What's Changed
✨ New Features
- feat(admin): add team and user administration API and CLI by @erichare in #14782
- feat(authz): add enterprise directory provenance and CLI by @erichare in #14841
- feat: add FunASR transcription component by @LauraGPT in #14225
- feat: add Plivo bundle with SMS, voice call, and number lookup components by @sarveshpatil-plivo in #14396
- feat(integrations): add lfx connection resolution contract by @erichare in #14919
- feat(integrations): load bundle capability manifests by @erichare in #14920
- feat(bundles): add Serply search extension bundle by @googio in #14626
- feat(integrations): add persistent connection API by @erichare in #14921
- feat(api): add enterprise pre-creation hook registry for projects, users and roles by @erichare in #14959
- feat: add Figranium bundle by @erichare in #15058
- feat(integrations): broker delegated OAuth connections by @erichare in #14935
- feat(integrations): resolve connections per execution principal across entry points by @erichare in #14946
- feat(integrations): govern integration providers and actions through the shared policy bundle by @erichare in #14947
- feat(mcp): pinned action-to-tool mode with a typed incompatible-tool error by @erichare in #14948
- feat(lfx-google): Google Workspace actions on managed connections by @erichare in #14950
- feat(integrations): add Microsoft and Slack connection-backed bundles by @erichare in #14952
- feat(frontend): render connection_ref fields with a connection picker (INT-8) by @erichare in #15165
- feat(api): list OAuth registrations a caller may authorize (INT-8) by @erichare in #15166
- feat(integrations): GA validation for dedicated integrations (INT-14 / LE-2472) by @erichare in #15167
- feat(triggers): trigger entity, event ledger, and the triggers API (TRG-2 part 1) by @erichare in #14956
- feat(triggers): leased dispatcher, retries, dead-lettering, and the executing identity (TRG-2 part 2) by @erichare in #14957
- feat(triggers): base trigger component, the schedule trigger, and flow-save reconciliation (TRG-2 part 3) by @erichare in #14958
- feat(bundles): add Serping API search extension bundle by @musabgultekin in #15221
- feat(triggers): the langflow listeners process, connection leases, and packaging (TRG-3) by @erichare in #15233
- feat(triggers): signed push ingress, inbound webhook trigger, and subscription renewal by @erichare in #15234
- feat(telemetry): report the database engine in the version event by @ogabrielluiz in #15106
- feat(triggers): Slack message and reaction triggers on the Events API and Socket Mode by @erichare in #15333
- feat(frontend): drop a bundle's own name from its components' palette labels by @erichare in #15390
- feat(i18n): add Korean (ko) locale for the UI and component descriptions by @pjw81226 in #15312
- feat(jobs): opt-in retention for terminal jobs by @erichare in #15316
- feat: multi-user editing safety by @Cristhianzl in #14903
- feat(triggers): add Microsoft and Google source events by @erichare in #15396
- feat(deployments): add atomic replacement and snapshots (LE-2717) by @jordanrfrazier in #15313
- feat: background execution job metrics for 1.13 by @erichare in #15314
- feat(kb): write precomputed vectors to a knowledge base without re-embedding by @ogabrielluiz in #15098
- feat(files): add relocate-files to copy uploaded file bytes into S3 by @ogabrielluiz in #15240
- feat(db): add a command to convert a SQLite database to Postgres by @ogabrielluiz in #15111
- feat: replace local Chroma knowledge bases with SQLite by @erichare in #15509
- feat(kb): add relocate-kb to move knowledge base vectors between backends by @ogabrielluiz in #15099
- feat(cli): add check-integrity to report where an instance disagrees with itself by @ogabrielluiz in #15324
- feat(deployments): declare required model providers and models in deploy artifacts by @Jkavia in #15548
- feat(cli): add --json output to convert-sqlite-to-postgres by @ogabrielluiz in #15524
- feat(cli): add migration-preflight to refuse a migration that cannot succeed by @ogabrielluiz in #15327
- feat(cli): add --json output to relocate-files and check the bucket first by @ogabrielluiz in #15525
- feat(i18n): translate the remaining backend strings to Korean by @pjw81226 in #15435
- feat: Add Enterprise navigation seams by @deon-sanchez in #15467
- feat: application audit log for flows and projects by @Cristhianzl in #15082
