From feacbd797d813393f472fde88146614f3ab2a405 Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Tue, 18 Aug 2026 16:13:14 -0400 Subject: [PATCH 01/20] docs: clean up observability --- docs/docs/Develop/logging.mdx | 6 +++--- docs/docs/Develop/observability-grafana-loki.mdx | 9 +++++++-- docs/docs/Develop/observability-new-relic.mdx | 1 - docs/docs/Develop/observability-opentelemetry.mdx | 4 +--- docs/docs/Lfx/lfx-overview.mdx | 1 + docs/sidebars.js | 5 ++--- 6 files changed, 14 insertions(+), 12 deletions(-) diff --git a/docs/docs/Develop/logging.mdx b/docs/docs/Develop/logging.mdx index 333f40474dcf..a18a06596d04 100644 --- a/docs/docs/Develop/logging.mdx +++ b/docs/docs/Develop/logging.mdx @@ -44,7 +44,7 @@ To customize log storage locations and behaviors, set the following [Langflow en | `LANGFLOW_LOG_TRACE_LOCALS` | Boolean | `false` | Include frame locals in structured tracebacks. Off by default because locals can leak secrets; enable only for local debugging. | | `LANGFLOW_NATIVE_TRACING` | Boolean | `true` | Enables the tracer to record execution traces in the Langflow database for use in Trace View. Set to `false` to disable. | | `LANGFLOW_PRETTY_LOGS` | Boolean | `True` | Controls output format when `LANGFLOW_LOG_ENV=default` or unset. `true`: [`ConsoleRenderer`](https://www.structlog.org/en/stable/console-output.html) (human-readable). `false`: JSON format. | -| `LANGFLOW_SERVICE_NAME` | String | `langflow` | Value of the `service` field on every JSON log record. Used as a label by log aggregators. See [Grafana and Loki](./observability-grafana-loki.mdx). | +| `LANGFLOW_SERVICE_NAME` | String | `langflow` | Value of the `service` field on every JSON log record. Used as a label by log aggregators. See [Grafana Loki](./observability-grafana-loki.mdx). | | `LANGFLOW_VERSION` | String | Not set | Adds a `version` field to every JSON log record when set. Omitted otherwise. | ## View logs in real-time @@ -264,8 +264,8 @@ If `opentelemetry-api` is installed and an active span is present, every log rec ## See also -* [Grafana and Loki](./observability-grafana-loki.mdx) +* [Grafana Loki](./observability-grafana-loki.mdx) * [Logs endpoints](/api-logs) * [Memory management options](/memory) * [Configure an external PostgreSQL database](/configuration-custom-database) -* [Grafana and Loki](./observability-grafana-loki.mdx) \ No newline at end of file +* [Grafana Loki](./observability-grafana-loki.mdx) \ No newline at end of file diff --git a/docs/docs/Develop/observability-grafana-loki.mdx b/docs/docs/Develop/observability-grafana-loki.mdx index d041030bff23..90a3d97df191 100644 --- a/docs/docs/Develop/observability-grafana-loki.mdx +++ b/docs/docs/Develop/observability-grafana-loki.mdx @@ -1,9 +1,13 @@ --- -title: Grafana and Loki +title: Grafana Loki slug: /observability-grafana-loki --- -Langflow can emit structured JSON logs for ingestion by [Grafana Loki](https://grafana.com/oss/loki/). + +This demonstration scrapes Langflow log files with [Promtail](https://grafana.com/docs/loki/latest/send-data/promtail/), and then sends JSON logs to [Grafana Loki](https://grafana.com/oss/loki/) to be viewed in a Grafana dashboard. + +It is _not_ OpenTelemetry. +For traces, metrics, and OTLP logs to Grafana Cloud or an OpenTelemetry Collector, see [OpenTelemetry](/observability-opentelemetry). This page demonstrates how to connect Langflow to the [reference Grafana stack](https://github.com/langflow-ai/langflow/tree/main/deploy/observability/grafana-loki) shipped with the Langflow repository. For more information, see the [README](https://github.com/langflow-ai/langflow/tree/main/deploy/observability/grafana-loki). @@ -53,5 +57,6 @@ To consume structured Langflow logs with other ingestion providers, see [Logs](/ ## See also +* [OpenTelemetry](/observability-opentelemetry) * [Logs](/logging) * [Logs endpoints](/api-logs) diff --git a/docs/docs/Develop/observability-new-relic.mdx b/docs/docs/Develop/observability-new-relic.mdx index 87cbe6caad22..e6d4d670542b 100644 --- a/docs/docs/Develop/observability-new-relic.mdx +++ b/docs/docs/Develop/observability-new-relic.mdx @@ -1,7 +1,6 @@ --- title: New Relic slug: /observability-new-relic -description: Export Langflow traces, metrics, and logs to New Relic over OTLP, and verify the data actually landed. --- New Relic accepts OpenTelemetry data over OTLP, so Langflow exports to it with configuration only and no vendor code. diff --git a/docs/docs/Develop/observability-opentelemetry.mdx b/docs/docs/Develop/observability-opentelemetry.mdx index af1ca8638613..a59481ce20d1 100644 --- a/docs/docs/Develop/observability-opentelemetry.mdx +++ b/docs/docs/Develop/observability-opentelemetry.mdx @@ -1,7 +1,6 @@ --- title: OpenTelemetry slug: /observability-opentelemetry -description: Export Langflow service health, flow execution spans, and runtime metrics to any OpenTelemetry backend. --- Langflow emits OpenTelemetry traces, metrics, and logs describing the health of the Langflow service itself: request rate, error rate, duration, runtime health, and one span per flow run. @@ -117,8 +116,7 @@ A successful send is not proof that your backend kept the data. Some backends ac ## Vendor guides -- [New Relic](./observability-new-relic.mdx) -- [Grafana and Loki](/observability-grafana-loki) +- [New Relic](./observability-new-relic.mdx) — OTLP export to New Relic. ## See also diff --git a/docs/docs/Lfx/lfx-overview.mdx b/docs/docs/Lfx/lfx-overview.mdx index 1d7602b3aa44..a5bbbaba5cb4 100644 --- a/docs/docs/Lfx/lfx-overview.mdx +++ b/docs/docs/Lfx/lfx-overview.mdx @@ -39,6 +39,7 @@ LFX provides two sets of commands: | [`lfx run`](./lfx-run) | Execute a flow locally and stream results to `stdout` | | [`lfx prewarm`](./lfx-prewarm) | Pre-warm core component imports and optional flows before a fork or snapshot | | [`lfx-mcp`](./lfx-mcp) | Start an MCP server that connects to a running Langflow instance | +| `lfx observability doctor` | Send a probe span, metric, and log to the configured OTLP endpoint. See [OpenTelemetry](/observability-opentelemetry#verify-your-configuration). | For the LFX runtime commands, see [Run flows with LFX](./lfx-run) and [Serve flows with LFX](./lfx-serve). diff --git a/docs/sidebars.js b/docs/sidebars.js index 3e46c0b6c382..ad2ec43520d7 100644 --- a/docs/sidebars.js +++ b/docs/sidebars.js @@ -172,17 +172,16 @@ module.exports = { type: "category", label: "Observability", items: [ - "Develop/logging", "Develop/observability-opentelemetry", "Develop/observability-new-relic", + "Develop/logging", "Develop/observability-grafana-loki", "Develop/traces", { type: "category", - label: "Monitoring", + label: "LLM tracing", items: [ "Develop/integrations-arize", - "Develop/observability-grafana-loki", "Develop/integrations-langfuse", "Develop/integrations-langsmith", "Develop/integrations-langwatch", From 45dc1ea41086951628e32e78ca6836a611d56166 Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Wed, 19 Aug 2026 09:57:38 -0400 Subject: [PATCH 02/20] docs: link env vars entry out to otel page --- docs/docs/Develop/environment-variables.mdx | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/docs/docs/Develop/environment-variables.mdx b/docs/docs/Develop/environment-variables.mdx index ccbfa814f05b..bbb347e2cfad 100644 --- a/docs/docs/Develop/environment-variables.mdx +++ b/docs/docs/Develop/environment-variables.mdx @@ -403,7 +403,10 @@ For multi-worker tuning—including the Redis job queue and Gunicorn worker sett ### Monitoring and metrics -For environment variables for specific monitoring service providers, see the Langflow monitoring integration guides, such as [Langfuse](/integrations-langfuse) and [Best practices for Langflow on Kubernetes](/deployment-prod-best-practices). +For OpenTelemetry traces, metrics, and logs that describe Langflow service health, see [OpenTelemetry](/observability-opentelemetry). + +For prompt-level LLM tracing, see [Langfuse](/integrations-langfuse) and the other monitoring integrations. +For Prometheus on Kubernetes, see [Best practices for Langflow on Kubernetes](/deployment-prod-best-practices). ### Server @@ -435,7 +438,9 @@ For database environment variables, including PostgreSQL configuration, see [Mem ### Telemetry -See [Telemetry](/contributing-telemetry). +Anonymous product usage telemetry is separate from OpenTelemetry export. +See [Telemetry](/contributing-telemetry) to opt out with `DO_NOT_TRACK`. +For OTLP export to your own backend, see [OpenTelemetry](/observability-opentelemetry). ### Visual editor and Playground behavior From 9c4995335b8cc0c76ed36f737564d60fb204ec2e Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Wed, 19 Aug 2026 10:06:03 -0400 Subject: [PATCH 03/20] docs: plain OTLP --- docs/docs/Develop/observability-opentelemetry.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/docs/Develop/observability-opentelemetry.mdx b/docs/docs/Develop/observability-opentelemetry.mdx index a59481ce20d1..4bdd340b0f5a 100644 --- a/docs/docs/Develop/observability-opentelemetry.mdx +++ b/docs/docs/Develop/observability-opentelemetry.mdx @@ -7,7 +7,7 @@ Langflow emits OpenTelemetry traces, metrics, and logs describing the health of This telemetry answers operator questions, such as which flows are failing, whether the service is slow, and where the time went. It is not LLM tracing. Langflow deliberately withholds prompts, completions, and other flow payloads from this export. For prompt-level tracing, use one of the [monitoring integrations](/integrations-langfuse) instead. -There is no vendor code in the Langflow runtime. Langflow speaks plain OTLP, so any OpenTelemetry-compatible backend works, either directly or through an OpenTelemetry Collector. +Langflow speaks plain OTLP, so any OpenTelemetry-compatible backend works, either directly or through an OpenTelemetry Collector. ## Prerequisites From d6efc52b961b5cee7bf75633ce0bcc4ca9593bd0 Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Fri, 21 Aug 2026 14:26:18 -0400 Subject: [PATCH 04/20] docs: bundle installation and langflow-core changes --- docs/docs/Components/components-bundles.mdx | 9 +- .../docs/Deployment/docker-image-profiles.mdx | 33 +- .../Develop/install-custom-dependencies.mdx | 19 +- docs/docs/Develop/knowledge.mdx | 5 + docs/docs/Lfx/extensions-bundle-list.mdx | 43 ++- docs/docs/Lfx/extensions-overview.mdx | 2 + docs/docs/Lfx/lfx-compatibility.mdx | 1 + docs/docs/Support/release-notes.mdx | 282 +----------------- .../_partial-bundle-graduated-install.mdx | 81 +++-- .../_partial-bundle-lfx-bundles-install.mdx | 2 +- .../_partial-extension-bundle-install.mdx | 4 +- docs/docs/_partial-opt-in-bundles.mdx | 38 +++ 12 files changed, 171 insertions(+), 348 deletions(-) create mode 100644 docs/docs/_partial-opt-in-bundles.mdx diff --git a/docs/docs/Components/components-bundles.mdx b/docs/docs/Components/components-bundles.mdx index 377cdc001cc5..e73552da7733 100644 --- a/docs/docs/Components/components-bundles.mdx +++ b/docs/docs/Components/components-bundles.mdx @@ -52,10 +52,11 @@ If all else fails, you can always create your own [custom components](/component ## Install bundle components {#bundle-install} -`uv pip install langflow` includes the default curated provider set, but not the -`lfx-bundles` long tail or the opt-in arXiv, DuckDuckGo, EmpirioLabs, Exa, -Firecrawl, NextPlaid, Paddle, and Valkey standalone packages. Install the -supported torch-free full profile with `uv pip install "langflow[bundles]"`. +`uv pip install langflow` includes the default curated provider set. +It does _not_ include the 73 opt-in bundles listed in +[Additional bundles](/extensions-bundle-list#additional-bundles). +Install a missing provider, or install the supported torch-free full +profile with `uv pip install "langflow[bundles]"`. If you install `lfx` directly or need to add bundles to an existing environment, see [Install LFX with bundle components](./lfx-install#install-with-bundle-components). diff --git a/docs/docs/Deployment/docker-image-profiles.mdx b/docs/docs/Deployment/docker-image-profiles.mdx index c529a75fc279..290fb52fe343 100644 --- a/docs/docs/Deployment/docker-image-profiles.mdx +++ b/docs/docs/Deployment/docker-image-profiles.mdx @@ -3,25 +3,32 @@ title: Choose a Langflow Docker image slug: /deployment/docker-image-profiles --- -Langflow publishes three application image profiles. They share the same -frontend, non-root runtime, health check, SSRF defaults, and `langflow` -executable. Choose the smallest profile that contains every extension used by -your flows. +Langflow publishes three application image profiles from +`docker/build_and_push.Dockerfile` (`base`, `full`, and `full-bundles`). +They share the same frontend, non-root runtime (uid 1000), +`LANGFLOW_AUTO_LOGIN=false`, and `langflow` executable. +None of them install PyTorch or TorchVision. +All three include the `postgresql` extra so they can use an external Postgres +database without a derived image. +Choose the smallest profile that contains every extension used by your flows. | Profile | Docker Hub image | GitHub Container Registry image | Included inventory | | --- | --- | --- | --- | -| Base | `langflowai/langflow:base-VERSION` | `ghcr.io/langflow-ai/langflow:base-VERSION` | The runnable `langflow-base` application and built-in LFX components, without provider extension distributions | -| Default | `langflowai/langflow:VERSION` | `ghcr.io/langflow-ai/langflow:VERSION` | Base plus the curated standalone `lfx-*` extensions included by `pip install langflow` | -| Extended | `langflowai/langflow-all:VERSION` | `ghcr.io/langflow-ai/langflow-all:VERSION` | The `langflow[bundles]` inventory: default plus the no-Torch long tail and opt-in standalone extensions | +| Base | `langflowai/langflow:base-VERSION` | `ghcr.io/langflow-ai/langflow:base-VERSION` | `langflow-base` plus built-in LFX components. No `lfx-*` provider packages. | +| Default | `langflowai/langflow:VERSION` | `ghcr.io/langflow-ai/langflow:VERSION` | Base plus the curated standalone `lfx-*` packages from `uv pip install langflow` | +| Extended | `langflowai/langflow-all:VERSION` | `ghcr.io/langflow-ai/langflow-all:VERSION` | Default plus `langflow[bundles]`: the no-Torch long tail and opt-in standalones, including Confluent | The base and default profiles use the `langflow` image repository. The extended profile uses the separate `langflow-all` repository. All three profiles use the -same Langflow 1.12 version; the base image isn't independently versioned. - -The base profile intentionally contains no provider extension distributions, -PyTorch, or TorchVision. A flow that references an omitted component cannot run -until you select a profile that provides it or install the reviewed extension -in a derived image. +same Langflow 1.12 version. +As of Langflow 1.12.x, there is no `langflow-core` image, and earlier `core-*` tags are not published. + +The base image is a complete, minimal Langflow with no provider extensions, +not only the [additional bundles](/extensions-bundle-list#additional-bundles) +omitted from the default `langflow` install. +The default image matches `uv pip install langflow`. +A flow that references an omitted component cannot run until you select a +profile that provides it, or install the reviewed extension in a derived image. ## Pin a release diff --git a/docs/docs/Develop/install-custom-dependencies.mdx b/docs/docs/Develop/install-custom-dependencies.mdx index 0878a211f4ba..05ce5e6dc9a5 100644 --- a/docs/docs/Develop/install-custom-dependencies.mdx +++ b/docs/docs/Develop/install-custom-dependencies.mdx @@ -7,8 +7,8 @@ Langflow provides optional dependency groups and support for custom dependencies The Langflow codebase uses three package layers: -* The full package (`langflow`) is managed by the root-level `pyproject.toml`. It depends on `langflow-base` and adds the curated standalone `lfx-*` provider extensions. -* The runnable base package (`langflow-base`) is managed at `src/backend/base/pyproject.toml`. It provides the UI, API, platform services, and built-in components without provider extension distributions. It depends on `lfx`. +* The minimal application (`langflow-base`) is managed at `src/backend/base/pyproject.toml`. As of Langflow 1.12, it is a complete Langflow install: UI, API, platform services, built-in components, and the `langflow` command, without provider extensions. It is version-aligned with `langflow`, and depends on `lfx`. There is no `langflow-core` package. +* The full package (`langflow`) is managed by the root-level `pyproject.toml`. It depends on the same `langflow-base` version and adds the curated standalone `lfx-*` provider extensions. * The `lfx` package is managed at `src/lfx/pyproject.toml`. LFX is a lightweight CLI tool for executing and serving Langflow flows. The `lfx` package does not provide optional dependency groups for end users. ## Install custom dependencies in Langflow Desktop {#langflow-desktop} @@ -55,8 +55,8 @@ uv pip install "langflow[postgresql,audio]" ``` Use the `bundles` extra to install every no-Torch long-tail bundle plus the -arXiv, DuckDuckGo, EmpirioLabs, Exa, Firecrawl, NextPlaid, Paddle, and Valkey -standalone extensions: +opt-in standalone extensions listed in +[Additional bundles](/extensions-bundle-list#additional-bundles): ```bash uv pip install "langflow[bundles]" @@ -64,11 +64,12 @@ uv pip install "langflow[bundles]" ### Install optional dependency groups for `langflow-base` -`langflow-base` is recommended when you want the runnable Langflow UI and API -without provider extensions. It includes platform services such as Redis, -Chroma, MCP, Kubernetes, object storage, and tracing support. The `langflow` -package depends on this same version of `langflow-base` and adds curated -standalone extensions. +`langflow-base` is the minimal workable Langflow: the UI, API, platform +services, and built-in components, without provider extensions. It is +version-aligned with `langflow` starting with version 1.12.0. It includes platform +services such as Redis, Chroma, MCP, Kubernetes, object storage, and +tracing support. The `langflow` package depends on this same version of +`langflow-base` and adds curated standalone extensions. The `langflow-base` package provides its own optional dependency groups that are separate from those in the `langflow` package. The `langflow-base` package can be installed as a standalone package with these optional dependency groups. diff --git a/docs/docs/Develop/knowledge.mdx b/docs/docs/Develop/knowledge.mdx index c5008892243e..af3f197276d2 100644 --- a/docs/docs/Develop/knowledge.mdx +++ b/docs/docs/Develop/knowledge.mdx @@ -30,6 +30,11 @@ Alternatively, you can use [knowledge bases](#knowledge-bases), which include bu Vector store components read and write to vector databases. Typically, these components connect to remote databases, but some vector store components support local databases. +As of Langflow 1.12, most vector store bundles, including the **Chroma DB** component in the visual editor, are not in the default Langflow installation. +Knowledge bases still use local Chroma storage in the default installation. +You will have to install any additional vector store providers. +FOr more information, see [Additional bundles](/extensions-bundle-list#additional-bundles). + import PartialVectorRagBlurb from '@site/docs/_partial-vector-rag-blurb.mdx'; diff --git a/docs/docs/Lfx/extensions-bundle-list.mdx b/docs/docs/Lfx/extensions-bundle-list.mdx index 7fc63984fb87..2a261c71a266 100644 --- a/docs/docs/Lfx/extensions-bundle-list.mdx +++ b/docs/docs/Lfx/extensions-bundle-list.mdx @@ -3,6 +3,8 @@ title: Bundle list slug: /extensions-bundle-list --- +import PartialOptInBundles from '@site/docs/_partial-opt-in-bundles.mdx'; + This page lists every official Langflow bundle and the pip **extension** package that ships it. Bundle names are stable identifiers used in saved flows (`ext::@official`). The pip install command is what you run when a bundle is missing from your environment. @@ -10,38 +12,49 @@ The pip install command is what you run when a bundle is missing from your envir This list reflects the bundles included with Langflow 1.12.0. Providers can graduate from `lfx-bundles` to a standalone `lfx-` package without changing the bundle name in your flows. -## Standalone packages +## Additional bundles {#additional-bundles} + + + +## Standalone packages included by default These providers ship as their own pip packages, each on its own release cadence. -The default `uv pip install langflow` includes the curated standalone packages -except arXiv, DuckDuckGo, EmpirioLabs, Exa, Firecrawl, NextPlaid, Paddle, and -Valkey. Install those eight together with every no-Torch long-tail bundle by -using `uv pip install "langflow[bundles]"`. +The default `uv pip install langflow` includes the following curated standalone packages. | Bundle | Install command | | --- | --- | | [`amazon`](/bundles-amazon) (Amazon) | `uv pip install lfx-amazon` | | [`anthropic`](/bundles-anthropic) (Anthropic) | `uv pip install lfx-anthropic` | -| [`arxiv`](/bundles-arxiv) (arXiv) | `uv pip install lfx-arxiv` | | [`azure`](/bundles-azure) (Azure) | `uv pip install lfx-azure` | | [`cohere`](/bundles-cohere) (Cohere) | `uv pip install lfx-cohere` | | [`datastax`](/bundles-datastax) (DataStax) | `uv pip install lfx-datastax` | | [`docling`](/bundles-docling) (Docling) | `uv pip install lfx-docling` | -| [`duckduckgo`](/bundles-duckduckgo) (DuckDuckGo) | `uv pip install lfx-duckduckgo` | -| [`empiriolabs`](./bundles-empiriolabs) (EmpirioLabs) | `uv pip install lfx-empiriolabs` | -| [`exa`](/bundles-exa) (Exa) | `uv pip install lfx-exa` | -| [`firecrawl`](/bundles-firecrawl) (Firecrawl) | `uv pip install lfx-firecrawl` | | [`google`](/bundles-google) (Google components) | `uv pip install lfx-google` | | [`ibm`](/bundles-ibm) (IBM) | `uv pip install