This release includes 7 security fixes for security teams reviewing exposed deployments.
Published 4d
AI Agents & Assistants
✓ No known CVEs patched
This release patches 7 known CVEs
Topics
agents
chatgpt
generative-ai
large-language-models
multiagent
react-flow
Affected surfaces
auth
rbac
Summary
AI summaryBroad release touches 🐛 Bug Fixes, ✨ New Features, fix, and Others.
Full changelog
What's Changed
✨ New Features
- feat: docs page copy-as-markdown keyboard shortcut by @mendonk in https://github.com/langflow-ai/langflow/pull/13628
- feat: add docs feedback components by @mendonk in https://github.com/langflow-ai/langflow/pull/13627
- feat: New Bundle support for Multi-vector NextPLAID vector store by @meetdoshi90 in https://github.com/langflow-ai/langflow/pull/13553
- feat: upgrade Firecrawl to v2 SDK and extract into the lfx-firecrawl extension bundle by @rakshith48 in https://github.com/langflow-ai/langflow/pull/13495
- feat(auth): external trusted JWT auth + JIT user mapping + access ceiling by @erichare in https://github.com/langflow-ai/langflow/pull/13293
- feat(lfx): verified-JWT identity forwarding for lfx serve by @jordanrfrazier in https://github.com/langflow-ai/langflow/pull/13632
- feat: native v2 workflows endpoint with pluggable stream protocols by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/13307
- feat(bundles): metapackage split (Phase A) — engine-only lfx, lfx-bundles long tail, 5 graduated partner packages by @erichare in https://github.com/langflow-ai/langflow/pull/13563
- feat(frontend): RBAC permission gating via /authz/me/permissions by @erichare in https://github.com/langflow-ai/langflow/pull/13543
- feat: wire list_visible_resource_ids prefilter into list endpoints by @erichare in https://github.com/langflow-ai/langflow/pull/13541
- feat(lfx): add pre-warm functionality by @jordanrfrazier in https://github.com/langflow-ai/langflow/pull/13682
- feat: a11y by @viktoravelino in https://github.com/langflow-ai/langflow/pull/13561
- feat(lfx): introduce pluggable executor seam by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/12981
- feat: make content_blocks the source of truth for Message content by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/13364
- feat(starter-projects): refresh starter flows for 1.10.x, add Multi Agent Flow, remove 4 deprecated templates by @rafaelgiln in https://github.com/langflow-ai/langflow/pull/13879
- feat: add PaddleOCR partner bundle (lfx-paddle) — inherits #13779 by @erichare in https://github.com/langflow-ai/langflow/pull/13908
- feat: add EmpirioLabs partner bundle (lfx-empiriolabs) — refactor of #13645 by @erichare in https://github.com/langflow-ai/langflow/pull/13918
- feat(lfx): let extension bundles register model providers by @erichare in https://github.com/langflow-ai/langflow/pull/13916
- feat: add OpenAI Compatible as a first-class unified model provider by @erichare in https://github.com/langflow-ai/langflow/pull/13940
- feat: unify JSON/Table/Text operations into a single Operations component by @erichare in https://github.com/langflow-ai/langflow/pull/13743
- feat(embeddings): populate available_models from configured providers by @HimavarshaVS in https://github.com/langflow-ai/langflow/pull/13820
- feat(exa): update Exa Search to the exa-py SDK and graduate it to the standalone lfx-exa bundle by @erichare in https://github.com/langflow-ai/langflow/pull/13968
- feat(bundles): add torch-free all-no-torch extra to lfx-bundles by @jordanrfrazier in https://github.com/langflow-ai/langflow/pull/13886
- feat(lfx-serve): v2 workflow endpoints (sync + stream) by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/13783
- feat(lfx-serve): lfx owns the v2 workflow router via a host-DI seam by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/13816
- feat(mcp): persist MCP servers in a database table by @thesaadmirza in https://github.com/langflow-ai/langflow/pull/13976
- feat(playground): content blocks frontend renderer for v2 workflows by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/13391
- feat(api): durable background execution service (store + default backend) by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/13507
- feat(frontend): render the flow share seam in the editor Share dropdown by @keval718 in https://github.com/langflow-ai/langflow/pull/14009
