Skip to content

chore: Sync release-1.9.1 with main#12790

Merged
erichare merged 75 commits into
release-1.9.1from
main
Apr 20, 2026
Merged

chore: Sync release-1.9.1 with main#12790
erichare merged 75 commits into
release-1.9.1from
main

Conversation

@erichare
Copy link
Copy Markdown
Collaborator

Summary

Sync the release-1.9.1 branch with the latest changes from main to keep the release branch current with ongoing development.

Changes

  • Merges all commits from main into release-1.9.1
  • No code changes authored in this PR — purely a branch sync

Motivation

Keeping release-1.9.1 up to date with main ensures:

  • Bug fixes and improvements from main are available on the release branch
  • Reduces merge conflict surface area for future backports
  • Keeps the release branch in a known, testable state

Test plan

  • CI passes on release-1.9.1 after merge
  • No new merge conflicts introduced
  • Smoke-test the release branch build locally
  • Verify no regressions in release-specific functionality

Adam-Aghili and others added 30 commits March 2, 2026 18:20
… (#11975)

* feat: add runtime port validation for Kubernetes service discovery

* test: add unit tests for runtime port validation in Settings

* fix: improve runtime port validation to handle exceptions and edge cases

Co-authored-by: Gabriel Luiz Freitas Almeida <gabriel@logspace.ai>
* feat: add documentation link to Guardrails component

* [autofix.ci] apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* feat: traces v0

v0 for traces includes:
- filters: status, token usage range and datatime
- accordian rows per trace

Could add:
- more filter options. Ecamples: session_id, trace_id and latency range

* fix: token range

* feat: create sidebar buttons for logs and trace

add sidebar buttons for logs and trace
remove lods canvas control

* fix: fix duplicate trace ID insertion

hopefully fix duplicate trace ID insertion on windows

* fix: update tests and alembic tables for uts

update tests and alembic tables for uts

* chore: add session_id

* chore: allo grouping by session_id and flow_id

* chore: update race input output

* chore: change run name to flow_name - flow_id
was flow_name - trace_id
now flow_name - flow_id

* facelift

* clean up and add testcases

* clean up and add testcases

* merge Alembic detected multiple heads

* [autofix.ci] apply automated fixes

* improve testcases

* remodel files

* chore: address gabriel simple changes

address gabriel simple changes in traces.py and native.py

* clean up and testcases

* chore: address OTel and PG status comments

#11689 (comment)
#11689 (comment)

* chore: OTel span naming convention

model name is now set using name = f"{operation} {model_name}" if model_name else operation

* add traces

* feat: use uv sources for CPU-only PyTorch (#11884)

* feat: use uv sources for CPU-only PyTorch

Configure [tool.uv.sources] with pytorch-cpu index to avoid ~6GB CUDA
dependencies in Docker images. This replaces hardcoded wheel URLs with
a cleaner index-based approach.

- Add pytorch-cpu index with explicit = true
- Add torch/torchvision to [tool.uv.sources]
- Add explicit torch/torchvision deps to trigger source override
- Regenerate lockfile without nvidia/cuda/triton packages
- Add required-environments for multi-platform support



* fix: update regex to only replace name in [project] section

The previous regex matched all lines starting with `name = "..."`,
which incorrectly renamed the UV index `pytorch-cpu` to `langflow-nightly`
during nightly builds. This caused `uv lock` to fail with:
"Package torch references an undeclared index: pytorch-cpu"

The new regex specifically targets the name field within the [project]
section only, avoiding unintended replacements in other sections like
[[tool.uv.index]].

* style: fix ruff quote style

* fix: remove required-environments to fix Python 3.13 macOS x86_64 CI

The required-environments setting was causing hard failures when packages
like torch didn't have wheels for specific platform/Python combinations.
Without this setting, uv resolves optimistically and handles missing wheels
gracefully at runtime instead of failing during resolution.



