diff --git a/.cursor/settings.json b/.cursor/settings.json index ab4c98c2a..c2a49269e 100644 --- a/.cursor/settings.json +++ b/.cursor/settings.json @@ -1,3 +1,3 @@ { - "biome.configurationPath": "src/frontend/biome.json" + "biome.configurationPath": "src/frontend/biome.json" } \ No newline at end of file diff --git a/.dockerignore b/.dockerignore new file mode 100644 index 000000000..a6f10e0b2 --- /dev/null +++ b/.dockerignore @@ -0,0 +1,12 @@ +src/frontend/node_modules +src/frontend/build +src/frontend/coverage +src/frontend/test-results +src/frontend/playwright-report +src/frontend/.dspy_cache +**/.DS_Store +**/__pycache__ +**/*.pyc +**/.pytest_cache +**/.venv +**/.env \ No newline at end of file diff --git a/.env.example b/.env.example index 7b3c76e9b..e4e9713b4 100644 --- a/.env.example +++ b/.env.example @@ -79,12 +79,16 @@ LANGFLOW_REMOVE_API_KEYS= # LANGFLOW_REDIS_CACHE_EXPIRE (default: 3600) LANGFLOW_CACHE_TYPE= -# Set AUTO_LOGIN to false if you want to disable auto login +# Set LANGFLOW_AUTO_LOGIN to false if you want to disable auto login # and use the login form to login. LANGFLOW_SUPERUSER and LANGFLOW_SUPERUSER_PASSWORD # must be set if AUTO_LOGIN is set to false # Values: true, false LANGFLOW_AUTO_LOGIN= +# SET LANGFLOW_ENABLE_SUPERUSER_CLI to false to disable +# superuser creation via the CLI +LANGFLOW_ENABLE_SUPERUSER_CLI= + # Superuser username # Example: LANGFLOW_SUPERUSER=admin LANGFLOW_SUPERUSER= @@ -97,6 +101,11 @@ LANGFLOW_SUPERUSER_PASSWORD= # Values: true, false LANGFLOW_STORE_ENVIRONMENT_VARIABLES= +# Should enable the MCP composer feature in MCP projects +# Values: true, false +# Default: true +LANGFLOW_FEATURE_MCP_COMPOSER= + # STORE_URL # Example: LANGFLOW_STORE_URL=https://api.langflow.store # LANGFLOW_STORE_URL= @@ -111,4 +120,4 @@ LANGFLOW_STORE_ENVIRONMENT_VARIABLES= # Value must finish with slash / #BACKEND_URL=http://localhost:7860/ -BACKEND_URL= \ No newline at end of file +BACKEND_URL= diff --git a/.github/changes-filter.yaml b/.github/changes-filter.yaml index b21ef891e..02a639abd 100644 --- a/.github/changes-filter.yaml +++ b/.github/changes-filter.yaml @@ -7,6 +7,7 @@ python: - "src/backend/base/pyproject.toml" - "src/backend/base/uv.lock" - "**/python_test.yml" + - ".github/workflows/ci.yml" components-changes: - "src/backend/base/langflow/components/**" starter-projects-changes: @@ -17,6 +18,7 @@ frontend: - "src/frontend/**" - "**/typescript_test.yml" - "**/jest_test.yml" + - ".github/workflows/ci.yml" docs: - "docs/**" diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 07f81087c..17b2fc53c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -38,7 +38,7 @@ on: type: string default: "['3.10']" pull_request: - types: [synchronize, labeled] + types: [opened, synchronize, labeled] merge_group: concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -120,7 +120,7 @@ jobs: name: Should Run CI runs-on: ubuntu-latest outputs: - should-run-ci: ${{ (contains( github.event.pull_request.labels.*.name, 'lgtm') && github.event.pull_request.draft == false) || (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || github.event_name == 'merge_group') }} + should-run-ci: ${{ (github.event.pull_request.draft == false) || (github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_call' || github.event_name == 'merge_group') }} should-run-tests: ${{ !contains(github.event.pull_request.labels.*.name, 'fast-track') || github.event_name == 'workflow_call' || github.event_name == 'workflow_dispatch' || github.event_name == 'merge_group' }} steps: # Do anything just to make the job run @@ -208,7 +208,7 @@ jobs: test-templates: needs: [path-filter, set-ci-condition] name: Test Starter Templates - if: ${{ needs.path-filter.outputs.starter-projects == 'true' && needs.set-ci-condition.outputs.should-run-tests == 'true' }} + if: ${{ (needs.path-filter.outputs.python == 'true' || needs.path-filter.outputs.frontend == 'true') && needs.set-ci-condition.outputs.should-run-tests == 'true' }} runs-on: ubuntu-latest steps: - name: Checkout code diff --git a/.github/workflows/cross-platform-test.yml b/.github/workflows/cross-platform-test.yml index 81158d734..b072fb41f 100644 --- a/.github/workflows/cross-platform-test.yml +++ b/.github/workflows/cross-platform-test.yml @@ -256,7 +256,8 @@ jobs: - name: Test CLI help command (Windows) if: matrix.os == 'windows' run: | - test-env\Scripts\python.exe -m langflow --help + call test-env\Scripts\activate.bat + python -m langflow --help shell: cmd - name: Test CLI help command (Unix) @@ -508,7 +509,8 @@ jobs: - name: Test CLI help command (Windows) if: matrix.os == 'windows' run: | - test-env\Scripts\python.exe -m langflow --help + call test-env\Scripts\activate.bat + python -m langflow --help shell: cmd - name: Test CLI help command (Unix) diff --git a/README.md b/README.md index 1529de885..0edc01745 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,10 @@ [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/langflow-ai/langflow) > [!CAUTION] -> Users must update to Langflow >= 1.3 to protect against [CVE-2025-3248](https://nvd.nist.gov/vuln/detail/CVE-2025-3248). +> - Users must update to Langflow >= 1.3 to protect against [CVE-2025-3248](https://nvd.nist.gov/vuln/detail/CVE-2025-3248) +> - Users must update to Langflow >= 1.5.1 to protect against [CVE-2025-57760](https://github.com/langflow-ai/langflow/security/advisories/GHSA-4gv9-mp8m-592r) +> +> For security information, see our [Security Policy](./SECURITY.md) and [Security Advisories](https://github.com/langflow-ai/langflow/security/advisories). [Langflow](https://langflow.org) is a powerful tool for building and deploying AI-powered agents and workflows. It provides developers with both a visual authoring experience and built-in API and MCP servers that turn every workflow into a tool that can be integrated into applications built on any framework or stack. Langflow comes with batteries included and supports all major LLMs, vector databases and a growing library of AI tools. diff --git a/RELEASE.md b/RELEASE.md new file mode 100644 index 000000000..f18f02a6b --- /dev/null +++ b/RELEASE.md @@ -0,0 +1,125 @@ +# Releasing Langflow + +Langflow follows a **release-when-ready** cadence, with each cycle typically lasting 4–6 weeks depending on QA and stabilization needs. + +## Goals + +* Keep `main` fast-moving for everyday work while ensuring stable release builds when features mature. +* Provide an isolated branch for QA and last-minute fixes (the release candidate, RC). +* Preserve a linear, readable history wherever possible. +* Ensure released code is extensively tested before publication. +* Minimize time to resolution of critical bugs. + +## Process Overview + +### 1. OSS QA + +Create an OSS release candidate (RC) branch containing `langflow` and any associated PyPI packages (e.g. `lfx`). +During this period: + +* QA is performed manually. +* Bug fixes are merged into the RC branch. +* New features continue development on `main`. + +This step usually lasts about a week. + +### 2. Desktop QA + +Once OSS QA and bugfixing are complete, create a Desktop release candidate. + +* The Desktop RC is based on the final OSS RC. +* Manual QA is performed. +* Bug fixes are merged into the Desktop RC. +* New features continue on `main`. + +This step also usually lasts about a week. + +### 3. Release + +After QA and bugfixing are complete for both OSS and Desktop: + +* Final releases are cut from their respective RC branches. +* Release timing is coordinated with Langflow’s DevRel team. +* For at least 24 hours after release, Discord, GitHub, and other support channels should be monitored for critical bug reports. + +## Branch Model + +| Branch | Purpose | Merge Policy | +| --------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ | +| **`main`** | Integration branch. All feature PRs target this by default. | **Squash & Merge** (linear history) | +| **`release-X.Y.Z`**
(e.g. `release-1.4.3`) | Temporary RC branch. Active only for the release cycle. Accepts QA and blocking-bug PRs labeled `type:release`. | **Squash & Merge** within the branch.