lfx-ibm` | -| [`nextplaid`](./bundles-nextplaid) (NextPlaid) | `uv pip install lfx-nextplaid` | | [`ollama`](/bundles-ollama) (Ollama) | `uv pip install lfx-ollama` | | [`openai`](/bundles-openai) (OpenAI) | `uv pip install lfx-openai` | -| [`openai-compatible`](./bundles-openai-compatible) (OpenAI Compatible) | `uv pip install lfx-openai-compatible` | -| [`oracle`](./bundles-oracle) (Oracle) | `uv pip install lfx-oracle` | -| [`paddle`](./bundles-paddle) (Paddle) | `uv pip install lfx-paddle` | -| [`valkey`](./bundles-valkey) (Valkey) | `uv pip install lfx-valkey` | +| [`openai-compatible`](/bundles-openai-compatible) (OpenAI Compatible) | `uv pip install lfx-openai-compatible` | +| [`oracle`](/bundles-oracle) (Oracle) | `uv pip install lfx-oracle` | | [`vllm`](/bundles-vllm) (vLLM) | `uv pip install lfx-vllm` | +## Opt-in standalone packages + +These providers also ship as standalone `lfx-*` packages, but they are **not** +included in `uv pip install langflow`. Install one package, or install all +eight together with every no-Torch long-tail bundle by using +`uv pip install "langflow[bundles]"`. + +| Bundle | Install command | +| --- | --- | +| [`arxiv`](/bundles-arxiv) (arXiv) | `uv pip install lfx-arxiv` | +| [`duckduckgo`](/bundles-duckduckgo) (DuckDuckGo) | `uv pip install lfx-duckduckgo` | +| [`empiriolabs`](/bundles-empiriolabs) (EmpirioLabs) | `uv pip install lfx-empiriolabs` | +| [`exa`](/bundles-exa) (Exa) | `uv pip install lfx-exa` | +| [`firecrawl`](/bundles-firecrawl) (Firecrawl) | `uv pip install lfx-firecrawl` | +| [`nextplaid`](/bundles-nextplaid) (NextPlaid) | `uv pip install lfx-nextplaid` | +| [`paddle`](/bundles-paddle) (Paddle) | `uv pip install lfx-paddle` | +| [`valkey`](/bundles-valkey) (Valkey) | `uv pip install lfx-valkey` | + ## Long-tail bundles (`lfx-bundles`) These providers ship inside the `lfx-bundles` metapackage. diff --git a/docs/docs/Lfx/extensions-overview.mdx b/docs/docs/Lfx/extensions-overview.mdx index 3878520b0e2e..c09c2ec335d8 100644 --- a/docs/docs/Lfx/extensions-overview.mdx +++ b/docs/docs/Lfx/extensions-overview.mdx @@ -12,6 +12,8 @@ This bundle is the same group that related components are listed under in the vi Instead of every integration being built into `langflow`, you install the extensions you need. Saved flows reference bundles by stable IDs (`ext::@official`), not by pip package name, so a provider can move between packages without breaking your flows. +Starting in Langflow 1.12, the default `uv pip install langflow` install omits 73 provider bundles. For more information, see [Additional bundles](/extensions-bundle-list#additional-bundles). + To install extensions and bundle components, see [Install LFX with bundle components](./lfx-install#install-with-bundle-components). To build your own extension, see [Build your first extension](./extensions-quickstart). diff --git a/docs/docs/Lfx/lfx-compatibility.mdx b/docs/docs/Lfx/lfx-compatibility.mdx index 671d0555feef..95a7b41911e9 100644 --- a/docs/docs/Lfx/lfx-compatibility.mdx +++ b/docs/docs/Lfx/lfx-compatibility.mdx @@ -117,6 +117,7 @@ This is equivalent to installing `lfx` plus `lfx-bundles[all]`, including the to It does **not** install graduated standalone packages such as `lfx-openai` or `lfx-exa`. `uv pip install langflow` installs the curated standalone `lfx-*` packages without `lfx-bundles`. Use `uv pip install "langflow[bundles]"` to add the reviewed `lfx-bundles[all-no-torch]` profile plus the opt-in arXiv, DuckDuckGo, EmpirioLabs, Exa, Firecrawl, NextPlaid, Paddle, and Valkey standalone packages while keeping the full Langflow application torch-free. +For the providers omitted from the default install, see [Additional bundles](/extensions-bundle-list#additional-bundles). For a slimmer image, install only the provider packages a deployment actually executes, for example `uv pip install lfx lfx-openai "lfx-bundles[qdrant]"`. There is intentionally no `lfx[all]` extra. Install `lfx-bundles` explicitly for long-tail providers, or install only the provider extras you need to avoid the full torch-inclusive `[all]` set. Some components require a [torch opt-in install](./components-bundle-components#torch-opt-in). diff --git a/docs/docs/Support/release-notes.mdx b/docs/docs/Support/release-notes.mdx index 0518d9f34475..ee1d7271d9d9 100644 --- a/docs/docs/Support/release-notes.mdx +++ b/docs/docs/Support/release-notes.mdx @@ -48,290 +48,24 @@ To avoid the impact of potential breaking changes and test new versions, the Lan ## 1.12.x -Langflow 1.12 consolidates the runnable application on `langflow-base`. -`pip install langflow-base` now provides the UI, API, platform services, built-in -components, and the `langflow` command without provider extension -distributions. `pip install langflow` installs that same base version and adds -the curated standalone `lfx-*` extensions. +Highlights of this release include the following changes. For all changes, see the [Changelog](https://github.com/langflow-ai/langflow/releases/latest). ### Breaking changes -- `langflow-base` version alignment +- `langflow-base` is now the minimal install - The runnable package starts at `langflow-base==1.12.0` and remains - version-aligned with `langflow` through stable, release-candidate, patch, - and nightly releases. A dependency such as `langflow-base~=0.12` remains on - the old package line and must be updated explicitly to select 1.12. - Before upgrading an existing environment, remove the retired package with - `pip uninstall langflow-core`; leaving an older `langflow-core` installed - can create conflicting dependency requirements. + Langflow 1.12 makes `langflow-base` a complete, version-aligned installation of the Langflow application. -- Base command and image tags +- Ongoing breaking changes: bundle separation - The base package provides the `langflow` executable, not a - `langflow-base` executable. The canonical bundle-free container is - `langflowai/langflow:base-VERSION`; normal `langflowai/langflow:VERSION` - tags contain the curated distribution. The previous `core-*` image profile - is no longer published. + Bundle separation concludes in 1.12. + `uv pip install langflow` no longer installs all provider bundles, and includes only a curated list of providers. -- Cassandra and Policies components are extensions - - Cassandra components now ship in `lfx-datastax`, and the - `PoliciesComponent` ships in `lfx-toolguard`. The full `langflow` package - includes both. Existing component class names and legacy Python import - paths remain compatible. For a base-only environment, add the extensions - with `pip install "lfx[cassandra,toolguard]"`. - Policies guard caches are now isolated under - `tmp_toolguard/{user}/{flow}/{component}/{project}`. Existing project-only - caches are not reused after upgrading; run **Generate** once before using - **Guard** in an upgraded flow. - -- The default `langflow` provider set is smaller - - arXiv, DuckDuckGo, EmpirioLabs, Exa, Firecrawl, NextPlaid, Paddle, and - Valkey are no longer installed by plain `pip install langflow`. Use - `pip install "langflow[bundles]"` to add those standalone extensions - together with every no-Torch long-tail bundle. - -- PyTorch remains opt-in - - The default base and curated Langflow installations do not install PyTorch - or TorchVision. Components that require them must be installed through an - explicit opt-in profile. - -- IBM watsonx Orchestrate clients move to the IBM extension - - The base deployment adapter remains feature-flagged, but its client - dependencies now ship with `lfx-ibm`. Install `lfx-ibm` or use the - compatibility extra `langflow-base[ibm-watsonx-clients]` before enabling - the adapter in a base-only environment. - -- LiteLLM remains optional in base-only environments - - `langflow-base` no longer imports LiteLLM by default. Install - `langflow-base[litellm]` when custom components or IDE tooling depend on - the LiteLLM compatibility surface. + For more information, see [Additional bundles](extensions-bundle-list#additional-bundles). ## 1.11.x -Highlights of this release include the following changes. -For all changes, see the [Changelog](https://github.com/langflow-ai/langflow/releases). - -:::tip -If Langflow fails to start with a `get_body_field` error after installing version 1.11.0, see [`get_body_field` error after installing Langflow](/troubleshoot#get_body_field-error-after-installing-langflow). -::: - -### Breaking changes - -- Short `LANGFLOW_SECRET_KEY` upgrade compatibility - - Langflow 1.10.1 changed how secrets shorter than 32 characters derive the Fernet key used for encrypted credentials. - Langflow 1.11.x retains read compatibility with credentials encrypted by the earlier derivation while continuing to use the current SHA-256 derivation for all new writes. - - If your deployment uses a `LANGFLOW_SECRET_KEY` shorter than 32 characters, keep it unchanged during the initial upgrade so Langflow can continue to decrypt existing credentials. - Langflow logs a startup warning for this configuration because short secrets aren't recommended for production. - To replace the key, first record or export the stored credentials, set a randomly generated key of at least 32 characters, and then re-enter the credentials; changing the key directly invalidates ciphertext created with the old key. - -- Default superuser password removed - - Langflow no longer creates or accepts the legacy `langflow`/`langflow` default superuser credentials. - If `LANGFLOW_AUTO_LOGIN=False`, set `LANGFLOW_SUPERUSER_PASSWORD` to a strong password before startup. - The legacy value `langflow` is not allowed, even if `LANGFLOW_AUTO_LOGIN=True`. - - ```bash - export LANGFLOW_SUPERUSER_PASSWORD=SUPERUSER_PASSWORD - ``` - - Replace `SUPERUSER_PASSWORD` with a strong password for the Langflow superuser. - - If `LANGFLOW_AUTO_LOGIN=true`, setting `LANGFLOW_SUPERUSER_PASSWORD` is optional. If you omit it, Langflow generates a random bootstrap password for the auto-login account. - - If you're running Langflow with Docker and `LANGFLOW_AUTO_LOGIN=false`, pass the password at startup: - - ```bash - docker run -d \ - --name ${CONTAINER_NAME} \ - --restart unless-stopped \ - -p 7860:7860 \ - -e LANGFLOW_HOST=0.0.0.0 \ - -e LANGFLOW_PORT=7860 \ - -e LANGFLOW_AUTO_LOGIN=false \ - -e LANGFLOW_SUPERUSER_PASSWORD=SUPERUSER_PASSWORD \ - -v langflow-data:/app/langflow \ - ${IMAGE} - ``` - - Replace `SUPERUSER_PASSWORD` with a strong password for the Langflow superuser. - -- Docker images disable auto-login by default - - Official Langflow Docker images set `LANGFLOW_AUTO_LOGIN=false`. - You must set `LANGFLOW_SUPERUSER_PASSWORD` (and optionally `LANGFLOW_SUPERUSER`) before the container can start, unless you explicitly set `LANGFLOW_AUTO_LOGIN=true`. - - For more information, see [Docker image defaults](/deployment-docker#docker-image-security-defaults). - - - Docker runtime home moved to `/app/data` - - Patched 1.11 Docker images set `HOME=/app/data` so the non-root runtime user has a writable home directory. - When `LANGFLOW_CONFIG_DIR` isn't set, the default config directory therefore changes from `/opt/app-root/src/.cache/langflow` to `/app/data/.cache/langflow`; SQLite follows that directory when `LANGFLOW_SAVE_DB_IN_CONFIG_DIR=true`. - Persist `/app/data` or set `LANGFLOW_CONFIG_DIR` to your existing writable data directory before upgrading to preserve existing data. - - - Long-tail component bundles are now opt-in - - Starting in Langflow 1.11.x, `pip install langflow` no longer installs the long-tail providers in the `lfx-bundles` metapackage. - If an existing flow uses components such as Chroma, Ollama, Qdrant, Redis, PGVector, Tavily, Wikipedia, MongoDB, Weaviate, or Milvus, install the metapackage in the same environment after upgrading: - - ```bash - pip install lfx-bundles - ``` - - You can instead install one provider and its dependencies, for example `pip install "lfx-bundles[qdrant]"`. - Missing-provider errors use the same install guidance. - Graduated providers such as OpenAI, Anthropic, Cohere, and Exa remain part of the default Langflow installation through their standalone `lfx-*` packages. - - For the complete package list and provider-specific commands, see [Extension bundle list](./extensions-bundle-list). - -- PyTorch components are opt-in by default - - **CUGA**, **Code Agents**, and **Docling** local conversion are excluded from the default `uv pip install langflow` installation because they require PyTorch. - - To install these components, see [Torch opt-in installs](./components-bundle-components#torch-opt-in). - -- Workflow API request schema (Beta) - - The v2 [Workflow API (Beta)](/workflow-api) request body and interaction pattern changes in 1.11. - Any client that calls `POST /api/v2/workflows` against 1.10.x must update as follows: - - Example 1.10.x request: - - ```json - { - "flow_id": "67ccd2be-17f0-8190-81ff-3bb2cf6508e6", - "background": false, - "inputs": { - "ChatInput-abc.input_value": "what is 2+2", - "LLMComponent-123.temperature": 0.7 - } - } - ``` - - Example 1.11.x request: - - ```json - { - "flow_id": "67ccd2be-17f0-8190-81ff-3bb2cf6508e6", - "input_value": "what is 2+2", - "mode": "stream", - "stream_protocol": "agui", - "tweaks": { - "LLMComponent-123": { - "temperature": 0.7 - } - } - } - ``` - - For more information, see [Workflow API (Beta)](/workflow-api). - -- Input Schema pane replaced by in-component Parameters - - The **Input Schema** pane under **Share** > **API access** is removed, but the fields can still be exposed to requests. - The `tweaks` object in API requests is unchanged. - **Endpoint Name** remains available from the **API access** pane. - - For details, see [Tweaks (API inputs)](/concepts-publish#input-schema). - -### New features and enhancements - -- Human-in-the-Loop (HITL) - - Human-in-the-Loop (HITL) pauses an agent when the agent calls a tool and creates a stateful checkpoint. - After a human responds by approving, rejecting, or editing the request, the agent resumes from the checkpoint. - - For more information, see [Human-in-the-Loop](./human-in-the-loop). - -- Agent2Agent (A2A) protocol support - - Publish a flow as an A2A agent so other agents can discover and call it, and call remote A2A agents from inside a flow with the **A2A Agent** component. - - For more information, see [Use Langflow as an A2A server](./a2a-server) and the [**A2A Agent** component](./a2a-agent-component). - -- AG-UI compatible streaming for the Workflow API - - The v2 [Workflow API](/workflow-api) now supports streaming with the [AG-UI (Agent–User Interaction) protocol](https://docs.ag-ui.com/introduction) streaming format. - - For more information, see [Workflow API (Beta)](/workflow-api#stream-with-ag-ui). - -- OpenAI Compatible model provider - - Point Langflow's model provider at any OpenAI-compatible endpoint, and Langflow discovers models live from the `/v1/models` endpoint. - These models can power flows, Langflow Assistant, and any component that uses Langflow’s global model providers. - - For more information, see [OpenAI Compatible](./bundles-openai-compatible). - -- Unified **Data Operations** component - - **Text Operations**, **JSON Operations**, and **Table Operations** are consolidated into a single [**Data Operations** component](./operations). - Saved flows that use the separate components continue to work. - For more information, see the [**Data Operations** component](./operations). - -- IBM watsonx Orchestrate: Python 3.14 compatibility - - The `ibm-watsonx-orchestrate-core` and `ibm-watsonx-orchestrate-clients` packages are upgraded to version 2.12, which supports Python 3.14. - IBM watsonx Orchestrate is no longer excluded from Python 3.14 installs. - - For more information, see [Deploy flows on watsonx Orchestrate](/deployment-wxo). - - The following optional integrations remain excluded from installations on Python 3.14: - - - [ALTK](/bundles-altk) - - [CUGA](/bundles-cuga) - - [LangWatch](/integrations-langwatch) - - [Pinecone](/bundles-pinecone) - - [OpenDsStar](/bundles-files-ingestion) - - [litellm](/bundles-lite-llm) - - [opik](/integrations-opik) - - [toolguard](/policies) - -- NextPlaid multi-vector bundle - - The **NextPlaid** bundle adds two new components for ColBERT-style multi-vector retrieval. - - The **NextPlaid** vector store, backed by a running [NextPlaid](https://github.com/meetdoshi90/next-plaid) server, stores each document as a matrix of token embeddings, and the **vLLM Multivector Embeddings** component generates the token-level multi-vector embeddings required by NextPlaid. - - For more information, see [NextPlaid bundle](./bundles-nextplaid). - -- PaddleOCR bundle - - The **Paddle** bundle (`lfx-paddle`) adds a **PaddleOCR** component that calls the PaddleOCR AI Studio Job API for layout-aware document parsing into Markdown. - - For more information, see [Paddle bundle](./bundles-paddle). - -- Oracle Extension bundle - - The **Oracle** bundle adds Oracle Database integration for vector search, document loading, and embeddings. - - For more information, see [Oracle bundle](./bundles-oracle). - -- Valkey bundle - - The **Valkey** bundle adds a vector store and chat memory components for [Valkey](https://valkey.io/), an open-source Redis fork. - - For more information, see [Valkey bundle](./bundles-valkey). - -- LFX is now engine-only - - `uv pip install lfx` now installs the LFX executor only, with no bundle components included. - `uv pip install langflow` installs the server and curated standalone providers, but not the long-tail `lfx-bundles` metapackage. - - If your flows use long-tail bundle components, install the required packages in the same environment. - - About 70 long-tail providers ship in the `lfx-bundles` metapackage. - Install one provider with `uv pip install "lfx-bundles[]"`, or install every long-tail provider with `uv pip install "lfx[bundles]"`. - Graduated providers, such as OpenAI, Anthropic, Cohere, and Exa, ship as individual packages and are installed separately with `uv pip install lfx-`. - - The `lfx-bundles` long tail is opt-in for both `lfx` and `langflow` installations. - For more information, see [Extensions overview](./extensions-overview). +For 1.11.x release notes, see the [1.11.x documentation](https://docs.langflow.org/1.11.0/release-notes). ## 1.10.x diff --git a/docs/docs/_partial-bundle-graduated-install.mdx b/docs/docs/_partial-bundle-graduated-install.mdx index b8d929fa0126..bb07d88bf7fc 100644 --- a/docs/docs/_partial-bundle-graduated-install.mdx +++ b/docs/docs/_partial-bundle-graduated-install.mdx @@ -2,30 +2,30 @@ import Admonition from '@theme/Admonition'; export const GraduatedBundleInstall = ({ packageName }) => { const providers = { - 'amazon': { name: 'Amazon Bedrock', coreSupport: true }, - 'anthropic': { name: 'Anthropic', coreSupport: true }, - 'arxiv': { name: 'arXiv Search', coreSupport: false }, - 'azure': { name: 'Azure AI Foundry', coreSupport: true }, - 'cohere': { name: 'Cohere', coreSupport: true }, - 'confluent': { name: 'IBM Confluent', coreSupport: false }, - 'datastax': { name: 'DataStax', coreSupport: false }, - 'docling': { name: 'Docling', coreSupport: false }, - 'duckduckgo': { name: 'DuckDuckGo Search', coreSupport: false }, - 'empiriolabs': { name: 'EmpirioLabs', coreSupport: false }, - 'exa': { name: 'Exa', coreSupport: false }, - 'firecrawl': { name: 'Firecrawl', coreSupport: false }, - 'ibm': { name: 'IBM', coreSupport: true }, - 'nextplaid': { name: 'NextPlaid', coreSupport: false }, - 'ollama': { name: 'Ollama', coreSupport: true }, - 'openai': { name: 'OpenAI', coreSupport: true }, - 'openai-compatible': { name: 'OpenAI Compatible', coreSupport: false }, - 'oracle': { name: 'Oracle', coreSupport: false }, - 'paddle': { name: 'PaddleOCR', coreSupport: false }, - 'valkey': { name: 'Valkey', coreSupport: false }, - 'vllm': { name: 'vLLM', coreSupport: false }, + 'amazon': { name: 'Amazon Bedrock', coreSupport: true, inDefault: true }, + 'anthropic': { name: 'Anthropic', coreSupport: true, inDefault: true }, + 'arxiv': { name: 'arXiv Search', coreSupport: false, inDefault: false }, + 'azure': { name: 'Azure AI Foundry', coreSupport: true, inDefault: true }, + 'cohere': { name: 'Cohere', coreSupport: true, inDefault: true }, + 'confluent': { name: 'IBM Confluent', coreSupport: false, inDefault: false }, + 'datastax': { name: 'DataStax', coreSupport: false, inDefault: true }, + 'docling': { name: 'Docling', coreSupport: false, inDefault: true }, + 'duckduckgo': { name: 'DuckDuckGo Search', coreSupport: false, inDefault: false }, + 'empiriolabs': { name: 'EmpirioLabs', coreSupport: false, inDefault: false }, + 'exa': { name: 'Exa', coreSupport: false, inDefault: false }, + 'firecrawl': { name: 'Firecrawl', coreSupport: false, inDefault: false }, + 'ibm': { name: 'IBM', coreSupport: true, inDefault: true }, + 'nextplaid': { name: 'NextPlaid', coreSupport: false, inDefault: false }, + 'ollama': { name: 'Ollama', coreSupport: true, inDefault: true }, + 'openai': { name: 'OpenAI', coreSupport: true, inDefault: true }, + 'openai-compatible': { name: 'OpenAI Compatible', coreSupport: false, inDefault: true }, + 'oracle': { name: 'Oracle', coreSupport: false, inDefault: true }, + 'paddle': { name: 'PaddleOCR', coreSupport: false, inDefault: false }, + 'valkey': { name: 'Valkey', coreSupport: false, inDefault: false }, + 'vllm': { name: 'vLLM', coreSupport: false, inDefault: true }, }; - const { name, coreSupport } = providers[packageName] ?? { name: packageName, coreSupport: false }; + const { name, coreSupport, inDefault } = providers[packageName] ?? { name: packageName, coreSupport: false, inDefault: false }; return ( @@ -35,15 +35,34 @@ export const GraduatedBundleInstall = ({ packageName }) => { This bundle adds an enhanced {name} component with additional provider-specific parameters.