---------



* LE-270: Hydration and Console Log error (#11628)

* LE-270: add fix hydration issues

* LE-270: fix disable field on max token on language model

---------



* test: add wait for selector in mcp server tests (#11883)

* Add wait for selector in mcp server tests

* [autofix.ci] apply automated fixes

* Add more awit for selectors

* [autofix.ci] apply automated fixes

---------



* fix: reduce visual lag in frontend  (#11686)

* Reduce lag in frontend by batching react events and reducing minimval visual build time

* Cleanup

* [autofix.ci] apply automated fixes

* add tests and improve code read

* [autofix.ci] apply automated fixes

* Remove debug log

---------




* feat: lazy load imports for language model component (#11737)

* Lazy load imports for language model component

Ensures that only the necessary dependencies are required.
For example, if OpenAI provider is used, it will now only
import langchain_openai, rather than requiring langchain_anthropic,
langchain_ibm, etc.

* Add backwards-compat functions

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* Add exception handling

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* comp index

* docs: azure default temperature (#11829)

* change-azure-openai-default-temperature-to-1.0

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* [autofix.ci] apply automated fixes (attempt 3/3)

* [autofix.ci] apply automated fixes

---------



* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* fix unit test?

* add no-group dev to docker builds

* [autofix.ci] apply automated fixes

---------





* feat: generate requirements.txt from dependencies  (#11810)

* Base script to generate requirements

Dymanically picks dependency for LanguageM Comp.
Requires separate change to remove eager loading.

* Lazy load imports for language model component

Ensures that only the necessary dependencies are required.
For example, if OpenAI provider is used, it will now only
import langchain_openai, rather than requiring langchain_anthropic,
langchain_ibm, etc.

* Add backwards-compat functions

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* Add exception handling

* Add CLI command to create reqs

* correctly exclude langchain imports

* Add versions to reqs

* dynamically resolve provider imports for language model comp

* Lazy load imports for reqs, some ruff fixes

* Add dynamic resolves for embedding model comp

* Add install hints

* Add missing provider tests; add warnings in reqs script

* Add a few warnings and fix install hint

* update comments add logging

* Package hints, warnings, comments, tests

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* [autofix.ci] apply automated fixes (attempt 3/3)

* Add alias for watsonx

* Fix anthropic for basic prompt, azure mapping

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* ruff

* [autofix.ci] apply automated fixes

* test formatting

* ruff

* [autofix.ci] apply automated fixes

---------



* fix: add handle to file input to be able to receive text (#11825)

* changed base file and file components to support muitiple files and files from messages

* update component index

* update input file component to clear value and show placeholder

* updated starter projects

* [autofix.ci] apply automated fixes

* updated base file, file and video file to share robust file verification method

* updated component index

* updated templates

* fix whitespaces

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* add file upload test for files fed through the handle

* [autofix.ci] apply automated fixes

* added tests and fixed things pointed out by revies

* update component index

* fixed test

* ruff fixes

* Update component_index.json

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* [autofix.ci] apply automated fixes (attempt 3/3)

* updated component index

* updated component index

* removed handle from file input

* Added functionality to use multiple files on the File Path, and to allow files on the langflow file system.

* [autofix.ci] apply automated fixes

* fixed lfx test

* build component index

---------





* docs: Add AGENTS.md development guide (#11922)

* add AGENTS.md rule to project

* change to agents-example

* remove agents.md

* add example description

* chore: address cris I1 comment

address cris I1 comment

* chore: address cris I5

address cris I5

* chore: address cris I6

address cris I6

* chore: address cris R7

address cris R7

* fix testcase

* chore: address cris R2

address cris R2

* restructure insight page into sidenav

* added header and total run node

* restructing branch

* chore: address gab otel model changes

address gab otel model changes will need no migration tables

* chore: update alembic migration tables

update alembic migration tables after model changes

* add empty state for gropu sessions

* remove invalid mock

* test: update and add backend tests

update and add backend tests

* chore: address backend code rabbit comments

address backend code rabbit comments

* chore: address code rabbit frontend comments

address code rabbit frontend comments

* chore: test_native_tracer minor fix address c1

test_native_tracer minor fix address c1

* chore: address C2 + C3

address C2 + C3

* chore: address H1-H5

address H1-H5

* test: update test_native_tracer

update test_native_tracer

* fixes

* chore: address M2

address m2

* chore: address M1

address M1

* dry changes, factorization

* chore: fix 422 spam and clean comments

fix 422 spam and clean comments

* chore: address M12

address M12

* chore: address M3
 address M3

* chore: address M4

address M4

* chore: address M5

address M5

* chore: clean up for M7, M9, M11

clean up for M7, M9, M11

* chore: address L2,L4,L5,L6 + any test

address L2,L4,L5 and L6 + any test

* chore: alembic + comment clean up

alembic + comment clean up

* chore: remove depricated test_traces file

remove depricated test_traces file. test have all been moved to test_traces_api.py

