What's Changed
✨ New Features
- feat(assistant): slash command menu and 100-step budget by @Cristhianzl in #15149
- feat(agui): let callers opt out of graph state on the stream by @ogabrielluiz in #15054
🐛 Bug Fixes
- fix(frontend): keep assistant reopenable mid-run by @Cristhianzl in #15136
- fix(mcp): 404 for missing servers on GET and PATCH by @Cristhianzl in #15130
- fix(frontend): report deleted MCP servers on edit by @Cristhianzl in #15132
- fix(frontend): keep GB18030 characters in downloaded project filenames by @viktoravelino in #15104
- fix(settings): keep database credentials out of settings errors and console tracebacks by @erichare in #15147
- fix(opensearch): select k-NN method by engine instead of hardcoding disk_ann by @erichare in #15142
- fix(export): keep global-variable bindings in flow and project exports by @erichare in #15143
- fix(kb): scope OpenSearch and Chroma Cloud knowledge base storage by owner by @erichare in #15148
- fix(mcp): stop project name prefix from blocking creation by @Cristhianzl in #15144
- fix(mcp): connect SSE-mode servers over SSE by @Cristhianzl in #15145
- fix(mcp): accept the tool names the MCP server publishes by @tarciorodrigues in #15179
- fix(lfx): name real PyPI packages in provider install hints by @erichare in #15189
- fix(security): pin IDN hosts by punycode and fail closed on DNS pin-map misses (LE-2544) by @erichare in #15171
- fix(security): canonicalize tempfile._os/_sys re-exports in component code scanner by @erichare in #15190
- fix(security): Scope frozen vertex result cache to executing principal by @erichare in #15191
- fix(security): Enforce aggregate expanded-size limit for flow ZIP imports by @erichare in #15196
- fix(security): Strip secret field values before publishing components to the Store by @erichare in #15192
- fix(security): apply the caller-aware component policy to nested flow graphs by @erichare in #15209
- fix(security): SSRF-validate OpenSearch and Chroma Cloud knowledge-base connection targets by @erichare in #15197
- fix(security): eliminate cache deserialization RCE paths (H1-3982189) by @erichare in #15199
- fix(connectors): call central SSRF guard in six unguarded connectors by @erichare in #15200
- fix(security): resolve str.join in Agentic Assistant code scanner by @erichare in #15195
- fix(security): close pathlib/io/codecs scanner bypass and stop validate_code from executing imports by @erichare in #15201
- fix(security): proxy allow-listed modules in Python REPL to block transitive sys.modules escape by @erichare in #15198
- fix(kb): SSRF-validate tenant-controlled OpenSearch and Chroma Cloud KB backend URLs by @erichare in #15207
- fix(security): Guard provider base_url against SSRF and credential exfiltration by @erichare in #15208
- fix(security): enforce fs_path containment in batch flow creation by @erichare in #15206
- fix(security): close scan_code_security sandbox-escape bypasses (getattr dynamic-dunder + PyYAML) by @erichare in #15202
- fix(security): close stdlib re-export bypass in component code scanner by @erichare in #15204
- fix(security): de-duplicate the SSRF guards left by today's four-PR merge train by @erichare in #15246
- fix(kb): require an operator-chosen destination for the network KB backends by @erichare in #15244
- fix(security): block vars()/mapping dunder-key sandbox escapes in code scanner by @erichare in #15194
- fix(security): close dynamic-getattr AST sandbox bypass in component code scanner by @erichare in #15205
- fix(security): Enforce local-file-access containment on FileContentRetriever persistent_dir by @erichare in #15193
- fix(security): Block jq $ENV/env server-environment disclosure in data components by @erichare in #15203
- fix(checkpoint): drop model state that cannot be validated back on resume by @erichare in #15241
- fix: Run Flow returns empty content when an Agent calls it as a tool by @erichare in #15242
- fix(security): default LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS to true by @erichare in #15210
- fix(security): Block environment-provisioned provider credentials from tenant-chosen endpoints by @erichare in #15211
- fix(mcp): stop Chinese project names from collapsing onto one server name by @viktoravelino in #15141
- fix(lfx): read chat attachments through the storage service by @RostiBer in #15249
- fix: honor CIDR allowlists for HTTP provider endpoints by @erichare in #15262
- fix(deps): cap SQLModel before timezone storage changes by @erichare in #15265
📝 Documentation Updates
- docs(security): warn when multi-user mode runs custom components unrestricted (LE-2533) by @erichare in #15169
🛠 Maintenance Tasks
- chore: 1.12.3 dep upgrade by @Adam-Aghili in #15245
- chore(bundles): bump lfx-google to 0.2.2 so the 1.12.3 release build can restamp by @erichare in #15250
New Contributors
Full Changelog: v1.12.2...v1.12.3