Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
859 commits
Select commit Hold shift + click to select a range
538bcf3
feat: docs page copy-as-markdown keyboard shortcut (#13628)
mendonk Jun 12, 2026
3e3a24e
fix: fail fast when Redis job queue backend is unreachable (#13456)
ogabrielluiz Jun 12, 2026
0231969
feat: add docs feedback components (#13627)
mendonk Jun 12, 2026
d416a9c
ci: fit weekly test-durations refresh inside the 6h limit and alert o…
erichare Jun 12, 2026
43d3510
chore: update test durations (#13640)
github-actions[bot] Jun 12, 2026
de06b91
fix(frontend): duplicate tooltip + raw i18n key on collapsed sidebar …
keval718 Jun 15, 2026
ca29afa
fix(frontend): restore Inspection Panel access to hidden advanced fie…
keval718 Jun 15, 2026
02e8845
fix(database): resolve Alembic log to writable config dir, never cras…
erichare Jun 15, 2026
bb930e2
docs: build docker from source (#13041)
mendonk Jun 15, 2026
a074efa
fix: protect URL components from SSRF (#13643)
erichare Jun 15, 2026
626365f
fix(security): run trusted server code on unauthenticated public flow…
erichare Jun 15, 2026
72f86c9
ci: gate backend tests by Python changes (#13614)
viktoravelino Jun 15, 2026
033ce41
fix: guard CUGA CodeAgent local execution (#13644)
erichare Jun 15, 2026
9266b08
chore: mend dep upgrades
Adam-Aghili Jun 15, 2026
c721fca
fix: guard event serialization against unserializable component paylo…
erichare Jun 15, 2026
d43c9ea
fix: run trusted server copy on custom-component hash-gate match (#13…
erichare Jun 16, 2026
11f2591
fix: map uuid to a CommonJS mock so Jest can load ESM-only uuid v14
erichare Jun 16, 2026
c4d2781
fix: nest root LLM runs under the flow trace in Langfuse (#13429) (#1…
erichare Jun 16, 2026
461d377
fix: accept Data and Message inputs in LoopComponent (#13646)
putramkti Jun 16, 2026
40d7814
feat: New Bundle support for Multi-vector NextPLAID vector store (#13…
meetdoshi90 Jun 16, 2026
4a138e2
chore: update uv
Adam-Aghili Jun 16, 2026
f8a1ce1
feat: first-class local-model support for the assistant (#13641)
Cristhianzl Jun 16, 2026
5d1c36c
test(authz): RBAC enforcement + share-lifecycle integration tests via…
erichare Jun 16, 2026
97c5598
fix(authz): schedule periodic audit-log retention cleanup (#13546)
erichare Jun 16, 2026
c0eebb1
fix: restore route discovery under FastAPI 0.137 lazy include_router …
erichare Jun 17, 2026
a383f4d
fix: guard OTel FastAPI span route extraction against 0.137 lazy incl…
erichare Jun 17, 2026
88ed381
fix: catch RecursionError when converting tools to SPARC specs on Pyt…
erichare Jun 17, 2026
e5d42e5
feat: upgrade Firecrawl to v2 SDK and extract into the lfx-firecrawl …
rakshith48 Jun 17, 2026
df0cedf
fix(security): block code-bearing nodes with empty type in flow valid…
erichare Jun 17, 2026
a8deb35
fix(security): bump residual deprecated transitive uuid to v11 (#13703)
erichare Jun 17, 2026
dd37e18
fix(security): gate public user self-registration (CWE-862) (#13706)
erichare Jun 17, 2026
b033bfa
feat(auth): external trusted JWT auth + JIT user mapping + access cei…
erichare Jun 17, 2026
b796f55
fix(load): bound remote flow fetches (#13660)
pony-maggie Jun 18, 2026
d68e4bb
fix: route IBM WatsonX selections to model_id endpoint in unified get…
erichare Jun 18, 2026
2b8f7f9
fix: Raise on an undecryptable secret at the variable-resolution (#1…
Jkavia Jun 18, 2026
842e815
chore: dep update
Adam-Aghili Jun 18, 2026
cf86bf6
fix(security): require authentication for POST /api/v2/registration/ …
erichare Jun 18, 2026
504f760
fix(security): block code injection via the Tweaks API (CWE-94) (#13705)
erichare Jun 18, 2026
094694d
fix(security): derive Fernet key from short secrets with SHA-256 (GHS…
erichare Jun 18, 2026
e7c33db
fix(security): do not execute code in validate_code (GHSA-2wcq-pvw2-x…
erichare Jun 18, 2026
17fd60e
fix: downgrade torchvision until cpu index fix (#13745)
Adam-Aghili Jun 18, 2026
744c36e
fix(security): stop issuing 365-day superuser token via auto_login (G…
erichare Jun 18, 2026
0f7c220
fix(security): HMAC-sign RedisCache payloads before dill deserializat…
erichare Jun 18, 2026
25124fa
fix(security): sanitize APIRequest Content-Disposition filename (GHSA…
erichare Jun 18, 2026
b43d17b
Update test_redis_job_queue_service.py
erichare Jun 18, 2026
59e0326
feat(lfx): verified-JWT identity forwarding for lfx serve (#13632)
jordanrfrazier Jun 19, 2026
2ff1921
docs: add lfx-nextplaid bundle (#13679)
mendonk Jun 19, 2026
11a18f7
fix(security): disable credentials for wildcard CORS origins (CWE-942…
erichare Jun 19, 2026
2754c84
fix(security): gate PythonREPL execution on allow_custom_components (…
