flower releases

Thanks to our contributors

We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):

Charles Beauville, Chong Shen Ng, Daniel J. Beutel, Heng Pan, Javier, Micah Sheller, Mohammad Naseri, Patrick Foley, Yan Gao

What's new?

• Introduce runtime dependency installation option for isolated execution (#6741)

  Introduces the --allow-runtime-dependency-installation flag to flower-superexec, enabling runtime dependency installation via uv so that applications with differing dependencies can run independently. Runtime dependency installation automatically creates an independent venv for each run, even if those runs happen concurrently. Propagates this option from flower-superlink/flower-supernode to automatically started flower-superexec instances when using subprocess isolation mode.

• Improve federation run management and validation (#6943, #6956, #6957, #6961)

  Enhances federation functionality by enabling members to inspect run details, stream logs, and stop runs directly within a federation. Introduces validation for federation names during creation. Hides the SuperNode status column when a federation is archived.

• Introduce SuperExec authentication with HMAC and shared secrets (#6948, #6949, #6950, #6951, #6952, #6977, #6978, #6979, #6980, #6981)

  Introduces an experimental SuperExec authentication mechanism based on shared-secret HMAC. Establishes core primitives, nonce replay protection, and interceptor foundations, and integrates authentication into ServerAppIo and ClientAppIo.

• Show Flower Hub compatibility note in CLI download and review flows (#6989, #6992)

  Surfaces the Flower Hub-provided compatibility note when an app download resolves to an older compatible version instead of the latest release. Reads the returned note field and displays it in flwr run, flwr new and flwr app review, improving transparency around version selection.

• Enhance authentication for flwr-* processes (#6796)

  Improves security by authenticating RPC calls from flwr-serverapp, flwr-simulation, and flwr-clientapp using token-based mechanism.

• Update examples with FAB metadata and improved documentation (#6890, #6935)

  Enhances examples by updating README files to use local SuperLink and adding FAB format metadata (fab-format-version = 1 and flwr-version-target). Introduces LICENSE files across published apps and bumps application versions at the minor level to reflect these updates.

• Display full FAB hash in flwr list JSON output (#6958)

  Replaces truncated FAB hash with the full hash value in the JSON output of flwr list, ensuring complete and accurate identification of FABs.

• Update documentation (#6959, #6964, #6966)

• Stabilize CI pipelines and improve test reliability (#6911, #6974, #6985, #6987)

• General improvements (#6931, #6944, #6946, #6955, #6970, #6973, #6982, #6983, #6988, #6990, #6994, #6995, #6996, #6997, #6999, #7003, #7004, #7005)

  As always, many parts of the Flower framework and quality infrastructure were improved and updated.

Incompatible changes

• Remove Flower File Storage (FFS) (#6809, #6810)

  Removes Flower File Storage (FFS) and transitions to LinkState-based storage, introducing replacement methods in LinkState and NodeState. Eliminates the --storage-dir option from flower-superlink as part of this change.

Thanks to our contributors

We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):

Charles Beauville, Chong Shen Ng, Daniel J. Beutel, Daniel Nata Nugraha, Heng Pan, Javier, Julian Rußmeyer, Micah Sheller, Mohammad Naseri, Patrick Foley, Taner Topal, William Lindskog, Yan Gao, xiaoyanshen799

What's new?

• Introduce federation-based simulation configuration and management (#6787, #6790, #6791, #6806, #6813, #6820, #6821, #6826, #6829, #6837, #6846, #6848, #6857, #6858, #6859, #6860, #6861, #6865, #6867, #6882, #6883, #6888, #6895, #6907, #6934)

  Introduces simulation-capable federations and a mechanism to configure the Simulation Runtime that these federations use in both a persistent manner and with per-run overrides. For the former, the flwr federation simulation-config command is introduced; for the latter --federation-config can be used to dynamically override values at when submitting a run via flwr run. Updates documentation and provides a migration guide here. Refer to the updated Simulation Runtime guide for more details about running simulations with Flower.

• Improve local SuperLink stability and configuration handling (#6797, #6873, #6874, #6889)

  Improves local SuperLink stability by improving SQLite bootstrap robustness and validating Control API availability before executing CLI calls. Allows magic values (":local:", ":local-in-memory:") for address fields in Flower configuration, which will be translated to the local SuperLink address. Ensures backward compatibility for .options-only connection configurations. Using .options fields in the Flower configuration (config.toml) is now deprecated. See Flower configuration guide for more details.

• Add configurable FAB inclusion and exclusion rules (#6803, #6804, #6805, #6822, #6823, #6872, #6885)

  Introduces support for user-defined include and exclude patterns in FAB builds via configuration, with validation of pattern lists and extended matching capabilities. Ensures publish filters are applied before FAB build filters, standardizes metadata keys in pyproject.toml, and refactors supporting utilities. Updates documentation with guide on configuring inclusion and exclusion rules.

• Introduce FAB format v1 validation rules and requirements (#6782, #6825, #6843, #6851, #6887)

  Introduces validation rules for FAB format version 1, requiring flwr-version-target to be specified and enforcing a lower bound for the flwr dependency in pyproject.toml. Adds license file requirements during FAB build.

• Add non-blocking version update checks across Flower components (#6786, #6788, #6833, #6938)

  Adds non-blocking startup checks in the Flower CLI to detect newer versions of flwr in CLI. Allows disabling by setting environment variable FLWR_DISABLE_UPDATE_CHECK=1.

