What's Changed
🐛 Bug Fixes
- fix: backport 1.13.1 fixes and image security updates to 1.12.9 by @erichare in #16119
- fix: absorb lxml and Mako image workarounds for 1.12.9 by @erichare in #16123
- fix: authenticate starter project MCP clients in auto-login mode by @erichare in #16151
- fix: preserve document identities during knowledge base ingestion by @erichare in #16134
- fix: preserve loop items and distinct outputs in list inputs by @erichare in #16147
- fix: honor detected Windows-1254 text encoding by @erichare in #16149
- fix: enforce flow permissions for event access by @erichare in #16150
- fix: run knowledge base rollback off the event loop by @erichare in #16148
- fix: preserve numeric column types in Parser templates by @erichare in #16146
- fix: honor MCP flow visibility for project resources by @erichare in #16127
- fix: validate class pattern attributes by @erichare in #16126
- fix: enforce outbound request policy for OpenAPI agents by @erichare in #16125
- fix: validate MCP shell wrapper arguments consistently by @erichare in #16124
- fix: authenticate project MCP clients in auto-login mode by @erichare in #16186
- fix: allow first ingestion into a new OpenSearch index by @erichare in #16171
- fix: patch release 1.12.10 image vulnerabilities by @erichare in #16201
- fix: patch bundled npm glob and minimatch for 1.12.10 by @erichare in #16205
- fix(lfx): apply Split Text Text Key to lists of Data records by @olayinkaadelakun in #16164
- fix: harden release 1.13.2 image dependencies by @erichare in #16196
- fix(lfx): report input length and format in Batch Run metadata by @olayinkaadelakun in #16152
- fix: preserve integer IDs in Parser Stringify tables by @erichare in #16214
- fix(schema): stop sending "None" as the default of table columns without one by @viktoravelino in #16144
- fix: validate forwarded prefixes as URL paths by @erichare in #16242
- fix: scope frozen vertex results to the build caller by @erichare in #16239
- fix(frontend): create one flow on a repeated New Flow click by @Cristhianzl in #16232
- fix(agents): keep parallel tool results on their own run by @Cristhianzl in #16233
- fix(api): recover milestones a slow event stream dropped by @Cristhianzl in #16234
- fix(components): send If-Else message on default route by @Cristhianzl in #16275
- fix: make model provider sections collapsible (LE-3358) by @erichare in #16281
- fix(security): reject frozen and ZIP loader imports by @erichare in #16282
- fix(deps): dependency upgrades for 1.13.2 by @Adam-Aghili in #16169
- fix(models): clear rejected Bedrock sampling fields before retrying by @erichare in #16298
- fix: revoke refresh sessions on logout by @erichare in #16293
- fix(tracing): isolate concurrent Phoenix workflows by @erichare in #16294
- fix(serialization): sanitize nonfinite NumPy and pandas floats by @erichare in #16297
- fix(deps): use patched Zod in the docs toolchain by @Adam-Aghili in #16299
- fix(security): require admin custom-code authoring by default by @erichare in #16288
- fix(lfx): keep non-string text values in Message by @MohammadHijjawi97 in #16218
- fix(api): rename a flow that loses a concurrent create for its name by @erichare in #16302
- fix(graph): give list inputs the same value order in every process by @viktoravelino in #16285
- fix: stop Filter Values crashing on ordinary text filters by @viktoravelino in #16202
- fix(lfx): keep top-level JSON arrays in JSON Cleaner by @MohammadHijjawi97 in #16206
- fix: reset model provider scroll on selection by @erichare in #16314
- fix(amazon): address Bedrock Converse QA failures by @erichare in #16326
📝 Documentation Updates
✅ Tests
- test(security): cover reflective namespace laundering by @erichare in #16243
- test(auth): cover trusted proxy credential sources by @erichare in #16238
Others
- ci: centralize Chromium runner defaults on Ubuntu 24.04 by @erichare in #16155
- fix: apply connector URL policy before connecting to NextPlaid by @erichare in #16283
- fix: require owner credentials for every webhook run by @erichare in #16284
- fix(authz): refuse unavailable configured plugins by @erichare in #16286
- fix(serve): scope durable workflow operations to caller by @erichare in #16287
- fix(security): reject unsafe library execution sinks by @erichare in #16289
- fix: enforce credential destinations during provider validation by @erichare in #16290
- fix: keep public API Request destinations fixed by @erichare in #16291
- fix: recheck execution identity and tool approval at runtime by @erichare in #16292
Full Changelog: v1.13.1...v1.13.2