)} -

- If you installed lfx directly (not as part of langflow), install the {name} bundle separately: -

-
    -
  1. Run uv pip install lfx-{packageName}.
    2. -
  2. Restart Langflow.
    3. -
  3. To confirm the bundle loaded, run lfx extension list.
    4. -
-

If you installed Langflow with uv pip install langflow, these bundle components are already included.

+ {inDefault ? ( + <> +

+ If you installed lfx directly (not as part of langflow), install the {name} bundle separately: +

+
    +
  1. Run uv pip install lfx-{packageName}.
    2. +
  2. Restart Langflow.
    3. +
  3. To confirm the bundle loaded, run lfx extension list.
    4. +
+

If you installed Langflow with uv pip install langflow, these bundle components are already included.

+ + ) : ( + <> +

+ This bundle is not included in the default uv pip install langflow install. Add it with: +

+
    +
  1. Run uv pip install lfx-{packageName}.
    2. +
  2. Restart Langflow.
    3. +
  3. To confirm the bundle loaded, run lfx extension list.
    4. +
+

+ To install every no-Torch opt-in provider at once, run uv pip install "langflow[bundles]". + For the full opt-in list, see Additional bundles. +

+ + )}

For more information, see Install LFX with bundle components.

 ); diff --git a/docs/docs/_partial-bundle-lfx-bundles-install.mdx b/docs/docs/_partial-bundle-lfx-bundles-install.mdx index cc3d4a459b4b..03fae2c09be7 100644 --- a/docs/docs/_partial-bundle-lfx-bundles-install.mdx +++ b/docs/docs/_partial-bundle-lfx-bundles-install.mdx @@ -8,5 +8,5 @@ uv pip install "lfx-bundles[]" Replace `` with this page's provider name, for example `qdrant`. For a torch-free full Langflow install, run `uv pip install "langflow[bundles]"`. For standalone LFX with every long-tail provider, including torch-based providers, run `uv pip install "lfx[bundles]"`. -See the [Bundle list](./extensions-bundle-list) for the exact extra name. +See [Additional bundles](/extensions-bundle-list#additional-bundles) for the exact extra name. ::: diff --git a/docs/docs/_partial-extension-bundle-install.mdx b/docs/docs/_partial-extension-bundle-install.mdx index c75a7c0b6438..3b2e7a286e0d 100644 --- a/docs/docs/_partial-extension-bundle-install.mdx +++ b/docs/docs/_partial-extension-bundle-install.mdx @@ -1,4 +1,6 @@ -`uv pip install langflow` installs bundle components automatically. +`uv pip install langflow` installs a curated provider set. +Long-tail bundles and eight standalone packages are opt-in in Langflow 1.12. +See [Additional bundles](/extensions-bundle-list#additional-bundles). `uv pip install lfx` installs the core LFX executor _only_, with no provider bundles included. diff --git a/docs/docs/_partial-opt-in-bundles.mdx b/docs/docs/_partial-opt-in-bundles.mdx new file mode 100644 index 000000000000..8c031db07785 --- /dev/null +++ b/docs/docs/_partial-opt-in-bundles.mdx @@ -0,0 +1,38 @@ +Starting in Langflow 1.12, `uv pip install langflow` includes a curated provider set only. +The following 73 bundles are **not** installed by default. Each is a one-line install. + +Install one long-tail provider: + +```bash +uv pip install "lfx-bundles[]" +``` + +Install one opt-in standalone package (`arxiv`, `duckduckgo`, `empiriolabs`, `exa`, `firecrawl`, `nextplaid`, `paddle`, or `valkey`): + +```bash +uv pip install lfx- +``` + +Install every no-Torch opt-in provider at once, including those standalone packages: + +```bash +uv pip install "langflow[bundles]" +``` + +Restart Langflow after installing. To confirm a bundle loaded, run `lfx extension list`. +The extra name is the identifier shown, such as `groq` or `exa`. + +Knowledge bases still use local Chroma storage in the default install. +The **Chroma DB** bundle component in the visual editor is opt-in. + +### Model providers (20) + +[`aiml`](/bundles-aiml) · [`baidu`](/bundles-baidu) · [`cloudflare`](/bundles-cloudflare) · [`cometapi`](/bundles-cometapi) · [`deepseek`](/bundles-deepseek) · [`empiriolabs`](/bundles-empiriolabs) · [`groq`](/bundles-groq) · [`huggingface`](/bundles-huggingface) · [`litellm`](/bundles-lite-llm) · [`lmstudio`](/bundles-lmstudio) · [`maritalk`](/bundles-maritalk) · [`mistral`](/bundles-mistralai) · `notdiamond` · [`novita`](/bundles-novita) · [`nvidia`](/bundles-nvidia) · [`openrouter`](/bundles-openrouter) · [`perplexity`](/bundles-perplexity) · [`sambanova`](/bundles-sambanova) · [`vertexai`](/bundles-vertexai) · [`xai`](/bundles-xai) + +### Vector stores and memory (19) + +[`chroma`](/bundles-chroma) · [`clickhouse`](/bundles-clickhouse) · [`couchbase`](/bundles-couchbase) · [`elastic`](/bundles-elastic) · [`faiss`](/bundles-faiss) · [`mem0`](/bundles-mem0) · [`milvus`](/bundles-milvus) · [`mongodb`](/bundles-mongodb) · `needle` · [`pgvector`](/bundles-pgvector) · [`pinecone`](/bundles-pinecone) · [`qdrant`](/bundles-qdrant) · [`redis`](/bundles-redis) · [`supabase`](/bundles-supabase) · [`upstash`](/bundles-upstash) · [`valkey`](/bundles-valkey) · [`vectara`](/bundles-vectara) · [`weaviate`](/bundles-weaviate) · `zep` + +### Tools, search, and integrations (34) + +`agentql` · [`altk`](/bundles-altk) · [`apify`](/bundles-apify) · [`arxiv`](/bundles-arxiv) · [`assemblyai`](/bundles-assemblyai) · [`bing`](/bundles-bing) · [`cleanlab`](/bundles-cleanlab) · [`composio`](/bundles-composio) · `confluence` · [`duckduckgo`](/bundles-duckduckgo) · [`exa`](/bundles-exa) · [`firecrawl`](/bundles-firecrawl) · `git` · [`glean`](/bundles-glean) · `homeassistant` · [`icosacomputing`](/bundles-icosacomputing) · `jigsawstack` · `langwatch` · [`nextplaid`](/bundles-nextplaid) · [`notion`](/bundles-notion) · `olivya` · [`paddle`](/bundles-paddle) · `scrapegraph` · [`searchapi`](/bundles-searchapi) · `serpapi` · `spider` · `tavily` · `twelvelabs` · `unstructured` · `vlmrun` · [`wikipedia`](/bundles-wikipedia) · `wolframalpha` · `yahoosearch` · `youtube` From 7e910901b92ed827d9cd9593345dbd3f07d4686c Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Mon, 24 Aug 2026 12:52:44 -0400 Subject: [PATCH 05/20] docs: admin page changes --- docs/docs/API-Reference/api-users.mdx | 3 + .../Develop/api-keys-and-authentication.mdx | 190 +++++++++++++++--- docs/docs/Support/release-notes.mdx | 11 + docs/docs/Support/troubleshooting.mdx | 3 +- 4 files changed, 183 insertions(+), 24 deletions(-) diff --git a/docs/docs/API-Reference/api-users.mdx b/docs/docs/API-Reference/api-users.mdx index 10243f2cb12e..c75b2028f916 100644 --- a/docs/docs/API-Reference/api-users.mdx +++ b/docs/docs/API-Reference/api-users.mdx @@ -34,6 +34,9 @@ import exampleJavascriptApiUsersDeleteUser from '!!raw-loader!@site/docs/API-Ref Use the `/users` endpoint to manage user accounts in Langflow. +As of Langflow 1.12, there is no **Admin Page** in the visual editor. +Superusers add, activate, list, and delete users, set **Superuser**, and reset passwords through the `/users` API. + ## Add user Create a new user account with a given username and password. diff --git a/docs/docs/Develop/api-keys-and-authentication.mdx b/docs/docs/Develop/api-keys-and-authentication.mdx index 7c48c32dfb99..53c373a3dc62 100644 --- a/docs/docs/Develop/api-keys-and-authentication.mdx +++ b/docs/docs/Develop/api-keys-and-authentication.mdx @@ -275,16 +275,17 @@ For more information, see [Secret Key Rotation](https://github.com/langflow-ai/l ### LANGFLOW_NEW_USER_IS_ACTIVE {#langflow-new-user-is-active} -When `LANGFLOW_NEW_USER_IS_ACTIVE=False` (default), accounts created by superusers are inactive by default and must be explicitly activated before users can sign in to the visual editor. -The superuser can also deactivate a user's account as needed. +When `LANGFLOW_NEW_USER_IS_ACTIVE=False` (default), new accounts are inactive until a superuser activates them with the [Users API](/api-users). +Inactive users cannot sign in to the visual editor. +The superuser can also deactivate an account with the same API. -When `LANGFLOW_NEW_USER_IS_ACTIVE=True`, accounts created by superusers are automatically activated. +When `LANGFLOW_NEW_USER_IS_ACTIVE=True`, new accounts are automatically activated. ```text LANGFLOW_NEW_USER_IS_ACTIVE=False ``` -Only superusers can manage user accounts for a Langflow server, but user management only matters if your server has authentication enabled. +Only superusers can manage user accounts for a Langflow server through the [Users API](/api-users). For more information, see [Start a Langflow server with authentication enabled](#start-a-langflow-server-with-authentication-enabled). ### LANGFLOW_ENABLE_SIGNUP {#langflow-enable-signup} @@ -294,7 +295,7 @@ This variable controls whether public self-registration is allowed at the `POST | Value | Description | |-------|-------------| | `True` (default) | Anyone can create a new Langflow account by calling the registration endpoint directly. | -| `False` | Public registration is disabled. Only superusers can create new accounts through the admin interface. | +| `False` | Public registration is disabled. Only superusers can create new accounts with the [Users API](/api-users). | Self-registration is always disabled when `LANGFLOW_AUTO_LOGIN=True`, because single-user mode has no multi-account concept. Superusers can create accounts regardless of this setting. @@ -453,18 +454,21 @@ LANGFLOW_CORS_ALLOW_METHODS=["GET","POST","PUT"] ### LANGFLOW_ACCESS_* and LANGFLOW_REFRESH_* {#session-cookie-hardening} -For a shared or public deployment served over HTTPS, harden the session cookies. These default to values that support local HTTP development and same-site deployments. The current frontend reads the access token in JavaScript, while the refresh token remains `HttpOnly`. +For a shared or public deployment served over HTTPS, harden the session cookies. +`Secure` and `SameSite` default to values that support local HTTP development. +Both the access and refresh cookies are `HttpOnly` by default; the browser sends them automatically with requests. Set both `LANGFLOW_ACCESS_SECURE` and `LANGFLOW_REFRESH_SECURE` to `True` for HTTPS deployments. Cross-site HTTPS deployments must also set `LANGFLOW_REFRESH_SAME_SITE=none`. | Variable | Format | Default | Description | |----------|--------|---------|-------------| | `LANGFLOW_ACCESS_SECURE` | Boolean | `False` | When `true`, the `access_token_lf` cookie is sent only over HTTPS. Recommended `true` for any HTTPS deployment. | -| `LANGFLOW_ACCESS_HTTPONLY` | Boolean | `False` | When `true`, the `access_token_lf` cookie is not readable by JavaScript. The default is `false` because the bundled frontend currently reads this cookie in JavaScript. | +| `LANGFLOW_ACCESS_HTTPONLY` | Boolean | `True` | When `true`, the `access_token_lf` cookie is not readable by JavaScript. Set to `false` only if a client must read this cookie in JavaScript. | | `LANGFLOW_ACCESS_SAME_SITE` | String | `lax` | The `SameSite` attribute of the access-token cookie (`lax`, `strict`, or `none`). | | `LANGFLOW_REFRESH_SECURE` | Boolean | `False` | When `true`, the `refresh_token_lf` cookie is sent only over HTTPS. Set this to `true` for any HTTPS deployment. | | `LANGFLOW_REFRESH_HTTPONLY` | Boolean | `True` | When `true`, the `refresh_token_lf` cookie is not readable by JavaScript. | | `LANGFLOW_REFRESH_SAME_SITE` | String | `lax` | The `SameSite` attribute of the refresh-token cookie (`lax`, `strict`, or `none`). | +| `LANGFLOW_COOKIE_DOMAIN` | String | Not set | Domain attribute for the access and refresh cookies. Leave unset for host-only cookies. Set to a parent domain, such as `.example.com`, when the frontend and API are on different subdomains. | ### Anonymous public-flow authorization @@ -755,7 +759,7 @@ LANGFLOW_REFRESH_TOKEN_EXPIRE_SECONDS=604800 # 7 days ## Start a Langflow server with authentication enabled {#start-a-langflow-server-with-authentication-enabled} This section shows you how to use the [authentication environment variables](/api-keys-and-authentication#authentication-environment-variables) to deploy a Langflow server with authentication enabled. -This involves disabling automatic login, setting superuser credentials, generating a secret encryption key, and enabling user management. +This involves disabling automatic login, setting superuser credentials, and generating a secret encryption key. This configuration is recommended for any deployment where Langflow is exposed to a shared or public network, or where multiple users access the same Langflow server. @@ -766,7 +770,8 @@ For more information, see [Docker image defaults](/deployment-docker#docker-imag ::: With authentication enabled, all users must sign in to the visual editor with valid credentials, and API requests require authentication with a Langflow API key. -Additionally, you must sign in as a superuser to manage users and [create a Langflow API key](#create-a-langflow-api-key) with superuser privileges. +Sign in as a superuser to [create a Langflow API key](#create-a-langflow-api-key) with superuser privileges. +User management is through the [Users API](/api-users), not the visual editor. ### Start the Langflow server @@ -778,12 +783,16 @@ Additionally, you must sign in as a superuser to manage users and [create a Lang LANGFLOW_SUPERUSER_PASSWORD= LANGFLOW_SECRET_KEY= LANGFLOW_NEW_USER_IS_ACTIVE=False + LANGFLOW_ENABLE_SIGNUP=False LANGFLOW_ENABLE_SUPERUSER_CLI=False ``` Your `.env` file can have other environment variables. This example focuses on authentication variables. + `LANGFLOW_ENABLE_SIGNUP=False` restricts account creation to superusers. + `LANGFLOW_NEW_USER_IS_ACTIVE=False` keeps new accounts inactive until you activate them with the Users API. + 2. Set `LANGFLOW_SUPERUSER_PASSWORD` to your desired superuser password. Optionally set `LANGFLOW_SUPERUSER` to override the default `langflow` username. For a one-time test, you can use basic credentials like `administrator` and `password`. @@ -803,6 +812,7 @@ Additionally, you must sign in as a superuser to manage users and [create a Lang LANGFLOW_SUPERUSER_PASSWORD=securepassword LANGFLOW_SECRET_KEY=dBuu...2kM2_fb LANGFLOW_NEW_USER_IS_ACTIVE=False + LANGFLOW_ENABLE_SIGNUP=False LANGFLOW_ENABLE_SUPERUSER_CLI=False ``` @@ -817,35 +827,169 @@ Additionally, you must sign in as a superuser to manage users and [create a Lang 6. Verify the server is running. The default location is `http://localhost:7860`. -Next, you can add users to your Langflow server to collaborate with others on flows. +Next, add users with the Users API so they can collaborate on flows. ### Manage users as an administrator -1. To complete your first-time login as a superuser, go to `http://localhost:7860/login`. +As of Langflow 1.12, Langflow OSS has no **Admin Page** in the visual editor. +Superusers add, activate, list, and delete users, set **Superuser**, and reset passwords with the [Users API](/api-users). + +1. To complete your first-time login as a superuser, navigate to `http://localhost:7860/login`. If you aren't using the default location, replace `localhost:7860` with your server's address. -2. Log in with the superuser credentials from your `.env`: the `LANGFLOW_SUPERUSER` username, or `langflow` if unset, and the `LANGFLOW_SUPERUSER_PASSWORD` password. +2. Log in with the password you set in `LANGFLOW_SUPERUSER_PASSWORD` and the username from `LANGFLOW_SUPERUSER`. + If you did not set `LANGFLOW_SUPERUSER`, the username is `langflow`. + +3. [Create a Langflow API key](#create-a-langflow-api-key) while signed in as the superuser. + User-management requests require a Langflow API key in the `x-api-key` header. + +4. Create a user: + + + -3. To manage users on your server, navigate to `/admin`, such as `http://localhost:7860/admin`, click your profile icon, and then click **Admin Page**. + ```python + import os - As a superuser, you can add users, set permissions, reset passwords, and delete accounts. + import requests -4. To add a user, click **New User**, and then complete the user account form: + base = os.environ["LANGFLOW_URL"] + headers = { + "Content-Type": "application/json", + "x-api-key": os.environ["LANGFLOW_API_KEY"], + } + payload = { + "username": "newuser", + "password": "securepassword123", + } + + response = requests.post(f"{base}/api/v1/users/", headers=headers, json=payload, timeout=30) + response.raise_for_status() + print(response.json()) + ``` + + + + + ```typescript + const url = `${process.env.LANGFLOW_URL}/api/v1/users/`; + + const response = await fetch(url, { + method: "POST", + headers: { + "Content-Type": "application/json", + "x-api-key": process.env.LANGFLOW_API_KEY!, + }, + body: JSON.stringify({ + username: "newuser", + password: "securepassword123", + }), + }); + + if (!response.ok) { + throw new Error(`HTTP ${response.status}`); + } + + console.log(await response.json()); + ``` + + + + + ```bash + curl -X POST \ + "$LANGFLOW_URL/api/v1/users/" \ + -H "Content-Type: application/json" \ + -H "x-api-key: $LANGFLOW_API_KEY" \ + -d '{ + "username": "newuser", + "password": "securepassword123" + }' + ``` + + + - 1. Enter a username and password. - 2. To activate the account immediately, select **Active**. Inactive users cannot sign in or access flows they created before becoming inactive. - 3. Deselect **Superuser** if you don't want the user to have full administrative privileges. - 4. Click **Save**. The new user appears in the **Admin Page**. + The response includes the user's `id`. + New accounts are inactive when `LANGFLOW_NEW_USER_IS_ACTIVE=False` (the default, and the value in the `.env` example above). + +5. Activate the account so the user can sign in. + Replace `USER_ID` with the `id` from the create response: + + + + + ```python + import os + + import requests + + base = os.environ["LANGFLOW_URL"] + user_id = "USER_ID" + headers = { + "Content-Type": "application/json", + "x-api-key": os.environ["LANGFLOW_API_KEY"], + } + payload = {"is_active": True} + + response = requests.patch( + f"{base}/api/v1/users/{user_id}", headers=headers, json=payload, timeout=30 + ) + response.raise_for_status() + print(response.json()) + ``` + + + + + ```typescript + const userId = "USER_ID"; + const url = `${process.env.LANGFLOW_URL}/api/v1/users/${userId}`; + + const response = await fetch(url, { + method: "PATCH", + headers: { + "Content-Type": "application/json", + "x-api-key": process.env.LANGFLOW_API_KEY!, + }, + body: JSON.stringify({ is_active: true }), + }); + + if (!response.ok) { + throw new Error(`HTTP ${response.status}`); + } + + console.log(await response.json()); + ``` + + + + + ```bash + curl -X PATCH \ + "$LANGFLOW_URL/api/v1/users/USER_ID" \ + -H "Content-Type: application/json" \ + -H "x-api-key: $LANGFLOW_API_KEY" \ + -d '{ + "is_active": true + }' + ``` + + + -5. Send the credentials to the user so they can sign in to Langflow. The superuser sets the initial password when creating the account, so users must receive their login credentials from the superuser. + To grant administrative privileges, include `"is_superuser": true` in the same request. + To list, deactivate, reset a password, or delete a user, see [Users endpoints](/api-users). -6. To test the new user's access, sign out of Langflow, and then sign in with the new user's credentials. +6. Send the username and password to the user. + The superuser sets the initial password when creating the account. - Try to access the `/admin` page. - You are redirected to the `/flows` page if the new user isn't a superuser. +7. To test the new user's access, sign out of Langflow, and then sign in at `/login` with the new user's credentials. + A non-superuser can use the visual editor and cannot call the Users API to manage other accounts. ## See also * [Langflow environment variables](/environment-variables) +* [Users endpoints](/api-users) * [Langflow Security Policy](https://github.com/langflow-ai/langflow/blob/main/SECURITY.md) — reporting vulnerabilities, security configuration, and [secret key rotation](https://github.com/langflow-ai/langflow/blob/main/SECURITY.md#secret-key-rotation) diff --git a/docs/docs/Support/release-notes.mdx b/docs/docs/Support/release-notes.mdx index ee1d7271d9d9..57847516cdb8 100644 --- a/docs/docs/Support/release-notes.mdx +++ b/docs/docs/Support/release-notes.mdx @@ -63,6 +63,17 @@ Highlights of this release include the following changes. For all changes, see t For more information, see [Additional bundles](extensions-bundle-list#additional-bundles). +- Admin Page removed + + Langflow OSS no longer includes an **Admin Page**. + The `/admin` route, the account-menu **Admin Page** link, and the user-management page are gone. + Superusers can no longer manage users or passwords in the visual editor. + + To manage users, use the [Users API](/api-users). + `/login/admin` is still the admin sign-in endpoint and page. + + For more information, see [Manage users as an administrator](/api-keys-and-authentication#manage-users-as-an-administrator). + ## 1.11.x For 1.11.x release notes, see the [1.11.x documentation](https://docs.langflow.org/1.11.0/release-notes). diff --git a/docs/docs/Support/troubleshooting.mdx b/docs/docs/Support/troubleshooting.mdx index 782c878db5da..b3a46891ab22 100644 --- a/docs/docs/Support/troubleshooting.mdx +++ b/docs/docs/Support/troubleshooting.mdx @@ -440,7 +440,8 @@ Therefore, you are locked out of this Langflow instance. If you aren't an administrator, then a superuser must create and activate a non-superuser account before you can sign in. -If you are the administrator, sign in with a superuser account, or restart Langflow with `LANGFLOW_AUTO_LOGIN=true`. +If you are the administrator, sign in with a superuser account, and then create and activate users with the [Users API](/api-users). +Alternatively, restart Langflow with `LANGFLOW_AUTO_LOGIN=true`. For more information, see [Start Langflow Server with authentication enabled](/api-keys-and-authentication#start-a-langflow-server-with-authentication-enabled). From 1096a846653158dd0305cbd0eefdd7daa6ac515b Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Mon, 24 Aug 2026 13:12:31 -0400 Subject: [PATCH 06/20] docs: bundle changes --- docs/docs/Components/bundles-paddle.mdx | 4 ++-- docs/docs/Components/components-bundles.mdx | 10 ++++++---- .../docs/Deployment/docker-image-profiles.mdx | 2 +- .../Develop/install-custom-dependencies.mdx | 7 +++---- docs/docs/Lfx/extensions-bundle-list.mdx | 20 ++++++++++--------- docs/docs/Lfx/lfx-compatibility.mdx | 10 +++++----- .../_partial-bundle-lfx-bundles-install.mdx | 4 ++-- .../_partial-extension-bundle-install.mdx | 16 +++++++-------- docs/docs/_partial-opt-in-bundles.mdx | 18 ++++++++--------- 9 files changed, 47 insertions(+), 44 deletions(-) diff --git a/docs/docs/Components/bundles-paddle.mdx b/docs/docs/Components/bundles-paddle.mdx index bfaba0636748..41d9f6899c34 100644 --- a/docs/docs/Components/bundles-paddle.mdx +++ b/docs/docs/Components/bundles-paddle.mdx @@ -28,8 +28,8 @@ Install it directly: uv pip install lfx-paddle ``` -Alternatively, include it with the other opt-in standalone and long-tail -bundles: +Alternatively, include it with the other opt-in standalone packages and +providers from `lfx-bundles`: ```bash uv pip install "langflow[bundles]" diff --git a/docs/docs/Components/components-bundles.mdx b/docs/docs/Components/components-bundles.mdx index e73552da7733..b7f391191c5a 100644 --- a/docs/docs/Components/components-bundles.mdx +++ b/docs/docs/Components/components-bundles.mdx @@ -62,12 +62,14 @@ If you install `lfx` directly or need to add bundles to an existing environment, ### Torch opt-in installs {#torch-opt-in} -The default `uv pip install langflow` and full `uv pip install "langflow[bundles]"` profiles do not install dependencies for components that require PyTorch. -The standalone `uv pip install "lfx[bundles]"` profile includes the torch-based long tail. +The default `uv pip install langflow` and full `uv pip install "langflow[bundles]"` installations do not install dependencies for components that require PyTorch. -As of Langflow 1.11.x, this list includes **CUGA**, **Code Agents**, and the **Docling** local parser. -To install PyTorch and the additional components, in your Langflow virtual environment, run `uv pip install "lfx-bundles[all]"`. +To install PyTorch and the components that require it, run the following in your Langflow virtual environment: + +```bash +uv pip install "lfx-bundles[all]" +``` ## Legacy bundles diff --git a/docs/docs/Deployment/docker-image-profiles.mdx b/docs/docs/Deployment/docker-image-profiles.mdx index 290fb52fe343..408708a44ed8 100644 --- a/docs/docs/Deployment/docker-image-profiles.mdx +++ b/docs/docs/Deployment/docker-image-profiles.mdx @@ -16,7 +16,7 @@ Choose the smallest profile that contains every extension used by your flows. | --- | --- | --- | --- | | Base | `langflowai/langflow:base-VERSION` | `ghcr.io/langflow-ai/langflow:base-VERSION` | `langflow-base` plus built-in LFX components. No `lfx-*` provider packages. | | Default | `langflowai/langflow:VERSION` | `ghcr.io/langflow-ai/langflow:VERSION` | Base plus the curated standalone `lfx-*` packages from `uv pip install langflow` | -| Extended | `langflowai/langflow-all:VERSION` | `ghcr.io/langflow-ai/langflow-all:VERSION` | Default plus `langflow[bundles]`: the no-Torch long tail and opt-in standalones, including Confluent | +| Extended | `langflowai/langflow-all:VERSION` | `ghcr.io/langflow-ai/langflow-all:VERSION` | Default plus `langflow[bundles]`: non-PyTorch providers from `lfx-bundles` and opt-in standalone packages, including Confluent | The base and default profiles use the `langflow` image repository. The extended profile uses the separate `langflow-all` repository. All three profiles use the diff --git a/docs/docs/Develop/install-custom-dependencies.mdx b/docs/docs/Develop/install-custom-dependencies.mdx index 05ce5e6dc9a5..b0ab50e8b641 100644 --- a/docs/docs/Develop/install-custom-dependencies.mdx +++ b/docs/docs/Develop/install-custom-dependencies.mdx @@ -54,8 +54,8 @@ To install multiple extras, use commas to separate each dependency group: uv pip install "langflow[postgresql,audio]" ``` -Use the `bundles` extra to install every no-Torch long-tail bundle plus the -opt-in standalone extensions listed in +Use the `bundles` extra to install the non-PyTorch providers from `lfx-bundles` plus the +opt-in standalone packages listed in [Additional bundles](/extensions-bundle-list#additional-bundles): ```bash @@ -66,8 +66,7 @@ uv pip install "langflow[bundles]" `langflow-base` is the minimal workable Langflow: the UI, API, platform services, and built-in components, without provider extensions. It is -version-aligned with `langflow` starting with version 1.12.0. It includes platform -services such as Redis, Chroma, MCP, Kubernetes, object