• Support port 0 for automatic OS-assigned ports (#6795)

• Add --version flag to Flower CLI components (#6781)

• Add dynamic data seed option to FlowerTune LLM examples (#6831)

• Add flwr federation remove-account command for managing federation membership (#6757, #6759, #6764, #6772, #6777, #6778, #6789)

• Improve availability and reliability of message delivery and state handling (#6773, #6785, #6877, #6915)

• Fix handling of scalar (0D) NumPy arrays in strategies and mods (#6783)

• Improve documentation (#6332, #6742, #6771, #6834, #6838, #6910, #6929, #6941)

• Improve CI/CD workflows and developer tooling (#6701, #6732, #6738, #6739, #6743, #6744, #6753, #6768, #6769, #6770, #6775, #6793, #6816, #6835)

• General improvements (#6578, #6627, #6734, #6740, #6748, #6749, #6751, #6755, #6763, #6774, #6776, #6779, #6800, #6801, #6802, #6811, #6815, #6827, #6828, #6839, #6840, #6841, #6842, #6868, #6869, #6893, #6900, #6901, #6906, #6908, #6909, #6918, #6919, #6920, #6921, #6922, #6923, #6930, #6932)

  As always, many parts of the Flower framework and quality infrastructure were improved and updated.

Incompatible changes

• Remove deprecated run_simulation Python entrypoint (#6752)

  Removes the previously deprecated run_simulation entrypoint to run simulations. The recommended way for launching simulations is flwr run. Refer to the quickstart-turorials for a short guide on how to run your simulations.

Thanks to our contributors

We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):

Charles Beauville, Chong Shen Ng, Daniel J. Beutel, Heng Pan, Javier, Micah Sheller, Mohammad Naseri, Roma Klapaukh, Ruth Galindo, Taner Topal, Yan Gao

What's new?

• Introduce local SuperLink for managing local simulations (#6599, #6717)

  Local simulations are now managed by a local SuperLink, which is automatically launched on demand. This enables running most flwr CLI commands locally, such as flwr list to list previous runs and flwr log to retrieve logs from earlier runs. See the documentation for more details.

• Allow SuperLink log rotation (#6700)

  Adds support for timed log rotation in SuperLink. Log files can now be configured using --log-file, --log-rotation-interval-hours, and --log-rotation-backup-count.

• Update framework documentation (#6533, #6537, #6541, #6546, #6551, #6593, #6598, #6612, #6615, #6629, #6631, #6635, #6681, #6694, #6710, #6718, #6719, #6731)

  Improves and fixes various parts of the framework documentation, including a new FAQ for unexpected Windows PowerShell output (FAQ entry).

• Adopt release-branch workflow for Flower framework releases (#6560, #6566, #6594)

  Adopts a release-branch workflow for the Flower framework, enabling releases from dedicated release/framework-X.Y branches and introducing the framework-X.Y.Z release tag format.

• Introduce versioned Flower documentation built from release branches (#6564, #6569, #6596, #6607, #6609, #6610)

  Introduces a new documentation release workflow where versioned Flower documentation is built and published from release branches. One documentation version is generated for each minor series (X.Y.x), allowing documentation updates after a release.

• Introduce multi-federation management via flwr federation CLI commands (#6559, #6582, #6583, #6588, #6589, #6611, #6618, #6623, #6625, #6632, #6658, #6662, #6673, #6674, #6676, #6680, #6695, #6703, #6705, #6707, #6708, #6722, #6725, #6726)

  On supported SuperLinks, users can manage federations using the flwr federation CLI. This includes creating federations (flwr federation create), adding or removing SuperNodes (flwr federation add-supernode / remove-supernode), and archiving federations (flwr federation archive). Users can also collaborate through federation invitations using flwr federation invite commands to create, list, accept, reject, or revoke invitations.

• Add --limit option to flwr list to limit the number of runs listed (#6639, #6737)

• Add Federated Analytics example (#6314)

• Improve Flower Hub app publishing and FAB building (#6656, #6685, #6686, #6689, #6736)

• Update examples (#6545, #6555, #6697, #6709)

• Update packaging and dependency configuration (#6548, #6558, #6648, #6651, #6654, #6683)

• Improve CI workflows (#6549, #6550, #6573, #6575, #6579, #6585, #6601, #6617, #6624, #6633, #6645, #6647, #6655, #6665, #6706)

• General improvements (#6540, #6547, #6553, #6563, #6568, #6591, #6595, #6602, #6616, #6634, #6637, #6642, #6643, #6650, #6652, #6659, #6670, #6679, #6696, #6712, #6716, #6720, #6721, #6723, #6724, #6727, #6728, #6729, #6735)

  As always, many parts of the Flower framework and quality infrastructure were improved and updated.

Incompatible changes

• Unpublish v1.8.0-v1.16.0 framework documentation (#6621)

  Unpublishes very old documentation versions that are no longer compatible with the updated documentation structure and release workflow.

• Drop deprecated --flwr-dir CLI option (#6677)

  Removes the deprecated --flwr-dir option from CLI commands. A custom Flower directory can still be configured using the FLWR_HOME environment variable.

