What's Changed

🐛 Bug Fixes

• fix: patch release 1.12.10 image vulnerabilities by @erichare in #16201
• fix: patch bundled npm glob and minimatch for 1.12.10 by @erichare in #16205

Full Changelog: v1.12.9...v1.12.10

What's Changed

🐛 Bug Fixes

• fix(deps): backport filelock 4 upgrade to 1.13.1 by @Adam-Aghili in #15966
• fix: confine Git loader files to repository by @erichare in #15972
• fix(oracle): confine loader local file access by @erichare in #15973
• fix(security): protect MCP component reserved fields by @erichare in #15974
• fix(security): isolate MCP batch login and request state by @erichare in #15978
• fix: secure quickstart PostgreSQL configuration by @erichare in #15979
• fix(auth): restrict external resolver credentials by @erichare in #15980
• fix: require OAuth attestation for Slack workspace routing by @erichare in #15981
• fix: separate user and flow storage namespaces by @erichare in #15982
• fix: fence stale listener delivery across trigger replicas by @erichare in #15942
• fix(agentic): check implicit calls in component definitions by @erichare in #15943
• fix(models): validate unified model credential destinations by @erichare in #15944
• fix(mcp): validate final shell arguments after headers by @erichare in #15946
• fix(python): require isolation for untrusted global imports by @erichare in #15945
• fix: stop listeners when background consent is withdrawn by @erichare in #16012
• fix(security): pin agentic MCP calls to the backend listener by @erichare in #16044
• fix(logging): redact credentials from query strings by @erichare in #16042
• fix(security): validate component connection targets by @erichare in #16043
• fix(security): block runtime readers in generated components by @erichare in #16040
• fix(security): enforce MCP HTTP destination policy by @erichare in #16041
• fix(security): block shipped inspect re-export bypasses by @Adam-Aghili in #16048
• fix: preserve SSO triggers during migration replay by @erichare in #16058
• fix: block assistant expression evaluation bypasses by @erichare in #16055
• fix: absorb image dependency CVE workarounds for 1.13.1 by @erichare in #16121
• fix(deps): dependency upgrades for 1.13.1 by @Adam-Aghili in #16131

📝 Documentation Updates

• docs: clarify autologin behavior in install and quickstart by @mendonk in #15968

🛠 Maintenance Tasks

• build: remove the unused MCP Fetch development dependency by @Adam-Aghili in #15585

✅ Tests

• test(audio): cover packaged worklet playback and startup failures by @Adam-Aghili in #15584
• test(mcp): cover safe authenticated global and project tool listings by @erichare in #16047
• test(a2a): cover safe agent-card discovery after owner deactivation by @erichare in #16045
• test(mcp): cover component policy before tool input preprocessing by @erichare in #16046

Full Changelog: v1.13.0...v1.13.1

What's Changed

🐛 Bug Fixes

• fix: backport 1.13.1 fixes and image security updates to 1.12.9 by @erichare in #16119
• fix: absorb lxml and Mako image workarounds for 1.12.9 by @erichare in #16123