- feat(models): add Azure AI Foundry to unified model provider setup by @HimavarshaVS in https://github.com/langflow-ai/langflow/pull/13912
- feat(assistant): QA fixes + model portability, budget, and error visibility by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14038
- feat(lfx): multi-worker serving with per-request isolation for lfx serve by @jordanrfrazier in https://github.com/langflow-ai/langflow/pull/13818
- feat: durable background execution + HITL suspend/resume schema by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/13633
- feat(frontend): add OpenRAG icon by @erichare in https://github.com/langflow-ai/langflow/pull/14095
- feat: add Valkey vector store and chat memory components by @MatthiasHowellYopp in https://github.com/langflow-ai/langflow/pull/12530
- feat(a2a): A2A protocol support by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/13831
- feat(job_queue): export cancel_stats and active_jobs to OpenTelemetry by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/13123
- feat(frontend): turn inspector panel into a parameter manager by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14078
- feat(valkey): restore components as 1.11 extension bundle by @erichare in https://github.com/langflow-ai/langflow/pull/14151
🐛 Bug Fixes
- fix(lfx): restamp component index version after 1.11.0 fork bump by @erichare in https://github.com/langflow-ai/langflow/pull/13574
- fix(ci): rebalance backend test splits with measured durations + raise unit-test step timeout by @erichare in https://github.com/langflow-ai/langflow/pull/13583
- fix(ci): rebalance backend test splits with measured durations + raise unit-test step timeout (main) by @erichare in https://github.com/langflow-ai/langflow/pull/13584
- fix(test): raise spawn-child join timeout in test_multi_process_visibility by @erichare in https://github.com/langflow-ai/langflow/pull/13588
- fix(test): raise spawn-child join timeout in test_multi_process_visibility (main) by @erichare in https://github.com/langflow-ai/langflow/pull/13589
- fix(ci): anchor langflow-base version extraction in nightly docker build by @erichare in https://github.com/langflow-ai/langflow/pull/13591
- fix(ci): anchor langflow-base version extraction in nightly docker build (1.11.0) by @erichare in https://github.com/langflow-ai/langflow/pull/13592
- fix(test): gate models.dev background refresh out of tests by @erichare in https://github.com/langflow-ai/langflow/pull/13596
- fix(test): gate models.dev background refresh out of tests (main) by @erichare in https://github.com/langflow-ai/langflow/pull/13597
- fix(ci): allow pre-releases when pinning the nightly in migration validation by @erichare in https://github.com/langflow-ai/langflow/pull/13599
- fix(ci): allow pre-releases when pinning the nightly in migration validation (1.11.0) by @erichare in https://github.com/langflow-ai/langflow/pull/13600
- fix(ci): scope nightly migration-test pre-releases to the langflow stack by @erichare in https://github.com/langflow-ai/langflow/pull/13603
- fix(ci): scope nightly migration-test pre-releases to the langflow stack (1.11.0) by @erichare in https://github.com/langflow-ai/langflow/pull/13604
- fix(ci): create GitHub releases on the dispatched v-prefixed tag by @erichare in https://github.com/langflow-ai/langflow/pull/13608
- fix(ci): resolve validate-version output in release-lfx changelog link by @erichare in https://github.com/langflow-ai/langflow/pull/13610
- fix: fail fast when Redis job queue backend is unreachable by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/13456
- fix(frontend): duplicate tooltip + raw i18n key on collapsed sidebar nav (1.11.0) by @keval718 in https://github.com/langflow-ai/langflow/pull/13652
- fix(frontend): restore Inspection Panel access to hidden advanced fields (1.11.0) by @keval718 in https://github.com/langflow-ai/langflow/pull/13626
- fix(authz): schedule periodic audit-log retention cleanup by @erichare in https://github.com/langflow-ai/langflow/pull/13546
- fix: Raise on an undecryptable secret at the variable-resolution by @Jkavia in https://github.com/langflow-ai/langflow/pull/13681
- fix: warn on empty value and decrypt failure in get_all variable listing by @Jkavia in https://github.com/langflow-ai/langflow/pull/13741
