github langflow-ai/langflow v1.10.0
1.10.0
on GitHub

latest release: v1.11.0.dev0
4 hours ago

What's Changed

✨ New Features

🐛 Bug Fixes

  • fix: Make sdk env flag idempotent by @erichare in #12716
  • fix: respect renamed/deleted default folder across logins by @erichare in #12746
  • fix: filter out null objects in mergeNodeTemplates function by @paulina-grunwald in #12688
  • fix(tests): Skip assistant-panel e2e test when OPENAI_API_KEY is missing by @Cristhianzl in #12747
  • fix: MCP Auth Error on restart / swapping auth by @erichare in #12715
  • fix: resolve ghosting issues in preload optimization by @severfire in #12587
  • fix(frontend): cap MCP server modal height by @viktoravelino in #12743
  • fix(mcp): reconnect Streamable HTTP after MCP server restart by @schuellerf in #12777
  • fix(frontend): show backend error detail on project upload failure by @keval718 in #12791
  • fix: mcp component dyanamic tool by @mansura-habiba in #12779
  • fix: propagate x-api-key and authorization headers to nested MCP calls by @octo-patch in #12541
  • fix(frontend): keep KnowledgeBase modal centered when side panel opens by @AntonioABLima in #12764
  • fix: update npm overrides by @Jkavia in #12843
  • fix(security): use CodeQL-recognized sanitizer for path-injection alerts #205-213 by @erichare in #12841
  • fix(security): drop URL substring checks for WXO auth scheme selection (#201-204) by @erichare in #12842
  • fix(frontend): preserve IME composition for dead-key accents by @keval718 in #12801
  • fix: serialize concurrent MCP session access to prevent race conditions by @erichare in #12761
  • fix: MCP server PATCH field clearing in backend and frontend [LE-891] by @viktoravelino in #12763
  • fix: MCP Tools component now works in LFX standalone mode by @erichare in #12760
  • fix: Handle videos with no comments in YouTube Comments component by @rodrigosnader in #10633
  • fix(custom): include future imports in component sandbox compilation by @erichare in #12865
  • fix: guard output logs against non-dict artifacts by @erichare in #12877
  • fix(frontend): align shareable playground input style with in-IDE playground by @Cristhianzl in #12862
  • fix(chroma): replace deprecated Client(settings=) with HttpClient for chromadb >=1.0 by @erichare in #12900
  • fix: migrate orphaned MCP servers config across DB resets by @erichare in #12762
  • fix(tests): Restore Windows-compatible slider Playwright test by @Cristhianzl in #12904
  • fix(frontend): validate deployment agent name by @viktoravelino in #12896
  • fix(mcp): enforce auth on /streamable for auth_type=oauth projects by @erichare in #12756
  • fix(composio): prevent KeyError('type') on Gmail/Calendar tool execution by @keval718 in #12905
  • fix: Add microseconds support for PostgreSQL data store by @dzbanek717 in #9941
  • fix(mcp): render connection handles for non-string MCP tool inputs by @erichare in #12782
  • fix: Don't show empty category for MCP search in sidebar by @erichare in #12930
  • fix(LE-602): Update Pydantic to >=2.13.0 for fastapi-pagination v0.16.0 compatibility by @vjgit96 in #12938
  • fix(tests): Stabilize Windows-only Playwright e2e failures by @Cristhianzl in #12942
  • fix: route custom Loguru logs through Langflow logger by @erichare in #12926
  • fix(tests): Stabilize Playwright e2e suite on Windows CI by @Cristhianzl in #12964
  • fix(deployments): rename env labels by @viktoravelino in #12949
  • fix: prevents credential types vars from being used as inputs/outputs unless specifically typed as secretstr by @jordanrfrazier in #12908
  • fix: Pagination shows "-19-0 of 0 items" in traces view when empty by @olayinkaadelakun in #12941
  • fix(ui): Hide native Edge password reveal icon on desktop by @Cristhianzl in #12972
  • fix(model-input): hide wrench when saved model's provider is configured by @erichare in #12971
  • fix: MCP connection refresh state by @erichare in #12931