Full Changelog: v1.12.8...v1.12.9

What's Changed

✨ New Features

• feat(admin): add team and user administration API and CLI by @erichare in #14782
• feat(authz): add enterprise directory provenance and CLI by @erichare in #14841
• feat: add FunASR transcription component by @LauraGPT in #14225
• feat: add Plivo bundle with SMS, voice call, and number lookup components by @sarveshpatil-plivo in #14396
• feat(integrations): add lfx connection resolution contract by @erichare in #14919
• feat(integrations): load bundle capability manifests by @erichare in #14920
• feat(bundles): add Serply search extension bundle by @googio in #14626
• feat(integrations): add persistent connection API by @erichare in #14921
• feat(api): add enterprise pre-creation hook registry for projects, users and roles by @erichare in #14959
• feat: add Figranium bundle by @erichare in #15058
• feat(integrations): broker delegated OAuth connections by @erichare in #14935
• feat(integrations): resolve connections per execution principal across entry points by @erichare in #14946
• feat(integrations): govern integration providers and actions through the shared policy bundle by @erichare in #14947
• feat(mcp): pinned action-to-tool mode with a typed incompatible-tool error by @erichare in #14948
• feat(lfx-google): Google Workspace actions on managed connections by @erichare in #14950
• feat(integrations): add Microsoft and Slack connection-backed bundles by @erichare in #14952
• feat(frontend): render connection_ref fields with a connection picker (INT-8) by @erichare in #15165
• feat(api): list OAuth registrations a caller may authorize (INT-8) by @erichare in #15166
• feat(integrations): GA validation for dedicated integrations (INT-14 / LE-2472) by @erichare in #15167
• feat(triggers): trigger entity, event ledger, and the triggers API (TRG-2 part 1) by @erichare in #14956
• feat(triggers): leased dispatcher, retries, dead-lettering, and the executing identity (TRG-2 part 2) by @erichare in #14957
• feat(triggers): base trigger component, the schedule trigger, and flow-save reconciliation (TRG-2 part 3) by @erichare in #14958
• feat(bundles): add Serping API search extension bundle by @musabgultekin in #15221
• feat(triggers): the langflow listeners process, connection leases, and packaging (TRG-3) by @erichare in #15233
• feat(triggers): signed push ingress, inbound webhook trigger, and subscription renewal by @erichare in #15234
• feat(telemetry): report the database engine in the version event by @ogabrielluiz in #15106
• feat(triggers): Slack message and reaction triggers on the Events API and Socket Mode by @erichare in #15333
• feat(frontend): drop a bundle's own name from its components' palette labels by @erichare in #15390
• feat(i18n): add Korean (ko) locale for the UI and component descriptions by @pjw81226 in #15312
• feat(jobs): opt-in retention for terminal jobs by @erichare in #15316
• feat: multi-user editing safety by @Cristhianzl in #14903
• feat(triggers): add Microsoft and Google source events by @erichare in #15396
• feat(deployments): add atomic replacement and snapshots (LE-2717) by @jordanrfrazier in #15313
• feat: background execution job metrics for 1.13 by @erichare in #15314
• feat(kb): write precomputed vectors to a knowledge base without re-embedding by @ogabrielluiz in #15098
• feat(files): add relocate-files to copy uploaded file bytes into S3 by @ogabrielluiz in #15240
• feat(db): add a command to convert a SQLite database to Postgres by @ogabrielluiz in #15111
• feat: replace local Chroma knowledge bases with SQLite by @erichare in #15509
• feat(kb): add relocate-kb to move knowledge base vectors between backends by @ogabrielluiz in #15099
• feat(cli): add check-integrity to report where an instance disagrees with itself by @ogabrielluiz in #15324
• feat(deployments): declare required model providers and models in deploy artifacts by @Jkavia in #15548
• feat(cli): add --json output to convert-sqlite-to-postgres by @ogabrielluiz in #15524
• feat(cli): add migration-preflight to refuse a migration that cannot succeed by @ogabrielluiz in #15327
• feat(cli): add --json output to relocate-files and check the bucket first by @ogabrielluiz in #15525
• feat(i18n): translate the remaining backend strings to Korean by @pjw81226 in #15435
• feat: Add Enterprise navigation seams by @deon-sanchez in #15467
• feat: application audit log for flows and projects by @Cristhianzl in #15082
• feat(kb): add --json output to relocate-kb and keep stored content out of errors by @ogabrielluiz in #15527
• feat: add GDPR data subject erase and requests by @Cristhianzl in #15470
• feat(api): run migration commands as child processes that outlive a request by @ogabrielluiz in #15580
• feat(api): add a write pause for instance migration by @ogabrielluiz in #15562
• feat(cli): add --json output to check-integrity and migration-preflight by @ogabrielluiz in #15574
• feat(authz): add per-resource access exceptions by @olayinkaadelakun in #15133
• feat: route product telemetry through Segment by @vjgit96 in #15616
• feat(cli): accept the target's Langflow version in migration-preflight by @ogabrielluiz in #15575
• feat(api): run the migration source checks from superuser endpoints by @ogabrielluiz in #15576
• feat(frontend): add a guided Settings > Migration page for superusers by @ogabrielluiz in #15577
• feat(api): pause and resume changes from the migration endpoints by @ogabrielluiz in #15601
• feat(api): test and save the destination of a migration by @ogabrielluiz in #15602
• feat(api): confirm the secret key reached the new instance by @ogabrielluiz in #15603
• feat(api): back up an instance before its migration by @ogabrielluiz in #15604
• feat(flow-versions): keep versions an extension marks as retained by @jordanrfrazier in #15638
• feat(frontend): add the destinations step to the migration page by @ogabrielluiz in #15606
• feat(frontend): add the secret key step to the migration page by @ogabrielluiz in #15607
• feat(frontend): add the pause step to the migration page by @ogabrielluiz in #15608
• feat(frontend): add the backup step to the migration page by @ogabrielluiz in #15609
• feat(api): run the database copy from the migration endpoints by @ogabrielluiz in #15610
• feat(api): run the knowledge base and file copies from the migration endpoints by @ogabrielluiz in #15611
• feat(api): record what the admin decides about a migration copy by @ogabrielluiz in #15612
• feat(api): count a migration copy only for the destination it was made to by @ogabrielluiz in #15613
• feat(frontend): add the database copy to the migration page by @ogabrielluiz in #15621
• feat(frontend): add the knowledge base and file copies to the migration p...