erichare Jun 19, 2026
7799d1a
fix(security): scope voice-mode clients per user (#13702)
erichare Jun 19, 2026
2b7b113
fix: warn on empty value and decrypt failure in get_all variable list…
Jkavia Jun 19, 2026
0b14a6b
fix(security): gate ToolGuard guard-code execution on allow_custom_co…
erichare Jun 19, 2026
81196ce
fix: validate uploaded MCP servers config to close command-injection …
erichare Jun 19, 2026
4ebac3f
chore: upgrade langchain (#13750)
Adam-Aghili Jun 19, 2026
194f42b
perf: cache Ollama model capabilities to fix slow Cloud model toggles…
erichare Jun 19, 2026
eb24739
fix(docker): force HTTP/1.1 on frontend nginx upstream proxy (#9010) …
keval718 Jun 19, 2026
db2f5c4
fix(smart-router): stop unselected branches from executing downstream…
erichare Jun 19, 2026
271c750
fix(lfx): preserve custom static models through models.dev override (…
erichare Jun 19, 2026
2b4e720
fix: stop temp_dirs masking startup errors; fail-fast on unresolvable…
erichare Jun 19, 2026
9bd47b6
Template and comp update
erichare Jun 19, 2026
f5ba8f5
fix: handle Windows path separators in Policies ToolGuard Guard mode …
erichare Jun 19, 2026
309a558
chore(deps): bump toolguard floor to 0.2.20 (#13769)
erichare Jun 22, 2026
b8d7a1a
fix(frontend): stop browser autofill from corrupting component config…
erichare Jun 22, 2026
cc398d9
fix(lfx): make OpenDsStar optional (#13749)
erichare Jun 22, 2026
b0d4fe0
fix(ci): resolve pre-release cross-platform install failure; graduate…
erichare Jun 22, 2026
47760d2
fix(ci): drop macOS Intel from py3.14 cross-platform set (onnxruntime…
erichare Jun 22, 2026
0125c38
fix(i18n): fix MCP hardcoded strings (#13621)
RamGopalSrikar Jun 22, 2026
f39416b
fix: make IBM WatsonX models selectable and runnable in the Langflow …
Cristhianzl Jun 22, 2026
0300305
docs: fix empty see also sections in extensions (#13774)
mendonk Jun 22, 2026
408b737
fix(agents): stop leaking LangChain chain markers to stdout (#13662) …
erichare Jun 22, 2026
2302ef9
fix(component): reconnect stale cached SQL database connections on SQ…
dutitello Jun 22, 2026
f58914b
fix: release candidate version selection (#13776)
erichare Jun 22, 2026
f85a32a
feat: native v2 workflows endpoint with pluggable stream protocols (#…
ogabrielluiz Jun 23, 2026
8c98cdf
fix(security): block socket/urllib network egress in component code s…
erichare Jun 23, 2026
7db4bcb
fix: degrade gracefully when caching unpicklable values in RedisCache…
erichare Jun 23, 2026
7896b9f
feat(bundles): metapackage split (Phase A) — engine-only lfx, lfx-bun…
erichare Jun 23, 2026
12d8128
feat(frontend): RBAC permission gating via /authz/me/permissions (#13…
erichare Jun 23, 2026
4c8fb6b
fix: gate release rc setup for stable releases
erichare Jun 23, 2026
f85901e
chore: bump sdk release version
erichare Jun 23, 2026
a66b75a
chore: require bumped sdk for lfx release
erichare Jun 23, 2026
9e2b8a1
feat: wire list_visible_resource_ids prefilter into list endpoints (#…
erichare Jun 23, 2026
6453fa8
ci: throttle bundle publishes to PyPI
erichare Jun 23, 2026
1a60220
Merge remote-tracking branch 'origin/release-1.10.1'
erichare Jun 23, 2026
4a8b47e
Merge remote-tracking branch 'origin/release-1.10.1' into release-1.11.0
erichare Jun 24, 2026
4a3622b
chore: release cleanup (#13789)
erichare Jun 24, 2026
1cb31f5
fix: cap composio client version
erichare Jun 24, 2026
7db38d1
fix: unblock nightly bundle install resolution
erichare Jun 24, 2026
3f4c1a0
fix: unblock nightly bundle install resolution
erichare Jun 24, 2026
e7bf0da
fix: include sdk wheel in bundle smoke test
erichare Jun 24, 2026
ecd7888
fix: temporarily disable unpublished bundle deps
erichare Jun 24, 2026
9121161
fix: skip provider-component tests while bundles are temporarily disa…
Cristhianzl Jun 24, 2026
cf9cabd
fix: guard temporarily-disabled bundle deps across backend + frontend…
Cristhianzl Jun 24, 2026
d2648b9
test: guard temporarily-disabled bundles in component/template tests …
Cristhianzl Jun 24, 2026
b565a14
fix: keep tests and the starter-projects endpoint green while bundles…
Cristhianzl Jun 24, 2026
a42af78
test: decouple core tests from disabled bundles (#13805)
erichare Jun 24, 2026
d500524
Revert "fix: keep tests and the starter-projects endpoint green while…
erichare Jun 24, 2026
b686855
feat(lfx): add pre-warm functionality (#13682)
jordanrfrazier Jun 24, 2026
5cb0edd
fix: keep nightly prerelease wheels explicit (#13815)
erichare Jun 24, 2026
4da60c4
fix: keep nightly prerelease wheels explicit (#13817)
erichare Jun 24, 2026
711b6b4
test: remove permanently-skipped dead specs (#13800)
tarciorodrigues Jun 24, 2026
3b6d154
fix: use session exec in telemetry writer (#13821)
