langflow-ai/langflow v1.11.0

1.11.0

on GitHub

What's Changed

✨ New Features

• feat: docs page copy-as-markdown keyboard shortcut by @mendonk in #13628
• feat: add docs feedback components by @mendonk in #13627
• feat: New Bundle support for Multi-vector NextPLAID vector store by @meetdoshi90 in #13553
• feat: upgrade Firecrawl to v2 SDK and extract into the lfx-firecrawl extension bundle by @rakshith48 in #13495
• feat(auth): external trusted JWT auth + JIT user mapping + access ceiling by @erichare in #13293
• feat(lfx): verified-JWT identity forwarding for lfx serve by @jordanrfrazier in #13632
• feat: native v2 workflows endpoint with pluggable stream protocols by @ogabrielluiz in #13307
• feat(bundles): metapackage split (Phase A) — engine-only lfx, lfx-bundles long tail, 5 graduated partner packages by @erichare in #13563
• feat(frontend): RBAC permission gating via /authz/me/permissions by @erichare in #13543
• feat: wire list_visible_resource_ids prefilter into list endpoints by @erichare in #13541
• feat(lfx): add pre-warm functionality by @jordanrfrazier in #13682
• feat: a11y by @viktoravelino in #13561
• feat(lfx): introduce pluggable executor seam by @ogabrielluiz in #12981
• feat: make content_blocks the source of truth for Message content by @ogabrielluiz in #13364
• feat(starter-projects): refresh starter flows for 1.10.x, add Multi Agent Flow, remove 4 deprecated templates by @rafaelgiln in #13879
• feat: add PaddleOCR partner bundle (lfx-paddle) — inherits #13779 by @erichare in #13908
• feat: add EmpirioLabs partner bundle (lfx-empiriolabs) — refactor of #13645 by @erichare in #13918
• feat(lfx): let extension bundles register model providers by @erichare in #13916
• feat: add OpenAI Compatible as a first-class unified model provider by @erichare in #13940
• feat: unify JSON/Table/Text operations into a single Operations component by @erichare in #13743
• feat(embeddings): populate available_models from configured providers by @HimavarshaVS in #13820
• feat(exa): update Exa Search to the exa-py SDK and graduate it to the standalone lfx-exa bundle by @erichare in #13968
• feat(bundles): add torch-free all-no-torch extra to lfx-bundles by @jordanrfrazier in #13886
• feat(lfx-serve): v2 workflow endpoints (sync + stream) by @ogabrielluiz in #13783
• feat(lfx-serve): lfx owns the v2 workflow router via a host-DI seam by @ogabrielluiz in #13816
• feat(mcp): persist MCP servers in a database table by @thesaadmirza in #13976
• feat(playground): content blocks frontend renderer for v2 workflows by @ogabrielluiz in #13391
• feat(api): durable background execution service (store + default backend) by @ogabrielluiz in #13507
• feat(frontend): render the flow share seam in the editor Share dropdown by @keval718 in #14009
• feat(models): add Azure AI Foundry to unified model provider setup by @HimavarshaVS in #13912
• feat(assistant): QA fixes + model portability, budget, and error visibility by @Cristhianzl in #14038
• feat(lfx): multi-worker serving with per-request isolation for lfx serve by @jordanrfrazier in #13818
• feat: durable background execution + HITL suspend/resume schema by @Cristhianzl in #13633
• feat(frontend): add OpenRAG icon by @erichare in #14095
• feat: add Valkey vector store and chat memory components by @MatthiasHowellYopp in #12530
• feat(a2a): A2A protocol support by @ogabrielluiz in #13831
• feat(job_queue): export cancel_stats and active_jobs to OpenTelemetry by @ogabrielluiz in #13123
• feat(frontend): turn inspector panel into a parameter manager by @tarciorodrigues in #14078
• feat(valkey): restore components as 1.11 extension bundle by @erichare in #14151