What's Changed

🐛 Bug Fixes

• fix: normalize exported flow code before execution by @erichare in #15915
• fix: allow caller-supplied credentials in public MCP flows by @erichare in #15917

Full Changelog: v1.12.7...v1.12.8

What's Changed

🐛 Bug Fixes

• fix(security): validate OpenSearch connector URLs by @erichare in #15756
• fix(security): scope original-file S3 uploads by @erichare in #15757
• fix(deps): dependency upgrades for 1.12.7 by @Adam-Aghili in #15762
• fix(security): reject process and code loader capabilities by @erichare in #15758
• fix(api): reconstruct workflow status without component instantiation by @erichare in #15781
• fix(kb): honor environment fallback and redact connection errors by @erichare in #15783
• fix(security): preserve jq conditional expressions during validation by @erichare in #15782
• fix(security): block runtime object recovery in generated components by @erichare in #15873
• fix(security): enforce admin policy on public component builds by @erichare in #15874
• fix(security): reject runtime loader and environment capabilities by @erichare in #15879
• fix: backport runtime URL prefixes and cookie isolation to 1.12.7 by @erichare in #15880
• fix(security): enforce model policy in standalone builders by @erichare in #15877
• fix(security): restrict non-owner graph overrides and local cleanup by @erichare in #15878
• fix(security): separate saved flows from public history identifiers by @erichare in #15876
• fix(deps): keep core package versions aligned on 1.12.7 by @erichare in #15900

✅ Tests

• test(files): verify unsafe renames preserve safe downloads by @erichare in #15759

Full Changelog: v1.12.6...v1.12.7

What's Changed

🐛 Bug Fixes

• fix: reject reusing bundle releases published for another lfx line by @erichare in #15657
• fix(deps): dependency upgrades to 1.12.6 by @Adam-Aghili in #15654
• fix: 1.13.0 security backports to 1.12.6 by @Adam-Aghili in #15655
• fix(mcp): derive flow input schemas without running stored component code by @erichare in #15660
• fix: accept dictionary input in Type Convert JSON and Message outputs (LE-3003) by @erichare in #15680
• fix(lfx): handle numeric columns in Replace Value operation by @tarciorodrigues in #15719

✅ Tests

• test: make WebhookTest.json fixture hermetic by @erichare in #15724

Full Changelog: v1.12.5...v1.12.6

What's Changed

🐛 Bug Fixes

• fix(mcp): stop session leak and timeout retries by @Cristhianzl in #15460
• fix(mcp): bound server discovery concurrency and cleanup by @Adam-Aghili in #15522
• fix(mcp): forward global variable headers from the environment by @erichare in #15500
• fix(mcp): redact server credentials from management responses by @erichare in #15529
• fix(a2a): enforce authenticated execution policy by @erichare in #15530
• fix(security): restrict built-in code execution to administrators by @erichare in #15531
• fix(security): confine stored chat attachments to authorized storage by @erichare in #15532
• fix(deps): upgrade vulnerable dependencies for 1.12.5 by @Adam-Aghili in #15505
• fix(lfx): stop Data addition from mutating the left operand's lists by @viktoravelino in #15514
• fix(mcp): replace a pooled session whose server died by @Cristhianzl in #15469
• fix(memory): preserve cancelled ingestion status on release-1.12.5 by @erichare in #15554
• fix(lfx): match numeric columns in the Filter equals operators by @MohammadHijjawi97 in #15486
• fix(api): bound the session list returned by /monitor/messages/sessions by @AhsanAkhlaq in #15466
• fix(lfx): skip the markdown delimiter row in Text to DataFrame by @MohammadHijjawi97 in #15485
• fix(tools): disambiguate duplicate tool names by @Cristhianzl in #15556
• fix(mcp): resolve tool arguments from configured values by @erichare in #15565
• fix: preserve source columns when merging tables by @LimbC-C in #15543
• fix(playground): keep new chats out of older sessions now that the session list is capped by @viktoravelino in #15581