erichare Jun 24, 2026
2e990b2
fix: disable mem0 telemetry by default (#13824)
erichare Jun 24, 2026
ce71c72
chore: restore bundles that are now published (#13825)
erichare Jun 25, 2026
ffd119c
test: remove duplicate Playwright e2e coverage (#13819)
tarciorodrigues Jun 25, 2026
cf5c37f
fix: handle invalid session auth tokens (#13823)
erichare Jun 25, 2026
776b9e6
fix: share policy refresh and owner permissions (#13830)
erichare Jun 25, 2026
7dd6347
feat: a11y (#13561)
viktoravelino Jun 25, 2026
c6dbca3
fix: remove hardcoded default superuser password (#13822)
erichare Jun 25, 2026
49fc1f8
feat(lfx): introduce pluggable executor seam (#12981)
ogabrielluiz Jun 25, 2026
8971129
ci: push nightly .devX Docker images to langflowai/langflow and fix d…
vjgit96 Jun 25, 2026
93e5472
feat: make content_blocks the source of truth for Message content (#1…
ogabrielluiz Jun 25, 2026
dc39921
fix: release QA component follow-ups for bundles (#13834)
erichare Jun 25, 2026
d2d1bdc
fix(telemetry): use SQLAlchemy AsyncSession to stop deprecation-warni…
erichare Jun 26, 2026
a277209
ci: push nightly .devX Docker images to langflowai/langflow and fix d…
vjgit96 Jun 25, 2026
b217730
fix: authz flow permission gates (#13857)
erichare Jun 26, 2026
c12bc16
fix: handle invalid session auth tokens (#13863)
erichare Jun 26, 2026
c1c2d59
ci: serialize starter project template shard (#13865)
erichare Jun 26, 2026
6388c84
fix(a11y): label icon-only controls (#13678)
viktoravelino Jun 26, 2026
5b12c51
feat(starter-projects): refresh starter flows for 1.10.x, add Multi A…
rafaelgiln Jun 27, 2026
5056622
fix: raise model input popover above inspection panel
erichare Jun 27, 2026
228145f
chore: clarify calculator AST comment (#13881)
erichare Jun 27, 2026
fa78cdd
test(e2e): DRY setup and parameterize same-shape specs (#13844)
tarciorodrigues Jun 27, 2026
26dc6fd
chore: update test durations (#13888)
github-actions[bot] Jun 29, 2026
76dae98
chore(base): trim langflow-base[complete] staleness; relocate lfx-cor…
erichare Jun 29, 2026
eaa8ec7
test: consolidate bundle-component tests under components/bundles/<pr…
erichare Jun 29, 2026
6282420
fix: isolate FAISS persistence by user (#13871)
erichare Jun 29, 2026
95b2074
fix: block public builds of code execution agents (#13875)
erichare Jun 29, 2026
19ef79d
fix: validate file paths by resolved cache containment (#13872)
erichare Jun 29, 2026
42a2332
fix: restrict log retrieval to superusers (#13873)
erichare Jun 29, 2026
2e46d06
fix: block dangerous MCP stdio env vars (#13874)
erichare Jun 29, 2026
3b110d9
fix: Block Python interpreter format traversal (#13880)
erichare Jun 29, 2026
572fb5b
fix: constrain Directory component paths (#13878)
erichare Jun 29, 2026
1ad7527
fix: changed image base to be ubi10 (#13893)
lucaseduoli Jun 29, 2026
2d283e4
fix: isolate FAISS persistence by user (lfx-bundles copy) (#13899)
erichare Jun 29, 2026
ae7f166
fix(mcp): launch stdio servers with shell=False (no bash -c / cmd /c …
erichare Jun 29, 2026
227c35f
fix(ci): pin lfx[extra] refs to exact dev version in nightly base bump
erichare Jun 30, 2026
ee60a50
fix: gate litellm off Python 3.14 so pip install langflow resolves (#…
erichare Jun 30, 2026
b64d4f5
feat: add PaddleOCR partner bundle (lfx-paddle) — inherits #13779 (#1…
erichare Jun 30, 2026
5075d0f
chore: clean up startup messages (#13909)
erichare Jun 30, 2026
9d4810c
Merge remote-tracking branch 'origin/release-1.10.2' into release-1.11.0
erichare Jun 30, 2026
a6f5f51
fix: scope local vector store collections by user (#13882)
erichare Jun 30, 2026
8c065a5
fix: scope local vector store collections by user (#13882)
erichare Jun 30, 2026
cfb1074
Merge remote-tracking branch 'origin/release-1.10.2' into release-1.11.0
erichare Jun 30, 2026
d0eab29
feat: add EmpirioLabs partner bundle (lfx-empiriolabs) — refactor of …
erichare Jun 30, 2026
c7d7676
feat(lfx): let extension bundles register model providers (#13916)
erichare Jun 30, 2026
1d93be6
test: gate CrewAI imports on Python 3.14
erichare Jul 1, 2026
777c002
fix: remove vllm from lfx-bundles
erichare Jul 1, 2026
7cae6d7
fix: allow retired vllm bare-name migrations
erichare Jul 1, 2026
f28337b
fix: remove stale vllm component shim
erichare Jul 1, 2026
6a1c088
test: fix FAISS bundle monkeypatch
erichare Jul 1, 2026
869627a
fix(ci): preserve lfx dependency markers in nightly pins
erichare Jul 1, 2026
f342655
fix(ci): stop nightly Group 3 timeout and db-migration superuser boot…
erichare Jul 1, 2026
951ea94
fix(ci): honor MCP auto-init skip with cached settings
erichare Jul 1, 2026
ab8508d
fix(ci): consolidate recent nightly CI fixes
erichare Jul 1, 2026
50f4f07