• Remove flower-simulation CLI entrypoint (#6628)

  Removes the flower-simulation CLI entrypoint. With the introduction of local SuperLink, this command is no longer needed.

Thanks to our contributors

We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):

Charles Beauville, Chong Shen Ng, Copilot, Daniel J. Beutel, Heng Pan, Javier, Taner Topal

What's new?

• Fix client resource handling in local simulations (#6536)

  Fix an issue in local simulations where backend configuration is not correctly propagated, causing virtual client resource settings such as CPU and GPU allocations in the Flower Configuration to be ignored.

• Update framework documentation (#6528, #6530)

• General improvements (#6526, #6493, #6534, #6531, #6523, #6529, #6501)

Thanks to our contributors

We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):

Charles Beauville, Chong Shen Ng, Daniel J. Beutel, Flippchen, Heng Pan, Iason Ofeidis, Javier, Jun S, Soumik Sarker, Taner Topal, Yan Gao, nihonge

What's new?

• Introduce centralized flwr CLI configuration (#6240, #6338, #6343, #6349, #6354, #6356, #6357, #6359, #6362, #6364, #6365, #6366, #6367, #6372, #6376, #6381, #6382, #6385, #6386, #6390, #6400, #6422, #6423, #6435, #6439, #6440, #6441, #6446, #6481, #6492, #6502, #6509, #6513, #6519)

  Changes Flower CLI (flwr) configuration to introduce a new way to manage SuperLink connections and simulation settings in a central place (instead of Flower app's pyproject.toml). This enables flwr commands to be executed from any directory and allow reuse of named connections across different Flower apps. This change also removes the now obsolete enable-account-auth option. The central Flower CLI config fully replaces the legacy federation configuration in pyproject.toml, which is automatically migrated to the new Flower configuration format when running flwr commands. For usage details, see the Flower CLI reference and the Flower configuration documentation.

• Enable automated database migrations on Flower version upgrades (#6345, #6355, #6370, #6371, #6378, #6379, #6380, #6383, #6384, #6387, #6388, #6389, #6396, #6398, #6402, #6403, #6404, #6406, #6407, #6408, #6410, #6411, #6424, #6425, #6426, #6433, #6436, #6448, #6450, #6457, #6459, #6460, #6469, #6477, #6478, #6521)

  Refactors Flower's internal states implementations to introduce Alembic-based schema migrations with automatic upgrades. This ensures database compatibility across Flower versions and lays the groundwork for supporting more types of databases. See the database migration guide for details.

• Improve CLI error handling and usability (#6432, #6437, #6444, #6462, #6467, #6505)

  Updates flwr CLI to provide clearer and more consistent error formatting, improves CLI error messages and logging, and shows command aliases.

• Improve reliability of network stack, ServerApp shutdown and Windows support (#6342, #6430, #6447, #6456, #6490, #6504)

  Improves the reliability of message transmission and capacity tracking under unstable network conditions and high concurrency, improves Windows process handling and address resolution, and ensures graceful shutdown of flwr-serverapp.

• Fix and improve framework documentation (#6312, #6336, #6351, #6397, #6401, #6434, #6455, #6470, #6485, #6506, #6508, #6511, #6512, #6516)

  Fixes an incorrect learning rate key in the tutorial series, updates the clientappio address in the auth example, and improves the documentation UI by making the versioning sidebar scrollable to show all versions.

• Update and maintain examples (#6331, #6334, #6369, #6395, #6419, #6474, #6488)

  Updates the JAX quickstart, bumps example dependencies, makes the certificate generation script cross-platform, normalizes training loss in the PyTorch quickstart, and marks the legacy quickstart-pytorch example as deprecated.

• Refine flwr federation CLI (#6340, #6461, #6463, #6468, #6476, #6479, #6480)

  Removes flwr federation show in favor of flwr federation list. This makes the command more consistent with how flwr list works. The aligned command now supports detailed inspection via flwr federation list --federation <federation> and displays account names instead of account IDs.

• Update CI/CD workflows and tests (#6301, #6321, #6330, #6346, #6347, #6348, #6352, #6373, #6375, #6394, #6445, #6449)

• General improvements (#6320, #6323, #6324, #6325, #6326, #6327, #6335, #6337, #6339, #6344, #6350, #6353, #6358, #6360, #6361, #6377, #6409, #6412, #6414, #6415, #6416, #6417, #6418, #6421, #6431, #6452, #6458, #6465, #6471, #6472, #6475, #6482, #6484, #6487, #6491, #6495, #6496, #6497, #6498, #6500, #6503, #6507, #6510, #6515, #6518, #6522, #6524)

  As always, many parts of the Flower framework and quality infrastructure were improved and updated.

Incompatible changes

• Deprecate legacy flwr CLI configuration via pyproject.toml (#6374, #6393, #6399, #6405)

  Deprecates the now-legacy flwr CLI configuration usage (where configuration lives in pyproject.toml) following the introduction of the (central, project-independent) Flower configuration. Refer to the Flower CLI reference or run flwr <command> --help for updated usage.

Thanks to our contributors

We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):

Chong Shen Ng, Daniel J. Beutel, Heng Pan, Javier, Mohammad Naseri, Soumik Sarker, William Lindskog, Yan Gao, sarahhfalco

What's new?