  • fix: Duplicate lines rendered in the tracing view by @olayinkaadelakun in #12944
  • fix(frontend): render node dropdowns above build/notification overlays by @keval718 in #12973
  • fix: encode non-ASCII filenames in Content-Disposition headers (RFC 5987) by @AntonioABLima in #12918
  • fix: Notifications overlap the bottom-center menubar by @olayinkaadelakun in #12946
  • fix: update Docker base images to latest Python 3.12 and Debian Trixie to resolve CVEs by @vjgit96 in #12990
  • fix: Respect proxy environment variables in URL Component by @erichare in #12989
  • fix(mcp): make run_tool wait_for timeout configurable, raise floor to… by @mansura-habiba in #12996
  • fix(frontend): paginator empty state shows "0 items" instead of "1-0 of 0 items" by @ogabrielluiz in #12965
  • fix(tests): Stabilize traces and user-flow-cleanup e2e on Windows CI by @Cristhianzl in #12997
  • fix(frontend): default event_delivery to streaming to match server config by @keval718 in #12978
  • fix: force pull latest base images in Docker nightly builds by @vjgit96 in #13014
  • fix: update Docker base images to Trixie and force pull latest images in nightly builds by @vjgit96 in #13015
  • fix: pin postgres image to bookworm in docker_example by @erichare in #13027
  • fix(security): prevent arbitrary file read via public flow build endpoint (GHSA-rcjh-r59h-gq37) by @keval718 in #13029
  • fix: remove stepper modal close button by @viktoravelino in #12986
  • fix: skip missing server file when delete_after_processing=True to avoid race condition by @octo-patch in #12556
  • fix(tests): Stabilize Windows-only Playwright e2e failures by @Cristhianzl in #13062
  • fix: Unblock nightly install on macOS x86_64 due OpenDsStar by @Cristhianzl in #13061
  • fix: Restore resolved release-branch ref in nightly build by @Cristhianzl in #13064
  • fix: OpenTelemetry trace context propagation by @ringerc in #12962
  • fix: update isinstance(value, Data) logic by @muhammadravi251001 in #12769
  • fix: use stable UUIDs for Qdrant document IDs to prevent duplicate ingestion by @octo-patch in #12642
  • fix: strip reserved 'code' param before build() in component reuse path by @aayushbaluni in #12712
  • fix: gracefully handle pyperclip failure in headless/remote environments by @octo-patch in #12614
  • fix: add [proxy] extra to litellm dependency for langflow-ide by @Jah-yee in #12235
  • fix: Skip built-in tool when external tool has same name by @Cristhianzl in #13036
  • fix: update security dependencies by @Jkavia in #13053
  • fix: restore Langfuse feedback trace linking by @viktoravelino in #13081
  • fix: ValidationError reduction on OSS and Desktop by @olayinkaadelakun in #12920
  • fix(ui): distinguish Memory and Model icons (BrainCog / BrainCircuit) by @keval718 in #13111
  • fix: stabilize model toggle and refresh Agent dropdown after provider changes by @erichare in #13113
  • fix: prevent canvas text-selection highlight on shift+drag in Tauri by @olayinkaadelakun in #12995
  • fix: normalise legacy uppercase SpanStatus/SpanType values on DB read by @olayinkaadelakun in #13000
  • fix(knowledge-base): align Filter by metadata pickers with app dropdowns by @keval718 in #13117
  • fix: upgrade langchain-classic to 1.0.7 by @Jkavia in #13130
  • fix(frontend): stop empty-state splash from flashing after login by @ogabrielluiz in #12966
  • fix: Remove redundant Components entry from the left sidebar by @olayinkaadelakun in #13090
  • fix: backport policies ToolGuard lazy imports by @erichare in #13144
  • fix: Memory Base Table output causes JSON serialization error when saving Agent message by @erichare in #13136
  • fix: validate review tool names inline by @viktoravelino in #13040
  • fix: added per-user endpoint for flows by @lucaseduoli in #13072
  • fix: reuse single Langfuse client across flow runs to stop thread leak by @erichare in #13107
  • fix(api): resolve global-variable default_fields on API runs (#11781) by @erichare in #13129