test(frontend): harden model dropdown footer clicks in select-gpt-mod…
erichare Jul 1, 2026
90158fc
refactor(lfx): extract v2 workflow contract layer into lfx.workflow (…
ogabrielluiz Jul 1, 2026
b9de51f
ci: surface nightly Group 3 stall via 90s pytest thread-timeout (rele…
erichare Jul 1, 2026
315cc41
ci: surface nightly Group 3 stall via 90s pytest thread-timeout (#13938)
erichare Jul 1, 2026
ed8ab84
feat: add OpenAI Compatible as a first-class unified model provider (…
erichare Jul 1, 2026
50b3c7b
feat: unify JSON/Table/Text operations into a single Operations compo…
erichare Jul 2, 2026
25e8b2c
fix(kb): align frontend default chunk settings with backend (#13896)
tarciorodrigues Jul 2, 2026
ac97b04
fix(a11y): resolve WCAG 2.1 Level A and AA violations on settings gen…
olayinkaadelakun Jul 2, 2026
4670395
feat(embeddings): populate available_models from configured providers…
HimavarshaVS Jul 2, 2026
d5ca6e1
fix: log missing optional deps as one-line warning during component d…
erichare Jul 2, 2026
df8752a
fix: false duplicate-distribution extension errors from lib64 symlink…
erichare Jul 2, 2026
106760a
fix: arxiv timeout in research translation loop (#13954)
erichare Jul 2, 2026
8136694
docs: add frontend-i18n agent skill and wire it into frontend-code-re…
Cristhianzl Jul 3, 2026
538506a
fix(api-keys): replace native date input with shadcn date picker (#13…
tarciorodrigues Jul 3, 2026
a91c3fd
fix(a11y): fix traces page accessibility violations — rowgroup tabbab…
olayinkaadelakun Jul 6, 2026
3965c3b
feat: add global variable model overrides (#13935)
erichare Jul 6, 2026
6bd0e05
feat(exa): update Exa Search to the exa-py SDK and graduate it to the…
erichare Jul 6, 2026
b40e4aa
chore: upgrade lock files (#13971)
Adam-Aghili Jul 6, 2026
a69a47f
fix: cascade span deletes when clearing traces for a flow (#13960)
andifilhohub Jul 6, 2026
60f3ab2
fix(frontend): stop flow deletes from clobbering newly created flows …
Cristhianzl Jul 7, 2026
1d10ca0
ci: fix Playwright retry shell and sweep grep
Cristhianzl Jul 7, 2026
0a07a5f
fix(frontend): clear /flows page a11y debt (#13891)
viktoravelino Jul 7, 2026
d4cab92
feat(bundles): add torch-free all-no-torch extra to lfx-bundles (#13886)
jordanrfrazier Jul 7, 2026
2433e87
chore: upgrade uv.lock
Adam-Aghili Jul 7, 2026
86ce969
chore: upgrade wxo adk core/clients to 2.12 (for python 3.14 support)…
HzaRashid Jul 7, 2026
6fef05c
Merge remote-tracking branch 'origin/release-1.10.2'
Adam-Aghili Jul 7, 2026
02a4d9a
Merge remote-tracking branch 'origin/main' into release-1.11.0
Adam-Aghili Jul 7, 2026
3fb6f92
fix(traces): migrate legacy uppercase spanstatus/spantype enum labels…
erichare Jul 7, 2026
55ac121
feat(lfx-serve): v2 workflow endpoints (sync + stream) (#13783)
ogabrielluiz Jul 8, 2026
91cb382
fix(ci): publish bundle deps before nightly main (#13982)
erichare Jul 8, 2026
577b47a
docs: wxo ADK upgrade to support Python 3.14 (#13667)
mendonk Jul 8, 2026
db50d03
feat(lfx-serve): lfx owns the v2 workflow router via a host-DI seam (…
ogabrielluiz Jul 8, 2026
998bee2
fix(lfx): read local files under S3 storage to unblock the Assistant …
Cristhianzl Jul 8, 2026
9894a29
perf: limit message history fetch to prevent canvas slowdown on repea…
YeonghyeonKO Jul 8, 2026
2b4b628
docs: add extension error guidance page and fix ref_url links (#13937)
mendonk Jul 8, 2026
c4db860
fix: prevent LangfuseResourceManager deepcopy failure in Agent/Tool C…
gingeekrishna Jul 9, 2026
c17051c
feat(mcp): persist MCP servers in a database table (#13976)
thesaadmirza Jul 9, 2026
6ea7dc0
docs: external authentication, RBAC, SSO (#13866)
mendonk Jul 9, 2026
1ba8b82
fix(docker): give runtime user a writable npm cache so stdio MCP serv…
erichare Jul 9, 2026
7ffd040
fix: thin single focus border on global-variable input (#13995)
Cristhianzl Jul 9, 2026
cd3f2b9
ci: add non-blocking flaky test report job with 30-day retention (#13…
tarciorodrigues Jul 10, 2026
0a07327
fix(a11y): improve API keys tab order (#13953)
viktoravelino Jul 10, 2026
db5f3b0
fix(frontend): center update toast buttons vertically (#14004)
Cristhianzl Jul 10, 2026
575a0d7
docs: lfx user docs and bundle extension changes (#13775)
mendonk Jul 10, 2026
bf81807
fix(a11y): make /assets/files accessible (#13987)
viktoravelino Jul 10, 2026
3239f63
feat(playground): content blocks frontend renderer for v2 workflows (…
ogabrielluiz Jul 10, 2026
645b838
feat(api): durable background execution service (store + default back…
ogabrielluiz Jul 10, 2026
d846b2b
docs: AGUI protocol, workflows quickstart, update examples (#13911)
mendonk Jul 10, 2026
c578a4b
feat(frontend): render the flow share seam in the editor Share dropdo…