- feat(kb): add --json output to relocate-kb and keep stored content out of errors by @ogabrielluiz in #15527
- feat: add GDPR data subject erase and requests by @Cristhianzl in #15470
- feat(api): run migration commands as child processes that outlive a request by @ogabrielluiz in #15580
- feat(api): add a write pause for instance migration by @ogabrielluiz in #15562
- feat(cli): add --json output to check-integrity and migration-preflight by @ogabrielluiz in #15574
- feat(authz): add per-resource access exceptions by @olayinkaadelakun in #15133
- feat: route product telemetry through Segment by @vjgit96 in #15616
- feat(cli): accept the target's Langflow version in migration-preflight by @ogabrielluiz in #15575
- feat(api): run the migration source checks from superuser endpoints by @ogabrielluiz in #15576
- feat(frontend): add a guided Settings > Migration page for superusers by @ogabrielluiz in #15577
- feat(api): pause and resume changes from the migration endpoints by @ogabrielluiz in #15601
- feat(api): test and save the destination of a migration by @ogabrielluiz in #15602
- feat(api): confirm the secret key reached the new instance by @ogabrielluiz in #15603
- feat(api): back up an instance before its migration by @ogabrielluiz in #15604
- feat(flow-versions): keep versions an extension marks as retained by @jordanrfrazier in #15638
- feat(frontend): add the destinations step to the migration page by @ogabrielluiz in #15606
- feat(frontend): add the secret key step to the migration page by @ogabrielluiz in #15607
- feat(frontend): add the pause step to the migration page by @ogabrielluiz in #15608
- feat(frontend): add the backup step to the migration page by @ogabrielluiz in #15609
- feat(api): run the database copy from the migration endpoints by @ogabrielluiz in #15610
- feat(api): run the knowledge base and file copies from the migration endpoints by @ogabrielluiz in #15611
- feat(api): record what the admin decides about a migration copy by @ogabrielluiz in #15612
- feat(api): count a migration copy only for the destination it was made to by @ogabrielluiz in #15613
- feat(frontend): add the database copy to the migration page by @ogabrielluiz in #15621
- feat(frontend): add the knowledge base and file copies to the migration page by @ogabrielluiz in #15622
- feat(frontend): let an admin decide what a migration copy asks by @ogabrielluiz in #15623
- feat(frontend): show what a migration pause is still waiting for by @ogabrielluiz in #15629
- feat: let the migration page check the copy and start the new instance by @ogabrielluiz in #15679
- feat(flow-versions): let a deploy record a version without pruning by @jordanrfrazier in #15722
- feat(deployments): declare and provision what a flow's MCP servers need by @Jkavia in #15668
- feat(mrscraper): consolidate bundle into Account, Scraper API, and Web Search by @ai-mrscraper in #15769
- feat(frontend): add header logo seam for brand overrides by @Cristhianzl in #15399
- feat: Add secondary navigation customization seams by @deon-sanchez in #15741
🐛 Bug Fixes
- fix(tests): match the publish PATCH by body before opening the shareable playground by @erichare in #14907
- fix(admin): harden conflict and prune handling by @erichare in #14923
- fix: explain missing Enterprise directory support in admin CLI by @erichare in #14974
- fix(variables): import environment globals for every user at startup by @IlyasIsHere in #14990
- fix(api): stop 422 responses from echoing submitted values by @erichare in #15038
- fix(lfx): import Graph/Vertex at runtime so Flow as Tool can build by @erichare in #15046
- fix(agentics): deprecate components whose SDK can't be installed by @erichare in #15045
- fix(api): publish administration endpoints in OpenAPI by @erichare in #15079
- fix(authz): delete a user's role assignments when the user is deleted & Adds the missing ORM cascade; SQLite never enforces the declared FK CASCADE. by @olayinkaadelakun in #15124
- fix(users): enforce case-insensitive username uniqueness by @olayinkaadelakun in #15123
- fix(slack): map caller-fault errors to invalid-request and prove headless token identity by @erichare in #15146
- fix(flows): own a flow by its project when created in a foreign project by @erichare in #15170
- fix(integrations): give connection metadata reads their own rate-limit bucket (INT-14-04) by @erichare in #15174