- fix: skip provider-component tests while bundles are temporarily disabled by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/13797
- fix: guard temporarily-disabled bundle deps across backend + frontend tests by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/13801
- fix: keep tests and the starter-projects endpoint green while bundles are temporarily unpublished by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/13809
- fix: keep nightly prerelease wheels explicit by @erichare in https://github.com/langflow-ai/langflow/pull/13815
- fix: keep nightly prerelease wheels explicit by @erichare in https://github.com/langflow-ai/langflow/pull/13817
- fix: share policy refresh and owner permissions by @erichare in https://github.com/langflow-ai/langflow/pull/13830
- fix: release QA component follow-ups for bundles by @erichare in https://github.com/langflow-ai/langflow/pull/13834
- fix(telemetry): use SQLAlchemy AsyncSession to stop deprecation-warning log flood by @erichare in https://github.com/langflow-ai/langflow/pull/13845
- fix: authz flow permission gates by @erichare in https://github.com/langflow-ai/langflow/pull/13857
- fix: handle invalid session auth tokens by @erichare in https://github.com/langflow-ai/langflow/pull/13863
- fix(a11y): label icon-only controls by @viktoravelino in https://github.com/langflow-ai/langflow/pull/13678
- fix: changed image base to be ubi10 by @lucaseduoli in https://github.com/langflow-ai/langflow/pull/13893
- fix: isolate FAISS persistence by user (lfx-bundles copy) by @erichare in https://github.com/langflow-ai/langflow/pull/13899
- fix(ci): stop nightly Group 3 timeout and db-migration superuser boot crash by @erichare in https://github.com/langflow-ai/langflow/pull/13933
- fix(kb): align frontend default chunk settings with backend by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/13896
- fix(a11y): resolve WCAG 2.1 Level A and AA violations on settings general page by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/13811
- fix: log missing optional deps as one-line warning during component discovery by @erichare in https://github.com/langflow-ai/langflow/pull/13941
- fix: false duplicate-distribution extension errors from lib64 symlink aliasing in ubi Docker images by @erichare in https://github.com/langflow-ai/langflow/pull/13943
- fix: arxiv timeout in research translation loop by @erichare in https://github.com/langflow-ai/langflow/pull/13954
- fix(api-keys): replace native date input with shadcn date picker by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/13913
- fix(a11y): fix traces page accessibility violations — rowgroup tabbable by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/13744
- fix(frontend): stop flow deletes from clobbering newly created flows by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/13975
- fix(frontend): clear /flows page a11y debt by @viktoravelino in https://github.com/langflow-ai/langflow/pull/13891
- fix(traces): migrate legacy uppercase spanstatus/spantype enum labels to lowercase by @erichare in https://github.com/langflow-ai/langflow/pull/13907
- fix(ci): publish bundle deps before nightly main by @erichare in https://github.com/langflow-ai/langflow/pull/13982
- fix(lfx): read local files under S3 storage to unblock the Assistant by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/13862
- fix: prevent LangfuseResourceManager deepcopy failure in Agent/Tool Calling Agent by @gingeekrishna in https://github.com/langflow-ai/langflow/pull/13966
- fix(docker): give runtime user a writable npm cache so stdio MCP servers start by @erichare in https://github.com/langflow-ai/langflow/pull/13992
- fix: thin single focus border on global-variable input by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/13995
- fix(a11y): improve API keys tab order by @viktoravelino in https://github.com/langflow-ai/langflow/pull/13953
- fix(frontend): center update toast buttons vertically by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14004
- fix(a11y): make /assets/files accessible by @viktoravelino in https://github.com/langflow-ai/langflow/pull/13987
- fix: fail loud on undecryptable KB embedding key with recovery path by @Jkavia in https://github.com/langflow-ai/langflow/pull/13806
- fix: rename Operations component display name to Data Operations by @erichare in https://github.com/langflow-ai/langflow/pull/14025