keval718 Jul 10, 2026
e871062
fix: fail loud on undecryptable KB embedding key with recovery path (…
Jkavia Jul 10, 2026
ccdb7c7
feat(models): add Azure AI Foundry to unified model provider setup (#…
HimavarshaVS Jul 10, 2026
7f28257
fix: add missing vllm icon from model providers
erichare Jul 10, 2026
fd2ecc8
chore: restore Python 3.14 litellm gating lost in release-1.10.2 merg…
erichare Jul 13, 2026
e6b5b87
docs: oracle component page and release note (#13984)
mendonk Jul 13, 2026
67f5a38
fix: rename Operations component display name to Data Operations (#14…
erichare Jul 13, 2026
c8fa807
fix: return 403 instead of 404 on denied flow DELETE when the flow is…
erichare Jul 13, 2026
01d1c68
fix(a11y): add accessible names to notifications popover controls (#1…
olayinkaadelakun Jul 13, 2026
b4ac6a6
fix: settings/global-variables accessibility (#13990)
deon-sanchez Jul 13, 2026
72bfbc7
fix(memory): preserve asyncio cancellation (#14028)
erichare Jul 13, 2026
1687c5a
docs: paddle OCR component bundle (#14011)
mendonk Jul 13, 2026
1821968
docs: add additional packages gated by python 3.14 (#13828)
mendonk Jul 13, 2026
1641b28
fix(security): harden multi-tenant surfaces (#13530)
jordanrfrazier Jul 13, 2026
e22c931
fix(models): allow Azure AI Foundry deployment names instead of catal…
HimavarshaVS Jul 13, 2026
80758f2
chore(deps): bump fastapi to 0.139.0, serve frontend via app.frontend…
ogabrielluiz Jul 13, 2026
5f1bb6d
feat(assistant): QA fixes + model portability, budget, and error visi…
Cristhianzl Jul 13, 2026
d536c89
fix: close tenant-isolation gaps in security hardening (#14044)
erichare Jul 13, 2026
d796ea6
feat(lfx): multi-worker serving with per-request isolation for lfx se…
jordanrfrazier Jul 13, 2026
1f8f98d
fix: refresh agentic MCP snapshots
erichare Jul 13, 2026
4e42308
feat: durable background execution + HITL suspend/resume schema (#13633)
Cristhianzl Jul 14, 2026
7157a10
fix: gate lfx-bundles ALTK on Python 3.14 (#14055)
erichare Jul 14, 2026
e53f92d
fix(initial_setup): preserve variable bindings when loading flows fro…
erichare Jul 14, 2026
99e864d
docs: unified operations component (#13920)
mendonk Jul 14, 2026
a934627
fix(lfx): tighten horizontal spacing in generated flow layout (#14059)
keval718 Jul 14, 2026
09d77c4
fix: correct deprecated model settings behavior (#14048)
erichare Jul 14, 2026
bf90b64
fix(frontend): stop assistant 'New' pill from shifting on hover (#14035)
keval718 Jul 14, 2026
ad1b44f
fix(frontend): anchor alert notifications flush to bottom corner (#14…
keval718 Jul 14, 2026
ffaba5c
chore: update deps (#14069)
Adam-Aghili Jul 14, 2026
d447000
docs: component input and component index telemetry events (#14062)
mendonk Jul 14, 2026
54c24c6
fix(frontend): hide assistant 'New' badge once feature is discovered …
keval718 Jul 15, 2026
a93c64a
fix(frontend): prefer strong model as assistant composer default (#14…
Cristhianzl Jul 15, 2026
887f2a5
fix(authz): close RBAC enforcement and permission UX gaps (#14068)
erichare Jul 15, 2026
4f86736
fix(api): enforce sync-only output_ids across modes and correct docum…
ogabrielluiz Jul 15, 2026
c487d31
fix(lfx): deduplicate Google embedding model aliases (#14082)
erichare Jul 15, 2026
43f52df
fix: expose stable Langfuse trace IO for evaluators (#14089)
erichare Jul 15, 2026
2af861f
fix: make the 1.11 core runtime self-contained (#14098)
erichare Jul 15, 2026
b00de32
fix(mcp): forward advertised flow input fields (#14074)
erichare Jul 15, 2026
5a1a21f
docs: openai compatible provider bundle (#14000)
mendonk Jul 15, 2026
e705b39
fix(release): scope bundle RC versioning
erichare Jul 15, 2026
85b76f5
fix: keep nv-ingest compatible with urllib3 security floor (#14106)
erichare Jul 15, 2026
f307634
fix(agentic): honor iterations_limit in builds (#14094)
Cristhianzl Jul 15, 2026
f4d6ac4
fix(security): forward-port release-1.10.3 hardening (#14073)
erichare Jul 16, 2026
82876e4
feat(frontend): add OpenRAG icon (#14095)
erichare Jul 16, 2026
d89c8f8
fix(hitl): rename inputs, advanced timeout + HITL palette and control…
Cristhianzl Jul 16, 2026
d0da490
feat: valkey component
Mar 30, 2026
2a4e228
[autofix.ci] apply automated fixes
autofix-ci[bot] Jul 16, 2026
f9cd333
[autofix.ci] apply automated fixes (attempt 2/3)
autofix-ci[bot] Jul 16, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
The diff you're trying to view is too large. We only load the first 3000 changed files.
12 changes: 7 additions & 5 deletions .agents/skills/e2e-testing/SKILL.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ description: Write and review Playwright E2E tests for Langflow. Trigger when th