* fix datetime

* chore: fix test_trace_api ge=0 is allowed now

fix test_trace_api ge=0 is allowed now

* chore: remove unused traces cost flow

remove unused traces cost flow

* fix traces test

* fix traces test

* fix traces test

* fix traces test

* fix traces test

* chore: address gabriels otel coment

address gabriels otel coment latest

---------

Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local>
Co-authored-by: Olayinka Adelakun <olayinkaadelakun@mac.war.can.ibm.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Ram Gopal Srikar Katakam <44802869+RamGopalSrikar@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: olayinkaadelakun <olayinka.adelakun@ibm.com>
Co-authored-by: Jordan Frazier <122494242+jordanrfrazier@users.noreply.github.com>
Co-authored-by: cristhianzl <cristhian.lousa@gmail.com>
Co-authored-by: Hamza Rashid <74062092+HzaRashid@users.noreply.github.com>
Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com>
Co-authored-by: Lucas Oliveira <62335616+lucaseduoli@users.noreply.github.com>
Co-authored-by: Edwin Jose <edwin.jose@datastax.com>
Co-authored-by: Himavarsha <40851462+HimavarshaVS@users.noreply.github.com>
#11982)

fix(test): Fix superuser timeout test errors by replacing heavy client fixture                                                    (#11972)

* fix super user timeout test error

* fix fixture db test

* remove canary test

* [autofix.ci] apply automated fixes

* flaky test

---------

Co-authored-by: Cristhian Zanforlin Lousa <cristhian.lousa@gmail.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
…ics module (#11974)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
…2002)

* fix: add ondelete=CASCADE to TraceBase.flow_id to match migration

The migration file creates the trace table's flow_id foreign key with
ondelete="CASCADE", but the model was missing this parameter. This
mismatch caused the migration validator to block startup.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: add defensive migration to ensure trace.flow_id has CASCADE

Adds a migration that ensures the trace.flow_id foreign key has
ondelete=CASCADE. While the original migration already creates it
with CASCADE, this provides a safety net for any databases that may
have gotten into an inconsistent state.

* fix: dynamically find FK constraint name in migration

The original migration did not name the FK constraint, so it gets an
auto-generated name that varies by database. This fix queries the
database to find the actual constraint name before dropping it.

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
…mprove button functionality (#12000)

* fix: Update ButtonSendWrapper to handle building state and improve button functionality

* fix(frontend): rename stop button title to avoid Playwright selector conflict

The "Stop building" title caused getByRole('button', { name: 'Stop' })
to match two elements, breaking Playwright tests in shards 19, 20, 22, 25.

Renamed to "Cancel" to avoid the collision with the no-input stop button.
pydantic fail because output is list, instead of a dict

Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local>
* Update guardrails.py

Changing the heuristic threshold icons.

The field was using the default icons. I added icons related to the security theme.

* [autofix.ci] apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Viktor Avelino <64113566+viktoravelino@users.noreply.github.com>
…#12028)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
fix reset button

Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local>
* fix: Handle message inputs when ingesting knowledge

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* [autofix.ci] apply automated fixes (attempt 3/3)

* Update test_ingestion.py

* [autofix.ci] apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
…on (#11985)

* fix(ui): add error handling for invalid JSON uploads via upload button

* feat(frontend): added new test for file upload

* feat(frontend): added new test for file upload
* fix: LM span is now properly parent of ChatOpenAI

Before LM span and ChatOpenAI span where both considered parents so they where being counted twice in token counts and other sumations
Now LM span is properly the parent of ChatOpenAI span so they are not accidently counted twice