• Track compute time and network traffic for runs (#6241, #6242, #6243, #6244, #6245, #6249, #6266, #6267, #6268, #6269, #6270, #6271, #6272, #6273, #6274, #6275, #6276, #6279)

  Flower now records compute time and network traffic for a run. The run detail view shown by flwr list --run-id <run-id> displays traffic exchanged between SuperLink and SuperNode, as well as compute time used by ServerApp and ClientApp.

• Refactor flwr new to pull apps from the Flower platform (#6251, #6252, #6258, #6259, #6260, #6263, #6265, #6283, #6284, #6285, #6292, #6294, #6302)

  Refactors flwr new to fetch Flower apps directly from the Flower platform (see the usage reference). This introduces new and updated quickstart examples (including NumPy and FlowerTune LLM), renames and updates existing examples, aligns CI to run against platform-backed examples, and updates related documentation and benchmark instructions.

• Migrate examples to the Message API and remove outdated Docker Compose as well as Tensorflow Privacy examples (#6232, #6233, #6238, #6297, #6304)

  Migrates the scikit-learn, Vertical FL, and Opacus examples to the Message API, with the Vertical FL example also updated to use flwr-datasets. The outdated Docker Compose and Tensorflow Privacy examples are removed.

• Improve CLI output with human-readable durations (#6277, #6296)

  Updates the Flower CLI to display durations in a more human-friendly format (xd xh xm xs), automatically selecting appropriate units instead of the previous HH:MM:SS format.

• Update examples and baselines (#6234, #6256, #6257, #6264, #6280, #6281, #6286, #6287, #6288, #6290, #6291, #6293)

• Improve documentation (#6229, #6230, #6255, #6262)

• Update CI/CD configuration (#6168, #6246, #6295, #6305)

• General improvements (#6056, #6085, #6176, #6235, #6236, #6254, #6278, #6299)

  As always, many parts of the Flower framework and quality infrastructure were improved and updated.

Incompatible changes

• Remove bundled templates from flwr new (#6261)

  Removes the templates previously bundled with the Flower wheel now that flwr new pulls apps from the Flower platform. The --framework and --username options are deprecated as part of this change.

Thanks to our contributors

We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):

Charles Beauville, Chong Shen Ng, Daniel J. Beutel, Daniel Nata Nugraha, Heng Pan, Javier, Patrick Foley, Robert Steiner, Yan Gao

What's new?

• Add Python 3.13 support (#6116, #6119, #6132)

  flwr now supports Python 3.13, with CI and dataset tests updated accordingly and ray bumped to ensure compatibility.

• Improve the flwr list view (#6117)

  flwr list now shows fewer details by default, while providing expanded information when using the --run-id flag.

• Extend federation commands and internal APIs (#6067, #6068, #6078, #6082, #6086, #6087, #6088, #6090, #6091, #6092, #6093, #6094, #6098, #6103, #6105, #6121, #6122, #6143, #6152, #6153, #6154, #6158, #6165, #6167)

  These updates refine and extend the existing federation concept. flwr federation show and flwr federation list now provide clearer visibility into SuperNodes and runs in the default federation.

• Introduce unified app heartbeat mechanism (#6204, #6206, #6209, #6210, #6212, #6213, #6214, #6215, #6218, #6219, #6221, #6224, #6225, #6226, #6227)

  Introduces a unified heartbeat mechanism for app processes, preventing hangs when an app process crashes without responding. The new system enables flwr-serverapp and flwr-simulation processes to exit more quickly when a run is stopped by the flwr stop command.

• Fix bugs (#6188, #6171, #6175, #6207)

  Resolves issues causing occasional missing or unregistered object IDs on lower-powered machines, prevent the flwr-serverapp process from hanging after being stopped via the CLI, and correct the finished_at timestamp and initial heartbeat interval for runs.

• Improve import performance (#6102)

• Improve internal SQLite database performance (#6178, #6195)

• Update CI workflows and development tooling (#5242, #6053, #6080, #6089, #6108, #6129, #6130, #6131, #6135, #6138, #6142, #6144, #6156, #6181, #6187, #6189)

• Update documentation (#6115, #6081, #6110, #6137, #6146, #6169, #6179, #6228)

• General improvements (#6077, #6083, #6084, #6095, #6097, #6100, #6101, #6109, #6114, #6123, #6127, #6139, #6140, #6150, #6151, #6157, #6159, #6160, #6162, #6164, #6172, #6173, #6174, #6180, #6190, #6191, #6192, #6193, #6196, #6197, #6198, #6199, #6200, #6202, #6203, #6205, #6208, #6211, #6222, #6223)

  As always, many parts of the Flower framework and quality infrastructure were improved and updated.

Incompatible changes

• Drop Python 3.9 support (#6118, #6136, #6147)

  flwr now requires Python 3.10 as the minimum supported version, with baselines and development scripts updated accordingly.

• Bump protobuf to 5.x (#6104)

  Upgrades protobuf to >=5.29.0, ensuring flwr uses the latest gRPC stack and remains compatible with TensorFlow 2.20+. Note that this version is incompatible with TensorFlow versions earlier than 2.18.

• Deprecate flwr.server.utils.tensorboard (#6113)

  The flwr.server.utils.tensorboard function is now deprecated, and a slow import issue occurring when tensorflow is installed has been resolved.

