords = ["nlp", "langchain", "openai", "gpt", "gui"]
readme = "README.md"
maintainers = [
{ name = "Carlos Coelho", email = "carlos@langflow.org" },
{ name = "Cristhian Zanforlin", email = "cristhian.lousa@gmail.com" },
{ name = "Gabriel Almeida", email = "gabriel@langflow.org" },
{ name = "Lucas Eduoli", email = "lucaseduoli@gmail.com" },
{ name = "Otávio Anovazzi", email = "otavio2204@gmail.com" },
{ name = "Rodrigo Nader", email = "rodrigo@langflow.org" },
{ name = "Italo dos Anjos", email = "italojohnnydosanjos@gmail.com" },
]
# Define your main dependencies here
dependencies = [
"langflow-base[complete]>=0.10.0",
# langflow-extensions:bundle-deps-start
"lfx-duckduckgo>=0.1.0",
"lfx-arxiv>=0.1.0",
"lfx-ibm>=0.1.0",
"lfx-docling>=0.1.0",
# langflow-extensions:bundle-deps-end
]
[dependency-groups]
dev = [
"pytest-instafail>=0.5.0",
"ipykernel>=6.29.0",
"ruff~=0.13.1",
"httpx>=0.28.1",
"pytest>=9.0.3",
"requests>=2.33.0",
"pytest-cov>=5.0.0",
"pytest-mock>=3.14.0",
"pytest-xdist>=3.6.0",
"pytest-sugar>=1.0.0",
"respx>=0.21.1",
"pytest-asyncio>=0.23.0",
"pytest-profiling>=1.7.0",
"pre-commit>=3.7.0",
"vulture>=2.11",
"dictdiffer>=0.9.0",
"pytest-split>=0.9.0",
"pytest-flakefinder>=1.1.0",
"packaging>=24.1,<25.0",
"asgi-lifespan>=2.1.0",
"pytest-github-actions-annotate-failures>=0.2.0",
"blockbuster>=1.5.20,<1.6",
"types-aiofiles>=24.1.0.20240626",
"codeflash>=0.8.4",
"hypothesis>=6.123.17",
"locust~=2.43.4",
"pytest-rerunfailures>=15.0",
"scrapegraph-py>=1.10.2",
'elevenlabs==1.58.1; python_version == "3.12"',
'elevenlabs>=1.52.0; python_version != "3.12"',
"faker>=37.0.0",
"pytest-timeout>=2.3.1",
"pyyaml>=6.0.2",
"pyleak>=0.1.14",
"mcp-server-fetch>=2025.1.17",
"onnxruntime>=1.20,<1.24; python_version<'3.14'", # >=1.24 does not support Python 3.10; <1.24 allows 1.23.x for agent-lifecycle-toolkit
"onnxruntime>=1.26; python_version>='3.14'",
"fakeredis>=2.0.0",
]
[[tool.uv.index]]
name = "pytorch-cpu"
url = "https://download.pytorch.org/whl/cpu"
explicit = true
[tool.uv.sources]
langflow-base = { workspace = true }
langflow = { workspace = true }
lfx = { workspace = true }
langflow-sdk = { workspace = true }
# langflow-extensions:bundle-sources-start
lfx-duckduckgo = { workspace = true }
lfx-arxiv = { workspace = true }
lfx-ibm = { workspace = true }
lfx-docling = { workspace = true }
# langflow-extensions:bundle-sources-end
torch = { index = "pytorch-cpu" }
torchvision = { index = "pytorch-cpu" }
[tool.uv.workspace]
members = [
"src/backend/base",
".",
"src/lfx",
"src/langflow-stepflow",
"src/sdk",
# langflow-extensions:bundle-members-start
"src/bundles/duckduckgo",
"src/bundles/arxiv",
"src/bundles/ibm",
"src/bundles/docling",
# langflow-extensions:bundle-members-end
]
[tool.hatch.build.targets.wheel]
packages = ["src/backend/langflow"]
[project.urls]
Repository = "https://github.com/langflow-ai/langflow"
Documentation = "https://docs.langflow.org"
[project.optional-dependencies]
docling = [
"lfx-docling[local]>=0.1.0",
]
docling-chunking = [
"lfx-docling[chunking]>=0.1.0",
]
docling-image-description = [
"lfx-docling[image-description]>=0.1.0",
]
audio = [
"webrtcvad>=2.0.10",
]
couchbase = [
"couchbase>=4.2.1"
]
cassio = [
"cassio>=0.1.7"
]
local = [
"sentence-transformers>=2.3.1",
"ctransformers>=0.2.10"
]
clickhouse-connect = [
"clickhouse-connect==0.7.19"
]
nv-ingest = [
"nv-ingest-api>=26.1.0,<27.0.0 ; python_version >= '3.12'",
"nv-ingest-client>=26.1.0,<27.0.0 ; python_version >= '3.12'",
]
postgresql = [
"sqlalchemy[postgresql_psycopg2binary]>=2.0.38,<3.0.0",
"sqlalchemy[postgresql_psycopg]>=2.0.38,<3.0.0",
]
[tool.uv]
override-dependencies = [
# temporary force a newer python-pptx
"python-pptx>=1.0.2",
# z3-solver 4.15.7 dropped Linux wheels, pin until codeflash is removed
"z3-solver<4.15.7",
# Security: Force upgraded versions to prevent transitive deps from pulling older vulnerable versions
"orjson>=3.11.6",
"gunicorn>=25.3.0",
"pypdf>=6.10.0", # Force pypdf 6.10+ to prevent vulnerable 6.6.x versions