storage, and +version-aligned with `langflow` starting with version 1.12.0. It includes platform services such as Redis, Chroma, MCP, Kubernetes, object storage, and tracing support. The `langflow` package depends on this same version of `langflow-base` and adds curated standalone extensions. diff --git a/docs/docs/Lfx/extensions-bundle-list.mdx b/docs/docs/Lfx/extensions-bundle-list.mdx index 2a261c71a266..ed690b92031d 100644 --- a/docs/docs/Lfx/extensions-bundle-list.mdx +++ b/docs/docs/Lfx/extensions-bundle-list.mdx @@ -39,14 +39,14 @@ The default `uv pip install langflow` includes the following curated standalone ## Opt-in standalone packages -These providers also ship as standalone `lfx-*` packages, but they are **not** -included in `uv pip install langflow`. Install one package, or install all -eight together with every no-Torch long-tail bundle by using +These providers are available as standalone `lfx-*` packages, but they are **not** included in `uv pip install langflow`. +Install one package, or install all of them together with the non-PyTorch providers in `lfx-bundles` by using `uv pip install "langflow[bundles]"`. | Bundle | Install command | | --- | --- | | [`arxiv`](/bundles-arxiv) (arXiv) | `uv pip install lfx-arxiv` | +| [`confluent`](/bundles-confluent) (IBM Confluent) | `uv pip install lfx-confluent` | | [`duckduckgo`](/bundles-duckduckgo) (DuckDuckGo) | `uv pip install lfx-duckduckgo` | | [`empiriolabs`](/bundles-empiriolabs) (EmpirioLabs) | `uv pip install lfx-empiriolabs` | | [`exa`](/bundles-exa) (Exa) | `uv pip install lfx-exa` | @@ -55,13 +55,14 @@ eight together with every no-Torch long-tail bundle by using | [`paddle`](/bundles-paddle) (Paddle) | `uv pip install lfx-paddle` | | [`valkey`](/bundles-valkey) (Valkey) | `uv pip install lfx-valkey` | -## Long-tail bundles (`lfx-bundles`) +## Providers in `lfx-bundles` {#lfx-bundles} -These providers ship inside the `lfx-bundles` metapackage. -Install one provider (with its SDK dependencies) with `uv pip install "lfx-bundles[]"`. -Install every long-tail provider with `uv pip install "lfx[bundles]"` or `uv pip install "lfx-bundles[all]"`. -Install every no-Torch long-tail provider plus the eight opt-in standalone packages listed above with `uv pip install "langflow[bundles]"`. -Bare `uv pip install lfx-bundles` registers the provider code only; add a per-provider extra when you need that provider's third-party SDK. +These providers do not have their own `lfx-` package. + +To install one provider and its SDK, run `uv pip install "lfx-bundles[]"`. +To install every provider in `lfx-bundles`, run `uv pip install "lfx[bundles]"`. + +To install every provider, including providers that require PyTorch as a dependency, run `uv pip install "lfx-bundles[all]"`. | Bundle | Install command | | --- | --- | @@ -107,6 +108,7 @@ Bare `uv pip install lfx-bundles` registers the provider code only; add a per-pr | [`nvidia`](/bundles-nvidia) (NVIDIA) | `uv pip install "lfx-bundles[nvidia]"` | | `olivya` | `uv pip install "lfx-bundles[olivya]"` | | [`openrouter`](/bundles-openrouter) (OpenRouter) | `uv pip install "lfx-bundles[openrouter]"` | +| [`orcarouter`](/bundles-orcarouter) (OrcaRouter) | `uv pip install "lfx-bundles[orcarouter]"` | | [`perplexity`](/bundles-perplexity) (Perplexity) | `uv pip install "lfx-bundles[perplexity]"` | | [`pgvector`](/bundles-pgvector) (pgvector) | `uv pip install "lfx-bundles[pgvector]"` | | [`pinecone`](/bundles-pinecone) (Pinecone) | `uv pip install "lfx-bundles[pinecone]"` | diff --git a/docs/docs/Lfx/lfx-compatibility.mdx b/docs/docs/Lfx/lfx-compatibility.mdx index 95a7b41911e9..b0404f98b6de 100644 --- a/docs/docs/Lfx/lfx-compatibility.mdx +++ b/docs/docs/Lfx/lfx-compatibility.mdx @@ -107,17 +107,17 @@ Going forward, pin with `lfx~=1.10.0` so you receive compatible patches without ## Engine-only LFX and `lfx[bundles]` `pip install lfx` installs the engine only — no component bundles. -For headless or serverless deployments that execute flows using provider components without the full Langflow server, install the long-tail bundle package alongside the engine: +For headless or serverless deployments that execute flows using provider components without the full Langflow server, install `lfx-bundles` alongside the engine: ```bash uv pip install "lfx[bundles]" ``` -This is equivalent to installing `lfx` plus `lfx-bundles[all]`, including the torch-pulling long-tail providers **CUGA** and **Code Agents**. -It does **not** install graduated standalone packages such as `lfx-openai` or `lfx-exa`. +This is equivalent to installing `lfx` plus `lfx-bundles[all]`, including the PyTorch-based providers **CUGA** and **Code Agents**. +It does **not** install standalone packages such as `lfx-openai` or `lfx-exa`. `uv pip install langflow` installs the curated standalone `lfx-*` packages without `lfx-bundles`. -Use `uv pip install "langflow[bundles]"` to add the reviewed `lfx-bundles[all-no-torch]` profile plus the opt-in arXiv, DuckDuckGo, EmpirioLabs, Exa, Firecrawl, NextPlaid, Paddle, and Valkey standalone packages while keeping the full Langflow application torch-free. +Use `uv pip install "langflow[bundles]"` to add the `lfx-bundles[all-no-torch]` profile plus the opt-in standalone packages while keeping the full Langflow application torch-free. For the providers omitted from the default install, see [Additional bundles](/extensions-bundle-list#additional-bundles). For a slimmer image, install only the provider packages a deployment actually executes, for example `uv pip install lfx lfx-openai "lfx-bundles[qdrant]"`. -There is intentionally no `lfx[all]` extra. Install `lfx-bundles` explicitly for long-tail providers, or install only the provider extras you need to avoid the full torch-inclusive `[all]` set. +There is intentionally no `lfx[all]` extra. Install `lfx-bundles` explicitly, or install only the provider extras you need to avoid the full torch-inclusive `[all]` set. Some components require a [torch opt-in install](./components-bundle-components#torch-opt-in). diff --git a/docs/docs/_partial-bundle-lfx-bundles-install.mdx b/docs/docs/_partial-bundle-lfx-bundles-install.mdx index 03fae2c09be7..086f4c403670 100644 --- a/docs/docs/_partial-bundle-lfx-bundles-install.mdx +++ b/docs/docs/_partial-bundle-lfx-bundles-install.mdx @@ -1,5 +1,5 @@ :::tip -Long-tail providers are opt-in for both Langflow and standalone LFX installs. Install this provider from the long-tail metapackage: +This provider is an extra of the `lfx-bundles` metapackage. It is opt-in for both Langflow and standalone LFX installs: ```bash uv pip install "lfx-bundles[]" @@ -7,6 +7,6 @@ uv pip install "lfx-bundles[]" Replace `` with this page's provider name, for example `qdrant`. For a torch-free full Langflow install, run `uv pip install "langflow[bundles]"`. -For standalone LFX with every long-tail provider, including torch-based providers, run `uv pip install "lfx[bundles]"`. +For standalone LFX with every provider in `lfx-bundles`, including PyTorch-based providers, run `uv pip install "lfx[bundles]"`. See [Additional bundles](/extensions-bundle-list#additional-bundles) for the exact extra name. ::: diff --git a/docs/docs/_partial-extension-bundle-install.mdx b/docs/docs/_partial-extension-bundle-install.mdx index 3b2e7a286e0d..8d9642d2f292 100644 --- a/docs/docs/_partial-extension-bundle-install.mdx +++ b/docs/docs/_partial-extension-bundle-install.mdx @@ -1,6 +1,6 @@ `uv pip install langflow` installs a curated provider set. -Long-tail bundles and eight standalone packages are opt-in in Langflow 1.12. -See [Additional bundles](/extensions-bundle-list#additional-bundles). +Other providers are opt-in. +For more information, see [Additional bundles](/extensions-bundle-list#additional-bundles). `uv pip install lfx` installs the core LFX executor _only_, with no provider bundles included. @@ -8,24 +8,24 @@ If your flows use bundle components, install the required packages in the same v Some components require an additional [torch opt-in installation](./components-bundle-components#torch-opt-in). -_Long-tail bundles_ are third-party provider integrations like vector stores or model providers that ship together in the `lfx-bundles` package. +Providers in `lfx-bundles` are extras of that metapackage, such as additional model providers and vector stores. -_Standalone bundles_ are graduated providers with their own release cadences, such as OpenAI, Anthropic, and Exa. +Standalone packages are providers with their own `lfx-` package and release cadence, such as OpenAI, Anthropic, and Exa. -To install one long-tail provider: +To install one provider from `lfx-bundles`: ```bash -uv pip install "lfx-bundles[]" +uv pip install "lfx-bundles[]" ``` -To install every long-tail provider: +To install every provider in `lfx-bundles`: ```bash uv pip install "lfx[bundles]" ``` `lfx[bundles]` is equivalent to `lfx` plus `lfx-bundles[all]`. -It does **not** install graduated standalone packages such as `lfx-openai`. +It does **not** install standalone packages such as `lfx-openai`. To install a standalone provider package: diff --git a/docs/docs/_partial-opt-in-bundles.mdx b/docs/docs/_partial-opt-in-bundles.mdx index 8c031db07785..b9634f0eda15 100644 --- a/docs/docs/_partial-opt-in-bundles.mdx +++ b/docs/docs/_partial-opt-in-bundles.mdx @@ -1,19 +1,19 @@ Starting in Langflow 1.12, `uv pip install langflow` includes a curated provider set only. -The following 73 bundles are **not** installed by default. Each is a one-line install. +The following bundles are **not** installed by default. Each is a one-line install. -Install one long-tail provider: +To install one provider from `lfx-bundles`, run: ```bash -uv pip install "lfx-bundles[]" +uv pip install "lfx-bundles[]" ``` -Install one opt-in standalone package (`arxiv`, `duckduckgo`, `empiriolabs`, `exa`, `firecrawl`, `nextplaid`, `paddle`, or `valkey`): +To install one opt-in standalone package, run: ```bash uv pip install lfx- ``` -Install every no-Torch opt-in provider at once, including those standalone packages: +To install every no-Torch opt-in provider at once, including the standalone packages: ```bash uv pip install "langflow[bundles]" @@ -25,14 +25,14 @@ The extra name is the identifier shown, such as `groq` or `exa`. Knowledge bases still use local Chroma storage in the default install. The **Chroma DB** bundle component in the visual editor is opt-in. -### Model providers (20) +### Model providers -[`aiml`](/bundles-aiml) · [`baidu`](/bundles-baidu) · [`cloudflare`](/bundles-cloudflare) · [`cometapi`](/bundles-cometapi) · [`deepseek`](/bundles-deepseek) · [`empiriolabs`](/bundles-empiriolabs) · [`groq`](/bundles-groq) · [`huggingface`](/bundles-huggingface) · [`litellm`](/bundles-lite-llm) · [`lmstudio`](/bundles-lmstudio) · [`maritalk`](/bundles-maritalk) · [`mistral`](/bundles-mistralai) · `notdiamond` · [`novita`](/bundles-novita) · [`nvidia`](/bundles-nvidia) · [`openrouter`](/bundles-openrouter) · [`perplexity`](/bundles-perplexity) · [`sambanova`](/bundles-sambanova) · [`vertexai`](/bundles-vertexai) · [`xai`](/bundles-xai) +[`aiml`](/bundles-aiml) · [`baidu`](/bundles-baidu) · [`cloudflare`](/bundles-cloudflare) · [`cometapi`](/bundles-cometapi) · [`deepseek`](/bundles-deepseek) · [`empiriolabs`](/bundles-empiriolabs) · [`groq`](/bundles-groq) · [`huggingface`](/bundles-huggingface) · [`litellm`](/bundles-lite-llm) · [`lmstudio`](/bundles-lmstudio) · [`maritalk`](/bundles-maritalk) · [`mistral`](/bundles-mistralai) · `notdiamond` · [`novita`](/bundles-novita) · [`nvidia`](/bundles-nvidia) · [`openrouter`](/bundles-openrouter) · [`orcarouter`](/bundles-orcarouter) · [`perplexity`](/bundles-perplexity) · [`sambanova`](/bundles-sambanova) · [`vertexai`](/bundles-vertexai) · [`xai`](/bundles-xai) ### Vector stores and memory (19) [`chroma`](/bundles-chroma) · [`clickhouse`](/bundles-clickhouse) · [`couchbase`](/bundles-couchbase) · [`elastic`](/bundles-elastic) · [`faiss`](/bundles-faiss) · [`mem0`](/bundles-mem0) · [`milvus`](/bundles-milvus) · [`mongodb`](/bundles-mongodb) · `needle` · [`pgvector`](/bundles-pgvector) · [`pinecone`](/bundles-pinecone) · [`qdrant`](/bundles-qdrant) · [`redis`](/bundles-redis) · [`supabase`](/bundles-supabase) · [`upstash`](/bundles-upstash) · [`valkey`](/bundles-valkey) · [`vectara`](/bundles-vectara) · [`weaviate`](/bundles-weaviate) · `zep` -### Tools, search, and integrations (34) +### Tools, search, and integrations -`agentql` · [`altk`](/bundles-altk) · [`apify`](/bundles-apify) · [`arxiv`](/bundles-arxiv) · [`assemblyai`](/bundles-assemblyai) · [`bing`](/bundles-bing) · [`cleanlab`](/bundles-cleanlab) · [`composio`](/bundles-composio) · `confluence` · [`duckduckgo`](/bundles-duckduckgo) · [`exa`](/bundles-exa) · [`firecrawl`](/bundles-firecrawl) · `git` · [`glean`](/bundles-glean) · `homeassistant` · [`icosacomputing`](/bundles-icosacomputing) · `jigsawstack` · `langwatch` · [`nextplaid`](/bundles-nextplaid) · [`notion`](/bundles-notion) · `olivya` · [`paddle`](/bundles-paddle) · `scrapegraph` · [`searchapi`](/bundles-searchapi) · `serpapi` · `spider` · `tavily` · `twelvelabs` · `unstructured` · `vlmrun` · [`wikipedia`](/bundles-wikipedia) · `wolframalpha` · `yahoosearch` · `youtube` +`agentql` · [`altk`](/bundles-altk) · [`apify`](/bundles-apify) · [`arxiv`](/bundles-arxiv) · [`assemblyai`](/bundles-assemblyai) · [`bing`](/bundles-bing) · [`cleanlab`](/bundles-cleanlab) · [`composio`](/bundles-composio) · [`confluent`](/bundles-confluent) · `confluence` · [`duckduckgo`](/bundles-duckduckgo) · [`exa`](/bundles-exa) · [`firecrawl`](/bundles-firecrawl) · `git` · [`glean`](/bundles-glean) · `homeassistant` · [`icosacomputing`](/bundles-icosacomputing) · `jigsawstack` · `langwatch` · [`nextplaid`](/bundles-nextplaid) · [`notion`](/bundles-notion) · `olivya` · [`paddle`](/bundles-paddle) · `scrapegraph` · [`searchapi`](/bundles-searchapi) · `serpapi` · `spider` · `tavily` · `twelvelabs` · `unstructured` · `vlmrun` · [`wikipedia`](/bundles-wikipedia) · `wolframalpha` · `yahoosearch` · `youtube` From 3ced29ca6031605e0a6ecc2ee6d8c8c9057f8826 Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Mon, 24 Aug 2026 14:41:16 -0400 Subject: [PATCH 07/20] docs: preflight checks --- docs/docs/Agents/mcp-server.mdx | 12 ++++ .../Deployment/deployment-kubernetes-prod.mdx | 1 + .../deployment-prod-best-practices.mdx | 66 +++++++++++++++++++ docs/docs/Develop/configuration-cli.mdx | 1 + docs/docs/Develop/environment-variables.mdx | 1 + docs/docs/Support/release-notes.mdx | 18 ++++- 6 files changed, 98 insertions(+), 1 deletion(-) diff --git a/docs/docs/Agents/mcp-server.mdx b/docs/docs/Agents/mcp-server.mdx index 504b0d5fd420..7e8087653597 100644 --- a/docs/docs/Agents/mcp-server.mdx +++ b/docs/docs/Agents/mcp-server.mdx @@ -13,6 +13,7 @@ This page describes how to use Langflow as an MCP server that exposes your flows Langflow MCP servers support both the **streamable HTTP** transport and **Server-Sent Events (SSE)** as a fallback. The default project MCP server configuration uses streamable HTTP transport at the URL path `/streamable`. +To serve only streamable HTTP, see [Disable the legacy MCP SSE transport](#disable-legacy-sse). For information about using Langflow as an MCP client and managing MCP server connections within flows, see [Use Langflow as an MCP client](/mcp-client). @@ -404,6 +405,11 @@ The default address is `http://localhost:6274`. 5. To quit MCP Inspector, press Control+C in the same terminal window where you started it. +## Disable the legacy MCP SSE transport {#disable-legacy-sse} + +Set `LANGFLOW_MCP_SSE_ENABLED=false` to return `404` from the legacy SSE transport and its message endpoint. +Streamable HTTP is unaffected. + ## Restrict MCP server management to superusers {#restrict-mcp-server-management} To prevent non-superusers from editing MCP server connections, set `LANGFLOW_MCP_SERVERS_LOCKED=true`. @@ -420,12 +426,18 @@ The following environment variables set behaviors related to your Langflow proje | Variable | Format | Default | Description | |----------|--------|---------|-------------| | `LANGFLOW_MCP_SERVER_ENABLED` | Boolean | `True` | Whether to initialize an MCP server for each of your Langflow projects. If `false`, Langflow doesn't initialize MCP servers. | +| `LANGFLOW_MCP_SSE_ENABLED` | Boolean | `True` | Whether to serve the legacy SSE transport. If `false`, SSE and its message endpoint return `404`. Streamable HTTP is unaffected. See [Disable the legacy MCP SSE transport](#disable-legacy-sse). | | `LANGFLOW_MCP_SERVER_ENABLE_PROGRESS_NOTIFICATIONS` | Boolean | `False` | If `true`, Langflow MCP servers send progress notifications. | +| `LANGFLOW_SKIP_MCP_AUTO_INIT` | Boolean | `False` | If `true`, skip background MCP server auto-initialization on startup. Use this on offline, firewalled, or CI hosts so startup does not wait on outbound MCP connections. | +| `LANGFLOW_MCP_COMPOSER_ENABLED` | Boolean | `True` | Whether to start the MCP Composer service. | | `LANGFLOW_MCP_SERVER_TIMEOUT` | Integer | `20` | Timeout in seconds for MCP connection setup and tool execution. See [Configure tool execution timeouts](#configure-tool-execution-timeouts). | | `LANGFLOW_MCP_TOOL_EXECUTION_TIMEOUT` | Integer | `180` | Global timeout in seconds for MCP tool calls. See [Configure tool execution timeouts](#configure-tool-execution-timeouts). | | `LANGFLOW_MCP_MAX_SESSIONS_PER_SERVER` | Integer | `10` | Maximum number of MCP sessions to keep per unique server. | | `LANGFLOW_ADD_PROJECTS_TO_MCP_SERVERS` | Boolean | `True` | Whether to automatically add newly created projects to the user's MCP servers configuration. If `false`, projects must be manually added to MCP servers. | | `LANGFLOW_MCP_SERVERS_LOCKED` | Boolean | `False` | If `true`, non-superusers cannot add, edit, or remove MCP server connections through the UI or API. Superusers retain full access. For more information, see [Restrict MCP server management to superusers](#restrict-mcp-server-management). | +| `LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES` | String | Not set | Comma-separated allowlist of package names that MCP `npx`/`uvx` stdio servers may download and run. Leave unset for single-tenant compatibility. An empty value blocks all package runners. | +| `LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING` | Boolean | `False` | If `true`, blocks tenant-controlled Python, Node.js, and shell MCP entrypoints. Package wrappers and the authenticated internal Langflow MCP server still work. | +| `LANGFLOW_MCP_SERVER_DOCKER_HARDENING` | Boolean | `False` | If `true`, applies a strict argument policy to MCP `docker` stdio servers so tenants cannot mount the host filesystem or use privileged flags. | ## Troubleshoot Langflow MCP servers {#troubleshooting-mcp-server} diff --git a/docs/docs/Deployment/deployment-kubernetes-prod.mdx b/docs/docs/Deployment/deployment-kubernetes-prod.mdx index 14474529c04b..c4b2b9cadd7c 100644 --- a/docs/docs/Deployment/deployment-kubernetes-prod.mdx +++ b/docs/docs/Deployment/deployment-kubernetes-prod.mdx @@ -205,4 +205,5 @@ Use `replicaCount` and `resources` in the Langflow runtime Helm chart's [`values ## See also * [Best practices for Langflow on Kubernetes](/deployment-prod-best-practices) +* [Production preflight checks](/deployment-prod-best-practices#production-preflight) * [Langflow Helm Charts repository](https://github.com/langflow-ai/langflow-helm-charts) \ No newline at end of file diff --git a/docs/docs/Deployment/deployment-prod-best-practices.mdx b/docs/docs/Deployment/deployment-prod-best-practices.mdx index 79061c888ddd..266bbd72b36b 100644 --- a/docs/docs/Deployment/deployment-prod-best-practices.mdx +++ b/docs/docs/Deployment/deployment-prod-best-practices.mdx @@ -120,6 +120,72 @@ Follow industry best practices and use secure Langflow configurations, such as t * **Encryption and privacy**: Follow industry best practices and legal requirements for data privacy and encryption of data in transit and at rest, including GDPR requirements, HTTPS, TLS, and SSL. For example, configure PostgreSQL with valid SSL certificates and append `?sslmode=require` or `?sslmode=verify-full` to the connection string to enable SSL for database connections. * **Security posture maintenance**: Conduct regular security audits, keep current with software updates, and monitor for suspicious activity using intrusion detection systems. +## Production preflight checks {#production-preflight} + +To verify production infrastructure before any workers start, set the `LANGFLOW_DEPLOYMENT_PROFILE` environment variable to `prod`. + +By default, `LANGFLOW_DEPLOYMENT_PROFILE` is set to `dev` and skips these checks. +When set to `prod`, Langflow runs every check once and prints the full result. A `fail` aborts boot with a non-zero exit, so a misconfigured server never starts up. +A `warn` does not abort and allows startup. + +Preflight checks run for any Langflow process started with the `prod` profile enabled, not only Kubernetes. + +To enable preflight checks, set the following in your `.env` file: + +```text +LANGFLOW_DEPLOYMENT_PROFILE=prod +``` + +Alternatively, pass the CLI option, which overrides the environment variable: + +```bash +uv run langflow run --deployment-profile prod +``` + +### Required checks + +These checks abort boot when they fail: + +| Check | What must be true | +|-------|-------------------| +| Database | `LANGFLOW_DATABASE_URL` is a reachable **PostgreSQL** database. SQLite fails this check. | +| File storage | `LANGFLOW_STORAGE_TYPE` is an external object store such as `s3`, not local disk. | +| Encryption secret | `LANGFLOW_SECRET_KEY` is set in the environment to a usable Fernet key. An auto-generated key or a node-local `config_dir/secret_key` file is not enough. See [`LANGFLOW_SECRET_KEY`](/api-keys-and-authentication#langflow-secret-key). | +| pgVector | `PGVECTOR_CONNECTION_STRING` is set, the database is reachable, and the Postgres `vector` extension is installed (`CREATE EXTENSION vector;`). Production Langflow requires pgVector even if you are not creating knowledge bases yet. | + +### Degraded checks + +These checks report reduced capability. Telemetry and MCP only `warn`. Cache and the shared job queue abort boot if you selected an external backend that is unreachable. + +| Check | `ok` | `warn` | `fail` (aborts) | +|-------|------|--------|-----------------| +| Cache | `LANGFLOW_CACHE_TYPE=redis` and Redis is reachable | In-memory default (`async` or `memory`). Caches are not shared across replicas. | Redis selected but unreachable. Unset `LANGFLOW_CACHE_TYPE` to boot with the in-memory fallback. | +| Shared queue | `LANGFLOW_JOB_QUEUE_TYPE=redis` and Redis is reachable | In-process default (`asyncio`). Jobs stay on a single pod. | Redis selected but unreachable. Unset `LANGFLOW_JOB_QUEUE_TYPE` to boot with the in-process fallback. | +| Telemetry | Product telemetry is enabled | `LANGFLOW_DO_NOT_TRACK` is set | Never fails | +| MCP serving posture | MCP is disabled, or the serving knobs below match the multi-tenant values | One or more knobs are still at a single-tenant default | Never fails | + +If this plane does not serve MCP, set `LANGFLOW_MCP_SERVER_ENABLED=false`. Otherwise, production preflight expects these values when MCP is enabled: + +| Variable | Expected in `prod` | Default | +|----------|--------------------|---------| +| `LANGFLOW_SKIP_MCP_AUTO_INIT` | `true` | `false` | +| `LANGFLOW_ADD_PROJECTS_TO_MCP_SERVERS` | `false` | `true` | +| `LANGFLOW_MCP_COMPOSER_ENABLED` | `false` | `true` | +| `LANGFLOW_MCP_SERVERS_LOCKED` | `true` | `false` | +| `LANGFLOW_MCP_SSE_ENABLED` | `false` | `true` | +| `LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING` | `true` | `false` | +| `LANGFLOW_MCP_SERVER_DOCKER_HARDENING` | `true` | `false` | +| `LANGFLOW_SSRF_PROTECTION_ENABLED` | `true` | `true` | +| `LANGFLOW_CONNECTOR_SSRF_VALIDATION_ENABLED` | `true` | `true` | +| `LANGFLOW_CONNECTOR_SSRF_ALLOW_LOOPBACK` | `false` | `true` | +| `LANGFLOW_DISABLE_TRACK_APIKEY_USAGE` | `true` | `false` | +| `LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES` | Set to an allowlist (empty string blocks all package runners) | Unset | + +### Local Chroma in `prod` + +The `prod` profile blocks new knowledge bases and memory bases that use local Chroma. +For local storage, use a shared pgVector, OpenSearch, or Chroma Cloud store, or run Langflow with `LANGFLOW_DEPLOYMENT_PROFILE=dev` + ## See also * [Deploy the Langflow production environment on Kubernetes](/deployment-kubernetes-prod) diff --git a/docs/docs/Develop/configuration-cli.mdx b/docs/docs/Develop/configuration-cli.mdx index 73e6a338b2d0..999d15e8f1c6 100644 --- a/docs/docs/Develop/configuration-cli.mdx +++ b/docs/docs/Develop/configuration-cli.mdx @@ -266,6 +266,7 @@ For more information Langflow configuration options, see [Langflow environment v | `--cache` | `async` | String | The type of [cache storage](/memory) to use. One of `async`, `redis`, `memory`, or `disk`. | | `--components-path` | Not set | String | The path to the directory containing your custom components. | | `--dev` | `--no-dev` (false) | Boolean | Whether to run in development mode (may contain bugs). | +| `--deployment-profile` | `dev` | String | Deployment profile: `dev` or `prod`. `prod` runs [production preflight](/deployment-prod-best-practices#production-preflight) before the server starts and aborts boot if a required service is missing. | | `--env-file` | Not set | String | The path to the `.env` file containing Langflow environment variables. See [Start Langflow with a specific .env file](#start-langflow-with-a-specific-env-file). | | `--frontend-path` | Not set | String | The path to the frontend directory containing build files. This is only used when [contributing to the Langflow codebase](/contributing-how-to-contribute) or developing a custom Langflow image that includes customized frontend code. | | `--health-check-max-retries` | `5` | Integer | The maximum number of retries for your Langflow server's health check. | diff --git a/docs/docs/Develop/environment-variables.mdx b/docs/docs/Develop/environment-variables.mdx index bbb347e2cfad..1d71a73ad9fc 100644 --- a/docs/docs/Develop/environment-variables.mdx +++ b/docs/docs/Develop/environment-variables.mdx @@ -418,6 +418,7 @@ The following environment variables set base Langflow server configuration, such | `LANGFLOW_PORT` | Integer | `7860` | The port on which the Langflow server runs. The server automatically selects a free port if the specified port is in use. | | `LANGFLOW_BACKEND_ONLY` | Boolean | `False` | Run only the Langflow backend service (no frontend). | | `LANGFLOW_DEV` | Boolean | `False` | Whether to run Langflow in development mode (may contain bugs). | +| `LANGFLOW_DEPLOYMENT_PROFILE` | String | `dev` | Deployment profile. `dev` skips production checks. `prod` runs [production preflight](/deployment-prod-best-practices#production-preflight) before the server starts and aborts boot if a required service is missing. | | `LANGFLOW_OPEN_BROWSER` | Boolean | `False` | Open the system web browser on startup. | | `LANGFLOW_HEALTH_CHECK_MAX_RETRIES` | Integer | `5` | Set the maximum number of retries for Langflow's server status health checks. | | `LANGFLOW_WORKERS` | Integer | `1` | Number of worker processes. See [Deploy Langflow with multiple workers](./deployment-multi-worker#recommended-gunicorn-settings). | diff --git a/docs/docs/Support/release-notes.mdx b/docs/docs/Support/release-notes.mdx index 57847516cdb8..d7692c5afa9e 100644 --- a/docs/docs/Support/release-notes.mdx +++ b/docs/docs/Support/release-notes.mdx @@ -56,7 +56,7 @@ Highlights of this release include the following changes. For all changes, see t Langflow 1.12 makes `langflow-base` a complete, version-aligned installation of the Langflow application. -- Ongoing breaking changes: bundle separation +- Ongoing breaking change: bundle separation Bundle separation concludes in 1.12. `uv pip install langflow` no longer installs all provider bundles, and includes only a curated list of providers. @@ -74,6 +74,22 @@ Highlights of this release include the following changes. For all changes, see t For more information, see [Manage users as an administrator](/api-keys-and-authentication#manage-users-as-an-administrator). +### New features + +- Production preflight + + Set `LANGFLOW_DEPLOYMENT_PROFILE=prod` to probe your Langflow deployment before any workers start. + The default remains `dev`, which skips prod checks. + + For more information, see [Production preflight checks](/deployment-prod-best-practices#production-preflight). + +- Disable the legacy MCP SSE transport + + Set `LANGFLOW_MCP_SSE_ENABLED=false` to return a `404` from the legacy SSE transport endpoint. + Streamable HTTP is not affected. + + For more information, see [Disable the legacy MCP SSE transport](/mcp-server#disable-legacy-sse). + ## 1.11.x For 1.11.x release notes, see the [1.11.x documentation](https://docs.langflow.org/1.11.0/release-notes). From b071fa2173ef59264a6aea1232765552f3a85e6a Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Mon, 24 Aug 2026 15:51:51 -0400 Subject: [PATCH 08/20] docs: interpreter vm --- docs/docs/Components/python-interpreter.mdx | 36 +++++++++++++++++++-- docs/docs/Support/release-notes.mdx | 8 +++++ 2 files changed, 41 insertions(+), 3 deletions(-) diff --git a/docs/docs/Components/python-interpreter.mdx b/docs/docs/Components/python-interpreter.mdx index d3f2f2dd3675..2fbe88a01a16 100644 --- a/docs/docs/Components/python-interpreter.mdx +++ b/docs/docs/Components/python-interpreter.mdx @@ -9,10 +9,11 @@ import TabItem from '@theme/TabItem'; This component allows you to execute Python code with imported packages. -The **Python Interpreter** component can only import packages that are already installed in your Langflow environment. -If you encounter an `ImportError` when trying to use a package, you need to install it first. +By default, code runs in the Langflow server process. +The **Python Interpreter** can only import packages that are already installed in your Langflow environment. +If you encounter an `ImportError`, install the package first. For more information, see [Install custom dependencies](/install-custom-dependencies). -To install custom packages, see [Install custom dependencies](/install-custom-dependencies). +On a shared server, isolate executions in a microVM or [block the custom component](/api-keys-and-authentication#multi-tenant-component-hardening). ## Use the Python Interpreter in a flow @@ -230,6 +231,35 @@ For example, to connect a [**Chat Input** component](/chat-input-and-output) and The **Python Interpreter** component can now use the `url` variable in the Python code that it executes. +## Isolate executions in a microVM {#sandbox} + +Set `LANGFLOW_SANDBOX_BACKEND=exec-sandbox` to run each **Python Interpreter** execution in a dedicated [QEMU microVM](https://www.qemu.org/docs/master/system/i386/microvm.html) instead of in the server process. +The VM has a read-only root filesystem, no host filesystem access, and no network unless you enable it. + +1. Use Python 3.12 or later, QEMU 8 or later, and hardware virtualization. Use KVM on Linux, or HVF on macOS. +2. The microVM is not included with a default `uv pip install langflow` installation. +To install it, run `uv pip install 'langflow[sandbox]'`. +If you enable the environment variable but don't install the sandbox package, the component errors. + +3. In your `.env` file, set: + + ```text + LANGFLOW_SANDBOX_BACKEND=exec-sandbox + ``` + +4. Restart Langflow. + +If the sandbox is configured but unavailable, execution fails with an error, and Langflow does not fall back to in-process `exec`. + +Sandboxed code may import any module already in the microVM's filesystem. +Langflow inserts `import` statements at the top of the script in the VM. Those packages must already be in the microVM's filesystem, not only in your Langflow environment. +Network access is off by default. +Code that fetches URLs needs `LANGFLOW_SANDBOX_ALLOW_NETWORK=true` and, for non-PyPI hosts, `LANGFLOW_SANDBOX_ALLOWED_DOMAINS`. + +Set `LANGFLOW_SANDBOX_ALLOW_SOFTWARE_EMULATION=true` for trusted development or CI hosts without a hypervisor. + +For more information, see [`LANGFLOW_SANDBOX_*`](/environment-variables). + ## Python Interpreter parameters | Name | Type | Description | diff --git a/docs/docs/Support/release-notes.mdx b/docs/docs/Support/release-notes.mdx index d7692c5afa9e..73df6cdd57b4 100644 --- a/docs/docs/Support/release-notes.mdx +++ b/docs/docs/Support/release-notes.mdx @@ -76,6 +76,14 @@ Highlights of this release include the following changes. For all changes, see t ### New features +- Python Interpreter microVM sandbox + + Set `LANGFLOW_SANDBOX_BACKEND=exec-sandbox` to run the [**Python Interpreter** component](/python-interpreter) in a dedicated [QEMU microVM](https://www.qemu.org/docs/master/system/i386/microvm.html) instead of in the Langflow server process. + The microVM is not included in a default `uv pip install langflow` installation. + To install it, run `uv pip install 'langflow[sandbox]'`. + + For more information, see [Isolate executions in a microVM](/python-interpreter#sandbox). + - Production preflight Set `LANGFLOW_DEPLOYMENT_PROFILE=prod` to probe your Langflow deployment before any workers start. From 765020afcc076c14bd9f8cb103bc1f239ece6160 Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Mon, 24 Aug 2026 16:19:03 -0400 Subject: [PATCH 09/20] docs: langflow observability doctor --- docs/docs/Components/python-interpreter.mdx | 2 +- docs/docs/Develop/configuration-cli.mdx | 35 ++++++++++++++++ docs/docs/Develop/environment-variables.mdx | 45 ++++++++++++++++----- docs/docs/Lfx/extensions-overview.mdx | 2 +- docs/docs/Support/release-notes.mdx | 18 +++++++++ 5 files changed, 91 insertions(+), 11 deletions(-) diff --git a/docs/docs/Components/python-interpreter.mdx b/docs/docs/Components/python-interpreter.mdx index 2fbe88a01a16..fb88dd03f31a 100644 --- a/docs/docs/Components/python-interpreter.mdx +++ b/docs/docs/Components/python-interpreter.mdx @@ -258,7 +258,7 @@ Code that fetches URLs needs `LANGFLOW_SANDBOX_ALLOW_NETWORK=true` and, for non- Set `LANGFLOW_SANDBOX_ALLOW_SOFTWARE_EMULATION=true` for trusted development or CI hosts without a hypervisor. -For more information, see [`LANGFLOW_SANDBOX_*`](/environment-variables). +For more information, see [Python Interpreter sandbox environment variables](/environment-variables#langflow-sandbox). ## Python Interpreter parameters diff --git a/docs/docs/Develop/configuration-cli.mdx b/docs/docs/Develop/configuration-cli.mdx index 999d15e8f1c6..de8eaf087ded 100644 --- a/docs/docs/Develop/configuration-cli.mdx +++ b/docs/docs/Develop/configuration-cli.mdx @@ -231,6 +231,41 @@ Use this mode to previews the changes that would be made to the database schema +### langflow observability doctor {#langflow-observability-doctor} + +Sends a probe span, metric, and log to the configured OTLP endpoint and reports what the backend accepted. + +This command is also available as `lfx observability doctor`. +It requires the `OTEL_EXPORTER_OTLP_ENDPOINT` environment variable to be set. + + + + +```bash +uv run langflow observability doctor +``` + + + + +```bash +langflow observability doctor +``` + + + + +#### Options + +| Option | Default | Type | Description | +|--------|---------|--------|-------------| +| `--timeout` | `OTEL_EXPORTER_OTLP_TIMEOUT` or the OpenTelemetry SDK default | Float | Per-export timeout in seconds. Must be greater than 0. | + +The doctor also prints whether log message bodies (`LANGFLOW_OTEL_LOG_BODIES`) and database spans (`LANGFLOW_OTEL_DB_SPANS`) are enabled. +In your backend, search for items named `lfx.observability.doctor`. + +For more information, see [OpenTelemetry](/observability-opentelemetry#verify-your-configuration). + ### langflow run {#langflow-run} Starts the Langflow server. diff --git a/docs/docs/Develop/environment-variables.mdx b/docs/docs/Develop/environment-variables.mdx index 1d71a73ad9fc..63b306e1ce64 100644 --- a/docs/docs/Develop/environment-variables.mdx +++ b/docs/docs/Develop/environment-variables.mdx @@ -403,7 +403,7 @@ For multi-worker tuning—including the Redis job queue and Gunicorn worker sett ### Monitoring and metrics -For OpenTelemetry traces, metrics, and logs that describe Langflow service health, see [OpenTelemetry](/observability-opentelemetry). +For OpenTelemetry traces, metrics, and logs that describe Langflow service health, including `LANGFLOW_OTEL_*` and `OTEL_EXPORTER_OTLP_*`, see [OpenTelemetry](/observability-opentelemetry). For prompt-level LLM tracing, see [Langfuse](/integrations-langfuse) and the other monitoring integrations. For Prometheus on Kubernetes, see [Best practices for Langflow on Kubernetes](/deployment-prod-best-practices). @@ -437,11 +437,44 @@ For file storage environment variables, see [File storage environment variables] For database environment variables, including PostgreSQL configuration, see [Memory management options](/memory#configure-external-memory). -### Telemetry +### Telemetry {#telemetry} Anonymous product usage telemetry is separate from OpenTelemetry export. + See [Telemetry](/contributing-telemetry) to opt out with `DO_NOT_TRACK`. -For OTLP export to your own backend, see [OpenTelemetry](/observability-opentelemetry). + +### OpenTelemetry {#opentelemetry} + +Langflow can export service-health traces, metrics, and logs over OTLP to **your** backend. +This is not LLM tracing and is not the anonymous product telemetry above. + +Set `OTEL_EXPORTER_OTLP_ENDPOINT` to enable export. If it is unset, Langflow installs no providers. + +| Variable | Format | Default | Description | +|----------|--------|---------|-------------| +| `OTEL_EXPORTER_OTLP_ENDPOINT` | String | Not set | OTLP collector or APM endpoint. Required to enable export. | +| `LANGFLOW_OTEL_DB_SPANS` | Boolean | `True` | Whether to export SQLAlchemy database spans. Set to `false` to send flow and request spans only. | +| `LANGFLOW_OTEL_LOG_LEVEL` | String | `INFO` | Minimum severity exported over OTLP. `DEBUG` includes flow inputs and outputs. | +| `LANGFLOW_OTEL_LOG_BODIES` | String | `allowlist` | Set to `all` to export log message bodies, including completions and chat history. | + +Standard OpenTelemetry SDK variables such as `OTEL_SERVICE_NAME` and `OTEL_EXPORTER_OTLP_HEADERS` also apply. +To verify the pipeline, run [`langflow observability doctor`](/configuration-cli#langflow-observability-doctor). + +For the full list, what Langflow does and does not export, and vendor setup, see [OpenTelemetry](/observability-opentelemetry). + +### Python Interpreter sandbox {#langflow-sandbox} + +These variables control the optional QEMU microVM backend for the [**Python Interpreter** component](/python-interpreter#sandbox). +They are not included in a default `uv pip install langflow` installation. Install `langflow[sandbox]` first. + +| Variable | Format | Default | Description | +|----------|--------|---------|-------------| +| `LANGFLOW_SANDBOX_BACKEND` | String | `none` | Execution backend for the code-execution components (Python Interpreter and the legacy Python REPL tool). Set to `exec-sandbox` to run user code in a dedicated QEMU microVM per execution instead of in-process. Requires `uv pip install 'langflow[sandbox]'`, Python 3.12 or later, and QEMU 8+ with hardware virtualization (KVM on Linux, HVF on macOS). When configured but unavailable — including hosts without a hardware hypervisor — execution fails with an error instead of falling back to in-process execution. | +| `LANGFLOW_SANDBOX_TIMEOUT_SECONDS` | Integer | `30` | Wall-clock limit for one sandboxed execution (1-300 seconds). Only used when `LANGFLOW_SANDBOX_BACKEND` is not `none`. | +| `LANGFLOW_SANDBOX_MEMORY_MB` | Integer | `192` | Guest VM memory for sandboxed executions, in MB (minimum 128). Only used when `LANGFLOW_SANDBOX_BACKEND` is not `none`. | +| `LANGFLOW_SANDBOX_ALLOW_NETWORK` | Boolean | `False` | Whether sandboxed code may access the network. The default runs the microVM fully offline. When enabled without `LANGFLOW_SANDBOX_ALLOWED_DOMAINS`, only exec-sandbox's package-registry defaults (PyPI) are reachable. Only used when `LANGFLOW_SANDBOX_BACKEND` is not `none`. | +| `LANGFLOW_SANDBOX_ALLOWED_DOMAINS` | String | Not set | Comma-separated list of domains sandboxed code may reach when network access is enabled. Treat like an SSRF allow-list: prefer narrow, fully-qualified domains. Only used when `LANGFLOW_SANDBOX_BACKEND` is not `none`. | +| `LANGFLOW_SANDBOX_ALLOW_SOFTWARE_EMULATION` | Boolean | `False` | Permit the sandbox to run without a hardware hypervisor, letting QEMU fall back to TCG software emulation. Upstream documents TCG as not security-supported, so enable only for trusted/development workloads. Only used when `LANGFLOW_SANDBOX_BACKEND` is not `none`. | ### Visual editor and Playground behavior @@ -461,12 +494,6 @@ For OTLP export to your own backend, see [OpenTelemetry](/observability-opentele | `LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS` | Boolean | `False` | If `true`, blocks built-in code-execution components (Python Interpreter, REPL/Code tools, Smart Transform, and code-running agents). See [Component hardening for untrusted users](/api-keys-and-authentication#multi-tenant-component-hardening). | | `LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS` | Boolean | `False` | If `true`, confines built-in file components to the upload storage directory and blocks local-file SQL dialects and local Git clones. See [Component hardening for untrusted users](/api-keys-and-authentication#multi-tenant-component-hardening). | | `LANGFLOW_MCP_SERVER_DOCKER_HARDENING` | Boolean | `False` | If `true`, applies a strict Docker-argument policy to MCP stdio servers that use the `docker` transport. See [Component hardening for untrusted users](/api-keys-and-authentication#multi-tenant-component-hardening). | -| `LANGFLOW_SANDBOX_BACKEND` | String | `none` | Execution backend for the code-execution components (Python Interpreter and the legacy Python REPL tool). Set to `exec-sandbox` to run user code in a dedicated QEMU microVM per execution instead of in-process. Requires `pip install 'langflow[sandbox]'`, Python 3.12 or later, and QEMU 8+ with hardware virtualization (KVM on Linux, HVF on macOS). When configured but unavailable — including hosts without a hardware hypervisor — execution fails with an error instead of falling back to in-process execution. | -| `LANGFLOW_SANDBOX_TIMEOUT_SECONDS` | Integer | `30` | Wall-clock limit for one sandboxed execution (1-300 seconds). Only used when `LANGFLOW_SANDBOX_BACKEND` is not `none`. | -| `LANGFLOW_SANDBOX_MEMORY_MB` | Integer | `192` | Guest VM memory for sandboxed executions, in MB (minimum 128). Only used when `LANGFLOW_SANDBOX_BACKEND` is not `none`. | -| `LANGFLOW_SANDBOX_ALLOW_NETWORK` | Boolean | `False` | Whether sandboxed code may access the network. The default runs the microVM fully offline. When enabled without `LANGFLOW_SANDBOX_ALLOWED_DOMAINS`, only exec-sandbox's package-registry defaults (PyPI) are reachable. Only used when `LANGFLOW_SANDBOX_BACKEND` is not `none`. | -| `LANGFLOW_SANDBOX_ALLOWED_DOMAINS` | String | Not set | Comma-separated list of domains sandboxed code may reach when network access is enabled. Treat like an SSRF allow-list: prefer narrow, fully-qualified domains. Only used when `LANGFLOW_SANDBOX_BACKEND` is not `none`. | -| `LANGFLOW_SANDBOX_ALLOW_SOFTWARE_EMULATION` | Boolean | `False` | Permit the sandbox to run without a hardware hypervisor, letting QEMU fall back to TCG software emulation. Upstream documents TCG as not security-supported, so enable only for trusted/development workloads. Only used when `LANGFLOW_SANDBOX_BACKEND` is not `none`. | | `LANGFLOW_LOAD_FLOWS_PATH` | String | Not set | Path to a directory containing flow JSON files to be loaded on startup. Typically used when creating a Docker image with prepackaged flows. Requires `LANGFLOW_AUTO_LOGIN=True`. | | `LANGFLOW_LOAD_FLOWS_OVERWRITE_ON_NAME_MATCH` | Boolean | `False` | When a flow file in `LANGFLOW_LOAD_FLOWS_PATH` shares a name with an existing DB row but has a different `id`, controls whether to overwrite the existing row. `False` (default) skips with a warning so UI edits are preserved on restart when file UUIDs regenerate. Set to `True` to opt into prepackaged-flows-are-source-of-truth semantics, typically for CI/CD pipelines. | | `LANGFLOW_LOAD_FLOWS_PRESERVE_VARIABLE_BINDINGS` | Boolean | `True` | Preserve global-variable bindings configured in the visual editor when an existing flow is reloaded from `LANGFLOW_LOAD_FLOWS_PATH`. Bindings explicitly configured in the flow file still take precedence. Set to `False` to restore blind replacement of the flow data on restart. | diff --git a/docs/docs/Lfx/extensions-overview.mdx b/docs/docs/Lfx/extensions-overview.mdx index c09c2ec335d8..99f4537d526a 100644 --- a/docs/docs/Lfx/extensions-overview.mdx +++ b/docs/docs/Lfx/extensions-overview.mdx @@ -12,7 +12,7 @@ This bundle is the same group that related components are listed under in the vi Instead of every integration being built into `langflow`, you install the extensions you need. Saved flows reference bundles by stable IDs (`ext::@official`), not by pip package name, so a provider can move between packages without breaking your flows. -Starting in Langflow 1.12, the default `uv pip install langflow` install omits 73 provider bundles. For more information, see [Additional bundles](/extensions-bundle-list#additional-bundles). +Starting in Langflow 1.12, the default `uv pip install langflow` installation includes only a curated list of providers. For more information, see [Additional bundles](/extensions-bundle-list#additional-bundles). To install extensions and bundle components, see [Install LFX with bundle components](./lfx-install#install-with-bundle-components). diff --git a/docs/docs/Support/release-notes.mdx b/docs/docs/Support/release-notes.mdx index 73df6cdd57b4..be4bff67d037 100644 --- a/docs/docs/Support/release-notes.mdx +++ b/docs/docs/Support/release-notes.mdx @@ -98,6 +98,24 @@ Highlights of this release include the following changes. For all changes, see t For more information, see [Disable the legacy MCP SSE transport](/mcp-server#disable-legacy-sse). +- OpenTelemetry export + + Langflow can export health traces, metrics, and logs over OTLP to your own backend. + + For more information, see [OpenTelemetry](/observability-opentelemetry). + +- OrcaRouter bundle + + The **OrcaRouter** bundle adds an OrcaRouter language model component. + + For more information, see [OrcaRouter](/bundles-orcarouter). + +- IBM Confluent bundle + + The **IBM Confluent** bundle adds Kafka, Tableflow, and Real-Time Context Engine components. + + For more information, see [IBM Confluent](/bundles-confluent). + ## 1.11.x For 1.11.x release notes, see the [1.11.x documentation](https://docs.langflow.org/1.11.0/release-notes). From 7c75930a0c4de03a5cb4ec53548313f64c3a0420 Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Mon, 24 Aug 2026 16:30:38 -0400 Subject: [PATCH 10/20] docs: linking cleanup and new bundle components --- docs/docs/Develop/configuration-cli.mdx | 2 +- docs/docs/Develop/environment-variables.mdx | 4 ++-- docs/docs/Develop/observability-grafana-loki.mdx | 4 ++-- docs/docs/Lfx/extensions-bundle-list.mdx | 4 ++-- docs/docs/Lfx/lfx-overview.mdx | 2 +- docs/docs/Support/release-notes.mdx | 6 +++--- docs/docs/_partial-opt-in-bundles.mdx | 4 ++-- 7 files changed, 13 insertions(+), 13 deletions(-) diff --git a/docs/docs/Develop/configuration-cli.mdx b/docs/docs/Develop/configuration-cli.mdx index de8eaf087ded..e53861ad6c86 100644 --- a/docs/docs/Develop/configuration-cli.mdx +++ b/docs/docs/Develop/configuration-cli.mdx @@ -264,7 +264,7 @@ langflow observability doctor The doctor also prints whether log message bodies (`LANGFLOW_OTEL_LOG_BODIES`) and database spans (`LANGFLOW_OTEL_DB_SPANS`) are enabled. In your backend, search for items named `lfx.observability.doctor`. -For more information, see [OpenTelemetry](/observability-opentelemetry#verify-your-configuration). +For more information, see [OpenTelemetry](./observability-opentelemetry.mdx#verify-your-configuration). ### langflow run {#langflow-run} diff --git a/docs/docs/Develop/environment-variables.mdx b/docs/docs/Develop/environment-variables.mdx index 63b306e1ce64..2cc2e560bf18 100644 --- a/docs/docs/Develop/environment-variables.mdx +++ b/docs/docs/Develop/environment-variables.mdx @@ -403,7 +403,7 @@ For multi-worker tuning—including the Redis job queue and Gunicorn worker sett ### Monitoring and metrics -For OpenTelemetry traces, metrics, and logs that describe Langflow service health, including `LANGFLOW_OTEL_*` and `OTEL_EXPORTER_OTLP_*`, see [OpenTelemetry](/observability-opentelemetry). +For OpenTelemetry traces, metrics, and logs that describe Langflow service health, including `LANGFLOW_OTEL_*` and `OTEL_EXPORTER_OTLP_*`, see [OpenTelemetry](./observability-opentelemetry.mdx). For prompt-level LLM tracing, see [Langfuse](/integrations-langfuse) and the other monitoring integrations. For Prometheus on Kubernetes, see [Best practices for Langflow on Kubernetes](/deployment-prod-best-practices). @@ -460,7 +460,7 @@ Set `OTEL_EXPORTER_OTLP_ENDPOINT` to enable export. If it is unset, Langflow ins Standard OpenTelemetry SDK variables such as `OTEL_SERVICE_NAME` and `OTEL_EXPORTER_OTLP_HEADERS` also apply. To verify the pipeline, run [`langflow observability doctor`](/configuration-cli#langflow-observability-doctor). -For the full list, what Langflow does and does not export, and vendor setup, see [OpenTelemetry](/observability-opentelemetry). +For the full list, what Langflow does and does not export, and vendor setup, see [OpenTelemetry](./observability-opentelemetry.mdx). ### Python Interpreter sandbox {#langflow-sandbox} diff --git a/docs/docs/Develop/observability-grafana-loki.mdx b/docs/docs/Develop/observability-grafana-loki.mdx index 90a3d97df191..ffe56621fc79 100644 --- a/docs/docs/Develop/observability-grafana-loki.mdx +++ b/docs/docs/Develop/observability-grafana-loki.mdx @@ -7,7 +7,7 @@ slug: /observability-grafana-loki This demonstration scrapes Langflow log files with [Promtail](https://grafana.com/docs/loki/latest/send-data/promtail/), and then sends JSON logs to [Grafana Loki](https://grafana.com/oss/loki/) to be viewed in a Grafana dashboard. It is _not_ OpenTelemetry. -For traces, metrics, and OTLP logs to Grafana Cloud or an OpenTelemetry Collector, see [OpenTelemetry](/observability-opentelemetry). +For traces, metrics, and OTLP logs to Grafana Cloud or an OpenTelemetry Collector, see [OpenTelemetry](./observability-opentelemetry.mdx). This page demonstrates how to connect Langflow to the [reference Grafana stack](https://github.com/langflow-ai/langflow/tree/main/deploy/observability/grafana-loki) shipped with the Langflow repository. For more information, see the [README](https://github.com/langflow-ai/langflow/tree/main/deploy/observability/grafana-loki). @@ -57,6 +57,6 @@ To consume structured Langflow logs with other ingestion providers, see [Logs](/ ## See also -* [OpenTelemetry](/observability-opentelemetry) +* [OpenTelemetry](./observability-opentelemetry.mdx) * [Logs](/logging) * [Logs endpoints](/api-logs) diff --git a/docs/docs/Lfx/extensions-bundle-list.mdx b/docs/docs/Lfx/extensions-bundle-list.mdx index ed690b92031d..a716abd65472 100644 --- a/docs/docs/Lfx/extensions-bundle-list.mdx +++ b/docs/docs/Lfx/extensions-bundle-list.mdx @@ -46,7 +46,7 @@ Install one package, or install all of them together with the non-PyTorch provid | Bundle | Install command | | --- | --- | | [`arxiv`](/bundles-arxiv) (arXiv) | `uv pip install lfx-arxiv` | -| [`confluent`](/bundles-confluent) (IBM Confluent) | `uv pip install lfx-confluent` | +| [`confluent`](./bundles-confluent) (IBM Confluent) | `uv pip install lfx-confluent` | | [`duckduckgo`](/bundles-duckduckgo) (DuckDuckGo) | `uv pip install lfx-duckduckgo` | | [`empiriolabs`](/bundles-empiriolabs) (EmpirioLabs) | `uv pip install lfx-empiriolabs` | | [`exa`](/bundles-exa) (Exa) | `uv pip install lfx-exa` | @@ -108,7 +108,7 @@ To install every provider, including providers that require PyTorch as a depende | [`nvidia`](/bundles-nvidia) (NVIDIA) | `uv pip install "lfx-bundles[nvidia]"` | | `olivya` | `uv pip install "lfx-bundles[olivya]"` | | [`openrouter`](/bundles-openrouter) (OpenRouter) | `uv pip install "lfx-bundles[openrouter]"` | -| [`orcarouter`](/bundles-orcarouter) (OrcaRouter) | `uv pip install "lfx-bundles[orcarouter]"` | +| [`orcarouter`](./bundles-orcarouter) (OrcaRouter) | `uv pip install "lfx-bundles[orcarouter]"` | | [`perplexity`](/bundles-perplexity) (Perplexity) | `uv pip install "lfx-bundles[perplexity]"` | | [`pgvector`](/bundles-pgvector) (pgvector) | `uv pip install "lfx-bundles[pgvector]"` | | [`pinecone`](/bundles-pinecone) (Pinecone) | `uv pip install "lfx-bundles[pinecone]"` | diff --git a/docs/docs/Lfx/lfx-overview.mdx b/docs/docs/Lfx/lfx-overview.mdx index a5bbbaba5cb4..3babd25a64d4 100644 --- a/docs/docs/Lfx/lfx-overview.mdx +++ b/docs/docs/Lfx/lfx-overview.mdx @@ -39,7 +39,7 @@ LFX provides two sets of commands: | [`lfx run`](./lfx-run) | Execute