- fix: return 403 instead of 404 on denied flow DELETE when the flow is readable by @erichare in https://github.com/langflow-ai/langflow/pull/14029
- fix(a11y): add accessible names to notifications popover controls by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/13994
- fix: settings/global-variables accessibility by @deon-sanchez in https://github.com/langflow-ai/langflow/pull/13990
- fix(memory): preserve asyncio cancellation by @erichare in https://github.com/langflow-ai/langflow/pull/14028
- fix(security): harden multi-tenant surfaces by @jordanrfrazier in https://github.com/langflow-ai/langflow/pull/13530
- fix(models): allow Azure AI Foundry deployment names instead of catalog IDs by @HimavarshaVS in https://github.com/langflow-ai/langflow/pull/14023
- fix: close tenant-isolation gaps in security hardening by @erichare in https://github.com/langflow-ai/langflow/pull/14044
- fix: gate lfx-bundles ALTK on Python 3.14 by @erichare in https://github.com/langflow-ai/langflow/pull/14055
- fix(initial_setup): preserve variable bindings when loading flows from disk by @erichare in https://github.com/langflow-ai/langflow/pull/14053
- fix(lfx): tighten horizontal spacing in generated flow layout by @keval718 in https://github.com/langflow-ai/langflow/pull/14059
- fix: correct deprecated model settings behavior by @erichare in https://github.com/langflow-ai/langflow/pull/14048
- fix(frontend): anchor alert notifications flush to bottom corner by @keval718 in https://github.com/langflow-ai/langflow/pull/14027
- fix(frontend): stop assistant 'New' pill from shifting on hover by @keval718 in https://github.com/langflow-ai/langflow/pull/14035
- fix(frontend): hide assistant 'New' badge once feature is discovered by @keval718 in https://github.com/langflow-ai/langflow/pull/14060
- fix(frontend): prefer strong model as assistant composer default by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14058
- fix(authz): close RBAC enforcement and permission UX gaps by @erichare in https://github.com/langflow-ai/langflow/pull/14068
- fix(api): enforce sync-only output_ids across modes and correct documented auth status code by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14091
- fix(lfx): deduplicate Google embedding model aliases by @erichare in https://github.com/langflow-ai/langflow/pull/14082
- fix: expose stable Langfuse trace IO for evaluators by @erichare in https://github.com/langflow-ai/langflow/pull/14089
- fix: make the 1.11 core runtime self-contained by @erichare in https://github.com/langflow-ai/langflow/pull/14098
- fix(mcp): forward advertised flow input fields by @erichare in https://github.com/langflow-ai/langflow/pull/14074
- fix: keep nv-ingest compatible with urllib3 security floor by @erichare in https://github.com/langflow-ai/langflow/pull/14106
- fix(agentic): honor iterations_limit in builds by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14094
- fix(security): forward-port release-1.10.3 hardening by @erichare in https://github.com/langflow-ai/langflow/pull/14073
- fix(hitl): rename inputs, advanced timeout + HITL palette and control polish by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14090
- fix: preserve OpenSearch JWT global variables by @erichare in https://github.com/langflow-ai/langflow/pull/14117
- fix: link legacy operations to Data Operations by @erichare in https://github.com/langflow-ai/langflow/pull/14118
- fix(api): preserve chronological message ordering by @erichare in https://github.com/langflow-ai/langflow/pull/14114
- fix(security): require docker run for MCP stdio by @erichare in https://github.com/langflow-ai/langflow/pull/14123
- fix(security): backport indirect component code bypass protections by @erichare in https://github.com/langflow-ai/langflow/pull/14125
- fix(lfx): backfill thinking field on Anthropic requests by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14092
- fix(ci): make core runtime wheel metadata assertion dynamic by @vjgit96 in https://github.com/langflow-ai/langflow/pull/14133
- fix(security): forward-port LFOSS security fixes to 1.11.0 by @erichare in https://github.com/langflow-ai/langflow/pull/14135
- fix(ci): keep core index check wheel-only by @erichare in https://github.com/langflow-ai/langflow/pull/14139