🐛 Bug Fixes

• fix(lfx): restamp component index version after 1.11.0 fork bump by @erichare in #13574
• fix(ci): rebalance backend test splits with measured durations + raise unit-test step timeout by @erichare in #13583
• fix(ci): rebalance backend test splits with measured durations + raise unit-test step timeout (main) by @erichare in #13584
• fix(test): raise spawn-child join timeout in test_multi_process_visibility by @erichare in #13588
• fix(test): raise spawn-child join timeout in test_multi_process_visibility (main) by @erichare in #13589
• fix(ci): anchor langflow-base version extraction in nightly docker build by @erichare in #13591
• fix(ci): anchor langflow-base version extraction in nightly docker build (1.11.0) by @erichare in #13592
• fix(test): gate models.dev background refresh out of tests by @erichare in #13596
• fix(test): gate models.dev background refresh out of tests (main) by @erichare in #13597
• fix(ci): allow pre-releases when pinning the nightly in migration validation by @erichare in #13599
• fix(ci): allow pre-releases when pinning the nightly in migration validation (1.11.0) by @erichare in #13600
• fix(ci): scope nightly migration-test pre-releases to the langflow stack by @erichare in #13603
• fix(ci): scope nightly migration-test pre-releases to the langflow stack (1.11.0) by @erichare in #13604
• fix(ci): create GitHub releases on the dispatched v-prefixed tag by @erichare in #13608
• fix(ci): resolve validate-version output in release-lfx changelog link by @erichare in #13610
• fix: fail fast when Redis job queue backend is unreachable by @ogabrielluiz in #13456
• fix(frontend): duplicate tooltip + raw i18n key on collapsed sidebar nav (1.11.0) by @keval718 in #13652
• fix(frontend): restore Inspection Panel access to hidden advanced fields (1.11.0) by @keval718 in #13626
• fix(authz): schedule periodic audit-log retention cleanup by @erichare in #13546
• fix: Raise on an undecryptable secret at the variable-resolution by @Jkavia in #13681
• fix: warn on empty value and decrypt failure in get_all variable listing by @Jkavia in #13741
• fix: skip provider-component tests while bundles are temporarily disabled by @Cristhianzl in #13797
• fix: guard temporarily-disabled bundle deps across backend + frontend tests by @Cristhianzl in #13801
• fix: keep tests and the starter-projects endpoint green while bundles are temporarily unpublished by @Cristhianzl in #13809
• fix: keep nightly prerelease wheels explicit by @erichare in #13815
• fix: keep nightly prerelease wheels explicit by @erichare in #13817
• fix: share policy refresh and owner permissions by @erichare in #13830
• fix: release QA component follow-ups for bundles by @erichare in #13834
• fix(telemetry): use SQLAlchemy AsyncSession to stop deprecation-warning log flood by @erichare in #13845
• fix: authz flow permission gates by @erichare in #13857
• fix: handle invalid session auth tokens by @erichare in #13863
• fix(a11y): label icon-only controls by @viktoravelino in #13678
• fix: changed image base to be ubi10 by @lucaseduoli in #13893
• fix: isolate FAISS persistence by user (lfx-bundles copy) by @erichare in #13899
• fix(ci): stop nightly Group 3 timeout and db-migration superuser boot crash by @erichare in #13933
• fix(kb): align frontend default chunk settings with backend by @tarciorodrigues in #13896
• fix(a11y): resolve WCAG 2.1 Level A and AA violations on settings general page by @olayinkaadelakun in #13811
• fix: log missing optional deps as one-line warning during component discovery by @erichare in #13941
• fix: false duplicate-distribution extension errors from lib64 symlink aliasing in ubi Docker images by @erichare in #13943
• fix: arxiv timeout in research translation loop by @erichare in #13954
• fix(api-keys): replace native date input with shadcn date picker by @tarciorodrigues in #13913
• fix(a11y): fix traces page accessibility violations — rowgroup tabbable by @olayinkaadelakun in #13744
• fix(frontend): stop flow deletes from clobbering newly created flows by @Cristhianzl in #13975
• fix(frontend): clear /flows page a11y debt by @viktoravelino in #13891
• fix(traces): migrate legacy uppercase spanstatus/spantype enum labels to lowercase by @erichare in #13907
• fix(ci): publish bundle deps before nightly main by @erichare in #13982
• fix(lfx): read local files under S3 storage to unblock the Assistant by @Cristhianzl in #13862
• fix: prevent LangfuseResourceManager deepcopy failure in Agent/Tool Calling Agent by @gingeekrishna in #13966
• fix(docker): give runtime user a writable npm cache so stdio MCP servers start by @erichare in #13992
• fix: thin single focus border on global-variable input by @Cristhianzl in #13995
• fix(a11y): improve API keys tab order by @viktoravelino in #13953
• fix(frontend): center update toast buttons vertically by @Cristhianzl in #14004
• fix(a11y): make /assets/files accessible by @viktoravelino in #13987
• fix: fail loud on undecryptable KB embedding key with recovery path by @Jkavia in #13806
• fix: rename Operations component display name to Data Operations by @erichare in #14025
• fix: return 403 instead of 404 on denied flow DELETE when the flow is readable by @erichare in #14029
• fix(a11y): add accessible names to notifications popover controls by @olayinkaadelakun in #13994
• fix: settings/global-variables accessibility by @deon-sanchez in #13990
• fix(memory): preserve asyncio cancellation by @erichare in #14028
• fix(security): harden multi-tenant surfaces by @jordanrfrazier in #13530
• fix(models): allow Azure AI Foundry deployment names instead of catalog IDs by @HimavarshaVS in #14023
