Task system + runtime checks + TLS + command restrictions
flower
AI Agents & AssistantsA framework for building federated AI systems that is customizable, extendable, and works with any machine learning library
Features
- Customizable to fit diverse federated learning use cases
- Extendable architecture supporting research‑grade experimentation
- Framework‑agnostic – integrates with PyTorch, TensorFlow, Hugging Face, scikit‑learn, JAX, etc.
- Designed for understandability and community contribution
Recent releases
View all 13 releases →- Removes Flower File Storage (FFS) and the `--storage-dir` option from `flower-superlink`; replaces with LinkState‑based storage methods.
- Adds `--allow-runtime-dependency-installation` flag to `flower-superexec` enabling per‑run venv creation via uv.
- Enhances federation management: inspect run details, stream logs, stop runs; adds federation name validation and hides SuperNode status for archived federations.
- Introduces experimental HMAC shared‑secret authentication for SuperExec with nonce replay protection.
Full changelog
Thanks to our contributors
We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):
Charles Beauville, Chong Shen Ng, Daniel J. Beutel, Heng Pan, Javier, Micah Sheller, Mohammad Naseri, Patrick Foley, Yan Gao
What's new?
-
Introduce runtime dependency installation option for isolated execution (#6741)
Introduces the
--allow-runtime-dependency-installationflag toflower-superexec, enabling runtime dependency installation viauvso that applications with differing dependencies can run independently. Runtime dependency installation automatically creates an independent venv for each run, even if those runs happen concurrently. Propagates this option fromflower-superlink/flower-supernodeto automatically startedflower-superexecinstances when using subprocess isolation mode. -
Improve federation run management and validation (#6943, #6956, #6957, #6961)
Enhances federation functionality by enabling members to inspect run details, stream logs, and stop runs directly within a federation. Introduces validation for federation names during creation. Hides the SuperNode status column when a federation is archived.
-
Introduce SuperExec authentication with HMAC and shared secrets (#6948, #6949, #6950, #6951, #6952, #6977, #6978, #6979, #6980, #6981)
Introduces an experimental SuperExec authentication mechanism based on shared-secret HMAC. Establishes core primitives, nonce replay protection, and interceptor foundations, and integrates authentication into ServerAppIo and ClientAppIo.
-
Show Flower Hub compatibility note in CLI download and review flows (#6989, #6992)
Surfaces the Flower Hub-provided compatibility note when an app download resolves to an older compatible version instead of the latest release. Reads the returned
notefield and displays it inflwr run,flwr newandflwr app review, improving transparency around version selection. -
Enhance authentication for
flwr-*processes (#6796)Improves security by authenticating RPC calls from
flwr-serverapp,flwr-simulation, andflwr-clientappusing token-based mechanism. -
Update examples with FAB metadata and improved documentation (#6890, #6935)
Enhances examples by updating README files to use local SuperLink and adding FAB format metadata (
fab-format-version = 1andflwr-version-target). Introduces LICENSE files across published apps and bumps application versions at the minor level to reflect these updates. -
Display full FAB hash in
flwr listJSON output (#6958)Replaces truncated FAB hash with the full hash value in the JSON output of
flwr list, ensuring complete and accurate identification of FABs. -
Stabilize CI pipelines and improve test reliability (#6911, #6974, #6985, #6987)
-
General improvements (#6931, #6944, #6946, #6955, #6970, #6973, #6982, #6983, #6988, #6990, #6994, #6995, #6996, #6997, #6999, #7003, #7004, #7005)
As always, many parts of the Flower framework and quality infrastructure were improved and updated.
Incompatible changes
- Removed deprecated `run_simulation` Python entrypoint; use `flwr run` instead.
- Introduce federation-based simulation configuration and management
- Add configurable FAB inclusion and exclusion rules
- Introduce FAB format v1 validation rules and requirements
Full changelog
Thanks to our contributors
We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):
Charles Beauville, Chong Shen Ng, Daniel J. Beutel, Daniel Nata Nugraha, Heng Pan, Javier, Julian Rußmeyer, Micah Sheller, Mohammad Naseri, Patrick Foley, Taner Topal, William Lindskog, Yan Gao, xiaoyanshen799
What's new?