New Contributors

• @MohammadHijjawi97 made their first contribution in #15486
• @LimbC-C made their first contribution in #15543

Full Changelog: v1.12.4...v1.12.5

What's Changed

🐛 Bug Fixes

• fix: reject mixed blocked DNS answers with IP allowlists by @erichare in #15334
• fix(agent): compute recursion_limit accounting for middleware graph nodes by @premtiwari508 in #15362
• fix(ci): keep PR filenames out of shell scripts by @erichare in #15328
• fix(twelvelabs): confine Split Video file reads by @erichare in #15336
• fix(auth): replace Passlib with bcrypt on release-1.12.4 by @erichare in #15368
• fix(api): fail closed on unowned v1 build jobs by @erichare in #15335
• fix: enforce admin policy for assistant execution by @erichare in #15337
• fix(lfx): skip unsupported files when errors are silent by @erichare in #15329
• fix: scope chat memory operations to flow and owner by @erichare in #15346
• fix: validate public flows after group expansion by @erichare in #15342
• fix(tracing): isolate tracer startup failures on 1.12.4 by @erichare in #15364
• fix(amazon): correct S3 uploader strategy and file inputs on 1.12.4 by @erichare in #15366
• fix(ssrf): pin direct Requests helper connections by @erichare in #15340
• fix: validate database connector bootstrap targets by @erichare in #15332
• fix: allow administrator-scoped database TLS files by @erichare in #15405
• fix: reject ambiguous Couchbase IPv4 seed prefixes by @erichare in #15406
• fix(frontend): keep model picked during a model refresh by @Cristhianzl in #15367
• fix(lfx): stop flow loads from resetting settings by @Cristhianzl in #15372
• fix: block known pickle deserializers in generated components by @erichare in #15345
• fix(security): protect Bing Search URL from run tweaks by @erichare in #15330
• fix: restrict Celery broker messages to JSON by @erichare in #15344
• fix(mcp): reject direct Node runtime options in stdio configs by @erichare in #15338
• fix(files): sanitize batch archive entry names by @erichare in #15339
• fix(agents): show iteration limit notice after text by @Cristhianzl in #15369
• fix(watsonx): validate credentials with a regional model by @erichare in #15353
• fix: hide stored flow credentials from shared readers by @erichare in #15343
• fix(deps): 1.12.4 dependency upgrades by @Adam-Aghili in #15427
• fix: surface credential decryption failures at the default log level by @erichare in #15434
• fix(knowledge-bases): keep ingested chunks within Chunk Size when a separator is set by @erichare in #15421
• fix(authz): allow only one role per user per assignment scope by @erichare in #15426
• fix(schema): sanitize underscore-prefixed field names in create_input_schema_from_json_schema by @TINGyu123644 in #15411
• fix(lfx): keep table markdown proportional to data by @Cristhianzl in #15370
• fix(lfx): apply Chat Output clean data to single tables by @Cristhianzl in #15420
• fix(lfx): reject inputs shadowed by component methods by @Cristhianzl in #15373
• fix(authz): reject unknown result and actor_type filters on the audit query by @tarciorodrigues in #15424
• fix(release): scope the bundle PyPI guard to the build's lfx line by @erichare in #15437
• fix(authz): reject role assignments for inactive users by @erichare in #15453
• fix(frontend): keep flow lock saved during node update by @Cristhianzl in #15439

📝 Documentation Updates

• docs: custom component and local DB hardening by @mendonk in #15431

✅ Tests

• test: give TestPerformIngestionTask its own database by @erichare in #15423

New Contributors

• @premtiwari508 made their first contribution in #15362
• @TINGyu123644 made their first contribution in #15411

Full Changelog: v1.12.3...v1.12.4

What's Changed

✨ New Features

• feat(assistant): slash command menu and 100-step budget by @Cristhianzl in #15149
• feat(agui): let callers opt out of graph state on the stream by @ogabrielluiz in #15054