Rebased onto **`main`** before final merge. | + +## Release Steps + +### 1. Cut Release Candidate + +```sh +git checkout main && git pull # Ensure local main is up to date +git checkout -b release-X.Y.Z # Create new release candidate branch +git push -u origin release-X.Y.Z # Push RC branch to remote +``` + +### 2. Apply a Bugfix to RC + +1. Create a feature branch as usual. +2. Open a GitHub PR targeting `release-X.Y.Z`. +3. Review and approve as normal. +4. Merge into the RC branch after review. + +### 3. Final Release + +```sh +git checkout release-X.Y.Z && git pull # Ensure RC branch is up to date +git tag vX.Y.Z # Create final release tag +git push origin vX.Y.Z # Push tag to remote +``` + +### 4. Merge RC Back into Main + +```sh +git checkout main +git merge --ff-only release-X.Y.Z # Fast-forward main to include RC changes +``` + +## Merge Strategy + +1. **Squash & Merge** everywhere for atomic commits and clean history. + +2. While RC is open, periodically re-sync with main: + + ```sh + git checkout release-X.Y.Z + git fetch origin + git rebase origin/main + ``` + + *This resolves conflicts early while keeping history linear.* + +3. Final merge back must be fast-forward only. If not possible, rebase the RC onto `main` before merging. + +## Versioning & Tags + +* Follows [Semantic Versioning](https://semver.org): `MAJOR.MINOR.PATCH`. +* RC tags use `-rc.N`, e.g. `v1.8.0-rc.1`. + +## Roles + +| Role | Responsibility | +| --------------------------------------- | ----------------------------------------------------------------- | +| **Release Captain** (rotates per cycle) | Owns timeline, branch cut, tagging, merge-back. | +| **PR Author** | Ensures tests pass; flags PR with `type:release` if needed in RC. | +| **CI** | Blocks merges on failing tests or missing labels. | + +## FAQ + +### Do we ever merge main into the RC? + +No. Always rebase the RC onto `main` to preserve linear history. + +### Can we automate branch deletion? + +Not yet — merge-back and cleanup are manual. + +### How flexible is the timeline? + +Very flexible. QA and stabilization phases can be extended as needed for quality. \ No newline at end of file diff --git a/SECURITY.md b/SECURITY.md index 275df1f23..930c0f86c 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -48,7 +48,15 @@ Langflow allows users to define and run **custom code components** through endpo This means an attacker could send malicious code to the endpoint and have it executed on the server—leading to full system compromise, including data theft, remote shell access, or lateral movement within the network. -To address, upgrade to >= 1.3.0. +**CVE**: [CVE-2025-3248](https://nvd.nist.gov/vuln/detail/CVE-2025-3248) +**Fixed in**: Langflow >= 1.3.0 + +### Privilege Escalation via CLI Superuser Creation (Fixed in 1.5.1) + +A privilege escalation vulnerability exists in Langflow containers where an authenticated user with RCE access can invoke the internal CLI command `langflow superuser` to create a new administrative user. This results in full superuser access, even if the user initially registered through the UI as a regular (non-admin) account. + +**CVE**: [CVE-2025-57760](https://github.com/langflow-ai/langflow/security/advisories/GHSA-4gv9-mp8m-592r) +**Fixed in**: Langflow >= 1.5.1 ### No API key required if running Langflow with `LANGFLOW_AUTO_LOGIN=true` and `LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true` @@ -59,4 +67,36 @@ Setting `LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true` and `LANGFLOW_AUTO_LOGIN=true` skip `LANGFLOW_SKIP_AUTH_AUTO_LOGIN=true` is the default behavior, so users do not need to change existing workflows in 1.5. To update your workflows to require authentication, set `LANGFLOW_SKIP_AUTH_AUTO_LOGIN=false`. -For more information, see [API keys and authentication](https://docs.langflow.org/api-keys-and-authentication). \ No newline at end of file +For more information, see [API keys and authentication](https://docs.langflow.org/api-keys-and-authentication). + +## Security Configuration Guidelines + +### Superuser Creation Security + +The `langflow superuser` CLI command can present a privilege escalation risk if not properly secured. + +#### Security Measures + +1. **Authentication Required in Production** + - When `LANGFLOW_AUTO_LOGIN=false`, superuser creation requires authentication + - Use `--auth-token` parameter with a valid superuser API key or JWT token + +2. **Disable CLI Superuser Creation** + - Set `LANGFLOW_ENABLE_SUPERUSER_CLI=false` to disable the command