- fix(components): trim Write File description to match other components by @keval718 in https://github.com/langflow-ai/langflow/pull/14107
- fix(custom): preserve async helpers in component scope by @erichare in https://github.com/langflow-ai/langflow/pull/14140
- fix(agents): preserve structured tool output artifacts by @erichare in https://github.com/langflow-ai/langflow/pull/14142
- fix(ssrf): honor connector loopback policy for requests by @erichare in https://github.com/langflow-ai/langflow/pull/14146
- fix(lfx): keep serve message persistence DB-less by @erichare in https://github.com/langflow-ai/langflow/pull/14147
- fix: correct HITL gate span label and dedupe paused trace rows by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14148
- fix(security): bind MCP stdio to code-exec lockdown by @erichare in https://github.com/langflow-ai/langflow/pull/14150
- fix(anthropic): rebuild compatibility model annotations by @erichare in https://github.com/langflow-ai/langflow/pull/14145
- fix(hitl): don't reschedule restored vertices on resume by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14156
- fix(anthropic): preserve model defaults during server lazy import by @erichare in https://github.com/langflow-ai/langflow/pull/14157
- fix(frontend): fire logout request when auto-login is disabled by @keval718 in https://github.com/langflow-ai/langflow/pull/14158
- fix: remove restrictive default settings by @Adam-Aghili in https://github.com/langflow-ai/langflow/pull/14164
- fix(gemini): preserve model validation during server import by @erichare in https://github.com/langflow-ai/langflow/pull/14165
- fix(lfx): honor env-file precedence in serve by @erichare in https://github.com/langflow-ai/langflow/pull/14162
- fix(security): preserve short-key credential upgrades by @erichare in https://github.com/langflow-ai/langflow/pull/14163
- fix(ssrf): re-check IPv4 embedded in 6to4 / NAT64 addresses by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14174
- fix(mcp): rebuild incomplete SDK root models by @erichare in https://github.com/langflow-ai/langflow/pull/14159
- fix(mcp): rebuild incomplete structured tools by @erichare in https://github.com/langflow-ai/langflow/pull/14176
- fix(frontend): fixed-width zoom control so the menubar stops resizing by @keval718 in https://github.com/langflow-ai/langflow/pull/14116
- fix: support data lists in Parser by @erichare in https://github.com/langflow-ai/langflow/pull/14175
- fix(assistant): block duplicate flow input on add by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14167
- fix(frontend): unclip file delete button by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14169
- fix: materialize Blog Writer URL prompt input by @erichare in https://github.com/langflow-ai/langflow/pull/14186
- fix(mcp): stabilize Tool Mode activation by @erichare in https://github.com/langflow-ai/langflow/pull/14188
- fix: validate IBM WatsonX credentials against a live model by @erichare in https://github.com/langflow-ai/langflow/pull/14185
- fix: enforce locked flows in backend by @erichare in https://github.com/langflow-ai/langflow/pull/14192
- fix(mcp): respect server timeout during session validation by @erichare in https://github.com/langflow-ai/langflow/pull/14200
- fix(mcp): preserve agent tool cache across invocations by @erichare in https://github.com/langflow-ai/langflow/pull/14198
- fix: discover embeddings from custom OpenAI endpoints by @erichare in https://github.com/langflow-ai/langflow/pull/14199
- fix(agent): normalize missing tool-call IDs by @erichare in https://github.com/langflow-ai/langflow/pull/14201
- fix(mcp): prevent session cleanup CPU spin and reuse hangs by @ashutoshdharibm in https://github.com/langflow-ai/langflow/pull/14205
- fix: restore user_id on HITL checkpoint resume by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14195
- fix(lfx): derive secret_key ACL from process token SID by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14190
- fix(settings): default agentic env-mirror off by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14189
- fix(frontend): snapshot before duplicate so undo reverts one action by @keval718 in https://github.com/langflow-ai/langflow/pull/14179
- fix(frontend): reject modifier-only keyboard shortcuts by @keval718 in https://github.com/langflow-ai/langflow/pull/14187