  • fix(api): parse multipart/form-data on /run so session_id is preserved by @erichare in #13092
  • fix(initial_setup): upsert by (user_id, name) when loading flows from disk by @erichare in #13132
  • fix(schema): resolve nested $ref objects to named models instead of dict by @erichare in #13128
  • fix: Remove duplicate Lock flow control from bottom-center menubar by @olayinkaadelakun in #13088
  • fix: Auto-create write parents and reject unsafe glob patterns by @Cristhianzl in #13075
  • fix: add stream toggle back to agent by @Cristhianzl in #13155
  • fix: update embedded chat CDN URL to langflow-ai org and v1.0.8 by @AntonioABLima in #13118
  • fix: avoid pickling vertex component instances by @newmattock in #13172
  • fix(ci): rename bundles to -nightly during nightly build by @erichare in #13193
  • fix: File upload toast showing only after successful upload by @olayinkaadelakun in #12984
  • fix: Model handling for tool calling in agents and update IBM models by @mfortman11 in #13201
  • fix(openrouter): validate against /api/v1/auth/key and disconnect all variables by @erichare in #13214
  • fix: UI polish for Memories and Traces sidebar sections by @olayinkaadelakun in #13205
  • fix: upgrade dependencies for security fixes by @Jkavia in #13218
  • fix: coerce numpy scalars in Memory Base metadata to Python primitives by @erichare in #13211
  • fix(extensions): discover editable bundles; clean up ticket refs and reload UX by @erichare in #13219
  • fix(agent): scope chat history retrieval by flow_id to prevent cross-flow leak by @erichare in #13087
  • fix: Expose Message connection handle on Run Flow's exposed text inputs (LE-1233) by @erichare in #13180
  • fix(ci): use local bundle wheels in nightly install tests by @erichare in #13257
  • fix(composio): handle Python keywords and non-identifier field names in action schemas by @olayinkaadelakun in #13139
  • fix(memory-base): Product Review Improvements by @dkaushik94 in #13248
  • fix(frontend): blur upload button so "Upload File" tooltip doesn't persist after file picker closes by @erichare in #13178
  • fix(guardrails): add message pass-through outputs by @viktoravelino in #13096
  • fix(docker): pre-create LANGFLOW_CONFIG_DIR so named volumes inherit uid=1000 ownership by @erichare in #13212
  • fix(tracing): forward request body user_id to Langfuse trace by @erichare in #13266
  • fix: upgrade litellm to 1.85.1 by @erichare in #13272
  • fix(flows): show readable API error messages on flow creation failure by @olayinkaadelakun in #13140
  • fix: quiet extension migration warnings by @erichare in #13275
  • fix: Sync Agent-as-tool description by removing deprecated agent_description by @Cristhianzl in #13151
  • fix: update mem0 and qdrant dependencies by @erichare in #13292
  • fix: canvas deploy attach/detach flow bugs by @viktoravelino in #13247
  • fix(auth): AUTO_LOGIN parity on protected endpoints + model-load error UI by @erichare in #13192
  • fix: error with loop in grouped components by @erichare in #13281
  • fix: chromadb trust remote code mitigation by @erichare in #13288
  • fix: Update package to safer version to address the CVEs by @Jkavia in #13270
  • fix(db): serialize concurrent Alembic migrations via Postgres advisory lock by @ogabrielluiz in #13204
  • fix(playground): auto-focus chat input when active session changes by @keval718 in #13310
  • fix(playground): distinguish active session row during multi-select by @keval718 in #13312
  • fix(canvas): replace panel toggle icon with SlidersHorizontal and add pressed/unpressed visual states by @olayinkaadelakun in #13286
  • fix(playground): align Select All bulk-delete icon with session ⋮ column by @keval718 in #13313
  • fix(canvas): remove fixed width on zoom percentage causing excess gap before chevron by @olayinkaadelakun in #13284
  • fix: use langchain-mongodb and langchain-qdrant. Port mem0 update by @Adam-Aghili in #13329