entirely + - Strongly recommended for production environments + +3. **Secure AUTO_LOGIN Setting** + - Default is `true` for <=1.5. This may change in a future release. + - When `true`, creates default superuser `langflow/langflow` - **ONLY USE IN DEVELOPMENT** + +#### Production Security Configuration + +```bash +# Recommended production settings +export LANGFLOW_AUTO_LOGIN=false +export LANGFLOW_ENABLE_SUPERUSER_CLI=false +export LANGFLOW_SUPERUSER="" +export LANGFLOW_SUPERUSER_PASSWORD="" +export LANGFLOW_DATABASE_URL="" # e.g. "postgresql+psycopg://langflow:secure_pass@db.internal:5432/langflow" +export LANGFLOW_SECRET_KEY="your-strong-random-secret-key" +``` diff --git a/docs/css/custom.css b/docs/css/custom.css index d93edc20e..1760ead4a 100644 --- a/docs/css/custom.css +++ b/docs/css/custom.css @@ -4,10 +4,9 @@ * work well for content-centric websites. */ :root { - --ifm-background-color: var(--token-primary-bg-c); - --ifm-color-primary: hsla(330, 81%, 60%, 1); --ifm-navbar-link-hover-color: initial; --ifm-navbar-padding-vertical: 0; + --ifm-global-radius: 16px; --ifm-navbar-item-padding-vertical: 0; --ifm-font-family-base: Inter, -apple-system, BlinkMacSystemFont, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI emoji"; @@ -15,6 +14,26 @@ "Liberation Mono", Menlo, Courier, monospace; } +/* Light theme - Pure white background */ +html[data-theme="light"] { + --ifm-color-primary: hsla(333, 71%, 51%, 1); /* Slightly darker pink for light theme */ + --ifm-background-color: var(--ifm-color-white); + --ifm-background-surface-color: var(--ifm-color-white); +} + +/* Dark theme - Pure black background */ +html[data-theme="dark"] { + --ifm-color-primary: hsla(329, 86%, 70%, 1); /* Lighter pink for dark theme */ + --ifm-background-color: var(--ifm-color-black); + --ifm-background-surface-color: var(--ifm-color-black); +} + +/* override the infima navbar docs/node_modules/infima/dist/css/default/default.css */ +.navbar { + box-shadow: none !important; + border-bottom: 1px solid var(--ifm-toc-border-color); +} + .theme-doc-sidebar-item-category.menu__list-item:not(:first-child) { margin-top: 0.5rem !important; } @@ -54,6 +73,34 @@ p { text-align: start; } +/* Tabs Styling */ +.tabs-container { + border: 1px solid var(--ifm-color-emphasis-300); + border-radius: var(--ifm-global-radius); + padding: 1rem; + margin-bottom: 1rem; +} + +.tabs { + margin-bottom: 1rem; +} + +.tabs__item { + border: none; + border-bottom: 1px solid var(--ifm-color-emphasis-200); + margin-right: 0rem; + padding-bottom: 0.5rem; + border-radius: 0; +} + +.tabs__item:hover { + background-color: var(--ifm-hover-overlay); +} + +.tabs__item--active { + border-bottom-color: var(--ifm-tabs-color-active); +} + /* apply */ #hero-apply { z-index: -1; @@ -80,21 +127,19 @@ p { ); } -/** - * Hero component title overrides to match other heading styles - */ +/* Hero component title overrides to match other heading styles */ .hero-title { color: rgb(28, 30, 33); font-family: var(--ifm-heading-font-family); } h1 { - font-size: 26px; + font-size: 30px; } h2 { - font-size: 22px; + font-size: 25px; } h3 { - font-size: 18px; + font-size: 22px; } body { @@ -154,7 +199,6 @@ body { } /* Discord */ - .header-discord-link { margin-right: 0.5rem; } @@ -279,8 +323,10 @@ body { /* Footer Styles */ .footer { - padding: 8px 0; - background-color: var(--ifm-navbar-background-color); + /* padding: 8px 0; */ + padding: 1rem 0 0; + background-color: var(--ifm-background-color); + border-top: 1px solid var(--ifm-color-emphasis-200); } [data-theme="light"] .footer { @@ -317,11 +363,16 @@ body { } .footer .container { - padding: 0 5rem; + padding: 0 1.25rem; display: flex; - justify-content: space-between; + justify-content: left; align-items: center; flex-direction: row-reverse; + max-width: 100%; +} + +.footer__title { + margin-bottom: 0; } /* Sidebar Styles */ @@ -416,3 +467,21 @@ body { padding: 0; } +/* DocSearch Input Styling - Simple border override */ +.DocSearch-Button { + border: 1px solid var(--ifm-color-emphasis-300) !important; + border-radius: 6px !important; + background: var(--ifm-color-content-inverse) !important; + color: var(--ifm-color-emphasis-500) !important; +} + +.DocSearch-Button:hover, +.DocSearch-Button:focus { + border-color: var(--ifm-color-primary) !important; + box-shadow: 0 0 0 1px var(--ifm-color-primary) !important; +} + +.DocSearch-Search-Icon { + color: var(--ifm-color-emphasis-500) !important; + size: 16px !important; +} \ No newline at end of file diff --git a/docs/docs/API-Reference/api-files.mdx b/docs/docs/API-Reference/api-files.mdx index 05e01f5e9..8b472f48e 100644 --- a/docs/docs/API-Reference/api-files.mdx +++ b/docs/docs/API-Reference/api-files.mdx @@ -419,4 +419,8 @@ curl -X DELETE \ ## Create upload file (Deprecated) -This endpoint is deprecated. Use the `/files` endpoints instead. \ No newline at end of file +This endpoint is deprecated. Use the `/files` endpoints instead. + +## See also + +* [Manage files](/concepts-file-management) \ No newline at end of file diff --git a/docs/docs/API-Reference/api-monitor.mdx b/docs/docs/API-Reference/api-monitor.mdx index f0839349a..89f697303 100644 --- a/docs/docs/API-Reference/api-monitor.mdx +++ b/docs/docs/API-Reference/api-monitor.mdx @@ -6,9 +6,26 @@ slug: /api-monitor import Tabs from '@theme/Tabs'; import TabItem from '@theme/TabItem'; -Use the `/monitor` endpoint to monitor and modify messages passed between Langflow components, vertex builds, and transactions. +The `/monitor` endpoints are for internal Langflow functionality, primarily related to running flows in the **Playground**, storing chat history, and generating flow logs. -## Get Vertex builds +This information is primarily for those who are building custom components or contributing to the Langflow codebase in a way that requires calling or understanding these endpoints. + +For typical application development with Langflow, there are more appropriate options for monitoring, debugging, and memory management. +For more information, see the following: + +* [Logs](/logging): Langflow log storage locations, customization options, and where to view logs in the visual editor +* [Test flows in the Playground](/concepts-playground): Run flows and inspect message history +* [Memory management options](/memory): Langflow storage locations and options, including the database, cache, and chat history + +## Vertex builds + +The Vertex build endpoints (`/monitor/builds`) are exclusively for **Playground** functionality. + +When you run a flow in the **Playground**, Langflow calls the `/build/$FLOW_ID/flow` endpoint in [chat.py](https://github.com/langflow-ai/langflow/blob/main/src/backend/base/langflow/api/v1/chat.py#L143). This call retrieves the flow data, builds a graph, and executes the graph. As each component (or node) is executed, the `build_vertex` function calls `build_and_run`, which may call the individual components' `def_build` method, if it exists. If a component doesn't have a `def_build` function, the build still returns a component. + +The `build` function allows components to execute logic at runtime. For example, the [**Recursive Character Text Splitter** component](https://github.com/langflow-ai/langflow/blob/main/src/backend/base/langflow/components/langchain_utilities/recursive_character.py) is a child of the `LCTextSplitterComponent` class. When text needs to be processed, the parent class's `build` method is called, which creates a `RecursiveCharacterTextSplitter` object and uses it to split the text according to the defined parameters. The split text is then passed on to the next component. This all occurs when the component is built. + +### Get Vertex builds Retrieve Vertex builds for a specific flow. @@ -384,7 +401,7 @@ curl -X GET \ -## Delete Vertex builds +### Delete Vertex builds Delete Vertex builds for a specific flow. @@ -404,7 +421,12 @@ curl -X DELETE \ -## Get messages +## Messages endpoints + +The `/monitor/messages` endpoints store, retrieve, edit, and delete records in the message table in [`langflow.db`](/memory) +Typically, these are called implicitly when running flows that produce message history, or when inspecting and modifying **Playground** memories. + +### Get messages Retrieve a list of all messages: @@ -466,7 +488,7 @@ curl -X GET \ -## Delete messages +### Delete messages Delete specific messages by their IDs. @@ -490,7 +512,7 @@ curl -v -X DELETE \ -## Update message +### Update message Update a specific message by its ID. @@ -540,7 +562,7 @@ curl -X PUT \ -## Update session ID +### Update session ID Update the session ID for messages. @@ -591,7 +613,7 @@ curl -X PATCH \ -## Delete messages by session +### Delete messages by session Delete all messages for a specific session. @@ -614,6 +636,7 @@ HTTP/1.1 204 No Content ## Get transactions Retrieve all transactions, which are interactions between components, for a specific flow. +This information is also available in [flow logs](/logging). ```bash curl -X GET \ @@ -651,4 +674,5 @@ curl -X GET \ ## See also +- [Use voice mode](/concepts-voice-mode) - [Session ID](/session-id) \ No newline at end of file diff --git a/docs/docs/API-Reference/api-reference-api-examples.mdx b/docs/docs/API-Reference/api-reference-api-examples.mdx index f9c7aeaae..a6290f2c1 100644 --- a/docs/docs/API-Reference/api-reference-api-examples.mdx +++ b/docs/docs/API-Reference/api-reference-api-examples.mdx @@ -186,9 +186,198 @@ curl -X GET \ -H "x-api-key: $LANGFLOW_API_KEY" ``` +## Available endpoints + +Because you can run Langflow as either an IDE (frontend and backend) or a runtime (headless, backend-only), it serves endpoints that support frontend and backend operations. +Many endpoints are for orchestration between the frontend and backend, reading and writing to the Langflow database, or enabling frontend functionality, like the **Playground**. +Unless you are contributing to the Langflow codebase, you won't directly call most of the Langflow endpoints. + +For application development, the most commonly used endpoints are the `/run` and `/webhook` [flow trigger endpoints](/api-flows-run). +For some use cases, you might use some other endpoints, such as the `/files` endpoints to use files in flows. + +To help you explore the available endpoints, the following lists are sorted by primary use case, although some endpoints might support multiple use cases. + + + + +The following endpoints are useful for developing applications with Langflow and administering Langflow deployments with one or more users. +You will most often use the flow trigger endpoints. +Other endpoints are helpful for specific use cases, such as administration and flow management in runtime deployments that don't have a visual editor. + +* [Flow trigger endpoints](/api-flows-run): + * POST `/v1/run/{flow_id_or_name}`: Run a flow. + * POST `/v1/run/advanced/{flow_id}`: Advanced run with explicit `inputs`, `outputs`, `tweaks`, and optional `session_id`. + * POST `/v1/webhook/{flow_id_or_name}`: Trigger a flow via webhook payload. + +* Deployment details: + * GET `/v1/version`: Return Langflow version. See [Get version](/api-reference-api-examples#get-version). + * GET `/v1/config`: Return deployment configuration. See [Get configuration](/api-reference-api-examples#get-configuration). + +* [Projects endpoints](/api-projects): + * POST `/v1/projects/`: Create a project. + * GET `/v1/projects/`: List projects. + * GET `/v1/projects/{project_id}`: Read a project (with paginated flows support). + * PATCH `/v1/projects/{project_id}`: Update project info and membership. + * DELETE `/v1/projects/{project_id}`: Delete a project. + * GET `/v1/projects/download/{project_id}`: Export all flows in a project as ZIP. + * POST `/v1/projects/upload/`: Import a project ZIP (creates project and flows). + * GET `/v1/starter-projects/`: Return a list of templates. + +* [Files endpoints](/api-files): + * Files (v1) + * POST `/v1/files/upload/{flow_id}`: Upload a file to a specific flow. + * GET `/v1/files/download/{flow_id}/{file_name}`: Download a file from a flow. + * GET `/v1/files/images/{flow_id}/{file_name}`: Stream an image from a flow. + * GET `/v1/files/profile_pictures/{folder_name}/{file_name}`: Get a profile picture asset. + * GET `/v1/files/profile_pictures/list`: List available profile picture assets. + * GET `/v1/files/list/{flow_id}`: List files for a flow. + * DELETE `/v1/files/delete/{flow_id}/{file_name}`: Delete a file from a flow. + * Files (v2) + * POST `/v2/files` (alias `/v2/files/`): Upload a file owned by the current user. + * GET `/v2/files` (alias `/v2/files/`): List files owned by