"nltk>=3.9.4",
"Markdown>=3.8.0",
"dynaconf>=3.2.13",
"pillow>=12.1.1", # Force Pillow 12.1.1+ to prevent CVE-vulnerable versions
"playwright>=1.59.0", # Latest available on PyPI; ensures updated Chromium with CVE fixes
# Transitive dependency CVE fixes
"lxml>=6.1.0,<7.0.0", # CVE-2026-41066
"mako>=1.3.12,<2.0.0", # CVE-2026-44307
"urllib3>=2.7.0,<3.0.0", # CVE-2026-44431, CVE-2026-44432
"python-liquid>=2.2.0,<3.0.0", # CVE-2026-45017
]
[project.scripts]
langflow = "langflow.langflow_launcher:main"
[tool.codespell]
skip = '.git,*.pdf,*.svg,*.pdf,*.yaml,*.ipynb,poetry.lock,*.min.js,*.css,package-lock.json,*.trig.,**/node_modules/**,./stuff/*,*.csv'
# Ignore latin etc
ignore-regex = '.*(Stati Uniti|Tense=Pres).*'
[tool.pytest.ini_options]
timeout = 150
timeout_method = "signal"
minversion = "6.0"
testpaths = ["src/backend/tests", "src/lfx/tests", "src/bundles/*/tests"]
console_output_style = "progress"
filterwarnings = [
"ignore::DeprecationWarning",
"ignore::ResourceWarning",
"ignore:Skipped unsupported reflection:sqlalchemy.exc.SAWarning",
"ignore:.*SQL-parsed foreign key constraint:sqlalchemy.exc.SAWarning",
"ignore:autogenerate skipping metadata-specified expression-based index:UserWarning",
]
log_cli = true
log_cli_format = "%(asctime)s [%(levelname)8s] %(message)s (%(filename)s:%(lineno)s)"
log_cli_date_format = "%Y-%m-%d %H:%M:%S"
markers = [
"async_test",
"api_key_required",
"no_blockbuster",
"benchmark",
"unit: Unit tests",
"integration: Integration tests",
"slow: Slow-running tests",
"security: Security regression tests (IDOR, auth, access control)"
]
asyncio_mode = "auto"
asyncio_default_fixture_loop_scope = "function"
addopts = "-p no:benchmark"
[tool.coverage.run]
command_line = """
-m pytest --ignore=tests/integration
--cov --cov-report=term --cov-report=html
--instafail -ra -n auto -m "not api_key_required"
"""
source = ["src/backend/base/langflow/"]
omit = ["*/alembic/*", "tests/*", "*/__init__.py"]
[tool.coverage.report]
sort = "Stmts"
skip_empty = true
show_missing = false
ignore_errors = true
[tool.coverage.html]
directory = "coverage"
[tool.ruff]
target-version = "py310"
exclude = [
"src/backend/base/langflow/alembic/*",
"src/frontend/tests/assets/*",
"src/lfx/src/lfx/_assets/component_index.json",
"docs/**/API-Reference/python-examples/**",
]
line-length = 120
[tool.ruff.lint]
flake8-annotations.mypy-init-return = true
flake8-bugbear.extend-immutable-calls = [
"fastapi.Depends",
"fastapi.File",
"fastapi.Query",
"typer.Argument",
"typer.Option",
]
flake8-type-checking.runtime-evaluated-base-classes = [
"pydantic.BaseModel",
"typing.TypedDict", # Needed by fastapi
"typing_extensions.TypedDict", # Needed by fastapi
]
pydocstyle.convention = "google"
select = ["ALL"]
ignore = [
"C90", # McCabe complexity
"CPY", # Missing copyright
"COM812", # Messes with the formatter
"ERA", # Eradicate commented-out code
"FIX002", # Line contains TODO
"ISC001", # Messes with the formatter
"PERF203", # Rarely useful
"PLR09", # Too many something (arg, statements, etc)
"RUF012", # Pydantic models are currently not well detected. See https://github.com/astral-sh/ruff/issues/13630
"TD002", # Missing author in TODO
"TD003", # Missing issue link in TODO
"TRY301", # A bit too harsh (Abstract `raise` to an inner function)
"PLC0415", # Inline imports
"D10", # Missing docstrings
"PLW1641", # Object does not implement `__hash__` method (mutable objects shouldn't be hashable)
# Rules that are TODOs
"ANN"
]
# Preview rules that are not yet activated
external = ["RUF027"]
[tool.ruff.lint.per-file-ignores]
"scripts/*" = ["D1", "INP", "T201"]
"src/backend/tests/stress/*" = [
"D1", # Docstrings: this is a manual CLI tool, not a test target
"INP001", # Stress tests live outside the unit test package
"S101", # Asserts ok in stress harness
"S311", # Standard PRNG is fine for stress payload jitter
"T201", # Print statements: this is a CLI script
]
"scripts/gp/tests/*" = [