- fix(frontend): mount a tab panel per trigger on the Connections page by @erichare in #15176
- fix(frontend): keep other users' connections out of a superuser's Mine tab by @erichare in #15182
- fix(google): deprecate Google Search API ahead of the CSE JSON API shutdown by @erichare in #15183
- fix(frontend): restore the auth store user from the session probe by @erichare in #15181
- fix(integrations): address INT-8 Enterprise QA findings (Gmail errors, auth reload, rate limits, picker, re-authorize) by @erichare in #15184
- fix(frontend): resolve legacy replacement hints for extension-bundle components by @erichare in #15185
- fix: point legacy components' replacement hints at current categories by @erichare in #15186
- fix(frontend): refresh the connections list when OAuth consent lands by @erichare in #15187
- fix(api-key): consult a deployment policy wherever a key is minted by @erichare in #15247
- fix(connections): validate handles and improve settings usability by @erichare in #15263
- fix(db): adopt SQLModel timezone-aware timestamps for 1.13 by @erichare in #15266
- fix(connections): offer OAuth registration scopes in consent by @erichare in #15310
- fix(projects): keep personal starter projects identifiable after renames by @erichare in #15404
- fix(frontend): only fetch GitHub and Discord counts where they render by @viktoravelino in #15400
- fix(files): stop Read File tool cancellations logging a shielded-future error by @erichare in #15317
- fix(amazon): port S3 uploader strategy and file-input fix to 1.13.0 by @erichare in #15422
- fix(frontend): let distributions drop the account menu community links and checklist divider by @viktoravelino in #15455
- fix: disable automatic login by default by @Adam-Aghili in #14993
- fix(tests): repair release-1.13.0 tests broken by the main merge by @erichare in #15461
- fix(lfx): run annotation checks once per component source by @HzaRashid in #15445
- fix(telemetry): preserve workflow completion timestamps by @Adam-Aghili in #15325
- fix(auth): keep the default superuser's data when AUTO_LOGIN is turned off by @ogabrielluiz in #15326
- fix(connections): explain an empty provider list and fix unreadable scope warning by @keval718 in #15440
- fix(db): merge the retired_at and atomic project replacement migration heads by @ogabrielluiz in #15476
- fix(security): bound URL component response size to prevent memory exhaustion by @andifilhohub in #15436
- fix(scripts): rotate apikey and mcp_server secrets in migrate_secret_key by @ogabrielluiz in #15097
- fix(kb): ask OpenSearch for _source when reading knowledge base vectors by @ogabrielluiz in #15429
- fix(background): release queued lease when startup enqueue fails by @liuzinann in #15356
- fix(files): repoint absolute chat attachment paths when relocating files by @ogabrielluiz in #15441
- fix(jobs): serialize concurrent idempotent job creation by @Liuzikaii in #15395
- fix(frontend): show Execution blocked on nodes an If-Else routed away from by @viktoravelino in #15398
- fix(projects): let _new_project run inside the caller's transaction by @jordanrfrazier in #15541
- fix: block unsafe module reexports in assistant code scanning by @erichare in #15586
- fix: complete Desktop OAuth consent and retries by @erichare in #15596
- fix: enforce credential egress policy across provider components by @erichare in #15587
- fix(knowledge): refresh statistics after flow ingestion by @erichare in #15578
- fix: prevent variable Share actions from opening the editor by @erichare in #15600
- fix(scripts): keep keys and the database password out of migrate_secret_key output by @ogabrielluiz in #15526
- fix(cli): make check-integrity and migration-preflight findings accurate and actionable by @ogabrielluiz in #15528
- fix(split-text): normalize keep separator values by @tarciorodrigues in #15559
- fix(authz): filter personal projects in listing queries by @erichare in #15635
- fix(scripts): seed migration rehearsal knowledge bases as SQLite stores by @ogabrielluiz in #15534
- fix(scripts): skip store API keys that were never encrypted in migrate_secret_key by @ogabrielluiz in #15563
- fix: pre-flight checks checks for at least 1 vector Db config by @dkaushik94 in #14802
- fix(knowledge): ingest once and finalize cancelled flow runs by @erichare in #15640
- fix: handle non-string labels in smart column ordering by @LimbC-C in #15511