* chore: clean up comments

clean up comments

* chore: incase -> incase

incase -> incase
* fix: LM span is now properly parent of ChatOpenAI

Before LM span and ChatOpenAI span where both considered parents so they where being counted twice in token counts and other sumations
Now LM span is properly the parent of ChatOpenAI span so they are not accidently counted twice

* chore: clean up comments

clean up comments

* chore: incase -> incase

incase -> incase

* design fix

* fix testcases

* fix header

* fix testcase

---------

Co-authored-by: Adam Aghili <Adam.Aghili@ibm.com>
Co-authored-by: Olayinka Adelakun <olayinkaadelakun@Olayinkas-MacBook-Pro.local>
Co-authored-by: Olayinka Adelakun <olayinkaadelakun@mac.war.can.ibm.com>
* fix: update layout and variant for file previews in chat messages

* fix: update background color to 'bg-muted' in chat header and input wrapper components

* refactor(CanvasControls): remove unused inspection panel logic and clean up code

* fix: remove 'bg-muted' class from chat header and add 'bg-primary-foreground' to chat sidebar

* fix: add Escape key functionality to close sidebar
#12040)

fix: playground does not scroll down to the latest user message upon sending (Regression) (#12006)

* fixes scroll is on input message

* feat: re-engage Safari sticky scroll mode when user sends message

Add custom event 'langflow-scroll-to-bottom' to force SafariScrollFix back into sticky mode when user sends a new message. This ensures the chat scrolls to bottom even if user had scrolled up, fixing behavior where Safari's scroll fix would remain disengaged after manual scrolling.

Co-authored-by: Deon Sanchez <69873175+deon-sanchez@users.noreply.github.com>
#12039)

fix: knowledge Base Table — Row Icon Appears Clipped/Cut for Some Entries (#12009)

* removed book and added file. makes more sense

* feat: add accent-blue color to design system and update knowledge base file icon

- Add accent-blue color variables to light and dark themes in CSS
- Register accent-blue in Tailwind config with DEFAULT and foreground variants
- Update knowledge base file icon fallback color from hardcoded text-blue-500 to text-accent-blue-foreground

Co-authored-by: Deon Sanchez <69873175+deon-sanchez@users.noreply.github.com>
* fixes to the mcp modal for style

* style: convert double quotes to single quotes in baseModal component

* style: convert double quotes to single quotes in addMcpServerModal component

Co-authored-by: Deon Sanchez <69873175+deon-sanchez@users.noreply.github.com>
* fix: change loop description (#12018)

* docs: simplify Loop component description in starter project and component index

* [autofix.ci] apply automated fixes

* style: format Loop component description to comply with line length limits

* fixed component index

* [autofix.ci] apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Deon Sanchez <69873175+deon-sanchez@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
…#12036)

* feat: add mutual exclusivity between ChatInput and Webhook components

* [autofix.ci] apply automated fixes

* refactor: address PR feedback - add comprehensive tests and constants

* [autofix.ci] apply automated fixes

* refactor: address PR feedback - add comprehensive tests and constants

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Janardan S Kavia <janardanskavia@Janardans-MacBook-Pro.local>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* Only process dict template fields

In json_schema_from_flow, guard access to template field properties by checking isinstance(field_data, dict) before calling .get(). This replaces the previous comparison to the string "Component" and prevents attribute errors when template entries are non-dict values, ensuring only dict-type fields with show=True and not advanced are included in the generated schema.

* Check and handle MCP server URL changes

When skipping creation of an existing MCP server for a user's starter projects, first compute the expected project URL and compare it to URLs found in the existing config args. If the URL matches, keep skipping and log that the server is correctly configured; if the URL differs (e.g., port changed on restart), log the difference and allow the flow to update the server configuration. Adds URL extraction and improved debug messages to support automatic updates when server endpoints change.

---------

Co-authored-by: Ram Gopal Srikar Katakam <44802869+RamGopalSrikar@users.noreply.github.com>
…2044)

Langflow breaks when we click on the last level of the chain.