🐛 Bug Fixes

• fix(frontend): keep assistant reopenable mid-run by @Cristhianzl in #15136
• fix(mcp): 404 for missing servers on GET and PATCH by @Cristhianzl in #15130
• fix(frontend): report deleted MCP servers on edit by @Cristhianzl in #15132
• fix(frontend): keep GB18030 characters in downloaded project filenames by @viktoravelino in #15104
• fix(settings): keep database credentials out of settings errors and console tracebacks by @erichare in #15147
• fix(opensearch): select k-NN method by engine instead of hardcoding disk_ann by @erichare in #15142
• fix(export): keep global-variable bindings in flow and project exports by @erichare in #15143
• fix(kb): scope OpenSearch and Chroma Cloud knowledge base storage by owner by @erichare in #15148
• fix(mcp): stop project name prefix from blocking creation by @Cristhianzl in #15144
• fix(mcp): connect SSE-mode servers over SSE by @Cristhianzl in #15145
• fix(mcp): accept the tool names the MCP server publishes by @tarciorodrigues in #15179
• fix(lfx): name real PyPI packages in provider install hints by @erichare in #15189
• fix(security): pin IDN hosts by punycode and fail closed on DNS pin-map misses (LE-2544) by @erichare in #15171
• fix(security): canonicalize tempfile._os/_sys re-exports in component code scanner by @erichare in #15190
• fix(security): Scope frozen vertex result cache to executing principal by @erichare in #15191
• fix(security): Enforce aggregate expanded-size limit for flow ZIP imports by @erichare in #15196
• fix(security): Strip secret field values before publishing components to the Store by @erichare in #15192
• fix(security): apply the caller-aware component policy to nested flow graphs by @erichare in #15209
• fix(security): SSRF-validate OpenSearch and Chroma Cloud knowledge-base connection targets by @erichare in #15197
• fix(security): eliminate cache deserialization RCE paths (H1-3982189) by @erichare in #15199
• fix(connectors): call central SSRF guard in six unguarded connectors by @erichare in #15200
• fix(security): resolve str.join in Agentic Assistant code scanner by @erichare in #15195
• fix(security): close pathlib/io/codecs scanner bypass and stop validate_code from executing imports by @erichare in #15201
• fix(security): proxy allow-listed modules in Python REPL to block transitive sys.modules escape by @erichare in #15198
• fix(kb): SSRF-validate tenant-controlled OpenSearch and Chroma Cloud KB backend URLs by @erichare in #15207
• fix(security): Guard provider base_url against SSRF and credential exfiltration by @erichare in #15208
• fix(security): enforce fs_path containment in batch flow creation by @erichare in #15206
• fix(security): close scan_code_security sandbox-escape bypasses (getattr dynamic-dunder + PyYAML) by @erichare in #15202
• fix(security): close stdlib re-export bypass in component code scanner by @erichare in #15204
• fix(security): de-duplicate the SSRF guards left by today's four-PR merge train by @erichare in #15246
• fix(kb): require an operator-chosen destination for the network KB backends by @erichare in #15244
• fix(security): block vars()/mapping dunder-key sandbox escapes in code scanner by @erichare in #15194
• fix(security): close dynamic-getattr AST sandbox bypass in component code scanner by @erichare in #15205
• fix(security): Enforce local-file-access containment on FileContentRetriever persistent_dir by @erichare in #15193
• fix(security): Block jq $ENV/env server-environment disclosure in data components by @erichare in #15203
• fix(checkpoint): drop model state that cannot be validated back on resume by @erichare in #15241
• fix: Run Flow returns empty content when an Agent calls it as a tool by @erichare in #15242
• fix(security): default LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS to true by @erichare in #15210
• fix(security): Block environment-provisioned provider credentials from tenant-chosen endpoints by @erichare in #15211
• fix(mcp): stop Chinese project names from collapsing onto one server name by @viktoravelino in #15141
• fix(lfx): read chat attachments through the storage service by @RostiBer in #15249
• fix: honor CIDR allowlists for HTTP provider endpoints by @erichare in #15262
• fix(deps): cap SQLModel before timezone storage changes by @erichare in #15265

📝 Documentation Updates

• docs(security): warn when multi-user mode runs custom components unrestricted (LE-2533) by @erichare in #15169

🛠 Maintenance Tasks

• chore: 1.12.3 dep upgrade by @Adam-Aghili in #15245
• chore(bundles): bump lfx-google to 0.2.2 so the 1.12.3 release build can restamp by @erichare in #15250

New Contributors

• @RostiBer made their first contribution in #15249

Full Changelog: v1.12.2...v1.12.3