• fix: close tenant-isolation gaps in security hardening by @erichare in #14044
• fix: gate lfx-bundles ALTK on Python 3.14 by @erichare in #14055
• fix(initial_setup): preserve variable bindings when loading flows from disk by @erichare in #14053
• fix(lfx): tighten horizontal spacing in generated flow layout by @keval718 in #14059
• fix: correct deprecated model settings behavior by @erichare in #14048
• fix(frontend): anchor alert notifications flush to bottom corner by @keval718 in #14027
• fix(frontend): stop assistant 'New' pill from shifting on hover by @keval718 in #14035
• fix(frontend): hide assistant 'New' badge once feature is discovered by @keval718 in #14060
• fix(frontend): prefer strong model as assistant composer default by @Cristhianzl in #14058
• fix(authz): close RBAC enforcement and permission UX gaps by @erichare in #14068
• fix(api): enforce sync-only output_ids across modes and correct documented auth status code by @ogabrielluiz in #14091
• fix(lfx): deduplicate Google embedding model aliases by @erichare in #14082
• fix: expose stable Langfuse trace IO for evaluators by @erichare in #14089
• fix: make the 1.11 core runtime self-contained by @erichare in #14098
• fix(mcp): forward advertised flow input fields by @erichare in #14074
• fix: keep nv-ingest compatible with urllib3 security floor by @erichare in #14106
• fix(agentic): honor iterations_limit in builds by @Cristhianzl in #14094
• fix(security): forward-port release-1.10.3 hardening by @erichare in #14073
• fix(hitl): rename inputs, advanced timeout + HITL palette and control polish by @Cristhianzl in #14090
• fix: preserve OpenSearch JWT global variables by @erichare in #14117
• fix: link legacy operations to Data Operations by @erichare in #14118
• fix(api): preserve chronological message ordering by @erichare in #14114
• fix(security): require docker run for MCP stdio by @erichare in #14123
• fix(security): backport indirect component code bypass protections by @erichare in #14125
• fix(lfx): backfill thinking field on Anthropic requests by @Cristhianzl in #14092
• fix(ci): make core runtime wheel metadata assertion dynamic by @vjgit96 in #14133
• fix(security): forward-port LFOSS security fixes to 1.11.0 by @erichare in #14135
• fix(ci): keep core index check wheel-only by @erichare in #14139
• fix(components): trim Write File description to match other components by @keval718 in #14107
• fix(custom): preserve async helpers in component scope by @erichare in #14140
• fix(agents): preserve structured tool output artifacts by @erichare in #14142
• fix(ssrf): honor connector loopback policy for requests by @erichare in #14146
• fix(lfx): keep serve message persistence DB-less by @erichare in #14147
• fix: correct HITL gate span label and dedupe paused trace rows by @Cristhianzl in #14148
• fix(security): bind MCP stdio to code-exec lockdown by @erichare in #14150
• fix(anthropic): rebuild compatibility model annotations by @erichare in #14145
• fix(hitl): don't reschedule restored vertices on resume by @Cristhianzl in #14156
• fix(anthropic): preserve model defaults during server lazy import by @erichare in #14157
• fix(frontend): fire logout request when auto-login is disabled by @keval718 in #14158
• fix: remove restrictive default settings by @Adam-Aghili in #14164
• fix(gemini): preserve model validation during server import by @erichare in #14165
• fix(lfx): honor env-file precedence in serve by @erichare in #14162
• fix(security): preserve short-key credential upgrades by @erichare in #14163
• fix(ssrf): re-check IPv4 embedded in 6to4 / NAT64 addresses by @ogabrielluiz in #14174
• fix(mcp): rebuild incomplete SDK root models by @erichare in #14159
• fix(mcp): rebuild incomplete structured tools by @erichare in #14176
• fix(frontend): fixed-width zoom control so the menubar stops resizing by @keval718 in #14116
• fix: support data lists in Parser by @erichare in #14175
• fix(assistant): block duplicate flow input on add by @Cristhianzl in #14167
• fix(frontend): unclip file delete button by @Cristhianzl in #14169
• fix: materialize Blog Writer URL prompt input by @erichare in #14186
• fix(mcp): stabilize Tool Mode activation by @erichare in #14188
• fix: validate IBM WatsonX credentials against a live model by @erichare in #14185
• fix: enforce locked flows in backend by @erichare in #14192
• fix(mcp): respect server timeout during session validation by @erichare in #14200
• fix(mcp): preserve agent tool cache across invocations by @erichare in #14198
• fix: discover embeddings from custom OpenAI endpoints by @erichare in #14199
• fix(agent): normalize missing tool-call IDs by @erichare in #14201
• fix(mcp): prevent session cleanup CPU spin and reuse hangs by @ashutoshdharibm in #14205
• fix: restore user_id on HITL checkpoint resume by @Cristhianzl in #14195
• fix(lfx): derive secret_key ACL from process token SID by @Cristhianzl in #14190
• fix(settings): default agentic env-mirror off by @Cristhianzl in #14189
• fix(frontend): snapshot before duplicate so undo reverts one action by @keval718 in #14179
• fix(frontend): reject modifier-only keyboard shortcuts by @keval718 in #14187
• fix(api): serve favicon from a dedicated route by @keval718 in #14166
• fix(memory): stop cross-flow chat-history leak in legacy flows (LE-1929) by @Cristhianzl in #14191
• fix(models): render provider logo on models.dev catalog rows by @keval718 in #14178
• fix(release): align Docker and PyPI artifacts by @erichare in #14211
• fix(release): prevent frontend restore source collision by @erichare in #14218