| Tool | Version | Purpose |
|------|---------|---------|
| Playwright | 1.57.0 | E2E test runner + browser automation |
| Playwright | 1.59.1 | E2E test runner + browser automation |
| Chromium | (bundled) | Default browser (Firefox/Safari disabled) |
| Custom fixtures | `tests/fixtures.ts` | Auto-detects API errors and flow execution failures |

Expand Down Expand Up @@ -167,17 +167,19 @@ withEventDeliveryModes(

## Tags System

Every test MUST have at least one tag. Tags enable filtering and CI pipeline configuration.
Every test MUST be tagged with `@release` — the release run greps for it, so an
untagged or wrongly-tagged spec silently drops out of release coverage. Add the
domain tag(s) below on top of `@release` (a test can have more than one). These
six are the only allowed tags; do not invent new ones.

| Tag | Purpose | When to Use |
|-----|---------|-------------|
| `@release` | Tests that must pass before release | Critical user flows |
| `@release` | Part of the release run (required on every spec) | All tests |
| `@workspace` | Workspace/flow management | Creating, editing, deleting flows |
| `@api` | API-dependent features | Tests that call backend endpoints |
| `@database` | Database operations | Tests involving persistence |
| `@components` | Component-level tests | Individual component behavior |
| `@starter-projects` | Template/starter project tests | Pre-built flow templates |
| `@regression` | Bug regression tests | Tests for specific fixed bugs |

```typescript
// Right: tag your test
Expand Down Expand Up @@ -322,7 +324,7 @@ test.skip(true, "Feature not yet implemented with new designs");
## Writing Good E2E Tests

### Do:
- **Tag every test** with at least one tag
- **Tag every test** with `@release` (plus any domain tags that apply)
- **Import from `../../fixtures`**, not `@playwright/test`
- **Start with `awaitBootstrapTest(page)`** — always
- **Use `getByTestId`** for stable selectors
Expand Down
239 changes: 239 additions & 0 deletions .agents/skills/frontend-a11y-check/SKILL.md

Large diffs are not rendered by default.

1 change: 1 addition & 0 deletions .agents/skills/frontend-code-review/SKILL.md
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ Notes when using this skill:
- **Code quality**: For any reviewed file, follow [references/code-quality.md](references/code-quality.md) to check styling conventions, TypeScript usage, Biome compliance, and component patterns.
- **Performance**: If the review scope involves React components, hooks, Zustand stores, React Query usage, or @xyflow/react node rendering, follow [references/performance.md](references/performance.md) to check for re-render issues, memoization, and data flow patterns.
- **Business logic**: If the review scope involves custom nodes (GenericNode), flow state, API calls, the component system, global variables, or the inspection panel, follow [references/business-logic.md](references/business-logic.md) to check for Langflow-specific correctness.
- **i18n**: If the diff adds or changes user-facing text (labels, buttons, tooltips, modals, toasts, errors, placeholders, aria-labels), follow the [frontend-i18n skill](../frontend-i18n/SKILL.md): no hardcoded UI strings — everything through `t(...)` — and every new key present in **all** locale files (`src/frontend/src/locales/*.json`).

## General Review Rules

Expand Down
62 changes: 62 additions & 0 deletions .agents/skills/frontend-i18n/SKILL.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
---
name: frontend-i18n
description: Add, change, or review user-facing text in the Langflow frontend using the i18n system (i18next / react-i18next). Use whenever a change adds or edits UI strings — labels, buttons, tooltips, modals, toasts, error messages, empty states — or when reviewing a diff that contains user-facing text. Every user-facing string must go through the translation system and every new key must exist in ALL locale files. Do NOT use for backend strings, log messages, or code identifiers.
---

# Frontend i18n

The Langflow frontend is internationalized with **i18next + react-i18next**. Locales live in `src/frontend/src/locales/` — currently `en`, `de`, `es`, `fr`, `ja`, `pt`, `zh-Hans`. A hardcoded user-facing string, or a key missing from one locale, ships broken UI for part of the user base.

## The two rules

1. **Every user-facing string goes through `t(...)`** — never hardcoded JSX text for labels, buttons, tooltips, modals, toasts, errors, placeholders, `aria-label`s, or empty states.
2. **Every new key is added to ALL locale files in the same PR** (`en.json`, `de.json`, `es.json`, `fr.json`, `ja.json`, `pt.json`, `zh-Hans.json`). `fallbackLng: "en"` means a missing key silently shows English — it won't crash, which is exactly why reviews must catch it.

## How it works here

- Config: `src/frontend/src/i18n.ts` — a custom i18next instance. `en` is bundled statically; other languages are **lazy-loaded** by `loadLanguage()` via dynamic import. Language preference comes from `localStorage.getItem("languagePreference")`, normalized (e.g. `zh-CN` → `zh-Hans`, unknown → `en`).
- Keys are **flat, dot-namespaced by feature**: `deleteModal.title`, `errors.fileTooLarge`, `crash.restartButton`. Follow the existing namespace of the area you're touching; create a new prefix only for a genuinely new surface.
- Interpolation uses `{{variable}}` in the string and an options object in the call.

## Adding a string (the pattern)