a flow locally and stream results to `stdout` | | [`lfx prewarm`](./lfx-prewarm) | Pre-warm core component imports and optional flows before a fork or snapshot | | [`lfx-mcp`](./lfx-mcp) | Start an MCP server that connects to a running Langflow instance | -| `lfx observability doctor` | Send a probe span, metric, and log to the configured OTLP endpoint. See [OpenTelemetry](/observability-opentelemetry#verify-your-configuration). | +| `lfx observability doctor` | Send a probe span, metric, and log to the configured OTLP endpoint. See [OpenTelemetry](./observability-opentelemetry#verify-your-configuration). | For the LFX runtime commands, see [Run flows with LFX](./lfx-run) and [Serve flows with LFX](./lfx-serve). diff --git a/docs/docs/Support/release-notes.mdx b/docs/docs/Support/release-notes.mdx index be4bff67d037..3ebb780fd754 100644 --- a/docs/docs/Support/release-notes.mdx +++ b/docs/docs/Support/release-notes.mdx @@ -102,19 +102,19 @@ Highlights of this release include the following changes. For all changes, see t Langflow can export health traces, metrics, and logs over OTLP to your own backend. - For more information, see [OpenTelemetry](/observability-opentelemetry). + For more information, see [OpenTelemetry](./observability-opentelemetry). - OrcaRouter bundle The **OrcaRouter** bundle adds an OrcaRouter language model component. - For more information, see [OrcaRouter](/bundles-orcarouter). + For more information, see [OrcaRouter](./bundles-orcarouter). - IBM Confluent bundle The **IBM Confluent** bundle adds Kafka, Tableflow, and Real-Time Context Engine components. - For more information, see [IBM Confluent](/bundles-confluent). + For more information, see [IBM Confluent](./bundles-confluent). ## 1.11.x diff --git a/docs/docs/_partial-opt-in-bundles.mdx b/docs/docs/_partial-opt-in-bundles.mdx index b9634f0eda15..ac039fc151f3 100644 --- a/docs/docs/_partial-opt-in-bundles.mdx +++ b/docs/docs/_partial-opt-in-bundles.mdx @@ -27,7 +27,7 @@ The **Chroma DB** bundle component in the visual editor is opt-in. ### Model providers -[`aiml`](/bundles-aiml) · [`baidu`](/bundles-baidu) · [`cloudflare`](/bundles-cloudflare) · [`cometapi`](/bundles-cometapi) · [`deepseek`](/bundles-deepseek) · [`empiriolabs`](/bundles-empiriolabs) · [`groq`](/bundles-groq) · [`huggingface`](/bundles-huggingface) · [`litellm`](/bundles-lite-llm) · [`lmstudio`](/bundles-lmstudio) · [`maritalk`](/bundles-maritalk) · [`mistral`](/bundles-mistralai) · `notdiamond` · [`novita`](/bundles-novita) · [`nvidia`](/bundles-nvidia) · [`openrouter`](/bundles-openrouter) · [`orcarouter`](/bundles-orcarouter) · [`perplexity`](/bundles-perplexity) · [`sambanova`](/bundles-sambanova) · [`vertexai`](/bundles-vertexai) · [`xai`](/bundles-xai) +[`aiml`](/bundles-aiml) · [`baidu`](/bundles-baidu) · [`cloudflare`](/bundles-cloudflare) · [`cometapi`](/bundles-cometapi) · [`deepseek`](/bundles-deepseek) · [`empiriolabs`](/bundles-empiriolabs) · [`groq`](/bundles-groq) · [`huggingface`](/bundles-huggingface) · [`litellm`](/bundles-lite-llm) · [`lmstudio`](/bundles-lmstudio) · [`maritalk`](/bundles-maritalk) · [`mistral`](/bundles-mistralai) · `notdiamond` · [`novita`](/bundles-novita) · [`nvidia`](/bundles-nvidia) · [`openrouter`](/bundles-openrouter) · [`orcarouter`](./bundles-orcarouter) · [`perplexity`](/bundles-perplexity) · [`sambanova`](/bundles-sambanova) · [`vertexai`](/bundles-vertexai) · [`xai`](/bundles-xai) ### Vector stores and memory (19) @@ -35,4 +35,4 @@ The **Chroma DB** bundle component in the visual editor is opt-in. ### Tools, search, and integrations -`agentql` · [`altk`](/bundles-altk) · [`apify`](/bundles-apify) · [`arxiv`](/bundles-arxiv) · [`assemblyai`](/bundles-assemblyai) · [`bing`](/bundles-bing) · [`cleanlab`](/bundles-cleanlab) · [`composio`](/bundles-composio) · [`confluent`](/bundles-confluent) · `confluence` · [`duckduckgo`](/bundles-duckduckgo) · [`exa`](/bundles-exa) · [`firecrawl`](/bundles-firecrawl) · `git` · [`glean`](/bundles-glean) · `homeassistant` · [`icosacomputing`](/bundles-icosacomputing) · `jigsawstack` · `langwatch` · [`nextplaid`](/bundles-nextplaid) · [`notion`](/bundles-notion) · `olivya` · [`paddle`](/bundles-paddle) · `scrapegraph` · [`searchapi`](/bundles-searchapi) · `serpapi` · `spider` · `tavily` · `twelvelabs` · `unstructured` · `vlmrun` · [`wikipedia`](/bundles-wikipedia) · `wolframalpha` · `yahoosearch` · `youtube` +`agentql` · [`altk`](/bundles-altk) · [`apify`](/bundles-apify) · [`arxiv`](/bundles-arxiv) · [`assemblyai`](/bundles-assemblyai) · [`bing`](/bundles-bing) · [`cleanlab`](/bundles-cleanlab) · [`composio`](/bundles-composio) · [`confluent`](./bundles-confluent) · `confluence` · [`duckduckgo`](/bundles-duckduckgo) · [`exa`](/bundles-exa) · [`firecrawl`](/bundles-firecrawl) · `git` · [`glean`](/bundles-glean) · `homeassistant` · [`icosacomputing`](/bundles-icosacomputing) · `jigsawstack` · `langwatch` · [`nextplaid`](/bundles-nextplaid) · [`notion`](/bundles-notion) · `olivya` · [`paddle`](/bundles-paddle) · `scrapegraph` · [`searchapi`](/bundles-searchapi) · `serpapi` · `spider` · `tavily` · `twelvelabs` · `unstructured` · `vlmrun` · [`wikipedia`](/bundles-wikipedia) · `wolframalpha` · `yahoosearch` · `youtube` From f137f77948741005661de3a8fa07e87559cb6f9f Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Mon, 24 Aug 2026 16:36:43 -0400 Subject: [PATCH 11/20] docs: opt-in partial --- docs/docs/_partial-opt-in-bundles.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/docs/_partial-opt-in-bundles.mdx b/docs/docs/_partial-opt-in-bundles.mdx index ac039fc151f3..9bb3deeca7a7 100644 --- a/docs/docs/_partial-opt-in-bundles.mdx +++ b/docs/docs/_partial-opt-in-bundles.mdx @@ -1,5 +1,5 @@ Starting in Langflow 1.12, `uv pip install langflow` includes a curated provider set only. -The following bundles are **not** installed by default. Each is a one-line install. +The following bundles are **not** installed by default. To install one provider from `lfx-bundles`, run: @@ -29,7 +29,7 @@ The **Chroma DB** bundle component in the visual editor is opt-in. [`aiml`](/bundles-aiml) · [`baidu`](/bundles-baidu) · [`cloudflare`](/bundles-cloudflare) · [`cometapi`](/bundles-cometapi) · [`deepseek`](/bundles-deepseek) · [`empiriolabs`](/bundles-empiriolabs) · [`groq`](/bundles-groq) · [`huggingface`](/bundles-huggingface) · [`litellm`](/bundles-lite-llm) · [`lmstudio`](/bundles-lmstudio) · [`maritalk`](/bundles-maritalk) · [`mistral`](/bundles-mistralai) · `notdiamond` · [`novita`](/bundles-novita) · [`nvidia`](/bundles-nvidia) · [`openrouter`](/bundles-openrouter) · [`orcarouter`](./bundles-orcarouter) · [`perplexity`](/bundles-perplexity) · [`sambanova`](/bundles-sambanova) · [`vertexai`](/bundles-vertexai) · [`xai`](/bundles-xai) -### Vector stores and memory (19) +### Vector stores and memory [`chroma`](/bundles-chroma) · [`clickhouse`](/bundles-clickhouse) · [`couchbase`](/bundles-couchbase) · [`elastic`](/bundles-elastic) · [`faiss`](/bundles-faiss) · [`mem0`](/bundles-mem0) · [`milvus`](/bundles-milvus) · [`mongodb`](/bundles-mongodb) · `needle` · [`pgvector`](/bundles-pgvector) · [`pinecone`](/bundles-pinecone) · [`qdrant`](/bundles-qdrant) · [`redis`](/bundles-redis) · [`supabase`](/bundles-supabase) · [`upstash`](/bundles-upstash) · [`valkey`](/bundles-valkey) · [`vectara`](/bundles-vectara) · [`weaviate`](/bundles-weaviate) · `zep` From e8c10c77cef8c4547cce3b3db2d980912765e6ad Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Mon, 24 Aug 2026 17:15:50 -0400 Subject: [PATCH 12/20] docs: deployment tweaks policy --- .../API-Reference/api-reference-api-examples.mdx | 6 ++++++ .../deployment-block-custom-components.mdx | 2 ++ docs/docs/Develop/api-keys-and-authentication.mdx | 5 +++++ docs/docs/Develop/environment-variables.mdx | 1 + docs/docs/Flows/concepts-publish.mdx | 4 ++++ docs/docs/Support/release-notes.mdx | 12 ++++++++++++ docs/sidebars.js | 1 + 7 files changed, 31 insertions(+) diff --git a/docs/docs/API-Reference/api-reference-api-examples.mdx b/docs/docs/API-Reference/api-reference-api-examples.mdx index 0b8b988e4f08..1f0dd3c28578 100644 --- a/docs/docs/API-Reference/api-reference-api-examples.mdx +++ b/docs/docs/API-Reference/api-reference-api-examples.mdx @@ -323,6 +323,12 @@ Other endpoints are helpful for specific use cases, such as administration and f * PATCH `/v1/users/{user_id}/reset-password`: Reset own password. * DELETE `/v1/users/{user_id}`: Delete a user (cannot delete yourself). +* [API governance policy](./api-governance-policy) (superuser required): + * GET `/v1/policy-bundle`: Read the install-wide catalog and model policy. + * PUT `/v1/policy-bundle`: Replace the bundle. Requires `expected_revision`. + * GET `/v1/catalog-policy/components` and `PUT /v1/catalog-policy/components`: Blocked component keys. + * GET `/v1/model-provider-policy` and `PUT /v1/model-provider-policy`: Approved model providers. + * Custom components: You might use these endpoints when developing custom Langflow components for your own use or to share with the Langflow community: * GET `/v1/all`: Return all available Langflow component types. See [Get all components](/api-reference-api-examples#get-all-components). * POST `/v1/custom_component`: Build a custom component from code and return its node. diff --git a/docs/docs/Deployment/deployment-block-custom-components.mdx b/docs/docs/Deployment/deployment-block-custom-components.mdx index 54e15376d26b..f46d23b0d610 100644 --- a/docs/docs/Deployment/deployment-block-custom-components.mdx +++ b/docs/docs/Deployment/deployment-block-custom-components.mdx @@ -100,6 +100,8 @@ When this is `false` **and** `LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false`, component Default is `true`, which preserves existing behavior. The setting has no effect while `LANGFLOW_ALLOW_CUSTOM_COMPONENTS=true`, since nothing is being bypassed. +To hide or refuse named built-in components, starter templates, model providers, or models without turning off custom code entirely, use the superuser [catalog and model policy APIs](./api-governance-policy). + For more information, see: * [Environment variables](/environment-variables#visual-editor-and-playground-behavior) diff --git a/docs/docs/Develop/api-keys-and-authentication.mdx b/docs/docs/Develop/api-keys-and-authentication.mdx index 53c373a3dc62..6a048e659d30 100644 --- a/docs/docs/Develop/api-keys-and-authentication.mdx +++ b/docs/docs/Develop/api-keys-and-authentication.mdx @@ -520,6 +520,7 @@ For more information, see [Docker image defaults](/deployment-docker#docker-imag | `LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS` | Boolean | `False` | When `true`, blocks execution of any flow containing a built-in arbitrary-code-execution component, including the [**Python Interpreter**](/python-interpreter), Python REPL/Code tools, [**Smart Transform**](/smart-transform), [**CSV Agent**](/bundles-langchain#csv-agent), and code-running agents such as [**CodeAct**](/bundles-codeagents#codeact-agent-smolagents), [**CUGA**](/bundles-cuga), and [**OpenDsStar**](/bundles-codeagents#opendstar-agent). | | `LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS` | Boolean | `False` | When `true`, built-in file-reading components, including the [**File**](/read-file), [**Directory**](/legacy-core-components#legacy-data-components), [**JSON/CSV-to-Data**](/legacy-core-components#legacy-data-components), and the [**CSV Agent**](/bundles-langchain#csv-agent), [**JSON Agent**](/bundles-langchain#legacy-langchain-components), and [**OpenAPI Agent**](/bundles-langchain#openapi-agent) can only read and write paths inside the [`LANGFLOW_CONFIG_DIR`](/memory) storage directory. This also blocks `sqlite` and `duckdb` dialects in the [**SQL Database**](/sql-database) components and local-filesystem Git clones. | | `LANGFLOW_MCP_SERVER_DOCKER_HARDENING` | Boolean | `False` | When `true`, applies a strict Docker-argument policy to MCP stdio servers that use the `docker` transport. Rejects host filesystem or device mounts, `host/another-container` namespaces, non-default networks, privilege flags, and sandbox-disabling `--security-opt` values. Forms such as `--network none` / `bridge` and `--security-opt no-new-privileges` remain allowed. | +| `LANGFLOW_TWEAKS_POLICY` | String | `permissive` | Which component fields a run request may set through `tweaks`. For more information, see [Restrict which fields API callers can tweak](./api-governance-policy#tweaks-policy). | Enable these flags when untrusted users can build flows on this server. @@ -532,6 +533,9 @@ To enable these flags, set the following: * `LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=true`: blocks built-in code-execution components. * `LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true`: confines built-in file access to the upload sandbox. * `LANGFLOW_MCP_SERVER_DOCKER_HARDENING=true`: tightens Docker MCP server arguments. +* `LANGFLOW_TWEAKS_POLICY=declared` or `off`: limits which component fields an API caller can override at run time. See [Restrict which fields API callers can tweak](./api-governance-policy#tweaks-policy). + +To block named built-in components, starter templates, model providers, or models across the install, use the [catalog and model policy APIs](./api-governance-policy). Pair these settings with the [SSRF settings](#ssrf-protection) to reduce common escape hatches. @@ -992,4 +996,5 @@ Superusers add, activate, list, and delete users, set **Superuser**, and reset p * [Langflow environment variables](/environment-variables) * [Users endpoints](/api-users) +* [API governance policy](./api-governance-policy) * [Langflow Security Policy](https://github.com/langflow-ai/langflow/blob/main/SECURITY.md) — reporting vulnerabilities, security configuration, and [secret key rotation](https://github.com/langflow-ai/langflow/blob/main/SECURITY.md#secret-key-rotation) diff --git a/docs/docs/Develop/environment-variables.mdx b/docs/docs/Develop/environment-variables.mdx index 2cc2e560bf18..5d6ff3c8921b 100644 --- a/docs/docs/Develop/environment-variables.mdx +++ b/docs/docs/Develop/environment-variables.mdx @@ -494,6 +494,7 @@ They are not included in a default `uv pip install langflow` installation. Insta | `LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS` | Boolean | `False` | If `true`, blocks built-in code-execution components (Python Interpreter, REPL/Code tools, Smart Transform, and code-running agents). See [Component hardening for untrusted users](/api-keys-and-authentication#multi-tenant-component-hardening). | | `LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS` | Boolean | `False` | If `true`, confines built-in file components to the upload storage directory and blocks local-file SQL dialects and local Git clones. See [Component hardening for untrusted users](/api-keys-and-authentication#multi-tenant-component-hardening). | | `LANGFLOW_MCP_SERVER_DOCKER_HARDENING` | Boolean | `False` | If `true`, applies a strict Docker-argument policy to MCP stdio servers that use the `docker` transport. See [Component hardening for untrusted users](/api-keys-and-authentication#multi-tenant-component-hardening). | +| `LANGFLOW_TWEAKS_POLICY` | String | `permissive` | Which component fields a run request may set through `tweaks`. For more information, see [Restrict which fields API callers can tweak](./api-governance-policy#tweaks-policy). | | `LANGFLOW_LOAD_FLOWS_PATH` | String | Not set | Path to a directory containing flow JSON files to be loaded on startup. Typically used when creating a Docker image with prepackaged flows. Requires `LANGFLOW_AUTO_LOGIN=True`. | | `LANGFLOW_LOAD_FLOWS_OVERWRITE_ON_NAME_MATCH` | Boolean | `False` | When a flow file in `LANGFLOW_LOAD_FLOWS_PATH` shares a name with an existing DB row but has a different `id`, controls whether to overwrite the existing row. `False` (default) skips with a warning so UI edits are preserved on restart when file UUIDs regenerate. Set to `True` to opt into prepackaged-flows-are-source-of-truth semantics, typically for CI/CD pipelines. | | `LANGFLOW_LOAD_FLOWS_PRESERVE_VARIABLE_BINDINGS` | Boolean | `True` | Preserve global-variable bindings configured in the visual editor when an existing flow is reloaded from `LANGFLOW_LOAD_FLOWS_PATH`. Bindings explicitly configured in the flow file still take precedence. Set to `False` to restore blind replacement of the flow data on restart. | diff --git a/docs/docs/Flows/concepts-publish.mdx b/docs/docs/Flows/concepts-publish.mdx index da92928520a4..5c8c3ea3c599 100644 --- a/docs/docs/Flows/concepts-publish.mdx +++ b/docs/docs/Flows/concepts-publish.mdx @@ -117,6 +117,10 @@ curl --request POST \ }' ``` +Marking a field **API** only adds it to generated snippets. +The server still accepts other `tweaks` unless you set `LANGFLOW_TWEAKS_POLICY`. +For more information, see [Restrict which fields API callers can tweak](./api-governance-policy#tweaks-policy). + ### Use a flow ID alias If you want your requests to use an alias instead of the actual flow ID, you can rename the flow's `/v1/run/$FLOW_ID` endpoint: diff --git a/docs/docs/Support/release-notes.mdx b/docs/docs/Support/release-notes.mdx index 3ebb780fd754..a251de6ad38f 100644 --- a/docs/docs/Support/release-notes.mdx +++ b/docs/docs/Support/release-notes.mdx @@ -116,6 +116,18 @@ Highlights of this release include the following changes. For all changes, see t For more information, see [IBM Confluent](./bundles-confluent). +- Deployment tweak policy + + Set `LANGFLOW_TWEAKS_POLICY` to control which component fields an API caller can override at run time. + + For more information, see [Restrict which fields API callers can tweak](./api-governance-policy#tweaks-policy). + +- Catalog and model policy APIs + + Superusers can block or allow components, starter templates, model providers, and specific models. + + For more information, see [API governance policy](./api-governance-policy). + ## 1.11.x For 1.11.x release notes, see the [1.11.x documentation](https://docs.langflow.org/1.11.0/release-notes). diff --git a/docs/sidebars.js b/docs/sidebars.js index ad2ec43520d7..fbf6458864ca 100644 --- a/docs/sidebars.js +++ b/docs/sidebars.js @@ -620,6 +620,7 @@ module.exports = { "API-Reference/api-monitor", "API-Reference/api-build", "API-Reference/api-users", + "API-Reference/api-governance-policy", { type: "link", label: "Langflow API specification", From d331f1415be71df63fee69f0d971a15e80514952 Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Mon, 24 Aug 2026 17:24:36 -0400 Subject: [PATCH 13/20] docs: move deployment tweaks to its own page --- docs/docs/API-Reference/api-reference-api-examples.mdx | 2 +- docs/docs/Develop/api-keys-and-authentication.mdx | 7 ++++--- docs/docs/Develop/environment-variables.mdx | 2 +- docs/docs/Flows/concepts-publish.mdx | 2 +- docs/docs/Support/release-notes.mdx | 4 ++-- docs/sidebars.js | 5 +++++ 6 files changed, 14 insertions(+), 8 deletions(-) diff --git a/docs/docs/API-Reference/api-reference-api-examples.mdx b/docs/docs/API-Reference/api-reference-api-examples.mdx index 1f0dd3c28578..f3bc5b13b647 100644 --- a/docs/docs/API-Reference/api-reference-api-examples.mdx +++ b/docs/docs/API-Reference/api-reference-api-examples.mdx @@ -323,7 +323,7 @@ Other endpoints are helpful for specific use cases, such as administration and f * PATCH `/v1/users/{user_id}/reset-password`: Reset own password. * DELETE `/v1/users/{user_id}`: Delete a user (cannot delete yourself). -* [API governance policy](./api-governance-policy) (superuser required): +* [Catalog and model policy](./api-governance-policy) (superuser required): * GET `/v1/policy-bundle`: Read the install-wide catalog and model policy. * PUT `/v1/policy-bundle`: Replace the bundle. Requires `expected_revision`. * GET `/v1/catalog-policy/components` and `PUT /v1/catalog-policy/components`: Blocked component keys. diff --git a/docs/docs/Develop/api-keys-and-authentication.mdx b/docs/docs/Develop/api-keys-and-authentication.mdx index 6a048e659d30..41f1d262fcb8 100644 --- a/docs/docs/Develop/api-keys-and-authentication.mdx +++ b/docs/docs/Develop/api-keys-and-authentication.mdx @@ -520,7 +520,7 @@ For more information, see [Docker image defaults](/deployment-docker#docker-imag | `LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS` | Boolean | `False` | When `true`, blocks execution of any flow containing a built-in arbitrary-code-execution component, including the [**Python Interpreter**](/python-interpreter), Python REPL/Code tools, [**Smart Transform**](/smart-transform), [**CSV Agent**](/bundles-langchain#csv-agent), and code-running agents such as [**CodeAct**](/bundles-codeagents#codeact-agent-smolagents), [**CUGA**](/bundles-cuga), and [**OpenDsStar**](/bundles-codeagents#opendstar-agent). | | `LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS` | Boolean | `False` | When `true`, built-in file-reading components, including the [**File**](/read-file), [**Directory**](/legacy-core-components#legacy-data-components), [**JSON/CSV-to-Data**](/legacy-core-components#legacy-data-components), and the [**CSV Agent**](/bundles-langchain#csv-agent), [**JSON Agent**](/bundles-langchain#legacy-langchain-components), and [**OpenAPI Agent**](/bundles-langchain#openapi-agent) can only read and write paths inside the [`LANGFLOW_CONFIG_DIR`](/memory) storage directory. This also blocks `sqlite` and `duckdb` dialects in the [**SQL Database**](/sql-database) components and local-filesystem Git clones. | | `LANGFLOW_MCP_SERVER_DOCKER_HARDENING` | Boolean | `False` | When `true`, applies a strict Docker-argument policy to MCP stdio servers that use the `docker` transport. Rejects host filesystem or device mounts, `host/another-container` namespaces, non-default networks, privilege flags, and sandbox-disabling `--security-opt` values. Forms such as `--network none` / `bridge` and `--security-opt no-new-privileges` remain allowed. | -| `LANGFLOW_TWEAKS_POLICY` | String | `permissive` | Which component fields a run request may set through `tweaks`. For more information, see [Restrict which fields API callers can tweak](./api-governance-policy#tweaks-policy). | +| `LANGFLOW_TWEAKS_POLICY` | String | `permissive` | Which component fields a run request may set through `tweaks`. For more information, see [Restrict API tweaks](./deployment-tweaks-policy). | Enable these flags when untrusted users can build flows on this server. @@ -533,7 +533,7 @@ To enable these flags, set the following: * `LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=true`: blocks built-in code-execution components. * `LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true`: confines built-in file access to the upload sandbox. * `LANGFLOW_MCP_SERVER_DOCKER_HARDENING=true`: tightens Docker MCP server arguments. -* `LANGFLOW_TWEAKS_POLICY=declared` or `off`: limits which component fields an API caller can override at run time. See [Restrict which fields API callers can tweak](./api-governance-policy#tweaks-policy). +* `LANGFLOW_TWEAKS_POLICY=declared` or `off`: limits which component fields an API caller can override at run time. See [Restrict API tweaks](./deployment-tweaks-policy). To block named built-in components, starter templates, model providers, or models across the install, use the [catalog and model policy APIs](./api-governance-policy). @@ -996,5 +996,6 @@ Superusers add, activate, list, and delete users, set **Superuser**, and reset p * [Langflow environment variables](/environment-variables) * [Users endpoints](/api-users) -* [API governance policy](./api-governance-policy) +* [Restrict API tweaks](./deployment-tweaks-policy) +* [Catalog and model policy](./api-governance-policy) * [Langflow Security Policy](https://github.com/langflow-ai/langflow/blob/main/SECURITY.md) — reporting vulnerabilities, security configuration, and [secret key rotation](https://github.com/langflow-ai/langflow/blob/main/SECURITY.md#secret-key-rotation) diff --git a/docs/docs/Develop/environment-variables.mdx b/docs/docs/Develop/environment-variables.mdx index 5d6ff3c8921b..d15a7a3afa70 100644 --- a/docs/docs/Develop/environment-variables.mdx +++ b/docs/docs/Develop/environment-variables.mdx @@ -494,7 +494,7 @@ They are not included in a default `uv pip install langflow` installation. Insta | `LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS` | Boolean | `False` | If `true`, blocks built-in code-execution components (Python Interpreter, REPL/Code tools, Smart Transform, and code-running agents). See [Component hardening for untrusted users](/api-keys-and-authentication#multi-tenant-component-hardening). | | `LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS` | Boolean | `False` | If `true`, confines built-in file components to the upload storage directory and blocks local-file SQL dialects and local Git clones. See [Component hardening for untrusted users](/api-keys-and-authentication#multi-tenant-component-hardening). | | `LANGFLOW_MCP_SERVER_DOCKER_HARDENING` | Boolean | `False` | If `true`, applies a strict Docker-argument policy to MCP stdio servers that use the `docker` transport. See [Component hardening for untrusted users](/api-keys-and-authentication#multi-tenant-component-hardening). | -| `LANGFLOW_TWEAKS_POLICY` | String | `permissive` | Which component fields a run request may set through `tweaks`. For more information, see [Restrict which fields API callers can tweak](./api-governance-policy#tweaks-policy). | +| `LANGFLOW_TWEAKS_POLICY` | String | `permissive` | Which component fields a run request may set through `tweaks`. For more information, see [Restrict API tweaks](./deployment-tweaks-policy). | | `LANGFLOW_LOAD_FLOWS_PATH` | String | Not set | Path to a directory containing flow JSON files to be loaded on startup. Typically used when creating a Docker image with prepackaged flows. Requires `LANGFLOW_AUTO_LOGIN=True`. | | `LANGFLOW_LOAD_FLOWS_OVERWRITE_ON_NAME_MATCH` | Boolean | `False` | When a flow file in `LANGFLOW_LOAD_FLOWS_PATH` shares a name with an existing DB row but has a different `id`, controls whether to overwrite the existing row. `False` (default) skips with a warning so UI edits are preserved on restart when file UUIDs regenerate. Set to `True` to opt into prepackaged-flows-are-source-of-truth semantics, typically for CI/CD pipelines. | | `LANGFLOW_LOAD_FLOWS_PRESERVE_VARIABLE_BINDINGS` | Boolean | `True` | Preserve global-variable bindings configured in the visual editor when an existing flow is reloaded from `LANGFLOW_LOAD_FLOWS_PATH`. Bindings explicitly configured in the flow file still take precedence. Set to `False` to restore blind replacement of the flow data on restart. | diff --git a/docs/docs/Flows/concepts-publish.mdx