📝 Documentation Updates

• docs: migrate code blocks to native Prism and restyle API reference pages by @AntonioABLima in #13299
• docs: build docker from source by @mendonk in #13041
• docs: add lfx-nextplaid bundle by @mendonk in #13679
• docs: add frontend-i18n agent skill and wire it into frontend-code-review by @Cristhianzl in #13959
• docs: wxo ADK upgrade to support Python 3.14 by @mendonk in #13667
• docs: add extension error guidance page and fix ref_url links by @mendonk in #13937
• docs: external authentication, RBAC, SSO by @mendonk in #13866
• docs: lfx user docs and bundle extension changes by @mendonk in #13775
• docs: AGUI protocol, workflows quickstart, update examples by @mendonk in #13911
• docs: oracle component page and release note by @mendonk in #13984
• docs: paddle OCR component bundle by @mendonk in #14011
• docs: add additional packages gated by python 3.14 by @mendonk in #13828
• docs: unified operations component by @mendonk in #13920
• docs: component input and component index telemetry events by @mendonk in #14062
• docs: openai compatible provider bundle by @mendonk in #14000
• docs: add valkey bundle by @mendonk in #14119
• docs: human in the loop feature by @mendonk in #13993
• docs: lfx prewarm by @mendonk in #14012
• docs: a2a server and component by @mendonk in #14143
• docs: security hardening for untrusted multitenancy deployments by @mendonk in #14061
• docs: bump API spec and version to 1.11 by @mendonk in #14173
• docs: add blog links for 1.11 by @mendonk in #14207

