langflow-ai/langflow v1.10.2 on GitHub

What's Changed

fix: use session exec in telemetry writer by @erichare in #13821
fix: disable mem0 telemetry by default by @erichare in #13824
fix: handle invalid session auth tokens by @erichare in #13823
fix: remove hardcoded default superuser password by @erichare in #13822
fix: isolate FAISS persistence by user by @erichare in #13871
fix: block public builds of code execution agents by @erichare in #13875
fix: validate file paths by resolved cache containment by @erichare in #13872
fix: restrict log retrieval to superusers by @erichare in #13873
fix: block dangerous MCP stdio env vars by @erichare in #13874
fix: Block Python interpreter format traversal by @erichare in #13880
fix: constrain Directory component paths by @erichare in #13878
fix(mcp): launch stdio servers with shell=False (no bash -c / cmd /c wrapper) by @erichare in #13900
fix: gate litellm off Python 3.14 so pip install langflow resolves by @erichare in #13814
fix: scope local vector store collections by user by @erichare in #13882
fix: cascade span deletes when clearing traces for a flow by @andifilhohub in #13960

test(frontend): harden model dropdown footer clicks in select-gpt-model by @erichare in #13936

Full Changelog: v1.10.1...v1.10.2