b/docs/docs/Flows/concepts-publish.mdx index 5c8c3ea3c599..d97eb273b947 100644 --- a/docs/docs/Flows/concepts-publish.mdx +++ b/docs/docs/Flows/concepts-publish.mdx @@ -119,7 +119,7 @@ curl --request POST \ Marking a field **API** only adds it to generated snippets. The server still accepts other `tweaks` unless you set `LANGFLOW_TWEAKS_POLICY`. -For more information, see [Restrict which fields API callers can tweak](./api-governance-policy#tweaks-policy). +For more information, see [Restrict API tweaks](./deployment-tweaks-policy). ### Use a flow ID alias diff --git a/docs/docs/Support/release-notes.mdx b/docs/docs/Support/release-notes.mdx index a251de6ad38f..999f69b6c1c4 100644 --- a/docs/docs/Support/release-notes.mdx +++ b/docs/docs/Support/release-notes.mdx @@ -120,13 +120,13 @@ Highlights of this release include the following changes. For all changes, see t Set `LANGFLOW_TWEAKS_POLICY` to control which component fields an API caller can override at run time. - For more information, see [Restrict which fields API callers can tweak](./api-governance-policy#tweaks-policy). + For more information, see [Restrict API tweaks](./deployment-tweaks-policy). - Catalog and model policy APIs Superusers can block or allow components, starter templates, model providers, and specific models. - For more information, see [API governance policy](./api-governance-policy). + For more information, see [Catalog and model policy](./api-governance-policy). ## 1.11.x diff --git a/docs/sidebars.js b/docs/sidebars.js index fbf6458864ca..d05eb9f7a66e 100644 --- a/docs/sidebars.js +++ b/docs/sidebars.js @@ -324,6 +324,11 @@ module.exports = { id: "Deployment/deployment-block-custom-components", label: "Block custom components", }, + { + type: "doc", + id: "Deployment/deployment-tweaks-policy", + label: "Restrict API tweaks", + }, { type: "doc", id: "Deployment/security", From eae6817f5d1fc3cde1cf748f83d913049f51ee01 Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Mon, 24 Aug 2026 17:38:17 -0400 Subject: [PATCH 14/20] docs: deployment tweaks page --- .../Deployment/deployment-tweaks-policy.mdx | 42 +++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 docs/docs/Deployment/deployment-tweaks-policy.mdx diff --git a/docs/docs/Deployment/deployment-tweaks-policy.mdx b/docs/docs/Deployment/deployment-tweaks-policy.mdx new file mode 100644 index 000000000000..39d3e025c6c1 --- /dev/null +++ b/docs/docs/Deployment/deployment-tweaks-policy.mdx @@ -0,0 +1,42 @@ +--- +title: Restrict API tweaks +slug: /deployment-tweaks-policy +--- + +When an application runs a flow through the Langflow API, the request can include `tweaks`, one-time overrides of component settings for that run. + +By default, a caller can change almost any field, not only the fields marked **API** in the Langflow visual editor. +The **API** button adds marked fields to the generated code snippets, but it does not stop the server from accepting other tweaks. + +To limit what callers can override, set the following [environment variable](/environment-variables): + +```bash +LANGFLOW_TWEAKS_POLICY=declared +``` + +Existing servers keep the default `permissive` behavior until you set this variable. + +## Choose a policy + +| Value | When to use it | What callers can change | +|-------|----------------|-------------------------| +| `permissive` (default) | Trusted callers, local development | Almost any component field. Code fields and other privileged settings stay blocked. | +| `declared` | Production APIs where you choose the knobs | Only fields marked **API** on a flow. If a flow marks none, it behaves like `permissive` so unpublished flows continue working. | +| `off` | Run-only serving | Nothing. Callers can still send the chat input (`input_value`) and `session_id`. | + +This policy applies to API callers, not values Langflow passes internally. A **Run Flow** component can still feed a sub-flow under `off`. + +MCP tools that only accept a prompt still work under `off`. +Additional MCP fields are tweaks, so they are refused. +Use `permissive` or `declared` for tools with additional MCP fields. + +This setting does not hide components from the palette or block model providers. +For those controls, see [Catalog and model policy](./api-governance-policy). + +To mark fields that `declared` should allow, see [Tweaks (API inputs)](/concepts-publish#input-schema). + +For more information, see: + +* [Environment variables](/environment-variables#visual-editor-and-playground-behavior) +* [Component hardening for untrusted users](/api-keys-and-authentication#multi-tenant-component-hardening) +* [Security](/security) From fa0a0ebad2ad7fcf72e94ba74ee3448e927f74de Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Mon, 24 Aug 2026 18:34:47 -0400 Subject: [PATCH 15/20] docs: model and catalog policy --- .../API-Reference/api-governance-policy.mdx | 352 ++++++++++++++++++ 1 file changed, 352 insertions(+) create mode 100644 docs/docs/API-Reference/api-governance-policy.mdx diff --git a/docs/docs/API-Reference/api-governance-policy.mdx b/docs/docs/API-Reference/api-governance-policy.mdx new file mode 100644 index 000000000000..ae5f65b1d5d0 --- /dev/null +++ b/docs/docs/API-Reference/api-governance-policy.mdx @@ -0,0 +1,352 @@ +--- +title: Catalog and model policy +slug: /api-governance-policy +--- + +import Tabs from '@theme/Tabs'; +import TabItem from '@theme/TabItem'; + +On a shared Langflow server, anyone who can build a flow can use every component and model. + +Superusers can create catalog and model policy to hide components, templates, model providers, and models from the Langflow visual builder. + +OSS Langflow has no visual editor for policy management. +Instead, use the APIs on this page with a **superuser** API key or session. +This is the same credential the [Users API](/api-users) requires. + +An empty policy is the default, and has no restrictions. +Nothing is restricted until a superuser writes a policy. + +The four lists of restrictions are saved in one policy bundle. +Replace the policy bundle with a `PUT` request. +Send every list you want in effect with the `PUT` request. +Send `[]` for a list you want unrestricted. + +| You want to… | Field | Example | +|--------------|-------|---------| +| Hide a component and refuse flows that use it | `blocked_component_keys` | `PythonREPLComponent` (Python Interpreter) | +| Hide a starter template | `blocked_template_keys` | `basic_prompting` | +| Allow only some providers | `approved_provider_ids` | `["openai", "anthropic"]`. `[]` means every provider. | +| Block a model | `blocked_model_keys` | `gpt-4o`, `openai::gpt-4o`, or `openai::llm::gpt-4o` | + +A blocked component disappears from the palette. +Saving or running a flow that still contains the component fails. + +A blocked template is omitted from the starter list. + +:::tip +Catalog policy hides or refuses *named* components, including built-ins. + +To block creating and editing custom code, set [`LANGFLOW_ALLOW_CUSTOM_COMPONENTS`](/deployment-block-custom-components). +To block built-in code-execution components at runtime without a policy bundle, set [`LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS`](/api-keys-and-authentication#multi-tenant-component-hardening). +::: + +## Apply a policy {#policy-bundle} + +:::tip +Apply any [database migrations](./database-migrations) before sending requests to these endpoints. +An uninitialized bundle returns `503`. +::: + +1. Create a [superuser API key](/api-keys-and-authentication#create-a-langflow-api-key). + +2. Query how many flows a component would affect before you block it. + + `GET /api/v1/catalog-policy/usage` returns the number of affected flows. + `GET /api/v1/catalog-policy/usage/flows?component=PythonREPLComponent` lists the affected flows. + + For field names and key formats, see [How to name what you block](#keys). + +3. Read the current policy bundle, and copy `revision`. + + + + + ```python + import os + + import requests + + url = f"{os.environ['LANGFLOW_URL']}/api/v1/policy-bundle" + headers = { + "accept": "application/json", + "x-api-key": os.environ["LANGFLOW_API_KEY"], + } + + response = requests.get(url, headers=headers) + response.raise_for_status() + print(response.json()) + ``` + + + + + ```javascript + const url = `${process.env.LANGFLOW_URL}/api/v1/policy-bundle`; + + const response = await fetch(url, { + method: "GET", + headers: { + accept: "application/json", + "x-api-key": process.env.LANGFLOW_API_KEY, + }, + }); + + if (!response.ok) { + throw new Error(`HTTP ${response.status}`); + } + console.log(await response.json()); + ``` + + + + + ```bash + curl -X GET \ + "$LANGFLOW_URL/api/v1/policy-bundle" \ + -H "accept: application/json" \ + -H "x-api-key: $LANGFLOW_API_KEY" + ``` + + + + +
+ Result + + ```json + { + "revision": 1, + "initialized": true, + "source": "default", + "approved_provider_ids": [], + "blocked_component_keys": [], + "blocked_template_keys": [], + "blocked_model_keys": [], + "content_hash": "ef74cccb21593ac02fc514e669c911768e740b1135d7a91d3fb15f72837ab762", + "created_at": null, + "created_by": null, + "reason": null, + "rollback_of_revision": null, + "managed_externally": false + } + ``` + +
+ + :::tip + If `managed_externally` is `true`, an external controller owns policy. + Reads still work. Writes return `409`. + ::: + +4. Replace the bundle with a `PUT` request that includes every list you want in effect. + Send the `revision` number copied from step 3 as `expected_revision`. + Send `[]` for a list you want unrestricted. + + + + + ```python + import os + + import requests + + base = os.environ["LANGFLOW_URL"] + headers = { + "accept": "application/json", + "Content-Type": "application/json", + "x-api-key": os.environ["LANGFLOW_API_KEY"], + } + + current = requests.get(f"{base}/api/v1/policy-bundle", headers=headers) + current.raise_for_status() + revision = current.json()["revision"] + + payload = { + "expected_revision": revision, + "approved_provider_ids": ["openai", "anthropic"], + "blocked_component_keys": ["PythonREPLComponent"], + "blocked_template_keys": [], + "blocked_model_keys": ["openai::llm::gpt-4o"], + "reason": "Limit providers and block code execution", + } + + response = requests.put(f"{base}/api/v1/policy-bundle", headers=headers, json=payload) + response.raise_for_status() + print(response.json()) + ``` + + + + + ```javascript + const base = process.env.LANGFLOW_URL; + const headers = { + accept: "application/json", + "Content-Type": "application/json", + "x-api-key": process.env.LANGFLOW_API_KEY, + }; + + const current = await fetch(`${base}/api/v1/policy-bundle`, { headers }); + if (!current.ok) { + throw new Error(`HTTP ${current.status}`); + } + const revision = (await current.json()).revision; + + const response = await fetch(`${base}/api/v1/policy-bundle`, { + method: "PUT", + headers, + body: JSON.stringify({ + expected_revision: revision, + approved_provider_ids: ["openai", "anthropic"], + blocked_component_keys: ["PythonREPLComponent"], + blocked_template_keys: [], + blocked_model_keys: ["openai::llm::gpt-4o"], + reason: "Limit providers and block code execution", + }), + }); + + if (!response.ok) { + throw new Error(`HTTP ${response.status}`); + } + console.log(await response.json()); + ``` + + + + + ```bash + curl -X PUT \ + "$LANGFLOW_URL/api/v1/policy-bundle" \ + -H "accept: application/json" \ + -H "Content-Type: application/json" \ + -H "x-api-key: $LANGFLOW_API_KEY" \ + -d '{ + "expected_revision": 1, + "approved_provider_ids": ["openai", "anthropic"], + "blocked_component_keys": ["PythonREPLComponent"], + "blocked_template_keys": [], + "blocked_model_keys": ["openai::llm::gpt-4o"], + "reason": "Limit providers and block code execution" + }' + ``` + + + + + If another user updated the policy first, the `PUT` returns `409`. + Repeat from step 3 with an updated `revision` number. + + ```json + { + "detail": { + "message": "Policy bundle revision conflict", + "expected_revision": 1, + "active_revision": 2 + } + } + ``` + +5. Optional: Undo a prior revision. + + `GET /api/v1/policy-bundle/history` lists prior bundle policy revisions. + + To restore a revision, `POST` to `/api/v1/policy-bundle/rollback/{revision}` with the current `expected_revision`: + + ```bash + curl -X POST \ + "$LANGFLOW_URL/api/v1/policy-bundle/rollback/1" \ + -H "accept: application/json" \ + -H "Content-Type: application/json" \ + -H "x-api-key: $LANGFLOW_API_KEY" \ + -d '{"expected_revision": 2, "reason": "Revert last change"}' + ``` + +## How to name blocked items {#keys} + +Components use the type stored in the flow JSON, such as `PythonREPLComponent` or `ChatInput`. +That is the component's class identity, not the label in the visual builder. +Keys are case-sensitive. +Older aliases still match, so blocking `PythonREPLComponent` also catches nodes saved under a previous type for the same component. + +```json +"blocked_component_keys": ["PythonREPLComponent"] +``` + +Starter templates use a lowercase slug of the English name with underscores, such as `basic_prompting`. + +```json +"blocked_template_keys": ["basic_prompting"] +``` + +Providers use lowercase IDs, such as `openai`. +`GET /api/v1/model-provider-policy` lists every provider the process is aware of, with `provider_id` and display name. + +```json +"approved_provider_ids": ["openai", "anthropic"] +``` + +Models use the identities in the model picker. + +```json +"blocked_model_keys": ["gpt-4o", "openai::gpt-4o", "openai::llm::gpt-4o"] +``` + +## Change one list at a time {#catalog-policy} + +Use these endpoints when you want to change only components, templates, or providers. +If you are changing more than one list, use one `PUT` to `/api/v1/policy-bundle` instead. See [Apply a policy](#policy-bundle). + +1. To hide or unhide components, `PUT` the complete blocked list to `/api/v1/catalog-policy/components`. + A `PUT` replaces the whole list. + Send `{"blocked": []}` to unblock every component. + + ```bash + curl -X PUT \ + "$LANGFLOW_URL/api/v1/catalog-policy/components" \ + -H "accept: application/json" \ + -H "Content-Type: application/json" \ + -H "x-api-key: $LANGFLOW_API_KEY" \ + -d '{"blocked": ["PythonREPLComponent"]}' + ``` + + To read the current list first, `GET /api/v1/catalog-policy/components`. + +2. To hide or unhide starter templates, `PUT` the complete blocked list to `/api/v1/catalog-policy/templates`. + + ```bash + curl -X PUT \ + "$LANGFLOW_URL/api/v1/catalog-policy/templates" \ + -H "accept: application/json" \ + -H "Content-Type: application/json" \ + -H "x-api-key: $LANGFLOW_API_KEY" \ + -d '{"blocked": ["basic_prompting"]}' + ``` + + To read the current list first, `GET /api/v1/catalog-policy/templates`. + +3. Optional: List the flows that include a component. + + `GET /api/v1/catalog-policy/usage` returns the number of flows. + `GET /api/v1/catalog-policy/usage/flows?component=PythonREPLComponent` lists the affected flows. + +4. To allow only some providers, `PUT` the complete approved list to `/api/v1/model-provider-policy`. + Send `{"approved_provider_ids": []}` to allow every provider. + + ```bash + curl -X PUT \ + "$LANGFLOW_URL/api/v1/model-provider-policy" \ + -H "accept: application/json" \ + -H "Content-Type: application/json" \ + -H "x-api-key: $LANGFLOW_API_KEY" \ + -d '{"approved_provider_ids": ["openai", "anthropic"]}' + ``` + + Set `blocked_model_keys` with `PUT /api/v1/policy-bundle`. + +## See also + +* [Restrict API tweaks](./deployment-tweaks-policy) +* [Users endpoints](/api-users) +* [Block custom components](/deployment-block-custom-components) +* [API keys and authentication](/api-keys-and-authentication) From 0b74d439f29f80a504964ac92d027303f0c8b543 Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Mon, 24 Aug 2026 18:35:34 -0400 Subject: [PATCH 16/20] docs: links check and release notes --- docs/docs/Support/release-notes.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/docs/Support/release-notes.mdx b/docs/docs/Support/release-notes.mdx index 999f69b6c1c4..1368836311ce 100644 --- a/docs/docs/Support/release-notes.mdx +++ b/docs/docs/Support/release-notes.mdx @@ -84,7 +84,7 @@ Highlights of this release include the following changes. For all changes, see t For more information, see [Isolate executions in a microVM](/python-interpreter#sandbox). -- Production preflight +- Production preflight checks Set `LANGFLOW_DEPLOYMENT_PROFILE=prod` to probe your Langflow deployment before any workers start. The default remains `dev`, which skips prod checks. From 135f7024b746520733b39e8ff28534df791db994 Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Tue, 25 Aug 2026 13:43:52 -0400 Subject: [PATCH 17/20] docs: set user password as superuser --- docs/docs/API-Reference/api-users.mdx | 34 ++++++++++++++++--- .../curl-examples/api-users/reset-password.sh | 1 + .../api-users/set-user-password.sh | 7 ++++ .../api-users/reset-password.js | 5 +-- .../api-users/set-user-password.js | 22 ++++++++++++ .../api-users/reset-password.py | 5 ++- .../api-users/set-user-password.py | 15 ++++++++ 7 files changed, 82 insertions(+), 7 deletions(-) create mode 100644 docs/docs/API-Reference/curl-examples/api-users/set-user-password.sh create mode 100644 docs/docs/API-Reference/javascript-examples/api-users/set-user-password.js create mode 100644 docs/docs/API-Reference/python-examples/api-users/set-user-password.py diff --git a/docs/docs/API-Reference/api-users.mdx b/docs/docs/API-Reference/api-users.mdx index c75b2028f916..2a24c4d718b5 100644 --- a/docs/docs/API-Reference/api-users.mdx +++ b/docs/docs/API-Reference/api-users.mdx @@ -11,6 +11,7 @@ import exampleApiUsersListAllUsers from '!!raw-loader!@site/docs/API-Reference/c import resultApiUsersResultListAllUsers from '!!raw-loader!@site/docs/API-Reference/curl-examples/api-users/result-list-all-users.json'; import exampleApiUsersUpdateUser from '!!raw-loader!@site/docs/API-Reference/curl-examples/api-users/update-user.sh'; import resultApiUsersResultUpdateUser from '!!raw-loader!@site/docs/API-Reference/curl-examples/api-users/result-update-user.json'; +import exampleApiUsersSetUserPassword from '!!raw-loader!@site/docs/API-Reference/curl-examples/api-users/set-user-password.sh'; import exampleApiUsersResetPassword from '!!raw-loader!@site/docs/API-Reference/curl-examples/api-users/reset-password.sh'; import resultApiUsersResultResetPassword from '!!raw-loader!@site/docs/API-Reference/curl-examples/api-users/result-reset-password.json'; import exampleApiUsersDeleteUser from '!!raw-loader!@site/docs/API-Reference/curl-examples/api-users/delete-user.sh'; @@ -25,6 +26,8 @@ import examplePythonApiUsersListAllUsers from '!!raw-loader!@site/docs/API-Refer import exampleJavascriptApiUsersListAllUsers from '!!raw-loader!@site/docs/API-Reference/javascript-examples/api-users/list-all-users.js'; import examplePythonApiUsersUpdateUser from '!!raw-loader!@site/docs/API-Reference/python-examples/api-users/update-user.py'; import exampleJavascriptApiUsersUpdateUser from '!!raw-loader!@site/docs/API-Reference/javascript-examples/api-users/update-user.js'; +import examplePythonApiUsersSetUserPassword from '!!raw-loader!@site/docs/API-Reference/python-examples/api-users/set-user-password.py'; +import exampleJavascriptApiUsersSetUserPassword from '!!raw-loader!@site/docs/API-Reference/javascript-examples/api-users/set-user-password.js'; import examplePythonApiUsersResetPassword from '!!raw-loader!@site/docs/API-Reference/python-examples/api-users/reset-password.py'; import exampleJavascriptApiUsersResetPassword from '!!raw-loader!@site/docs/API-Reference/javascript-examples/api-users/reset-password.js'; import examplePythonApiUsersDeleteUser from '!!raw-loader!@site/docs/API-Reference/python-examples/api-users/delete-user.py'; @@ -35,7 +38,7 @@ import exampleJavascriptApiUsersDeleteUser from '!!raw-loader!@site/docs/API-Ref Use the `/users` endpoint to manage user accounts in Langflow. As of Langflow 1.12, there is no **Admin Page** in the visual editor. -Superusers add, activate, list, and delete users, set **Superuser**, and reset passwords through the `/users` API. +Superusers add, activate, list, and delete users, set **Superuser**, and set another user's password with `PATCH /api/v1/users/{id}`. ## Add user @@ -132,7 +135,7 @@ Requires authentication as a superuser if the Langflow server has authentication -## Update user +## Update user {#update-user} Modify an existing user's information with a PATCH request. @@ -165,11 +168,34 @@ This example activates the specified user's account and makes them a superuser: +To set another user's password as an administrator, include `"password"` in the same `PATCH /api/v1/users/{id}` body. +Only a superuser can set a password this way, and the current password is not required. +Non-superusers cannot change passwords on this route. + + + + +{examplePythonApiUsersSetUserPassword} + + + + +{exampleJavascriptApiUsersSetUserPassword} + + + + +{exampleApiUsersSetUserPassword} + + + + ## Reset password -Change the specified user's password to a new secure value. +Change **your own** password. -Requires authentication as the target user. +This route is self-service. Authenticate as the target user, send that user's `id` in the path, and include `current_password` plus the new `password`. +A superuser resetting someone else's password must use [Update user](#update-user) instead. diff --git a/docs/docs/API-Reference/curl-examples/api-users/reset-password.sh b/docs/docs/API-Reference/curl-examples/api-users/reset-password.sh index 3ec304a0be10..800d505617ed 100644 --- a/docs/docs/API-Reference/curl-examples/api-users/reset-password.sh +++ b/docs/docs/API-Reference/curl-examples/api-users/reset-password.sh @@ -3,5 +3,6 @@ curl -X PATCH \ -H "Content-Type: application/json" \ -H "x-api-key: $LANGFLOW_API_KEY" \ -d '{ + "current_password": "securepassword123", "password": "newsecurepassword123" }' diff --git a/docs/docs/API-Reference/curl-examples/api-users/set-user-password.sh b/docs/docs/API-Reference/curl-examples/api-users/set-user-password.sh new file mode 100644 index 000000000000..a9e4fe520f09 --- /dev/null +++ b/docs/docs/API-Reference/curl-examples/api-users/set-user-password.sh @@ -0,0 +1,7 @@ +curl -X PATCH \ + "$LANGFLOW_URL/api/v1/users/10c1c6a2-ab8a-4748-8700-0e4832fd5ce8" \ + -H "Content-Type: application/json" \ + -H "x-api-key: $LANGFLOW_API_KEY" \ + -d '{ + "password": "newsecurepassword123" + }' diff --git a/docs/docs/API-Reference/javascript-examples/api-users/reset-password.js b/docs/docs/API-Reference/javascript-examples/api-users/reset-password.js index 483aebcd481d..5b78ac6ab4f9 100644 --- a/docs/docs/API-Reference/javascript-examples/api-users/reset-password.js +++ b/docs/docs/API-Reference/javascript-examples/api-users/reset-password.js @@ -7,8 +7,9 @@ const options = { "x-api-key": `${process.env.LANGFLOW_API_KEY ?? ""}`, }, body: JSON.stringify({ - "password": "newsecurepassword123" -}), + current_password: "securepassword123", + password: "newsecurepassword123", + }), }; fetch(url, options) diff --git a/docs/docs/API-Reference/javascript-examples/api-users/set-user-password.js b/docs/docs/API-Reference/javascript-examples/api-users/set-user-password.js new file mode 100644 index 000000000000..307376abcdc1 --- /dev/null +++ b/docs/docs/API-Reference/javascript-examples/api-users/set-user-password.js @@ -0,0 +1,22 @@ +const url = `${process.env.LANGFLOW_URL ?? ""}/api/v1/users/10c1c6a2-ab8a-4748-8700-0e4832fd5ce8`; + +const options = { + method: "PATCH", + headers: { + "Content-Type": "application/json", + "x-api-key": `${process.env.LANGFLOW_API_KEY ?? ""}`, + }, + body: JSON.stringify({ + password: "newsecurepassword123", + }), +}; + +fetch(url, options) + .then(async (response) => { + if (!response.ok) { + throw new Error(`HTTP ${response.status}`); + } + const text = await response.text(); + console.log(text); + }) + .catch((error) => console.error(error)); diff --git a/docs/docs/API-Reference/python-examples/api-users/reset-password.py b/docs/docs/API-Reference/python-examples/api-users/reset-password.py index ea4c8fdad343..e36d6e79fda1 100644 --- a/docs/docs/API-Reference/python-examples/api-users/reset-password.py +++ b/docs/docs/API-Reference/python-examples/api-users/reset-password.py @@ -12,7 +12,10 @@ user_id = who.json()["id"] # Must differ from the current password. -payload = {"password": "DocsExampleResetPass2025!"