🛠 Maintenance Tasks

• refactor(lfx): extract v2 workflow contract layer into lfx.workflow by @ogabrielluiz in #13782
• perf: limit message history fetch to prevent canvas slowdown on repeated runs by @YeonghyeonKO in #13461

✅ Tests

• test(authz): RBAC enforcement + share-lifecycle integration tests via a test-double enforcer by @erichare in #13549
• test: guard temporarily-disabled bundles in component/template tests + skip Windows-flaky model spec by @Cristhianzl in #13807
• test: decouple core tests from disabled bundles by @erichare in #13805
• test: remove permanently-skipped dead specs by @tarciorodrigues in #13800
• test: remove duplicate Playwright e2e coverage by @tarciorodrigues in #13819
• test(e2e): DRY setup and parameterize same-shape specs by @tarciorodrigues in #13844
• test: consolidate bundle-component tests under components/bundles// by @erichare in #13895

Others

• fix(ci): create GitHub releases on the dispatched v-prefixed tag (1.11.0) by @erichare in #13607
• fix(ci): resolve validate-version output in release-lfx changelog link (1.11.0) by @erichare in #13612
• ci: fit weekly test-durations refresh inside the 6h limit and alert on failure by @erichare in #13586
• chore: update test durations by @github-actions[bot] in #13640
• ci: gate backend tests by Python changes by @viktoravelino in #13614
• chore: release cleanup by @erichare in #13789
• chore: restore bundles that are now published by @erichare in #13825
• ci: push nightly .devX Docker images to langflowai/langflow and fix db-migration-validation image references by @vjgit96 in #13836
• ci: serialize starter project template shard by @erichare in #13865
• chore: clarify calculator AST comment by @erichare in #13881
• chore: update test durations by @github-actions[bot] in #13888
• chore(base): trim langflow-base[complete] staleness; relocate lfx-core deps by @erichare in #13892
• chore: clean up startup messages by @erichare in #13909
• ci: surface nightly Group 3 stall via 90s pytest thread-timeout (release-1.11.0) by @erichare in #13939
• ci: surface nightly Group 3 stall via 90s pytest thread-timeout by @erichare in #13938
• chore: upgrade wxo adk core/clients to 2.12 (for python 3.14 support) by @HzaRashid in #13665
• ci: add non-blocking flaky test report job with 30-day retention by @tarciorodrigues in #13996
• chore: restore Python 3.14 litellm gating lost in release-1.10.2 merge by @erichare in #14018
• chore(deps): bump fastapi to 0.139.0, serve frontend via app.frontend() by @ogabrielluiz in #13978
• chore: update deps by @Adam-Aghili in #14069
• chore: enable LiteLLM on Python 3.14 by @erichare in #14170
• chore: upgrade fast-uri version by @Adam-Aghili in #14171
• i18n: translate Human Input component metadata by @Cristhianzl in #14168
• chore: update translations from Globalization Pipeline by @RamGopalSrikar in #14184

New Contributors

• @meetdoshi90 made their first contribution in #13553
• @rakshith48 made their first contribution in #13495
• @rafaelgiln made their first contribution in #13879
• @YeonghyeonKO made their first contribution in #13461
• @thesaadmirza made their first contribution in #13976
• @MatthiasHowellYopp made their first contribution in #12530
• @ashutoshdharibm made their first contribution in #14205

Full Changelog: v1.10.2...v1.11.0