- fix(api): serve favicon from a dedicated route by @keval718 in https://github.com/langflow-ai/langflow/pull/14166
- fix(memory): stop cross-flow chat-history leak in legacy flows (LE-1929) by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14191
- fix(models): render provider logo on models.dev catalog rows by @keval718 in https://github.com/langflow-ai/langflow/pull/14178
- fix(release): align Docker and PyPI artifacts by @erichare in https://github.com/langflow-ai/langflow/pull/14211
- fix(release): prevent frontend restore source collision by @erichare in https://github.com/langflow-ai/langflow/pull/14218
📝 Documentation Updates
- docs: migrate code blocks to native Prism and restyle API reference pages by @AntonioABLima in https://github.com/langflow-ai/langflow/pull/13299
- docs: build docker from source by @mendonk in https://github.com/langflow-ai/langflow/pull/13041
- docs: add lfx-nextplaid bundle by @mendonk in https://github.com/langflow-ai/langflow/pull/13679
- docs: add frontend-i18n agent skill and wire it into frontend-code-review by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/13959
- docs: wxo ADK upgrade to support Python 3.14 by @mendonk in https://github.com/langflow-ai/langflow/pull/13667
- docs: add extension error guidance page and fix ref_url links by @mendonk in https://github.com/langflow-ai/langflow/pull/13937
- docs: external authentication, RBAC, SSO by @mendonk in https://github.com/langflow-ai/langflow/pull/13866
- docs: lfx user docs and bundle extension changes by @mendonk in https://github.com/langflow-ai/langflow/pull/13775
- docs: AGUI protocol, workflows quickstart, update examples by @mendonk in https://github.com/langflow-ai/langflow/pull/13911
- docs: oracle component page and release note by @mendonk in https://github.com/langflow-ai/langflow/pull/13984
- docs: paddle OCR component bundle by @mendonk in https://github.com/langflow-ai/langflow/pull/14011
- docs: add additional packages gated by python 3.14 by @mendonk in https://github.com/langflow-ai/langflow/pull/13828
- docs: unified operations component by @mendonk in https://github.com/langflow-ai/langflow/pull/13920
- docs: component input and component index telemetry events by @mendonk in https://github.com/langflow-ai/langflow/pull/14062
- docs: openai compatible provider bundle by @mendonk in https://github.com/langflow-ai/langflow/pull/14000
- docs: add valkey bundle by @mendonk in https://github.com/langflow-ai/langflow/pull/14119
- docs: human in the loop feature by @mendonk in https://github.com/langflow-ai/langflow/pull/13993
- docs: lfx prewarm by @mendonk in https://github.com/langflow-ai/langflow/pull/14012
- docs: a2a server and component by @mendonk in https://github.com/langflow-ai/langflow/pull/14143
- docs: security hardening for untrusted multitenancy deployments by @mendonk in https://github.com/langflow-ai/langflow/pull/14061
- docs: bump API spec and version to 1.11 by @mendonk in https://github.com/langflow-ai/langflow/pull/14173
- docs: add blog links for 1.11 by @mendonk in https://github.com/langflow-ai/langflow/pull/14207
🛠 Maintenance Tasks
- refactor(lfx): extract v2 workflow contract layer into lfx.workflow by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/13782
- perf: limit message history fetch to prevent canvas slowdown on repeated runs by @YeonghyeonKO in https://github.com/langflow-ai/langflow/pull/13461
✅ Tests
- test(authz): RBAC enforcement + share-lifecycle integration tests via a test-double enforcer by @erichare in https://github.com/langflow-ai/langflow/pull/13549
- test: guard temporarily-disabled bundles in component/template tests + skip Windows-flaky model spec by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/13807
- test: decouple core tests from disabled bundles by @erichare in https://github.com/langflow-ai/langflow/pull/13805
- test: remove permanently-skipped dead specs by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/13800
- test: remove duplicate Playwright e2e coverage by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/13819
- test(e2e): DRY setup and parameterize same-shape specs by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/13844
- test: consolidate bundle-component tests under components/bundles// by @erichare in https://github.com/langflow-ai/langflow/pull/13895
Others