  • fix: port chroma collection hardening by @erichare in #13339
  • fix(playground): hide session-row checkbox until hover or selection by @keval718 in #13314
  • fix(playground): add gap between consecutive error cards in chat messages by @keval718 in #13325
  • fix(frontend): Safari Selected Components by @olayinkaadelakun in #13283
  • fix(tracing): surface Langfuse setup failures, pin pydantic>=2.13 (Py3.14) by @erichare in #13341
  • fix: set graph inputs by component type by @erichare in #13343
  • fix(traces): bypass impl result_processor in _LegacyCaseEnum so legacy uppercase rows load by @erichare in #13346
  • fix(server): refuse to start with multiple workers and the default in-memory job queue by @ogabrielluiz in #13202
  • fix(mcp): fix validation, session isolation, and update_flow_from_spec parity by @ogabrielluiz in #12528
  • fix(api-keys): add expiration date support for API keys by @dkaushik94 in #13330
  • fix(tracing): isolate Langfuse OTel tracer to stop HTTP span pollution by @erichare in #13344
  • fix(agent): Force streaming on Agent LLM so tokens stream incrementally by @Cristhianzl in #13356
  • fix: change docling remote component to receive task id and to throw processing errors by @lucaseduoli in #13353
  • fix: Force streaming on AgentComponent regardless of toggle by @Cristhianzl in #13358
  • fix: Run Flow mutable state leak by @erichare in #13340
  • fix: Restore custom Agent prompts in starter projects by @Cristhianzl in #13282
  • fix(chat): align message card surfaces by @viktoravelino in #13354
  • fix: Add defense in depth user_id filter to handle list tools MCP handler by @Jkavia in #13373
  • fix: Respect OpenAI embeddings API base for Knowledge Base by @erichare in #13380
  • fix: bundle event inconsistency and other fixes by @dkaushik94 in #13374
  • fix(traces): full-height trace panel, and status badge position by @olayinkaadelakun in #13385
  • fix(playground): expand session checkbox click target to full row height by @keval718 in #13349
  • fix: improve trace search functionality by @olayinkaadelakun in #13383
  • fix(ci): lockstep langflow-nightly and langflow-base-nightly versions by @erichare in #13413
  • fix: separate docling chunking dependencies by @lucaseduoli in #13411
  • fix: Resolve API keys from global variable before .env by @Cristhianzl in #13408
  • fix: use Langflow logo on loading screen and remove size jump glitch by @Cristhianzl in #13417
  • fix: add failed login logging with IP tracking and other relevant details by @Jkavia in #13409
  • fix(ci): give extension bundles a nightly track so langflow-nightly resolves by @erichare in #13418
  • fix(i18n): backend locale translation fixes — custom component nodes, Toolset output, RAG template notes, UI banner strings by @RamGopalSrikar in #13296
  • fix(i18n): default to English regardless of browser locale by @RamGopalSrikar in #13324
  • fix(ci): re-enable migration-pip-venv now that nightly bundles resolve by @erichare in #13421
  • fix: remove duplicate uv.lock from workspace member by @vjgit96 in #13326
  • fix(db): hold migration advisory lock for create_db_and_tables too by @ogabrielluiz in #13393
  • fix: Remove Playwright from Dependencies by @olayinkaadelakun in #13382
  • fix(tracing): warn clearly when LangWatch is unavailable on Python 3.14 (Docker) by @erichare in #13410
  • fix: ibm db2 bulk insert pr 13438 by @erichare in #13449
  • fix: restrict builtins and validate code in Python Interpreter components by @erichare in #13397
  • fix: point file manager empty-state link to the files page route by @erichare in #13450
  • fix: add SSRF protection to legacy RSS Reader and SearXNG components by @erichare in #13395
  • fix: re-validate redirects against SSRF protection in API Request component by @erichare in #13394
  • fix(logging): keep JSON level field clean when stdlib level names are mutated by @erichare in #13457