- fix(i18n): translate remaining English UI strings and fix mistranslations by @erichare in #15651
- fix: preserve caller credentials in agentic MCP requests by @erichare in #15652
- fix(api): hold the data subject erase worker during the write pause by @ogabrielluiz in #15645
- fix(cli): keep the migration preflight general about the new instance by @ogabrielluiz in #15636
- fix(agent): keep string chunks of a mixed list content in the stored reply by @tarciorodrigues in #15650
- fix: reject reusing bundle releases published for another lfx line by @erichare in #15658
- fix(workflow): cancel a disconnected stream's run task only once by @erichare in #15662
- fix(knowledge): finalize runs on repeated cancels and keep KB status on cancel by @erichare in #15661
- fix(cli): warn when the default superuser has signed in and AUTO_LOGIN is on by @ogabrielluiz in #15663
- fix(knowledge): show orphaned ingestion runs as failed and keep live runs from being swept by @erichare in #15664
- fix(jobs): keep in-request runs alive so orphan sweeps cannot fail them by @erichare in #15665
- fix(kb): treat a process reaped during its identity read as gone by @ogabrielluiz in #15566
- fix: keep a request body that fails validation out of the server log by @ogabrielluiz in #15628
- fix(playground): stop the editor freezing on flows with thousands of chat sessions by @viktoravelino in #15579
- fix(data-subjects): erase end-user memory on SQLite and refresh the counts by @erichare in #15674
- fix(api): fail knowledge bases as their database did when it is refused by @ogabrielluiz in #15605
- fix(data-subjects): erase the Chroma copies kept by the storage upgrade by @erichare in #15676
- fix(data-subjects): delete the storage upgrade's application backup once it has finished by @erichare in #15681
- fix(data-subjects): erase only the builder's own legacy knowledge base directories by @erichare in #15682
- fix(knowledge-bases): find legacy directories by evidence, not the current username by @erichare in #15683
- fix(data-subjects): erase legacy knowledge base directories under dot-prefixed usernames by @erichare in #15684
- fix(api): close the migration checks' source when the client goes away by @ogabrielluiz in #15618
- fix(frontend): fold what the migration rehearsal found into the page by @ogabrielluiz in #15624
- fix(tests): keep the client database template readable on SQLite 3.54 by @erichare in #15725
- fix(playground): show new chats on the shared Playground page by @viktoravelino in #15673
- fix(kb): align vector-backend preflight and UI default with the runtime by @dkaushik94 in #15733
- fix: retire the separate Chroma migration helper by @erichare in #15737
- fix(processing): preserve JSON payload keys when combining by @LimbC-C in #15699
- fix(data): decode Windows-1252 text files instead of mangling them by @xiao115255 in #15707
- fix(lfx): resolve the intended class in multi-component source by @Cristhianzl in #15740
- fix(lfx): validate issuer in OIDC discovery metadata by @Adam-Aghili in #15637
- fix: include provider bundles in CLI upgrades and correct prerelease versions by @erichare in #15742
- fix(frontend): remove canvas handle from connection_ref fields by @keval718 in #15753
- fix: show Slack and Microsoft list results in output inspector by @erichare in #15772
- fix: preserve integration hints and codes in workflow errors by @erichare in #15773
- fix: persist connection health after runtime credential expiry by @erichare in #15763
- fix(integrations): distinguish Google network failures from provider outages by @erichare in #15775
- fix: retain Google identity scopes when reconnecting by @erichare in #15774
- fix(slack): omit blank canvas titles from API requests by @erichare in #15771
- fix(connections): validate pasted Slack tokens and credential health by @erichare in #15767
- fix(connections): revoke pasted Slack tokens and report provider outcomes by @erichare in #15766
- fix(connections): request offline access on Microsoft reconnect by @erichare in #15780
- fix(api): handle legacy NULL text in memory message listings by @erichare in #15748
- fix(api): keep idle workflow streams alive by @erichare in #15749
- fix(processing): preserve append and update payload keys by @erichare in #15750
- fix(agent): resolve current_date to the UTC day by @Cristhianzl in #15752
- fix(mcp): keep a credential typed into the MCP component's Headers box by @Jkavia in #15761