Thanks to our contributors

We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):

Adam Tupper, Alan Yi, Alireza Ghasemi, Charles Beauville, Chong Shen Ng, Daniel Anoruo, Daniel J. Beutel, Daniel Nata Nugraha, Heng Pan, Javier, Patrick Foley, Robert Steiner, Rohat Bozyil, Yan Gao, combe4259, han97901, maviva

What's new?

• Enable dynamic SuperNode management via Flower CLI (#5953, #5954, #5955, #5962, #5968, #5974, #5977, #5980, #5981, #5985, #5986, #5987, #5988, #5991, #5998, #6003, #6004, #6006, #6009, #6023, #6028, #6029, #6037, #6064, #6070)

• Add migration guide for OpenFL to Flower (#5975)

  Adds a migration guide to support OpenFL users as the project approaches archival. The guide explains how to transition existing OpenFL setups to Flower, providing step-by-step migration instructions.

• Add quantum federated learning example with PennyLane (#5852)

  Introduces a new example demonstrating quantum federated learning using PennyLane. This example showcases how Flower can be integrated with quantum machine learning workflows—Flower is going quantum!

• Replace flwr ls with flwr list (keep alias for compatibility) (#5973)

  The old flwr ls command remains available as an alias.

• Migrate examples and tutorials to Message API (#5950, #5957, #5963, #5966)

  Migrates the remaining examples and tutorials, including the 30-minute Flower tutorial, whisper, quickstart-pandas, and federated-kaplan-meier-fitter, to the new Message API for improved consistency and maintainability.

• Refactor SuperNode lifecycle (#6051, #6052, #6060, #6061, #6063, #6069, #6073)

  Refactors the SuperNode lifecycle to align with the new management flow, streamlining SuperNode registration, activation, deactivation, and unregistration.

• Add deployment guide for multi-cluster OpenShift setups (#6001)

• Introduce file-based ObjectStore (#6040, #6036, #6008, #6042)

• Improve documentation (#5936, #5937, #5943, #5949, #5956, #5958, #5972, #5976, #5983, #5996, #5999, #6010, #6018, #6030)

• Update dependencies and CI (#5932, #5941, #5944, #5964, #6014, #6020, #6021, #6022, #6024, #6026, #6032, #6035, #6055, #6065)

• Bugfix (#5979)

• General improvements (#5773, #5938, #5939, #5942, #5948, #5951, #5959, #5984, #5989, #5992, #6007, #6011, #6033, #6038, #6041, #6046, #6047, #6048, #6050, #6054, #6057, #6058, #6074, #6075)

  As always, many parts of the Flower framework and quality infrastructure were improved and updated.

Incompatible changes

• Remove CSV-based SuperNode authentication (#5997)

• Rename user authentication to account authentication (#5965, #5969)

  Renames "user authentication" to "account authentication" across the framework for improved clarity and consistency. This change also updates the YAML key from auth_type to authn_type to align with authz_type.

• Deprecate --auth-supernode-public-key flag (#6002, #6076)

  The --auth-supernode-public-key flag in flower-supernode is deprecated and no longer in use. The public key is now automatically derived from the --auth-supernode-private-key, simplifying configuration and reducing redundancy.

Thanks to our contributors

We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):

Charles Beauville, Chong Shen Ng, Daniel J. Beutel, Heng Pan, Javier, Patrick Foley, William Lindskog, William Lindskog-Munzing, Yan Gao

What's new?

• Migrate all strategies to Message API (#5845, #5850, #5851, #5867, #5884, #5894, #5904, #5905, #5908, #5913, #5914, #5915, #5917, #5919, #5920, #5931)

  Migrates and implements all federated learning strategies to support the new Message API. Strategies updated or introduced include FedAvg, FedOpt and its variants (FedAdam, FedYogi, FedAdagrad), FedProx, Krum, MultiKrum, FedAvgM, FedMedian, FedTrimmedAvg, QFedAvg, and Bulyan. Differential privacy strategies were also migrated, including both fixed and adaptive clipping mechanisms on the server and client sides.

• Migrate flwr new templates to Message API (#5901, #5818, #5893, #5849, #5883)

  All flwr new templates have been updated to use the Message API. The PyTorch template based on the legacy API is retained and explicitly marked as legacy for those who prefer or require the older approach. A new template for XGBoost is introduced.

• Revamp main tutorials to use the Message API (#5861)

  The primary tutorial series has been updated to showcase the Message API. The revamped content improves alignment with recent architectural changes and enhances learning clarity. See the updated tutorial: Get started with Flower.

• Upgrade tutorials and how-to guides to the Message API (#5862, #5877, #5891, #5895, #5896, #5897, #5898, #5906, #5912, #5916, #5921, #5922, #5923, #5924, #5927, #5928, #5925)

  All framework tutorials and how-to guides have been fully migrated to the Message API. This includes quickstarts for JAX, TensorFlow, PyTorch Lightning, MLX, FastAI, Hugging Face Transformers, and XGBoost, along with comprehensive updates to guides covering strategy design, differential privacy, checkpointing, client configuration, evaluation aggregation, and stateful client implementation. These changes ensure all learning resources are up-to-date, aligned with the current architecture, and ready for developers building on the Message API.