Co-authored-by: Olayinka Adelakun <olayinkaadelakun@mac.war.can.ibm.com>
#12051)

fix: standardize "README" title and update API key configuration notes in 3 main flow templates (#12005)

* updated for README

* chore: update secrets baseline with new line numbers

* fixed test

Co-authored-by: Deon Sanchez <69873175+deon-sanchez@users.noreply.github.com>
…8.0 (#12052)

* fix: improve knowledge base UI consistency and pagination handling

- Change quote style from double to single quotes throughout knowledge base components
- Update "Hide Sources" button label to "Hide Configuration" for clarity
- Restructure SourceChunksPage layout to use xl:container for consistent spacing
- Add controlled page input state with validation on blur and Enter key
- Synchronize page input field with pagination controls to prevent state drift
- Reset page input to "1" when changing page

* refactor: extract page input commit logic into reusable function

Extract page input validation and commit logic from handlePageInputBlur and handlePageInputKeyDown into a shared commitPageInput function to eliminate code duplication.
…12043)

* fix(ui): ensure session deletion properly clears backend and cache

* fix: resolved PR comments and add new regression test

* fix: resolved PR comments and add new regression test

* [autofix.ci] apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
erichare and others added 15 commits March 25, 2026 13:53
#12329)

* fix: prevent overwriting user-selected global variables in provider c… (#12217)

* fix: nightly now properly gets 1.9.0 branch (#12215)

before it was attempting to pull release-notes as letters are alphanumerically after numbers when we sort -V then grab tail
now we only look at branch names that follow the pattern '^release-[0-9]+\.[0-9]+\.[0-9]+$'

* docs: add search icon (#12216)

add-back-svg

* fix: prevent overwriting user-selected global variables in provider config

Previously, the apply_provider_variable_config_to_build_config function would
automatically overwrite field values with environment variable keys whenever
an env var was present, even if the user had already selected a different
global variable.

This fix adds a check to only auto-set the environment variable if:
- The field is currently empty, OR
- The field is not already configured to load from the database

This preserves user selections while still providing automatic configuration
for new/empty fields.

Added comprehensive unit tests to verify:
- Auto-setting env vars for empty fields
- Preserving user-selected global variables
- Overwriting hardcoded values (expected behavior)
- Skipping when env var is not set
- Applying component metadata correctly

* [autofix.ci] apply automated fixes

* style: use dictionary comprehension instead of for-loop

Fixed PERF403 Ruff style warning by replacing for-loop with dictionary
comprehension in update_projects_components_with_latest_component_versions

* chore: retrigger CI build

* test: improve test coverage and clarity for provider config

- Renamed test_apply_provider_config_overwrites_hardcoded_value to
  test_apply_provider_config_replaces_hardcoded_with_env_var for clarity
- Added test_apply_provider_config_idempotent_when_already_set to document
  idempotent behavior when value already matches env var key
- Removed sensitive value from debug log message to prevent potential
  exposure of API keys or credentials

These changes improve test coverage by documenting the no-op scenario
and enhance security by avoiding logging of potentially sensitive data.

* chore: retrigger CI build

---------

Co-Authored-By: Adam-Aghili <149833988+Adam-Aghili@users.noreply.github.com>
Co-Authored-By: Mendon Kissling <59585235+mendonk@users.noreply.github.com>
Co-Authored-By: Steve Haertel <shaertel@ca.ibm.com>
Co-Authored-By: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-Authored-By: Eric Hare <ericrhare@gmail.com>

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* [autofix.ci] apply automated fixes (attempt 3/3)

* Update test_unified_models.py

---------

Co-authored-by: Adam-Aghili <149833988+Adam-Aghili@users.noreply.github.com>
Co-authored-by: Mendon Kissling <59585235+mendonk@users.noreply.github.com>
Co-authored-by: Steve Haertel <shaertel@ca.ibm.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* fix: replace grep -oP with sed for Node.js version extraction in Docker images (#12330)

* fix: replace grep -oP with sed for Node.js version extraction in Docker builds

The grep -oP (PCRE regex) command fails in the python:3.12.12-slim-trixie
Docker base image because PCRE support is not available in the slim variant.

This replaces grep -oP with portable sed -nE in all 5 Dockerfiles and adds
an empty version guard to fail fast with a clear error message instead of
producing a broken download URL.