-
Introduce federation-based simulation configuration and management (#6787, #6790, #6791, #6806, #6813, #6820, #6821, #6826, #6829, #6837, #6846, #6848, #6857, #6858, #6859, #6860, #6861, #6865, #6867, #6882, #6883, #6888, #6895, #6907, #6934)
Introduces simulation-capable federations and a mechanism to configure the Simulation Runtime that these federations use in both a persistent manner and with per-run overrides. For the former, the
flwr federation simulation-configcommand is introduced; for the latter--federation-configcan be used to dynamically override values at when submitting a run viaflwr run. Updates documentation and provides a migration guide here. Refer to the updated Simulation Runtime guide for more details about running simulations with Flower. -
Improve local SuperLink stability and configuration handling (#6797, #6873, #6874, #6889)
Improves local SuperLink stability by improving SQLite bootstrap robustness and validating Control API availability before executing CLI calls. Allows magic values (
":local:",":local-in-memory:") foraddressfields in Flower configuration, which will be translated to the local SuperLink address. Ensures backward compatibility for.options-only connection configurations. Using.optionsfields in the Flower configuration (config.toml) is now deprecated. See Flower configuration guide for more details. -
Add configurable FAB inclusion and exclusion rules (#6803, #6804, #6805, #6822, #6823, #6872, #6885)
Introduces support for user-defined include and exclude patterns in FAB builds via configuration, with validation of pattern lists and extended matching capabilities. Ensures publish filters are applied before FAB build filters, standardizes metadata keys in
pyproject.toml, and refactors supporting utilities. Updates documentation with guide on configuring inclusion and exclusion rules. -
Introduce FAB format v1 validation rules and requirements (#6782, #6825, #6843, #6851, #6887)
Introduces validation rules for FAB format version 1, requiring
flwr-version-targetto be specified and enforcing a lower bound for theflwrdependency inpyproject.toml. Adds license file requirements during FAB build. -
Add non-blocking version update checks across Flower components (#6786, #6788, #6833, #6938)
Adds non-blocking startup checks in the Flower CLI to detect newer versions of
flwrin CLI. Allows disabling by setting environment variableFLWR_DISABLE_UPDATE_CHECK=1. -
Support port
0for automatic OS-assigned ports (#6795) -
Add
--versionflag to Flower CLI components (#6781) -
Add dynamic data seed option to FlowerTune LLM examples (#6831)
-
Add
flwr federation remove-accountcommand for managing federation membership (#6757, #6759, #6764, #6772, #6777, #6778, #6789) -
Improve availability and reliability of message delivery and state handling (#6773, #6785, #6877, #6915)
-
Fix handling of scalar (0D) NumPy arrays in strategies and mods (#6783)
-
Improve documentation (#6332, #6742, #6771, #6834, #6838, #6910, #6929, #6941)
-
Improve CI/CD workflows and developer tooling (#6701, #6732, #6738, #6739, #6743, #6744, #6753, #6768, #6769, #6770, #6775, #6793, #6816, #6835)
-
General improvements (#6578, #6627, #6734, #6740, #6748, #6749, #6751, #6755, #6763, #6774, #6776, #6779, #6800, #6801, #6802, #6811, #6815, #6827, #6828, #6839, #6840, #6841, #6842, #6868, #6869, #6893, #6900, #6901, #6906, #6908, #6909, #6918, #6919, #6920, #6921, #6922, #6923, #6930, #6932)
As always, many parts of the Flower framework and quality infrastructure were improved and updated.
Incompatible changes
-
Remove deprecated
run_simulationPython entrypoint (#6752)Removes the previously deprecated
run_simulationentrypoint to run simulations. The recommended way for launching simulations isflwr run. Refer to the quickstart-turorials for a short guide on how to run your simulations.
- Unpublished documentation versions v1.8.0–v1.16.0; use current versioned docs.
- Configure custom Flower directory via `FLWR_HOME` environment variable instead of `--flwr-dir`.
- Removed deprecated CLI option `--flwr-dir`; use environment variable `FLWR_HOME` instead.
- Removed `flower-simulation` CLI entrypoint; superseded by local SuperLink.
- Local SuperLink for managing local simulations (auto‑launches, enables `flwr list`, `flwr log`).
- SuperLink log rotation with configurable `--log-file`, `--log-rotation-interval-hours`, and `--log-rotation-backup-count`.
- Multi-federation management via new `flwr federation` CLI commands (create, add‑supernode, remove‑supernode, archive, invite).