• Migrate and update examples to support the Message API (#5827, #5830, #5833, #5834, #5839, #5840, #5841, #5860, #5868, #5869, #5875, #5876, #5879, #5880, #5882, #5887, #5888, #5889, #5892, #5907, #5911, #5930)

  Migrates a wide range of examples to the new Message API, ensuring consistency with recent framework updates. Examples updated include quickstarts (e.g., TensorFlow, PyTorch Lightning, Hugging Face, MONAI, FastAI, MLX), advanced use cases (e.g., FlowerTune for ViT and LLMs, FedRAG, FL-VAE), and specialized scenarios (e.g., XGBoost, tabular data, embedded devices, authentication, and custom mods). Enhancements also include updated variable naming, model-saving logic, readme improvements, and import path corrections for better usability and alignment with the new API.

• Introduce experimental flwr pull command (#5863)

  The flwr pull Flower CLI command is the foundation for future functionality allowing for the retrieval of artifacts generated by a ServerApp in a remote SuperLink.

• Improve CI/CD workflows (#5810, #5842, #5843, #5854, #5856, #5857, #5858, #5859, #5865, #5874, #5900, #5815)

• General improvements (#5844, #5847, #5870, #5872, #5873, #5881, #5886, #5890, #5902, #5903, #5909, #5910, #5918)

  As always, many parts of the Flower framework and quality infrastructure were improved and updated.

Thanks to our contributors

We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):

Charles Beauville, Chong Shen Ng, Daniel J. Beutel, Daniel Nata Nugraha, Dimitris Stripelis, Evram, Heng Pan, Javier, Robert Steiner, Yan Gao

What's new?

• Introduce Message API strategies (#5710, #5766, #5770, #5771, #5774, #5779, #5787, #5794, #5798, #5804, #5807, #5813, #5824, #5831, #5838)

  Introduces a new abstract base class Strategy that operate on Message replies, mirroring the design of those operating on FitIns/FitRes or EvaluateIns/EvaluteRes while providing more versatility on the type of payloads that can be federated with Flower. The first batch of Message-based strategies are: FedAvg, FedOpt, FedAdam, FedAdagrad, FedYogi, and fixed-clipping Differential Privacy strategies. More will follow in subsequent releases. A migration guide has been added to help users transition their existing Flower Apps operating on the original Strategy and NumPyClient abstractions to the Message API.

• Introduce Flower SuperExec (#5659, #5674, #5678, #5680, #5682, #5683, #5685, #5696, #5699, #5700, #5701, #5702, #5703, #5706, #5713, #5726, #5731, #5734, #5735, #5737, #5751, #5759, #5811, #5828)

  SuperExec is a new component responsible for scheduling, launching, and managing app processes (e.g., ServerApp, ClientApp) within the Flower deployment runtime. It is automatically spawned when running a SuperLink or SuperNode in subprocess mode (default). This also introduces a token-based mechanism that improves security by assigning a unique token to each app execution. Supporting changes include new RPCs, protocol updates, plugin abstractions, and Docker image support for SuperExec. For more details, refer to the updated Flower architecture explainer. Documentation has been revised to reflect the introduction of Flower SuperExec, including guides and tutorials such as quickstart with Docker, GCP deployment, and network communication to consistently use SuperExec.

• Update quickstart-pytorch to use Message API (#5785, #5786, #5802)

  The quickstart-pytorch tutorial has been migrated to the Message API, using the new FedAvg strategy and the new flwr new template.

• New PyTorch template with Message API (#5784)

  A new PyTorch template using the Message API is now available through flwr new.

• Add OpenShift deployment guide for Flower (#5781)

  Introduces a guide for deploying Flower on Red Hat OpenShift, including setup steps and configuration examples.

• Improve Helm documentation (#5711, #5733, #5748, #5758, #5765, #5816)

  Helm guide has been enhanced with additional configuration details and updated formatting. Changes include adding a parameters section, documenting how to set a custom secretKey, updating TLS instructions for version 1.20, introducing audit logging configuration, and using SuperExec.

• Improve documentation (#5159, #5655, #5668, #5692, #5723, #5738, #5739, #5740, #5753, #5764, #5769, #5775, #5782, #5788, #5795, #5809, #5812, #5817, #5819, #5825, #5836)

  Restructures the tutorial series, removes flower-simulation references, and updates versioned docs to use the correct flwr versions. The framework documentation homepage now defaults to the latest stable release instead of the main branch.

• Re-export user-facing API from flwr.*app (#5814, #5821, #5832, #5835)

  The following classes are now re-exported:

  • From flwr.serverapp: ServerApp, Grid
  • From flwr.clientapp: ClientApp, arrays_size_mod, message_size_mod
  • From flwr.app: Array, ArrayRecord, ConfigRecord, Context, Message, MetricRecord, RecordDict

  Importing these from flwr.server, flwr.client, or flwr.common is deprecated. Please update your imports to use flwr.serverapp, flwr.clientapp, or flwr.app instead to ensure forward compatibility.

• Add --health-server-address flag to Flower SuperLink/SuperNode/SuperExec (#5792)

• Update CI/CD workflows and dependencies (#5647, #5650, #5651, #5656, #5712, #5714, #5747, #5754, #5755, #5796, #5806, #5808, #5829)

• General improvements (#5622, #5660, #5673, #5675, #5676, #5686, #5697, #5708, #5719, #5720, #5722, #5736, #5746, #5750, #5757, #5776, #5777, #5789, #5805, #5797, #5820)

  As always, many parts of the Flower framework and quality infrastructure were improved and updated.