Fixes the Docker base build failure in the v1.8.2 release workflow.

* fix(docker): remove broken npm self-upgrade from Docker images

Node.js 22.x now bundles npm 11.x which fails when trying to self-upgrade
via 'npm install -g npm@latest' in the slim Docker image. The bundled npm
version is sufficient.

This is the same fix as PR #12309 on release-1.9.0.

* chore: version bump and merge 1.8.2

bump version to 1.8.3, 0.8.3 and 0.3.3
merge changes added to 1.8.2 into 1.8.3

---------

Co-authored-by: vjgit96 <vijay.katuri@ibm.com>
#12334)

* fix: disable dangerous deserialization by default in FAISS component (#11999)

* fix: disable dangerous deserialization by default in FAISS component

Change the default value of allow_dangerous_deserialization from True
to False to prevent remote code execution via malicious pickle files.

This addresses a security vulnerability where an attacker could upload
a crafted pickle file and trigger arbitrary code execution when the
FAISS component loads the index.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes (attempt 2/3)

* fix: set allow_dangerous_deserialization to false in Nvidia Remix starter project and add regression test

- Changed allow_dangerous_deserialization default from true to false in
  Nvidia Remix.json starter project to match the FAISS component security fix
- Added regression tests to ensure the default value does not revert to True

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

* fix: skip FAISS test gracefully when langchain_community is not installed

* [autofix.ci] apply automated fixes

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Janardan Singh Kavia <janardankavia@ibm.com>

* [autofix.ci] apply automated fixes

---------

Co-authored-by: Ram Gopal Srikar Katakam <44802869+RamGopalSrikar@users.noreply.github.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Janardan Singh Kavia <janardankavia@ibm.com>
Runner group has been restored by Chris. Reverting ubuntu-latest back to
Langflow-runner for faster Docker image builds.
#12419)

fix(deps): pin tar-fs to >=2.1.4 to fix symlink following vulnerability (#12078)

Adds override for tar-fs in package.json to ensure versions prior to
2.1.4 are never resolved. Addresses CVE in tar-fs <2.1.4 (PVR0686558)
where symlink validation bypass was possible with a crafted tarball.

Co-authored-by: Ram Gopal Srikar Katakam <44802869+RamGopalSrikar@users.noreply.github.com>
bump versions
)

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
* fix: Build and install the langflow-sdk for lfx (fixes nightly) (#12481)

* fix: Build and install the langflow-sdk for lfx

* Publish sdk as a nightly

* Update ci.yml

* Update python_test.yml

* Update ci.yml

* fix: Properly grep for the langflow version (#12486)

* fix: Properly grep for the langflow version

* Mount the sdk where needed

* Skip the sdk

* [autofix.ci] apply automated fixes

* Update setup.py

* fix(docker): Remove broken npm self-upgrade from Docker images (#12309)

* fix: replace grep -oP with sed for Node.js version extraction in Docker builds (#12331)

The grep -oP (PCRE regex) command fails in the python:3.12.12-slim-trixie
Docker base image because PCRE support is not available in the slim variant.

This replaces grep -oP with portable sed -nE in all 5 Dockerfiles and adds
an empty version guard to fail fast with a clear error message instead of
producing a broken download URL.