Full changelog
Thanks to our contributors
We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):
Charles Beauville, Chong Shen Ng, Daniel J. Beutel, Heng Pan, Javier, Micah Sheller, Mohammad Naseri, Roma Klapaukh, Ruth Galindo, Taner Topal, Yan Gao
What's new?
-
Introduce local SuperLink for managing local simulations (#6599, #6717)
Local simulations are now managed by a local SuperLink, which is automatically launched on demand. This enables running most
flwrCLI commands locally, such asflwr listto list previous runs andflwr logto retrieve logs from earlier runs. See the documentation for more details. -
Allow SuperLink log rotation (#6700)
Adds support for timed log rotation in SuperLink. Log files can now be configured using
--log-file,--log-rotation-interval-hours, and--log-rotation-backup-count. -
Update framework documentation (#6533, #6537, #6541, #6546, #6551, #6593, #6598, #6612, #6615, #6629, #6631, #6635, #6681, #6694, #6710, #6718, #6719, #6731)
Improves and fixes various parts of the framework documentation, including a new FAQ for unexpected Windows PowerShell output (FAQ entry).
-
Adopt release-branch workflow for Flower framework releases (#6560, #6566, #6594)
Adopts a release-branch workflow for the Flower framework, enabling releases from dedicated
release/framework-X.Ybranches and introducing theframework-X.Y.Zrelease tag format. -
Introduce versioned Flower documentation built from release branches (#6564, #6569, #6596, #6607, #6609, #6610)
Introduces a new documentation release workflow where versioned Flower documentation is built and published from release branches. One documentation version is generated for each minor series (
X.Y.x), allowing documentation updates after a release. -
Introduce multi-federation management via
flwr federationCLI commands (#6559, #6582, #6583, #6588, #6589, #6611, #6618, #6623, #6625, #6632, #6658, #6662, #6673, #6674, #6676, #6680, #6695, #6703, #6705, #6707, #6708, #6722, #6725, #6726)On supported SuperLinks, users can manage federations using the
flwr federationCLI. This includes creating federations (flwr federation create), adding or removing SuperNodes (flwr federation add-supernode/remove-supernode), and archiving federations (flwr federation archive). Users can also collaborate through federation invitations usingflwr federation invitecommands to create, list, accept, reject, or revoke invitations. -
Add
--limitoption toflwr listto limit the number of runs listed (#6639, #6737) -
Add Federated Analytics example (#6314)
-
Improve Flower Hub app publishing and FAB building (#6656, #6685, #6686, #6689, #6736)
-
Update packaging and dependency configuration (#6548, #6558, #6648, #6651, #6654, #6683)
-
Improve CI workflows (#6549, #6550, #6573, #6575, #6579, #6585, #6601, #6617, #6624, #6633, #6645, #6647, #6655, #6665, #6706)
-
General improvements (#6540, #6547, #6553, #6563, #6568, #6591, #6595, #6602, #6616, #6634, #6637, #6642, #6643, #6650, #6652, #6659, #6670, #6679, #6696, #6712, #6716, #6720, #6721, #6723, #6724, #6727, #6728, #6729, #6735)
As always, many parts of the Flower framework and quality infrastructure were improved and updated.
Incompatible changes
-
Unpublish
v1.8.0-v1.16.0framework documentation (#6621)Unpublishes very old documentation versions that are no longer compatible with the updated documentation structure and release workflow.
-
Drop deprecated
--flwr-dirCLI option (#6677)Removes the deprecated
--flwr-diroption from CLI commands. A custom Flower directory can still be configured using theFLWR_HOMEenvironment variable. -
Remove
flower-simulationCLI entrypoint (#6628)Removes the
flower-simulationCLI entrypoint. With the introduction of local SuperLink, this command is no longer needed.
Fixed client resource handling in local simulations to correctly propagate backend configuration settings such as CPU and GPU allocations.
Full changelog
Thanks to our contributors
We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):
Charles Beauville, Chong Shen Ng, Copilot, Daniel J. Beutel, Heng Pan, Javier, Taner Topal
What's new?
-
Fix client resource handling in local simulations (#6536)
Fix an issue in local simulations where backend configuration is not correctly propagated, causing virtual client resource settings such as CPU and GPU allocations in the Flower Configuration to be ignored.
-
General improvements (#6526, #6493, #6534, #6531, #6523, #6529, #6501)
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.