  • fix(memory): show dashes for stat cards in All Sessions view by @olayinkaadelakun in #13443
  • fix(stepflow): route multi-output fan-out to the correct step per connection by @erichare in #13412
  • fix(memories): return 422 instead of 500 when request body is missing by @erichare in #13452
  • fix: Move Docling components into bundle by @erichare in #13442
  • fix: declare kb_allowed_folder_roots on Settings so KB folder ingestion works by @erichare in #13448
  • fix: Fix timestamp rendering for expires_at in API Key model by @dkaushik94 in #13471
  • fix: populate _embeddings for upload-ingested KBs in Knowledge retrieve by @erichare in #13446
  • fix: prevent MCP server edit from creating a duplicate on name change by @erichare in #13464
  • fix: make playground code block background theme-reactive by @keval718 in #13470
  • fix: enforce mutually exclusive component constraint on paste by @keval718 in #13468
  • fix(conditional-router): route Text Input when Case True/False are blank by @erichare in #13389
  • fix(frontend): clean up new-flow onboarding, no orphaned placeholders, named templates, assistant tooltip stacking by @Cristhianzl in #13451
  • fix: Warm circular imports to avoid deadlock by @erichare in #13490
  • fix: add back in the missing npm docker changes by @Adam-Aghili in #13501
  • fix: replace GradientSave icon with plain Save in saved components sidebar by @AntonioABLima in #13485
  • fix: Improved styling of DatePicker icon in dark theme by @dkaushik94 in #13506
  • fix: enable IBM watsonx.ai bundle on Python 3.14 by @erichare in #13512
  • fix: enable agent-lifecycle-toolkit (altk) on Python 3.14 by @erichare in #13513
  • fix: decouple Db2 vector store ingestion from search query by @erichare in #13514
  • fix(bundles): sync lfx pin to the 1.10.0 line after version realignment by @erichare in #13516
  • fix: prevent X-Forwarded-For bypass of login rate limit by @Jkavia in #13509
  • fix(i18n): translate QA-identified missing strings for 1.10.0 by @RamGopalSrikar in #13503
  • fix: add ssrf protection to url component by @Adam-Aghili in #13488
  • fix: slider value lost when adjusting before the node is selected by @erichare in #13515
  • fix(canvas): anchor new note bottom-center to cursor on placement by @olayinkaadelakun in #13441
  • fix: standardize playground code block + container backgrounds on shadcn tokens by @keval718 in #13520
  • fix: Remove getenvvar component and update locales by @Jkavia in #13521
  • fix: serialize DataFrames in tool mode to prevent pandas truncation by @dkaushik94 in #13504
  • fix(security): block code-execution components on unauthenticated public flow builds by @erichare in #13538
  • fix(bundles): republish lfx-* at 0.1.1 with corrected pin + relax lfx floor for RC builds by @erichare in #13542
  • fix(ci): make Biome lint non-blocking for release workflow calls by @vjgit96 in #13547
  • fix(security): remove the disabled Python Code Structured tool component by @erichare in #13560

📝 Documentation Updates

🛠 Maintenance Tasks

✅ Tests

  • test: fix flow state clean test on windows by @Cristhianzl in #13013
  • test: Skip user-flow-state-cleanup e2e on Windows CI by @Cristhianzl in #13070
  • test: Refactor Playwright suite with shared helpers and remove redundant tests by @Cristhianzl in #13278
  • test: cover cross-user cache pollution on deprecated vertices endpoint (supplied-data path) by @erichare in #13398
  • test(e2e): Replace non-terminal waits to fix flaky Windows specs by @Cristhianzl in #13407
  • test: Skip starter-projects shard4 on Windows CI by @Cristhianzl in #13439
  • test: fix flaky Windows Playwright tests for error popups, settings nav, and output inspection by @Cristhianzl in #13463

Others

New Contributors

Full Changelog: v1.9.0...v1.10.0

Check out latest releases or
releases around langflow-ai/langflow v1.10.0

Don't miss a new langflow release

NewReleases is sending notifications on new releases.

Get notifications