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Co-authored-by: Cristhian Zanforlin Lousa <cristhian.lousa@gmail.com>
Co-authored-by: vjgit96 <vijay.katuri@ibm.com>
# Conflicts:
#	.secrets.baseline
#	pyproject.toml
#	src/backend/base/langflow/initial_setup/starter_projects/Hybrid Search RAG.json
#	src/backend/base/langflow/initial_setup/starter_projects/Knowledge Retrieval.json
#	src/backend/base/langflow/initial_setup/starter_projects/Research Translation Loop.json
#	src/backend/base/langflow/initial_setup/starter_projects/Vector Store RAG.json
#	src/backend/base/langflow/services/database/models/traces/model.py
#	src/backend/base/langflow/services/tracing/native.py
#	src/backend/base/pyproject.toml
#	src/backend/tests/unit/services/tracing/test_native_tracer.py
#	src/frontend/package-lock.json
#	src/frontend/package.json
#	src/frontend/src/components/core/playgroundComponent/chat-view/chat-header/components/chat-sidebar.tsx
#	src/frontend/src/components/core/playgroundComponent/chat-view/chat-header/components/session-selector.tsx
#	src/frontend/src/components/core/playgroundComponent/chat-view/chat-header/hooks/use-edit-session-info.ts
#	src/frontend/src/components/core/playgroundComponent/chat-view/chat-header/hooks/use-get-add-sessions.ts
#	src/frontend/src/components/core/playgroundComponent/sliding-container/components/flow-page-sliding-container.tsx
#	src/frontend/src/components/ui/__tests__/dialog.test.tsx
#	src/frontend/src/components/ui/sidebar.tsx
#	src/frontend/src/modals/addMcpServerModal/index.tsx
#	src/frontend/src/pages/FlowPage/components/flowSidebarComponent/components/__tests__/sidebarSegmentedNav.test.tsx
#	src/frontend/src/pages/FlowPage/components/flowSidebarComponent/components/sidebarSegmentedNav.tsx
#	src/frontend/src/pages/FlowPage/components/flowSidebarComponent/helpers/__tests__/disable-item.test.ts
#	src/frontend/src/pages/FlowPage/components/flowSidebarComponent/helpers/__tests__/get-disabled-tooltip.test.ts
#	src/frontend/src/pages/FlowPage/components/flowSidebarComponent/index.tsx
#	src/frontend/tests/core/integrations/Market Research.spec.ts
#	src/frontend/tests/core/regression/general-bugs-invalid-json-upload.spec.ts
#	src/frontend/tests/core/regression/session-deletion-data-leakage.spec.ts
#	src/lfx/pyproject.toml
#	src/lfx/src/lfx/_assets/component_index.json
#	src/lfx/src/lfx/_assets/stable_hash_history.json
#	src/lfx/src/lfx/base/models/unified_models.py
#	src/lfx/src/lfx/components/deactivated/ingestion.py
#	uv.lock
# Conflicts:
#	src/backend/tests/unit/test_unified_models.py
# Conflicts:
#	src/backend/base/langflow/api/v1/chat.py
#	src/backend/tests/unit/test_chat_endpoint.py
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented Apr 20, 2026

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 8ae6f525-8a07-42e0-956c-d91de80b437f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch main

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

name="gemini-3.1-pro-preview",
icon="GoogleGenerativeAI",
tool_calling=True,
tool_calling=False, # TODO: When Google GenAI has been upgraded, tool calling should be enabled for Gemini 3
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should these be enabled now?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point!

"devtools>=0.12.2",
"pytest-flakefinder>=1.1.0",
"types-markdown>=3.7.0.20240822",
"codeflash>=0.8.4",
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ogabrielluiz do we still want this?

@github-actions
Copy link
Copy Markdown
Contributor

Frontend Unit Test Coverage Report

Coverage Summary

Lines Statements Branches Functions
Coverage: 34%
34.96% (40044/114539) 68.02% (5541/8146) 35.82% (934/2607)

Unit Test Results

Tests Skipped Failures Errors Time
3980 0 💤 0 ❌ 0 🔥 7m 12s ⏱️

Comment on lines +133 to +134
"types-markdown>=3.7.0.20240822",
"codeflash>=0.8.4",
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Jkavia did you remove these imports?

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i dont recall removing any imports of the top of my head, it was mostly either changing versions or adding them to override so this should be good.

@erichare erichare requested a review from Adam-Aghili April 20, 2026 17:30
@erichare
Copy link
Copy Markdown
Collaborator Author

Two separate PRs will be opened against release-1.9.1: addressing gemini models / tool calling, addressing pyproject additions @Adam-Aghili

@github-actions github-actions Bot added the lgtm This PR has been approved by a maintainer label Apr 20, 2026
@erichare erichare added this pull request to the merge queue Apr 20, 2026
Merged via the queue into release-1.9.1 with commit 5da64e2 Apr 20, 2026
1348 of 1376 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ignore-for-release lgtm This PR has been approved by a maintainer

Projects

None yet

Development

Successfully merging this pull request may close these issues.