Incompatible changes

• Rename Exec API to Control API (#5663, #5665, #5667, #5671)

  The Exec API has been fully renamed to Control API to make its purpose clearer and avoid confusion with SuperExec. This includes renaming exec.proto to control.proto, updating documentation, and changing the --exec-api-address flag to --control-api-address. For backward compatibility, the old flag is still supported.

• Deprecate flwr-* commands (#5707, #5725, #5727, #5760)

  The long-running commands flwr-serverapp, flwr-clientapp, and flwr-simulation are deprecated in favor of SuperExec. Invoking them now launches the corresponding SuperExec process for backward compatibility.

• Remove --executor* flags (#5657, #5745, #5749)

  The --executor, --executor-dir, and --executor-config flags have been deprecated and the executor code removed. Use the new --simulation flag to run SuperLink with the simulation runtime.

Thanks to our contributors

We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):

Charles Beauville, Chong Shen Ng, Daniel J. Beutel, Daniel Nata Nugraha, Dimitris Stripelis, Heng Pan, Javier, Kumbham Ajay Goud, Robert Steiner, William Lindskog, Yan Gao

What's new?

• Send/receive arbitrarily large models (#5552, #5550, #5600, #5611, #5614, #5551)

  Flower 1.20 can send and receive arbitrarily large models like LLMs, way beyond the 2GB limit imposed by gRPC. It does so by chunking messages sent and received. The best part? This happens automatically without the user having to do anything.

• Implement object-based messaging between SuperNode and ClientApp (#5540, #5577, #5581, #5582, #5583, #5584, #5585, #5586, #5587, #5589, #5590, #5592, #5595, #5597, #5598, #5599, #5602, #5604, #5605, #5606, #5607, #5609, #5613, #5616, #5624, #5645)

  Redesigns the messaging system to enable object-based communication between the SuperNode and ClientApp, replacing the previous message-coupled design. Introduces new RPCs and enhances the ClientAppIo and Fleet APIs to faciliate better object storage in SuperNode and decouple ObjectStore from Message, improving maintainability and extensibility. Several refactorings improve modularity, naming consistency, and model weight streaming.

• Refactor SuperNode to use NodeState exclusively (#5535, #5536, #5537, #5541, #5542, #5610, #5628)

  Refactors SuperNode to rely solely on NodeState for managing all information, decoupling internal components for improved maintainability and clearer state handling. RPCs of the ClientAppIo API have been refactored accordingly, laying the groundwork for future concurrent ClientApps support.

• Enforce maximum size limit for FAB files (#5493)

  Limits the size of FAB files to a maximum of 10MB to prevent oversized artifacts. Developers can reduce FAB size by excluding unnecessary files via the .gitignore file in the Flower app directory.

• Add CatBoost federated learning quickstart example (#5564)

  This example shows how to use CatBoost with Flower for federated binary classification on the Adult Census Income dataset. It applies a tree-based bagging aggregation method. View the example for more details.

• Fix Windows path issue in FAB builds (#5608)

  Updates the way FAB files represent relative paths to their internal files to ensure consistency across different operating systems. This fixes an issue where a FAB built on Windows would fail integrity checks when run on UNIX-based systems (e.g., Ubuntu).

• Add explainer for pyproject.toml configuration (#5636)

  Adds a guide explaining how to configure a Flower app using its pyproject.toml file. The documentation is available here.

• Improve flwr new templates with TOML comments and README links (#5635)

  Adds comments to the generated pyproject.toml and a new section in the README.md, both linking to the TOML explainer.

• Warn when running Ray backend on Windows and update simulation guide (#5579)

  Logs a warning when using the Ray backend for simulation on Windows. Updates the simulation guide to include a corresponding note about limited Windows support.

• Add Helm deployment guide (#5637)

  The documentation now includes a comprehensive guide for deploying Flower SuperLink and SuperNode using Helm charts. For full instructions, refer to the Helm Guide.

• Add docs for user authentication and audit logging (#5630, #5643, #5649)

  Introduces documentation for configuring user authentication (User Authentication Guide) and audit logging (Audit Logging Guide) in Flower.

• Support gRPC health check by default (#5591)

• Bugfixes (#5567, #5545, #5534)

• Improve CI/CD (#5560, #5544, #5531, #5532, #5547, #5578)

• Improve and update documentation (#5558, #5603, #5538, #5626, #5566, #5553, #5588, #5549, #5618, #5612, #5646)

• General improvements (#5543, #5594, #5623, #5615, #5629, #5571, #5617, #5563, #5620, #5619, #5546, #5601, #5641, #5555, #5533, #5548, #5557, #5565, #5554, #5621, #5644, #5576, #5648)

  As always, many parts of the Flower framework and quality infrastructure were improved and updated.

Incompatible changes

• Remove non-grpc-bidi transport support from deprecated start_client (#5593)

  Drops support for non-grpc-bidi transport in the deprecated start_client API. Pleaes use flower-supernode instead.

Thanks to our contributors

We would like to give our special thanks to all the contributors who made the new version of Flower possible (in git shortlog order):

Adam Tupper, Andrej Jovanović, Charles Beauville, Chong Shen Ng, Daniel J. Beutel, Daniel Nata Nugraha, Dimitris Stripelis, Haoran Jie, Heng Pan, Javier, Kevin Ta, Mohammad Naseri, Ragnar, Robert Steiner, William Lindskog, ashley09, dennis-grinwald, sukrucildirr

What's new?