} +payload = { + "current_password": os.environ.get("LANGFLOW_CURRENT_PASSWORD", "securepassword123"), + "password": "DocsExampleResetPass2025!", +} response = requests.patch( f"{base}/api/v1/users/{user_id}/reset-password", diff --git a/docs/docs/API-Reference/python-examples/api-users/set-user-password.py b/docs/docs/API-Reference/python-examples/api-users/set-user-password.py new file mode 100644 index 000000000000..355363d89d64 --- /dev/null +++ b/docs/docs/API-Reference/python-examples/api-users/set-user-password.py @@ -0,0 +1,15 @@ +import os + +import requests + +base = os.environ.get("LANGFLOW_URL", "") +api_key = os.environ.get("LANGFLOW_API_KEY", "") +user_id = os.environ.get("LANGFLOW_USER_ID", "10c1c6a2-ab8a-4748-8700-0e4832fd5ce8") + +headers = {"Content-Type": "application/json", "x-api-key": api_key} + +payload = {"password": "newsecurepassword123"} + +response = requests.patch(f"{base}/api/v1/users/{user_id}", headers=headers, json=payload, timeout=30) +response.raise_for_status() +print(response.text) From 06ba6d9d0ff839b715c7f0c923e893295c11b738 Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Tue, 25 Aug 2026 13:50:28 -0400 Subject: [PATCH 18/20] docs: add mrscraper page --- docs/docs/API-Reference/api-users.mdx | 2 +- docs/docs/Agents/mcp-server.mdx | 3 +- docs/docs/Components/bundles-mrscraper.mdx | 146 ++++++++++++++++++ docs/docs/Components/components-bundles.mdx | 2 +- .../deployment-prod-best-practices.mdx | 1 + .../Develop/api-keys-and-authentication.mdx | 7 +- docs/docs/Develop/environment-variables.mdx | 3 +- .../Develop/observability-opentelemetry.mdx | 4 +- docs/docs/Lfx/extensions-bundle-list.mdx | 1 + .../_partial-bundle-graduated-install.mdx | 1 + docs/docs/_partial-opt-in-bundles.mdx | 2 +- docs/sidebars.js | 1 + 12 files changed, 162 insertions(+), 11 deletions(-) create mode 100644 docs/docs/Components/bundles-mrscraper.mdx diff --git a/docs/docs/API-Reference/api-users.mdx b/docs/docs/API-Reference/api-users.mdx index 2a24c4d718b5..0ce989b62fe1 100644 --- a/docs/docs/API-Reference/api-users.mdx +++ b/docs/docs/API-Reference/api-users.mdx @@ -194,7 +194,7 @@ Non-superusers cannot change passwords on this route. Change **your own** password. -This route is self-service. Authenticate as the target user, send that user's `id` in the path, and include `current_password` plus the new `password`. +Authenticate as the target user, send that user's `id` in the path, and include `current_password` plus the new `password`. A superuser resetting someone else's password must use [Update user](#update-user) instead. diff --git a/docs/docs/Agents/mcp-server.mdx b/docs/docs/Agents/mcp-server.mdx index 7e8087653597..f9af999b27fa 100644 --- a/docs/docs/Agents/mcp-server.mdx +++ b/docs/docs/Agents/mcp-server.mdx @@ -419,7 +419,7 @@ Superusers retain full access to MCP server configuration. Locking the MCP server configuration for users does not disable Langflow's built-in MCP server for serving flows as MCP tools. -## MCP server environment variables +## MCP server environment variables {#mcp-server-environment-variables} The following environment variables set behaviors related to your Langflow projects' MCP servers: @@ -436,6 +436,7 @@ The following environment variables set behaviors related to your Langflow proje | `LANGFLOW_ADD_PROJECTS_TO_MCP_SERVERS` | Boolean | `True` | Whether to automatically add newly created projects to the user's MCP servers configuration. If `false`, projects must be manually added to MCP servers. | | `LANGFLOW_MCP_SERVERS_LOCKED` | Boolean | `False` | If `true`, non-superusers cannot add, edit, or remove MCP server connections through the UI or API. Superusers retain full access. For more information, see [Restrict MCP server management to superusers](#restrict-mcp-server-management). | | `LANGFLOW_MCP_SERVER_ALLOWED_PACKAGES` | String | Not set | Comma-separated allowlist of package names that MCP `npx`/`uvx` stdio servers may download and run. Leave unset for single-tenant compatibility. An empty value blocks all package runners. | +| `LANGFLOW_MCP_SERVER_ENV_ALLOWLIST` | String | Not set | Comma-separated allowlist of environment-variable names an MCP stdio config may set. Leave unset for single-tenant compatibility; production preflight warns when it is unset. An empty value blocks all tenant-supplied environment variables. | | `LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING` | Boolean | `False` | If `true`, blocks tenant-controlled Python, Node.js, and shell MCP entrypoints. Package wrappers and the authenticated internal Langflow MCP server still work. | | `LANGFLOW_MCP_SERVER_DOCKER_HARDENING` | Boolean | `False` | If `true`, applies a strict argument policy to MCP `docker` stdio servers so tenants cannot mount the host filesystem or use privileged flags. | diff --git a/docs/docs/Components/bundles-mrscraper.mdx b/docs/docs/Components/bundles-mrscraper.mdx new file mode 100644 index 000000000000..eaa9a88fc32b --- /dev/null +++ b/docs/docs/Components/bundles-mrscraper.mdx @@ -0,0 +1,146 @@ +--- +title: MrScraper +slug: /bundles-mrscraper +--- + +import Icon from "@site/src/components/icon"; +import PartialLfxBundlesInstall from '@site/docs/_partial-bundle-lfx-bundles-install.mdx'; + + + + To grant administrative privileges, include `"is_superuser": true` in the same request. - To list, deactivate, reset a password, or delete a user, see [Users endpoints](/api-users). + To reset another user's password, `PATCH /api/v1/users/{id}` with `"password": ""`. That path does not require the current password. `PATCH /api/v1/users/{id}/reset-password` is self-service: it must be called as that user and requires `current_password`. See [Update user](./api-users#update-user). + To list, deactivate, or delete a user, see [Users endpoints](/api-users). 6. Send the username and password to the user. The superuser sets the initial password when creating the account. @@ -996,6 +997,4 @@ Superusers add, activate, list, and delete users, set **Superuser**, and reset p * [Langflow environment variables](/environment-variables) * [Users endpoints](/api-users) -* [Restrict API tweaks](./deployment-tweaks-policy) -* [Catalog and model policy](./api-governance-policy) * [Langflow Security Policy](https://github.com/langflow-ai/langflow/blob/main/SECURITY.md) — reporting vulnerabilities, security configuration, and [secret key rotation](https://github.com/langflow-ai/langflow/blob/main/SECURITY.md#secret-key-rotation) diff --git a/docs/docs/Develop/environment-variables.mdx b/docs/docs/Develop/environment-variables.mdx index d15a7a3afa70..1b3def058946 100644 --- a/docs/docs/Develop/environment-variables.mdx +++ b/docs/docs/Develop/environment-variables.mdx @@ -454,7 +454,7 @@ Set `OTEL_EXPORTER_OTLP_ENDPOINT` to enable export. If it is unset, Langflow ins |----------|--------|---------|-------------| | `OTEL_EXPORTER_OTLP_ENDPOINT` | String | Not set | OTLP collector or APM endpoint. Required to enable export. | | `LANGFLOW_OTEL_DB_SPANS` | Boolean | `True` | Whether to export SQLAlchemy database spans. Set to `false` to send flow and request spans only. | -| `LANGFLOW_OTEL_LOG_LEVEL` | String | `INFO` | Minimum severity exported over OTLP. `DEBUG` includes flow inputs and outputs. | +| `LANGFLOW_OTEL_LOG_LEVEL` | String | `INFO` | Minimum severity exported over OTLP. `DEBUG` exports more records (flow inputs and outputs are logged at `DEBUG`) but withholds their bodies unless `LANGFLOW_OTEL_LOG_BODIES=all` is also set. | | `LANGFLOW_OTEL_LOG_BODIES` | String | `allowlist` | Set to `all` to export log message bodies, including completions and chat history. | Standard OpenTelemetry SDK variables such as `OTEL_SERVICE_NAME` and `OTEL_EXPORTER_OTLP_HEADERS` also apply. @@ -494,6 +494,7 @@ They are not included in a default `uv pip install langflow` installation. Insta | `LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS` | Boolean | `False` | If `true`, blocks built-in code-execution components (Python Interpreter, REPL/Code tools, Smart Transform, and code-running agents). See [Component hardening for untrusted users](/api-keys-and-authentication#multi-tenant-component-hardening). | | `LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS` | Boolean | `False` | If `true`, confines built-in file components to the upload storage directory and blocks local-file SQL dialects and local Git clones. See [Component hardening for untrusted users](/api-keys-and-authentication#multi-tenant-component-hardening). | | `LANGFLOW_MCP_SERVER_DOCKER_HARDENING` | Boolean | `False` | If `true`, applies a strict Docker-argument policy to MCP stdio servers that use the `docker` transport. See [Component hardening for untrusted users](/api-keys-and-authentication#multi-tenant-component-hardening). | +| `LANGFLOW_MCP_SERVER_ENV_ALLOWLIST` | String | Not set | Comma-separated allowlist of environment-variable names an MCP stdio config may set. Production preflight warns when this is unset. An empty value blocks all tenant-supplied environment variables. See [MCP server environment variables](/mcp-server#mcp-server-environment-variables). | | `LANGFLOW_TWEAKS_POLICY` | String | `permissive` | Which component fields a run request may set through `tweaks`. For more information, see [Restrict API tweaks](./deployment-tweaks-policy). | | `LANGFLOW_LOAD_FLOWS_PATH` | String | Not set | Path to a directory containing flow JSON files to be loaded on startup. Typically used when creating a Docker image with prepackaged flows. Requires `LANGFLOW_AUTO_LOGIN=True`. | | `LANGFLOW_LOAD_FLOWS_OVERWRITE_ON_NAME_MATCH` | Boolean | `False` | When a flow file in `LANGFLOW_LOAD_FLOWS_PATH` shares a name with an existing DB row but has a different `id`, controls whether to overwrite the existing row. `False` (default) skips with a warning so UI edits are preserved on restart when file UUIDs regenerate. Set to `True` to opt into prepackaged-flows-are-source-of-truth semantics, typically for CI/CD pipelines. | diff --git a/docs/docs/Develop/observability-opentelemetry.mdx b/docs/docs/Develop/observability-opentelemetry.mdx index 4bdd340b0f5a..7729b26a072e 100644 --- a/docs/docs/Develop/observability-opentelemetry.mdx +++ b/docs/docs/Develop/observability-opentelemetry.mdx @@ -85,8 +85,8 @@ Two settings widen this, and both warn when set: | Variable | Effect | |----------|--------| -| `LANGFLOW_OTEL_LOG_LEVEL=DEBUG` | Exports `DEBUG` records. Langflow logs flow inputs and outputs at `DEBUG`, so prompt and completion content reaches your backend. | -| `LANGFLOW_OTEL_LOG_BODIES=all` | Exports log message bodies, including completions, chat history, and provider error text. | +| `LANGFLOW_OTEL_LOG_LEVEL=DEBUG` | Exports `DEBUG` records. Langflow logs flow inputs and outputs at `DEBUG`, so this raises export volume. Prompt and completion **bodies** stay withheld unless `LANGFLOW_OTEL_LOG_BODIES=all` is also set. | +| `LANGFLOW_OTEL_LOG_BODIES=all` | Exports log message bodies, including completions, chat history, and provider error text. With `LANGFLOW_OTEL_LOG_LEVEL=DEBUG`, prompt and completion content reaches your backend. | ## Control span volume diff --git a/docs/docs/Lfx/extensions-bundle-list.mdx b/docs/docs/Lfx/extensions-bundle-list.mdx index a716abd65472..872cbab830ce 100644 --- a/docs/docs/Lfx/extensions-bundle-list.mdx +++ b/docs/docs/Lfx/extensions-bundle-list.mdx @@ -101,6 +101,7 @@ To install every provider, including providers that require PyTorch as a depende | [`milvus`](/bundles-milvus) (Milvus) | `uv pip install "lfx-bundles[milvus]"` | | [`mistral`](/bundles-mistralai) (MistralAI) | `uv pip install "lfx-bundles[mistral]"` | | [`mongodb`](/bundles-mongodb) (MongoDB) | `uv pip install "lfx-bundles[mongodb]"` | +| [`mrscraper`](./bundles-mrscraper) (MrScraper) | `uv pip install "lfx-bundles[mrscraper]"` | | `needle` | `uv pip install "lfx-bundles[needle]"` | | `notdiamond` | `uv pip install "lfx-bundles[notdiamond]"` | | [`notion`](/bundles-notion) (Notion) | `uv pip install "lfx-bundles[notion]"` | diff --git a/docs/docs/_partial-bundle-graduated-install.mdx b/docs/docs/_partial-bundle-graduated-install.mdx index bb07d88bf7fc..4db59bd624ad 100644 --- a/docs/docs/_partial-bundle-graduated-install.mdx +++ b/docs/docs/_partial-bundle-graduated-install.mdx @@ -14,6 +14,7 @@ export const GraduatedBundleInstall = ({ packageName }) => { 'empiriolabs': { name: 'EmpirioLabs', coreSupport: false, inDefault: false }, 'exa': { name: 'Exa', coreSupport: false, inDefault: false }, 'firecrawl': { name: 'Firecrawl', coreSupport: false, inDefault: false }, + 'google': { name: 'Google', coreSupport: true, inDefault: true }, 'ibm': { name: 'IBM', coreSupport: true, inDefault: true }, 'nextplaid': { name: 'NextPlaid', coreSupport: false, inDefault: false }, 'ollama': { name: 'Ollama', coreSupport: true, inDefault: true }, diff --git a/docs/docs/_partial-opt-in-bundles.mdx b/docs/docs/_partial-opt-in-bundles.mdx index 9bb3deeca7a7..1cd7d05e0f62 100644 --- a/docs/docs/_partial-opt-in-bundles.mdx +++ b/docs/docs/_partial-opt-in-bundles.mdx @@ -35,4 +35,4 @@ The **Chroma DB** bundle component in the visual editor is opt-in. ### Tools, search, and integrations -`agentql` · [`altk`](/bundles-altk) · [`apify`](/bundles-apify) · [`arxiv`](/bundles-arxiv) · [`assemblyai`](/bundles-assemblyai) · [`bing`](/bundles-bing) · [`cleanlab`](/bundles-cleanlab) · [`composio`](/bundles-composio) · [`confluent`](./bundles-confluent) · `confluence` · [`duckduckgo`](/bundles-duckduckgo) · [`exa`](/bundles-exa) · [`firecrawl`](/bundles-firecrawl) · `git` · [`glean`](/bundles-glean) · `homeassistant` · [`icosacomputing`](/bundles-icosacomputing) · `jigsawstack` · `langwatch` · [`nextplaid`](/bundles-nextplaid) · [`notion`](/bundles-notion) · `olivya` · [`paddle`](/bundles-paddle) · `scrapegraph` · [`searchapi`](/bundles-searchapi) · `serpapi` · `spider` · `tavily` · `twelvelabs` · `unstructured` · `vlmrun` · [`wikipedia`](/bundles-wikipedia) · `wolframalpha` · `yahoosearch` · `youtube` +`agentql` · [`altk`](/bundles-altk) · [`apify`](/bundles-apify) · [`arxiv`](/bundles-arxiv) · [`assemblyai`](/bundles-assemblyai) · [`bing`](/bundles-bing) · [`cleanlab`](/bundles-cleanlab) · [`composio`](/bundles-composio) · [`confluent`](./bundles-confluent) · `confluence` · [`duckduckgo`](/bundles-duckduckgo) · [`exa`](/bundles-exa) · [`firecrawl`](/bundles-firecrawl) · `git` · [`glean`](/bundles-glean) · `homeassistant` · [`icosacomputing`](/bundles-icosacomputing) · `jigsawstack` · `langwatch` · [`mrscraper`](./bundles-mrscraper) · [`nextplaid`](/bundles-nextplaid) · [`notion`](/bundles-notion) · `olivya` · [`paddle`](/bundles-paddle) · `scrapegraph` · [`searchapi`](/bundles-searchapi) · `serpapi` · `spider` · `tavily` · `twelvelabs` · `unstructured` · `vlmrun` · [`wikipedia`](/bundles-wikipedia) · `wolframalpha` · `yahoosearch` · `youtube` diff --git a/docs/sidebars.js b/docs/sidebars.js index d05eb9f7a66e..376ce4c30318 100644 --- a/docs/sidebars.js +++ b/docs/sidebars.js @@ -540,6 +540,7 @@ module.exports = { "Components/bundles-milvus", "Components/bundles-mistralai", "Components/bundles-mongodb", + "Components/bundles-mrscraper", "Components/bundles-nextplaid", "Components/bundles-notion", "Components/bundles-novita", From 55a970e9f9fb4a5d449237866c0d39d9e4522a2c Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Wed, 26 Aug 2026 09:31:26 -0400 Subject: [PATCH 19/20] docs: alloy replaces promtail (#14768) * docs: alloy replaces promtail * docs: make readme link relative * docs: listen on container localhost --- deploy/observability/grafana-loki/README.md | 29 +++++------ .../grafana-loki/alloy/config.alloy | 48 +++++++++++++++++++ .../grafana-loki/docker-compose.yml | 14 ++++-- .../grafana-loki/promtail/config.yml | 4 ++ .../Develop/observability-grafana-loki.mdx | 9 ++-- 5 files changed, 77 insertions(+), 27 deletions(-) create mode 100644 deploy/observability/grafana-loki/alloy/config.alloy diff --git a/deploy/observability/grafana-loki/README.md b/deploy/observability/grafana-loki/README.md index 74a17c68d240..a985e5e99d99 100644 --- a/deploy/observability/grafana-loki/README.md +++ b/deploy/observability/grafana-loki/README.md @@ -2,12 +2,14 @@ Reference stack that ingests Langflow's structured JSON logs into [Loki](https://grafana.com/oss/loki/) and visualizes them with a pre-provisioned Grafana dashboard. -Use this as a starting point. The compose file, Promtail config, and dashboard JSON are independent of the rest of `deploy/` and can be lifted into any environment. +Use this as a starting point. The compose file, Alloy config, dashboard JSON, and legacy Promtail configuration are independent of the rest of `deploy/` and can be lifted into any environment. + +[Grafana Alloy](https://grafana.com/oss/alloy/) replaced [Promtail](https://grafana.com/docs/alloy/latest/set-up/migrate/from-promtail/), which reached end of life on March 2, 2026. ## What you get - **Loki 3.2** on `:3100` -- **Promtail 3.2** scraping a directory of Langflow log files +- **Alloy 1.18** scraping a directory of Langflow log files - **Grafana 11.3** on `:3000` with the Loki datasource and the `Langflow Logs` dashboard already provisioned ## Prerequisites on the Langflow side @@ -22,17 +24,9 @@ LANGFLOW_VERSION=1.10.0 LANGFLOW_ENVIRONMENT=production ``` -Promtail scrapes a directory of `*.log` files, so `LANGFLOW_LOG_FILE` must point at a file inside -the directory you expose to Promtail as `LANGFLOW_LOG_DIR` (see [Run](#run)). Set both to the same -directory, otherwise Promtail watches an empty folder and the dashboard stays blank. Use an -absolute path: `LANGFLOW_LOG_FILE` is resolved against Langflow's working directory, not this one. +Alloy scrapes a directory of `*.log` files, so `LANGFLOW_LOG_FILE` must point at a file inside the directory you expose to Alloy as `LANGFLOW_LOG_DIR` (see [Run](#run)). Set both to the same directory, otherwise Alloy watches an empty folder and the dashboard stays blank. Use an absolute path: `LANGFLOW_LOG_FILE` is resolved against Langflow's working directory, not this one. -In JSON mode the file is a single JSON stream: application logs and third-party stdlib loggers -(`uvicorn`, `sqlalchemy`, `httpx`, `langchain`) are all rendered as JSON and run through PII -redaction, so the `json` parse stage and the **Stdlib intercept routing** panel work against it -directly. This stack scrapes a file, so `LANGFLOW_LOG_FILE` is required. If you instead run -Langflow as a container, you can drop the file and scrape its stdout by swapping Promtail's -`static_configs` file target for `docker_sd_configs` (same JSON, same labels). +In JSON mode the file is a single JSON stream: application logs and third-party stdlib loggers (`uvicorn`, `sqlalchemy`, `httpx`, `langchain`) are all rendered as JSON and run through PII redaction, so the `stage.json` parse stage and the **Stdlib intercept routing** panel work against it directly. This stack scrapes a file, so `LANGFLOW_LOG_FILE` is required. If you instead run Langflow as a container, you can drop the file and scrape its stdout by swapping Alloy's `loki.source.file` target for [`loki.source.docker`](https://grafana.com/docs/alloy/latest/reference/components/loki/loki.source.docker/). See [Logs and observability](../../../docs/docs/Develop/observability-grafana-loki.mdx) for the full list of environment variables (per-logger overrides, extra PII redaction keys, trace correlation, etc.). @@ -41,7 +35,7 @@ See [Logs and observability](../../../docs/docs/Develop/observability-grafana-lo From this directory: ```bash -# Point Promtail at the directory that holds the file you set in +# Point Alloy at the directory that holds the file you set in # LANGFLOW_LOG_FILE above. Must be the same directory. Defaults to the # bundled ./logs (used by the quick smoke test below). export LANGFLOW_LOG_DIR=/absolute/path/to/langflow/logs @@ -59,8 +53,7 @@ docker compose down -v ### Quick smoke test (no Langflow required) -To verify the stack end to end without running Langflow, write a sample record into the bundled -`./logs` directory and query Loki directly: +To verify the stack end to end without running Langflow, write a sample record into the bundled `./logs` directory and query Loki directly: ```bash mkdir -p logs @@ -68,7 +61,7 @@ echo '{"event":"smoke test","level":"info","logger":"langflow.api.run","timestam docker compose up -d -# Give Promtail a few seconds to tail the file, then confirm the line reached Loki: +# Give Alloy a few seconds to tail the file, then confirm the line reached Loki: sleep 5 curl -sG 'http://localhost:3100/loki/api/v1/query_range' --data-urlencode 'query={job="langflow"}' | grep -q "smoke test" && echo "OK: log reached Loki" ``` @@ -87,6 +80,6 @@ curl -sG 'http://localhost:3100/loki/api/v1/query_range' --data-urlencode 'query ## Notes -- Promtail only promotes `level`, `service`, `environment`, `version`, `logger` to labels. High-cardinality fields (`user_id`, `flow_id`, `trace_id`) stay in the log body — query them with `| json` in LogQL. -- Replace Promtail with [Grafana Alloy](https://grafana.com/oss/alloy/) if you already standardize on it; the JSON parse stage maps 1:1. +- Alloy only promotes `level`, `service`, `environment`, `version`, `logger` to labels. High-cardinality fields (`user_id`, `flow_id`, `trace_id`) stay in the log body — query them with `| json` in LogQL. +- A legacy Promtail config remains at [`promtail/config.yml`](./promtail/config.yml) for reference. Promtail reached end of life on March 2, 2026 and is not started by compose. Grafana documents a [Promtail-to-Alloy conversion](https://grafana.com/docs/alloy/latest/set-up/migrate/from-promtail/). - If your runtime ships logs through a different transport (Fluent Bit, Vector, OTLP), only the scrape side changes — the dashboard and label schema stay the same. diff --git a/deploy/observability/grafana-loki/alloy/config.alloy b/deploy/observability/grafana-loki/alloy/config.alloy new file mode 100644 index 000000000000..c9c1e4e7c2b6 --- /dev/null +++ b/deploy/observability/grafana-loki/alloy/config.alloy @@ -0,0 +1,48 @@ +logging { + level = "info" + format = "logfmt" +} + +local.file_match "langflow" { + path_targets = [ + { + __path__ = "/var/log/langflow/*.log", + job = "langflow", + }, + ] +} + +loki.source.file "langflow" { + targets = local.file_match.langflow.targets + forward_to = [loki.process.langflow.receiver] +} + +loki.process "langflow" { + stage.json { + expressions = { + level = "level", + service = "service", + environment = "environment", + version = "version", + logger = "logger", + } + } + + stage.labels { + values = { + level = "", + service = "", + environment = "", + version = "", + logger = "", + } + } + + forward_to = [loki.write.default.receiver] +} + +loki.write "default" { + endpoint { + url = "http://loki:3100/loki/api/v1/push" + } +} diff --git a/deploy/observability/grafana-loki/docker-compose.yml b/deploy/observability/grafana-loki/docker-compose.yml index 94b52383354b..b6ad7213af47 100644 --- a/deploy/observability/grafana-loki/docker-compose.yml +++ b/deploy/observability/grafana-loki/docker-compose.yml @@ -11,15 +11,19 @@ services: timeout: 3s retries: 20 - promtail: - image: grafana/promtail:3.2.0 - container_name: lf-promtail + alloy: + image: grafana/alloy:v1.18.1 + container_name: lf-alloy volumes: - - ./promtail/config.yml:/etc/promtail/config.yml + - ./alloy/config.alloy:/etc/alloy/config.alloy:ro # Mount the directory that holds your langflow JSON log file. # Override LANGFLOW_LOG_DIR to point at your real log location. - ${LANGFLOW_LOG_DIR:-./logs}:/var/log/langflow:ro - command: -config.file=/etc/promtail/config.yml + command: + - run + - --server.http.listen-addr=127.0.0.1:12345 + - --storage.path=/var/lib/alloy/data + - /etc/alloy/config.alloy depends_on: loki: condition: service_healthy diff --git a/deploy/observability/grafana-loki/promtail/config.yml b/deploy/observability/grafana-loki/promtail/config.yml index 228e06efe98b..54fe302ac3d3 100644 --- a/deploy/observability/grafana-loki/promtail/config.yml +++ b/deploy/observability/grafana-loki/promtail/config.yml @@ -1,3 +1,7 @@ +# LEGACY. Promtail reached end of life on 2026-03-02 and is not used by this stack. +# The compose file runs Grafana Alloy instead. +# For more on converting this file, see the Grafana documentation: https://grafana.com/docs/alloy/latest/set-up/migrate/from-promtail/ + server: http_listen_port: 9080 grpc_listen_port: 0 diff --git a/docs/docs/Develop/observability-grafana-loki.mdx b/docs/docs/Develop/observability-grafana-loki.mdx index ffe56621fc79..b2948a1b8ae5 100644 --- a/docs/docs/Develop/observability-grafana-loki.mdx +++ b/docs/docs/Develop/observability-grafana-loki.mdx @@ -3,8 +3,7 @@ title: Grafana Loki slug: /observability-grafana-loki --- - -This demonstration scrapes Langflow log files with [Promtail](https://grafana.com/docs/loki/latest/send-data/promtail/), and then sends JSON logs to [Grafana Loki](https://grafana.com/oss/loki/) to be viewed in a Grafana dashboard. +This demonstration scrapes Langflow log files with [Grafana Alloy](https://grafana.com/oss/alloy/), and then sends JSON logs to [Grafana Loki](https://grafana.com/oss/loki/) to be viewed in a Grafana dashboard. It is _not_ OpenTelemetry. For traces, metrics, and OTLP logs to Grafana Cloud or an OpenTelemetry Collector, see [OpenTelemetry](./observability-opentelemetry.mdx). @@ -12,6 +11,8 @@ For traces, metrics, and OTLP logs to Grafana Cloud or an OpenTelemetry Collecto This page demonstrates how to connect Langflow to the [reference Grafana stack](https://github.com/langflow-ai/langflow/tree/main/deploy/observability/grafana-loki) shipped with the Langflow repository. For more information, see the [README](https://github.com/langflow-ai/langflow/tree/main/deploy/observability/grafana-loki). +Grafana Alloy replaced [Promtail](https://grafana.com/docs/alloy/latest/set-up/migrate/from-promtail/), which reached end of life on March 2, 2026. + To consume structured Langflow logs with other ingestion providers, see [Logs](/logging). ## Prerequisites @@ -35,9 +36,9 @@ To consume structured Langflow logs with other ingestion providers, see [Logs](/ Setting `LANGFLOW_LOG_ENV=container` switches structlog's terminal processor to [`JSONRenderer`](https://www.structlog.org/en/stable/api.html#structlog.processors.JSONRenderer), so every line written to stdout is a JSON object containing the event message, level, timestamp, logger name, exception structure, and service metadata. For more information, see [Logs](/logging). - The shipped Promtail configuration scrapes `*.log` files from a directory rather than stdout. `LANGFLOW_LOG_FILE` must point at a file inside the directory that Promtail watches. Set `LANGFLOW_LOG_DIR` to that same directory so Langflow creates the file in the right place. + The shipped Alloy configuration scrapes `*.log` files from a directory rather than stdout. `LANGFLOW_LOG_FILE` must point at a file inside the directory that Alloy watches. Set `LANGFLOW_LOG_DIR` to that same directory so Langflow creates the file in the right place. -3. Start the reference Loki + Promtail + Grafana stack from the repository: +3. Start the reference Loki + Alloy + Grafana stack from the repository: ```bash cd deploy/observability/grafana-loki From f7cfcb2cc1ee6f545c4387971dd8f1e87e803cbc Mon Sep 17 00:00:00 2001 From: Mendon Kissling <59585235+mendonk@users.noreply.github.com> Date: Wed, 26 Aug 2026 11:07:36 -0400 Subject: [PATCH 20/20] docs: move otel to first feature in release notes --- docs/docs/Support/release-notes.mdx | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/docs/Support/release-notes.mdx b/docs/docs/Support/release-notes.mdx index 1368836311ce..765bb1b744c5 100644 --- a/docs/docs/Support/release-notes.mdx +++ b/docs/docs/Support/release-notes.mdx @@ -76,6 +76,12 @@ Highlights of this release include the following changes. For all changes, see t ### New features +- OpenTelemetry export + + Langflow can export health traces, metrics, and logs over OTLP to your own backend. + + For more information, see [OpenTelemetry](./observability-opentelemetry), [New Relic](./observability-new-relic), and [Instana](./observability-instana). + - Python Interpreter microVM sandbox Set `LANGFLOW_SANDBOX_BACKEND=exec-sandbox` to run the [**Python Interpreter** component](/python-interpreter) in a dedicated [QEMU microVM](https://www.qemu.org/docs/master/system/i386/microvm.html) instead of in the Langflow server process. @@ -98,12 +104,6 @@ Highlights of this release include the following changes. For all changes, see t For more information, see [Disable the legacy MCP SSE transport](/mcp-server#disable-legacy-sse). -- OpenTelemetry export - - Langflow can export health traces, metrics, and logs over OTLP to your own backend. - - For more information, see [OpenTelemetry](./observability-opentelemetry). - - OrcaRouter bundle The **OrcaRouter** bundle adds an OrcaRouter language model component.