"D1", # Missing docstrings
"PLR2004", # Magic value comparisons
"S101", # Use of assert (required for pytest)
"TRY003", # Long exception messages
"EM101", # String literals in exceptions
]
"scripts/ci/test_*.py" = [
"D1", # Missing docstrings
"PLR2004", # Magic value comparisons
"S101", # Use of assert (required for pytest)
"TRY003", # Long exception messages
"EM101", # String literals in exceptions
]
"src/backend/base/langflow/alembic/versions/*" = ["INP001", "D415", "PGH003"]
"src/backend/base/langflow/custom/__init__.py" = [
"I001", # Import order affects initialization - must import custom module first
]
"src/backend/base/langflow/api/v1/*" = [
"TCH", # FastAPI needs to evaluate types at runtime
]
"src/backend/base/langflow/api/v2/*" = [
"TCH", # FastAPI needs to evaluate types at runtime
]
"src/backend/base/langflow/__main__.py" = [
"B008", # Typer CLI requires function calls in defaults
]
"src/backend/base/langflow/services/cache/*" = [
"S301", # Pickle usage is intentional for caching
]
"src/backend/base/langflow/services/tracing/*" = [
"SLF001", # Third-party library private member access (langwatch, opik)
]
"src/lfx/src/lfx/base/curl/parse.py" = [
"S105", # False positive: 'token' variable name, not a password
]
"src/lfx/src/lfx/services/auth/service.py" = [
"ARG002", # No-op impl: unused args required by interface
"EM101", # NotImplementedError messages as literals
"TC003", # Type-only imports used in signatures
]
"src/lfx/src/lfx/base/mcp/util.py" = [
"SLF001", # MCP library private member access
]
"src/lfx/src/lfx/cli/common.py" = [
"S104", # Intentional binding to all interfaces for server
"S105", # False positive: GITHUB_TOKEN_ENV is an env var name
]
"src/lfx/src/lfx/cli/upgrade.py" = [
"TC003", # Path is used at runtime, not just in type hints
]
"src/lfx/src/lfx/components/__init__.py" = [
"SLF001", # Accessing _dynamic_imports from modules
]
"src/lfx/src/lfx/components/data/save_file.py" = [
"SLF001", # Google API client private member access
]
"src/lfx/src/lfx/components/datastax/astradb_vectorstore.py" = [
"S110", # Try-except-pass for optional metadata
]
"src/lfx/src/lfx/components/google/google_generative_ai_embeddings.py" = [
"SLF001", # Google AI library private member access
]
"src/lfx/src/lfx/components/knowledge_bases/retrieval.py" = [
"SLF001", # Chroma client private member access
]
"src/lfx/src/lfx/components/mongodb/mongodb_atlas.py" = [
"SLF001", # MongoDB collection private member access
]
"src/lfx/src/lfx/components/tools/{python_code_structured_tool.py,searxng.py}" = [
"S102", # Use of exec/eval for dynamic code execution
"SLF001", # Component internal member access
]
"src/lfx/src/lfx/components/vectorstores/astradb.py" = [
"S110", # Try-except-pass for optional metadata
]
"src/lfx/src/lfx/custom/{code_parser/code_parser.py,validate.py}" = [
"S102", # Use of exec for code validation
]
"src/lfx/src/lfx/custom/custom_component/component.py" = [
"SLF001", # Component internal state management
]
"src/lfx/src/lfx/custom/directory_reader/directory_reader.py" = [
"SLF001", # Component introspection
]
"src/lfx/src/lfx/custom/utils.py" = [
"SLF001", # Component code analysis
]
"src/lfx/src/lfx/graph/graph/ascii.py" = [
"SLF001", # Grandalf library private member access
]
"src/lfx/src/lfx/inputs/input_mixin.py" = [
"S105", # False positive: PASSWORD is a type constant
]
"src/lfx/src/lfx/__main__.py" = [
"B008", # Typer CLI requires function calls in argument defaults
"FBT001", # Bool flags are the standard typer pattern
"FBT003", # Boolean positional values in typer.Option() calls
]
"src/lfx/src/lfx/cli/_setup_commands.py" = [
"B008", # Typer CLI requires function calls in argument defaults
"FBT001", # Bool flags are the standard typer pattern
"FBT003", # Boolean positional values in typer.Option() calls
]
"src/lfx/src/lfx/cli/_authoring_commands.py" = [
"B008", # Typer CLI requires function calls in argument defaults