- fix(connections): add provider setup guidance by @erichare in #15796
- fix(voice): load the audio worklet from a packaged asset by @Cristhianzl in #15678
- fix: improve knowledge base list readability by @erichare in #15805
- fix(knowledge): honor the selected database provider by @erichare in #15813
- fix: preserve knowledge base names when adding files by @erichare in #15806
- fix: preserve knowledge base availability after interrupted ingestion by @erichare in #15807
- fix(connections): explain OAuth scopes and action risks by @erichare in #15810
- fix: explain rate-limited OAuth callbacks in the browser by @erichare in #15811
- fix(connections): handle lost OAuth popup tracking by @erichare in #15816
- fix(connections): block unusable providers before consent by @erichare in #15809
- fix: recognize environment-configured knowledge providers by @erichare in #15808
- fix(api): reject out-of-range page/size with 422 instead of 500 by @viktoravelino in #15760
- fix: accept environment pgVector defaults in creation dialogs by @erichare in #15821
- fix(connections): preserve saved credentials during reconnect by @erichare in #15822
- fix: use server OpenSearch configuration in provider settings by @erichare in #15820
- fix(knowledge): explain empty filtered Google Drive ingestion by @erichare in #15823
- fix(connections): clarify third-party account description by @erichare in #15825
- fix: guide recovery after upgrading from an auto-login installation by @tarciorodrigues in #15789
- fix(knowledge): report stored and skipped ingestion rows by @erichare in #15828
- fix(frontend): show and copy the shareable playground link by @Cristhianzl in #15826
- fix(frontend): keep the version token when the canvas unmounts by @Cristhianzl in #15824
- fix(frontend): scroll the model provider list by @Cristhianzl in #15819
- fix(kb): stop the storage upgrade from refusing on macOS with more than one Terminal tab by @ogabrielluiz in #15787
- fix(migration): let the admin set the 'langflow' account's password from its row by @ogabrielluiz in #15815
- fix(processing): keep Data Operations inputs visible after Update Component by @viktoravelino in #15812
- fix(cli): exit non-zero and say so when a signal stops a migration command by @ogabrielluiz in #15802
- fix: report the knowledge base id in the Knowledge ingest output by @tarciorodrigues in #15804
- fix(migration): say before copying the database again that it needs a new, empty database by @ogabrielluiz in #15814
- fix(frontend): show the right times in My Files and in ingestion runs by @ogabrielluiz in #15803
- fix(frontend): keep the Settings header and menu in view by @Cristhianzl in #15818
- fix(migration): show a paused notice on every page and fail paused changes at once by @ogabrielluiz in #15779
- fix(migration): say that the pause and the saved passwords hold for one Langflow process by @ogabrielluiz in #15778
- fix(migration): let a knowledge base the copy cannot read be left behind by @ogabrielluiz in #15777
- fix(ci): build backend and frontend images when an upstream release job is skipped by @erichare in #15834
- fix(processing): keep JSON Operations inputs visible after Update Component by @erichare in #15833
- fix(processing): set the JSON input's list flag under the key the canvas reads by @erichare in #15836
- fix: preserve item type for nullable array params in MCP tool schemas by @Dominik23 in #15745
- fix(processing): keep non-dict values when selecting the data key by @Cristhianzl in #15751
- fix(sidebar): find components from custom sections when searching by @viktoravelino in #15855
- fix(frontend): apply LANGFLOW_ROOT_PATH at runtime by @erichare in #15856
- fix: retired youtube subscriber badge by @mendonk in #15479
- fix(auth): isolate sessions for runtime URL prefixes by @erichare in #15875
- fix(memory): Memory Base component update, ingestion snapshot, and reasoning-model temperature bugs by @dkaushik94 in #15864
- fix(knowledge): clarify storage upgrade guidance and retry feedback by @erichare in #15890
- fix(auth): surface superuser password recovery guidance by @erichare in #15889
- fix(deps): keep core package versions aligned by @erichare in #15899
- fix: let the assistant read bundled component sources by @Cristhianzl in #15893
- fix: make orphaned storage upgrade issues actionable by @erichare in #15938
- fix(deps): block compromised LiteLLM installs by @Adam-Aghili in #15939