• Revamp messaging system with content-addressable object model (#5513, #5477, #5424, #5379, #5353, #5372, #5507, #5364, #5517, #5514, #5342, #5393, #5508, #5504, #5335, #5341, #5430, #5308, #5487, #5509, #5438, #5369, #5354, #5486, #5380, #5496, #5399, #5489, #5446, #5432, #5456, #5442, #5462, #5429, #5497, #5435, #5371, #5450, #5384, #5488, #5434, #5425, #5475, #5458, #5494, #5449, #5492, #5426, #5445, #5467, #5474, #5527)

  Introduces a content-addressable messaging system that breaks messages into a tree of uniquely identified, SHA256-hashed objects. This model allows objects to be pushed and pulled efficiently, avoiding redundant uploads and enabling scalable message streaming and broadcasting. Core enhancements include the new InflatableObject abstraction and ObjectStore for storing and retrieving message content, with Array, Message, and *Record classes now inherit from InflatableObject. New utilities and RPCs facilitate recursive object handling, ID recomputation avoidance, and safe deletion. The framework's servicers, REST, and gRPC layers were refactored to integrate this system, improving real-world deployment scalability and communication efficiency.

• Improve user authorization and access control (#5428, #5505, #5506, #5422, #5510, #5421, #5420, #5448, #5447, #5503, #5501, #5502, #5511)

  Improves user authorization feature that integrates with the existing authentication protocol. When authentication is enabled, commands like flwr ls, flwr log, and flwr stop are restricted to displaying or affecting only the runs submitted by the authenticated user. This is enforced using the Flower Account ID. Additionally, fine-grained access control can be enforced for CLI operations based on assigned roles (RBAC).

• Add Floco baseline for personalized federated learning (#4941)

  Introduces Floco, a method that enhances both personalized and global model performance in non-IID cross-silo federated learning. It trains a shared solution simplex across clients, promoting collaboration among similar clients and reducing interference from dissimilar ones. Learn more in Floco Baseline Documentation.

• Add FEMNIST support to FedProx baseline (#5290)

  Adds FEMNIST dataset to FedProx with preprocessing matching the original paper—subsampling 'a'-'j' and assigning 5 classes per device. More details: FedProx Baseline Documentation

• Upgrade StatAvg baseline to new Flower App format (#4952)

  The StatAvg baseline is updated to use the new Flower App format. Changes include removing Hydra, switching to pyproject.toml configs, using ClientApp and ServerApp, and saving results via a custom Server class. More details: StatAvg Baseline Documentation.

• Add guide for running Flower on Google Cloud Platform (#5327)

  The documentation now includes a detailed guide on deploying and running Flower on Google Cloud Platform (GCP). It provides step-by-step instructions for managing Flower workloads in a GCP environment. For more information, refer to the official guide.

• Implement ServerApp heartbeat monitoring (#5228, #5370, #5358, #5332, #5322, #5324, #5230, #5325)

  Adds heartbeat support to ServerApp processes, enabling the SuperLink to detect crashed or terminated processes and mark them as finished:failed when no final status is received.

• Extend NodeState to improve SuperNode state management (#5470, #5473, #5402, #5521)

  Extends the NodeState interface and implementation to manage all SuperNode state.

• Refactor SuperNode for improved robustness and maintainability (#5398, #5397, #5443, #5410, #5411, #5469, #5419)

  Ongoing refactoring of SuperNode improves modularity, simplifies client execution, removes gRPC bidirectional streaming and unused code, and centralizes connection logic. These changes align SuperNode's behavior more closely with SuperLink to make Flower the best platform for robust enterprise deployments..

• Restructure Flower (#5465, #5476, #5460, #5409, #5408, #5396, #5389, #5392, #5461)

  Reorganizes infrastructure code into dedicated submodules to improve maintainability and clarify the separation from user-facing components.

• Improve CI/CD workflows (#5498, #5265, #5266, #5328, #5500, #5346, #5318, #5256, #5298, #5257, #5483, #5440, #5304, #5313, #5381, #5385, #5316, #5260, #5349, #5319, #5296, #5294, #5317, #5482, #5282, #5223, #5225, #5326)

  Refines CI workflows, templates, and automation; improves Docker, dependency, and version management; removes legacy jobs and adds proactive maintainer tools.

• Improve documentation and examples (#5345, #5400, #5406, #5401, #5283, #5416, #5337, #5436, #5373, #5471, #5395, #5279, #5288, #5457, #5305, #5365, #5491, #5463, #5367, #5360, #5374, #5361, #5063)

  Adds documentation for the Flower Components Network Interface and Communication Model, updates the Deployment Engine page, and clarifies the distinctions between simulation and deployment. The custom-mods example has also been revised.

• Build FAB in memory with new utility function (#5334)

• Add logging for incoming and outgoing messages in size modifiers (#5437)

• Bugfixes (#5340, #5366, #5478)

• General improvements (#5516, #5499, #4927, #5310, #5343, #5359, #5413, #5299, #5433, #5390, #5427, #5350, #5394, #5295, #5315, #5468, #5412, #5348, #5444, #5522)

  As always, many parts of the Flower framework and quality infrastructure were improved and updated.