"FBT001", # Bool flags are the standard typer pattern
"FBT003", # Boolean positional values in typer.Option() calls
]
"src/lfx/src/lfx/cli/_running_commands.py" = [
"B008", # Typer CLI requires function calls in argument defaults
"FBT001", # Bool flags are the standard typer pattern
"FBT003", # Boolean positional values in typer.Option() calls
]
"src/lfx/src/lfx/cli/_remote_commands.py" = [
"B008", # Typer CLI requires function calls in argument defaults
"FBT001", # Bool flags are the standard typer pattern
"FBT003", # Boolean positional values in typer.Option() calls
]
"src/backend/base/langflow/api/utils/*" = [
"TCH", # Imports are used at runtime (FastAPI deps, SQLAlchemy queries, model constructors)
]
"src/sdk/src/langflow_sdk/_http.py" = [
"TCH", # httpx is used at runtime (response object methods)
]
"src/sdk/src/langflow_sdk/environments.py" = [
"TRY003", # Contextual error messages are necessary here
"EM102", # f-string messages assigned before raise where possible
]
"src/sdk/tests/*" = [
"S101", # assert is the standard pytest assertion style
"INP001", # Not a package namespace issue in tests
"TC003", # pytest fixture type hints are evaluated at runtime
]
"src/lfx/src/lfx/schema/table.py" = [
"S105", # False positive: PASSWORD is a formatter type
]
"src/lfx/src/lfx/services/mcp_composer/service.py" = [
"S104", # Intentional binding to all interfaces for server
"S110", # Try-except-pass for optional error logging
]
"src/backend/tests/*" = [
"D1",
"PLR2004",
"S101",
"SLF001",
"BLE001", # allow broad-exception catching in tests
]
"src/backend/base/langflow/tests/*" = [
"D1",
"PLR2004",
"S101",
"SLF001",
"BLE001", # allow broad-exception catching in tests
]
"src/lfx/tests/*" = [
"D1",
"PLR2004",
"S101",
"SLF001",
"BLE001", # allow broad-exception catching in tests
"S104", # Binding to all interfaces (test servers)
"S108", # Insecure temp file usage (safe in tests)
]
"src/bundles/*/tests/*" = [
"D1",
"PLR2004",
"S101",
"SLF001",
"BLE001", # allow broad-exception catching in tests
"S104", # Binding to all interfaces (test servers)
"S108", # Insecure temp file usage (safe in tests)
"INP001", # Bundle test dirs are not import packages
]
"src/backend/tests/locust/*" = [
"D1", # Missing docstrings (CLI tools don't need full docstrings)
"T201", # Print statements (needed for CLI output)
"S603", # Subprocess calls (needed for running commands)
"S607", # Starting process with partial executable path
"S104", # Binding to all interfaces (needed for Langflow server)
"S105", # Hardcoded passwords (test credentials)
"FBT001", # Boolean-typed positional arguments (common in CLI)
"FBT002", # Boolean default arguments (common in CLI tools)
"TRY002", # Custom exceptions (generic exceptions OK for CLI)
"TRY003", # Long exception messages (descriptive errors for users)
"TRY300", # Consider moving to else block (return patterns)
"EM101", # String literals in exceptions (user-facing messages)
"EM102", # F-string literals in exceptions (user-facing messages)
"EXE001", # Shebang without executable (may be run via python)
"D415", # First line punctuation (CLI docstrings)
"F401", # Unused imports (imports for availability checking)
"PTH123", # Use Path.open (open() is fine for simple cases)
"PTH107", # Use Path.unlink (os.remove is fine for simple cases)
"PTH207", # Use Path.glob (glob.glob is fine for simple cases)
"B007", # Unused loop variables (tuple unpacking)
"PLW0602", # Global variable usage (needed for locust state)
"PLW0603", # Global variable updates (needed for locust state)
"DTZ005", # Datetime without timezone (local time is fine for logs)
"G004", # Logging f-strings (detailed error logging)
"SIM102", # Nested if statements (readability over optimization)
"E501", # Line too long (some CLI commands are naturally long)
]
[tool.ruff.lint.flake8-builtins]
builtins-allowed-modules = [ "io", "logging", "socket"]
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"
Reference in New Issue View Git Blame Copy Permalink