📝 Documentation Updates
- docs(integrations): INT-1 discovery gate records and capability-matrix checker by @erichare in #14906
- docs(integrations): scaffold the triggers discovery gate (TRG-1) by @erichare in #14911
- docs(triggers): define discovery gate records and enforce closure by @erichare in #14955
- docs(lfx): document headless connection resolution and deployment requirements by @erichare in #14954
- docs: auto_login is false by default by @mendonk in #15135
- docs: integrated connectors by @mendonk in #15348
- docs: concurrent editing checks by @mendonk in #15649
- docs: use mcp server with langflow assistant by @mendonk in #15738
- docs: entra registration and chroma removal by @mendonk in #15728
- docs: fix Docker upgrade data loss, langflow api-key guidance, and MrScraper note by @erichare in #15835
- docs: backport Docker upgrade data-loss fix to the 1.8 through 1.12 docs by @erichare in #15837
- docs: cut 1.13.0 release by @mendonk in #15829
🛠 Maintenance Tasks
- perf(api): compress flow payloads on the wire by @tarciorodrigues in #14916
- chore(bundles): bump lfx-google to 0.2.3 to stay ahead of the 1.12 line by @erichare in #15251
- perf: reduce backend test and plugin startup overhead by @erichare in #15264
- perf(lfx): cache FileInput names per component source by @HzaRashid in #15446
- refactor(lfx): make the file loader chain async end to end by @erichare in #15315
- perf(storage): reuse one S3 client per event loop by @ogabrielluiz in #15318
- perf: cut database round trips per v2 workflow run by @HzaRashid in #15473
- perf(ci): speed up backend fixtures and publish reliable shard timings by @erichare in #15504
- perf(ci): reuse backend schemas and refresh branch timing baselines by @erichare in #15507
- perf(lfx): cache component class names per source by @HzaRashid in #15471
- perf(lfx): run token usage and provider metrics callbacks inline by @HzaRashid in #15482
- chore: move 1.13 bundles onto their own minor line by @erichare in #15656
- perf(db): reduce connection-pool pressure ahead of Enterprise GA (LE-2617) by @RamGopalSrikar in #15561
✅ Tests
- test: use graduated Ollama package imports by @LauraGPT in #14882
- test: move never-run langflow-base tests into the CI suite by @erichare in #15043
- test: move orphan VLM Run test into lfx-bundles, drop stale agentics copy by @erichare in #15044
- test: run the build_component_index script tests that always skipped by @erichare in #15047
- test: run every component output in test_latest_version by @erichare in #15048
- test(a11y): assert the a11y route manifest covers every route in routes.tsx by @erichare in #15173
- test: add migration rehearsal fixtures by @ogabrielluiz in #15017
- test(cli): keep the malformed-key preflight test out of the shared key file by @ogabrielluiz in #15639
- test(api): list the GET routes that a migration pause lets through by @ogabrielluiz in #15633
- test(frontend): run the bulk delete session tests one after another by @ogabrielluiz in #15708
- test(connections): mock Slack validation before token revocation by @erichare in #15791
- test: assert build_public_tmp never forwards request data to the build by @OriHasin16 in #15845
Others
- regression: backfill known regressions for 1.9.x through 1.12.x by @daniellicnerski1 in #15002
- bug: Memory bases cleanup post flow deletion by @dkaushik94 in #14915
- ci: point migration-validation at relocated flow_version concurrency test by @erichare in #15125
- regression: log 12 regressions found by an upstream issue sweep (1.9.x-1.12.x) by @daniellicnerski1 in #15131
- ci: watch every GA checklist evidence path in ci-scripts-test.yml by @erichare in #15172
- Merge release-1.12.6 into main by @erichare in #15734
New Contributors
- @LauraGPT made their first contribution in #14882
- @sarveshpatil-plivo made their first contribution in #14396
- @IlyasIsHere made their first contribution in #14990
- @daniellicnerski1 made their first contribution in #15002
- @googio made their first contribution in #14626
- @musabgultekin made their first contribution in #15221
- @pjw81226 made their first contribution in #15312
- @liuzinann made their first contribution in #15356
- @xiao115255 made their first contribution in #15707
- @Dominik23 made their first contribution in #15745
- @OriHasin16 made their first contribution in #15845
Full Changelog: v1.12.8...v1.13.0