- fix(ci): create GitHub releases on the dispatched v-prefixed tag (1.11.0) by @erichare in https://github.com/langflow-ai/langflow/pull/13607
- fix(ci): resolve validate-version output in release-lfx changelog link (1.11.0) by @erichare in https://github.com/langflow-ai/langflow/pull/13612
- ci: fit weekly test-durations refresh inside the 6h limit and alert on failure by @erichare in https://github.com/langflow-ai/langflow/pull/13586
- chore: update test durations by @github-actions[bot] in https://github.com/langflow-ai/langflow/pull/13640
- ci: gate backend tests by Python changes by @viktoravelino in https://github.com/langflow-ai/langflow/pull/13614
- chore: release cleanup by @erichare in https://github.com/langflow-ai/langflow/pull/13789
- chore: restore bundles that are now published by @erichare in https://github.com/langflow-ai/langflow/pull/13825
- ci: push nightly .devX Docker images to langflowai/langflow and fix db-migration-validation image references by @vjgit96 in https://github.com/langflow-ai/langflow/pull/13836
- ci: serialize starter project template shard by @erichare in https://github.com/langflow-ai/langflow/pull/13865
- chore: clarify calculator AST comment by @erichare in https://github.com/langflow-ai/langflow/pull/13881
- chore: update test durations by @github-actions[bot] in https://github.com/langflow-ai/langflow/pull/13888
- chore(base): trim langflow-base[complete] staleness; relocate lfx-core deps by @erichare in https://github.com/langflow-ai/langflow/pull/13892
- chore: clean up startup messages by @erichare in https://github.com/langflow-ai/langflow/pull/13909
- ci: surface nightly Group 3 stall via 90s pytest thread-timeout (release-1.11.0) by @erichare in https://github.com/langflow-ai/langflow/pull/13939
- ci: surface nightly Group 3 stall via 90s pytest thread-timeout by @erichare in https://github.com/langflow-ai/langflow/pull/13938
- chore: upgrade wxo adk core/clients to 2.12 (for python 3.14 support) by @HzaRashid in https://github.com/langflow-ai/langflow/pull/13665
- ci: add non-blocking flaky test report job with 30-day retention by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/13996
- chore: restore Python 3.14 litellm gating lost in release-1.10.2 merge by @erichare in https://github.com/langflow-ai/langflow/pull/14018
- chore(deps): bump fastapi to 0.139.0, serve frontend via app.frontend() by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/13978
- chore: update deps by @Adam-Aghili in https://github.com/langflow-ai/langflow/pull/14069
- chore: enable LiteLLM on Python 3.14 by @erichare in https://github.com/langflow-ai/langflow/pull/14170
- chore: upgrade fast-uri version by @Adam-Aghili in https://github.com/langflow-ai/langflow/pull/14171
- i18n: translate Human Input component metadata by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14168
- chore: update translations from Globalization Pipeline by @RamGopalSrikar in https://github.com/langflow-ai/langflow/pull/14184
New Contributors
- @meetdoshi90 made their first contribution in https://github.com/langflow-ai/langflow/pull/13553
- @rakshith48 made their first contribution in https://github.com/langflow-ai/langflow/pull/13495
- @rafaelgiln made their first contribution in https://github.com/langflow-ai/langflow/pull/13879
- @YeonghyeonKO made their first contribution in https://github.com/langflow-ai/langflow/pull/13461
- @thesaadmirza made their first contribution in https://github.com/langflow-ai/langflow/pull/13976
- @MatthiasHowellYopp made their first contribution in https://github.com/langflow-ai/langflow/pull/12530
- @ashutoshdharibm made their first contribution in https://github.com/langflow-ai/langflow/pull/14205
Full Changelog: https://github.com/langflow-ai/langflow/compare/v1.10.2...v1.11.0
Security Fixes
- fix(security): harden multi-tenant surfaces
- fix(security): close tenant-isolation gaps in security hardening
- fix(security): require docker run for MCP stdio
- fix(security): backport indirect component code bypass protections
- fix(security): forward-port LFOSS security fixes to 1.11.0
- fix(ssrf): honor connector loopback policy for requests
- fix(ssrf): re-check IPv4 embedded in 6to4 / NAT64 addresses
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Langflow
All releases →Related context
Related tools
Beta — feedback welcome: [email protected]