```tsx
import { useTranslation } from "react-i18next";

const { t } = useTranslation();

<span>{t("deleteModal.title")}</span>
<p>{t("errors.fileTooLarge", { maxSizeMB: "10MB" })}</p>
```

In `locales/en.json` (and **every** other locale file):

```json
"errors.fileTooLarge": "The file size is too large. Please select a file smaller than {{maxSizeMB}}."
```

For the non-English locales, write a real translation when confident; if not, add the key with the English value and flag it in the PR — a present-but-untranslated key is visible and searchable, a missing key is invisible.

## Rules that prevent real bugs

- **Don't concatenate translated fragments** (`t("a") + name + t("b")`) — word order differs across languages. Use one key with interpolation: `t("greeting", { name })`.
- **Don't put JSX/HTML inside translation strings**; compose in JSX around `t()` calls (see how `crash.descriptionBefore` / `crash.githubIssues` / `crash.descriptionAfter` split around a link).
- **Plurals**: use i18next plural forms (`_one` / `_other` suffixes), not `count === 1 ? ... : ...`.
- **Keys are code**: renaming or deleting a key means updating **all seven** locale files — an orphan key in one file is dead weight; a rename missed in one file is a regression.
- Dates/numbers/currency: format with `Intl.*` using the active locale, never hardcoded formats.

## Review checklist (apply to any diff with UI text)

- [ ] No hardcoded user-facing string in JSX (including `placeholder`, `title`, `aria-label`, toast/error text).
- [ ] Every new key exists in **all** locale files (grep the key across `src/frontend/src/locales/*.json`).
- [ ] No concatenation of translated fragments; interpolation used instead.
- [ ] Removed/renamed keys cleaned up in all locales (no orphans).
- [ ] Key follows the existing dot-namespace of the feature area.

Quick check for a key across locales:

```bash
for f in src/frontend/src/locales/*.json; do grep -L '"my.new.key"' "$f"; done
```

(prints the locale files where the key is **missing** — should print nothing)
2 changes: 1 addition & 1 deletion .agents/skills/frontend-testing/SKILL.md
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ Activate this skill when:
- **Path alias**: `@/` maps to `<rootDir>/src/`
- **Test match patterns**: `src/**/__tests__/**/*.{test,spec}.{ts,tsx}` and `src/**/*.{test,spec}.{ts,tsx}`
- **Transform**: Custom `transform-import-meta.js` handles `import.meta` for Jest compatibility
- **Global mocks** (in `jest.setup.js`): `@radix-ui/react-form`, `react-markdown`, `lucide-react/dynamicIconImports`, `@/components/common/genericIconComponent`, `@/icons/BotMessageSquare`, `@/stores/darkStore`, `localStorage`, `sessionStorage`, `crypto`
- **Global mocks** (in `jest.setup.js`): `@radix-ui/react-form`, `react-markdown`, `remark-gfm`, `remark-math`, `rehype-mathjax/browser`, `lucide-react/dynamicIconImports`, `@/components/common/genericIconComponent`, `@/icons/BotMessageSquare`, `@/stores/darkStore`, `localStorage`, `sessionStorage`, `crypto`

## Key Commands

Expand Down
1 change: 1 addition & 0 deletions .agents/skills/frontend-testing/references/mocking.md
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ These modules are already mocked in `jest.setup.js`. Do NOT re-mock them unless

- `@radix-ui/react-form` (all exports render children)
- `react-markdown` (renders null)
- `remark-gfm`, `remark-math`, `rehype-mathjax/browser` (no-op plugins; pure ESM that fails to parse under jest)
- `lucide-react/dynamicIconImports` (empty object)
- `@/components/common/genericIconComponent` (renders null)
- `@/icons/BotMessageSquare` (renders null)
Expand Down
184 changes: 184 additions & 0 deletions .agents/skills/ibm-a11y-automation/SKILL.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,184 @@
---
name: ibm-a11y-automation
description: Run Langflow's local accessibility scanner script against frontend routes from src/frontend/src/routes.tsx and summarize the JSON report.
---

# Langflow Accessibility Scanner

Use this skill when asked to scan Langflow frontend pages for accessibility issues.

## Scanner

Use the Python script:

```bash
uv run python scripts/a11y/a11y_scan.py \
--url http://localhost:3000 \
--routes-file scripts/a11y/a11y_routes.json \
--route-group static \
--out /tmp/langflow-a11y-report.json \
--markdown /tmp/langflow-a11y-report.md \
--html /tmp/langflow-a11y-report.html \
--timeout-ms 45000
```

Script options:

- `--url`: base app URL, usually `http://localhost:3000`.
- `--routes-file`: route manifest JSON file. Prefer `scripts/a11y/a11y_routes.json`.
- `--route-group`: manifest group to scan. Default: `static`.
- `--routes`: comma-separated route paths to scan.
- `--route`: one route path; can be repeated instead of `--routes`.
- `--levels`: comma-separated issue levels. Default: `violation`.
- `--out`: JSON report path.
- `--markdown`: optional Markdown report path.
- `--html`: optional self-contained HTML report path.
- `--timeout-ms`: per-route timeout.
- `--quiet-ms`: network quiet window before scanning. Default: `1000`.
- `--states-file`: JSON file with explicit modal/state actions.
- `--headed`: show browser while scanning.

## Route Selection

Use `scripts/a11y/a11y_routes.json` as the source of truth for route selection.

The normal CI/local batch is the manifest `static` group. Prefer that unless the user asks for custom, dynamic, or gated routes.

Common manifest-backed command:

```bash
uv run python scripts/a11y/a11y_scan.py \
--url http://localhost:3000 \
--routes-file scripts/a11y/a11y_routes.json \
--route-group static \
--out /tmp/langflow-a11y-static.json \
--markdown /tmp/langflow-a11y-static.md \
--html /tmp/langflow-a11y-static.html
```

Dynamic routes need real IDs before scanning:

- `/flow/:id/`
- `/flow/:id/view`
- `/playground/:id/`
- `/assets/knowledge-bases/:sourceId/chunks`

For dynamic routes, get IDs from the loaded app, API responses, or existing test data before replacing placeholders.

## Examples

Scan one route:

```bash
uv run python scripts/a11y/a11y_scan.py \
--url http://localhost:3000 \
--route /flows \
--out /tmp/langflow-a11y-flows.json
```

Scan multiple routes:

```bash
uv run python scripts/a11y/a11y_scan.py \
--url http://localhost:3000 \
--routes-file scripts/a11y/a11y_routes.json \
--route-group static \
--out /tmp/langflow-a11y-report.json \
--markdown /tmp/langflow-a11y-report.md \
--html /tmp/langflow-a11y-report.html
```

Scan more than violations:

```bash
uv run python scripts/a11y/a11y_scan.py \
--url http://localhost:3000 \
--routes-file scripts/a11y/a11y_routes.json \
--route-group static \
--levels violation,potentialviolation,recommendation \
--out /tmp/langflow-a11y-expanded.json
```

Scan route plus modal states:

```bash
uv run python scripts/a11y/a11y_scan.py \
--url http://localhost:3000 \
--states-file /tmp/langflow-a11y-states.json \
--out /tmp/langflow-a11y-modal-report.json \
--markdown /tmp/langflow-a11y-modal-report.md \
--html /tmp/langflow-a11y-modal-report.html \
--timeout-ms 45000
```

State file shape:

```json
[
{
"route": "/settings/global-variables",
"states": [
{
"name": "new-global-variable-modal",
"open": [
{ "click": "[data-testid='api-key-button-store']" },
{ "waitFor": "[role='dialog']" }
],
"close": [
{ "press": "Escape" },
{ "waitForHidden": "[role='dialog']" }
]
}
]
}
]
```

Supported state actions:

- `{ "click": "<css selector>" }`
- `{ "clickText": "<visible text>" }`
- `{ "clickRole": { "role": "button", "name": "Create" } }`
- `{ "fill": { "selector": "<css selector>", "value": "text" } }`
- `{ "press": "Escape" }`
- `{ "press": { "selector": "<css selector>", "key": "Enter" } }`
- `{ "waitFor": "<css selector>" }`
- `{ "waitForHidden": "<css selector>" }`
- `{ "waitForText": "<visible text>" }`
- `{ "wait": 500 }`

## Report

The scanner always writes JSON. It can also write Markdown and HTML for presentation.

Use JSON for exact data. Use Markdown for PR comments or issues. Use HTML when the user wants a browsable report.

Summarize:

- report path
- Markdown/HTML report paths, when generated
- total issue count
- per-route issue count
- per-route API request count
- per-route request failure count
- top rule IDs

Use report fields directly:

- `totalIssues`
- `results[].route`
- `results[].state`
- `results[].phase`
- `results[].apiRequests`
- `results[].requestFailures`
- `results[].diagnostics`
- `results[].issues[].ruleId`

## Rules

- Use only scanner output for findings.
- Do not invent route names. Read `routes.tsx`.
- Do not auto-click arbitrary buttons to find modals. Use explicit state actions.
- Avoid destructive modal actions unless the user explicitly asks and data is safe.
- If a route has zero API requests, mention that scan quality may be limited.
- Ask before fixing files unless the user explicitly asks for fixes.
Loading