the current user. + * DELETE `/v2/files/batch/`: Delete multiple files by IDs. + * POST `/v2/files/batch/`: Download multiple files as a ZIP by IDs. + * GET `/v2/files/{file_id}`: Download a file by ID (or return raw content internally). + * PUT `/v2/files/{file_id}`: Edit a file name by ID. + * DELETE `/v2/files/{file_id}`: Delete a file by ID. + * DELETE `/v2/files` (alias `/v2/files/`): Delete all files for the current user. + +* [API keys and authentication](/api-keys-and-authentication): + * GET `/v1/api_key/`: List API keys for the current user. + * POST `/v1/api_key/`: Create a new API key. + * DELETE `/v1/api_key/{api_key_id}`: Delete an API key. + * POST `/v1/api_key/store`: Save an encrypted Store API key (cookie set). + +* [Flow management endpoints](/api-flows): + * POST `/v1/flows/`: Create a flow. + * GET `/v1/flows/`: List flows (supports pagination and filters). + * GET `/v1/flows/{flow_id}`: Read a flow by ID. + * GET `/v1/flows/public_flow/{flow_id}`: Read a public flow by ID. + * PATCH `/v1/flows/{flow_id}`: Update a flow. + * DELETE `/v1/flows/{flow_id}`: Delete a flow. + * POST `/v1/flows/batch/`: Create multiple flows. + * POST `/v1/flows/upload/`: Import flows from a JSON file. + * DELETE `/v1/flows/`: Delete multiple flows by IDs. + * POST `/v1/flows/download/`: Export flows to a ZIP file. + * GET `/v1/flows/basic_examples/`: List basic example flows. + +* [Users endpoints](/api-users): + * POST `/v1/users/`: Add a user (superuser required when auth enabled). + * GET `/v1/users/whoami`: Return the current authenticated user. + * GET `/v1/users/`: List all users (superuser required). + * PATCH `/v1/users/{user_id}`: Update a user (with role checks). + * PATCH `/v1/users/{user_id}/reset-password`: Reset own password. + * DELETE `/v1/users/{user_id}`: Delete a user (cannot delete yourself). + + + + +You might use these endpoints when developing custom Langflow components for your own use or to share with the Langflow community: + +* Develop custom components: + * GET `/v1/all`: Return all available Langflow component types. See [Get all components](/api-reference-api-examples#get-all-components). + * POST `/v1/custom_component`: Build a custom component from code and return its node. + * POST `/v1/custom_component/update`: Update an existing custom component's build config and outputs. + * POST `/v1/validate/code`: Validate a Python code snippet for a custom component. + +* Langflow Store: + * GET `/v1/store/check/`: Return whether the Store feature is enabled. + * GET `/v1/store/check/api_key`: Check if a Store API key exists and is valid. + * POST `/v1/store/components/`: Share a component to the Store. + * PATCH `/v1/store/components/{component_id}`: Update a shared component. + * GET `/v1/store/components/`: List available Store components (filters supported). + * GET `/v1/store/components/{component_id}`: Download a component from the Store. + * GET `/v1/store/tags`: List Store tags. + * GET `/v1/store/users/likes`: List components liked by the current user. + * POST `/v1/store/users/likes/{component_id}`: Like a component. + + + + +The following endpoints are for managing Langflow MCP servers, both Langflow-hosted MCP servers and external MCP server connections: + +* **MCP (global)**: + * HEAD `/v1/mcp/sse`: Health check for MCP SSE. + * GET `/v1/mcp/sse`: Open SSE stream for MCP server events. + * POST `/v1/mcp/`: Post messages to the MCP server. + +* **MCP (project-specific)**: + * GET `/v1/mcp/project/{project_id}`: List MCP-enabled tools and project auth settings. + * HEAD `/v1/mcp/project/{project_id}/sse`: Health check for project SSE. + * GET `/v1/mcp/project/{project_id}/sse`: Open project-scoped MCP SSE. + * POST `/v1/mcp/project/{project_id}`: Post messages to project MCP server. + * POST `/v1/mcp/project/{project_id}/` (trailing slash): Same as above. + * PATCH `/v1/mcp/project/{project_id}`: Update MCP settings for flows and project auth settings. + * POST `/v1/mcp/project/{project_id}/install`: Install MCP client config for Cursor/Windsurf/Claude (local only). + * GET `/v1/mcp/project/{project_id}/installed`: Check which clients have MCP config installed. + + + + +The following endpoints are most often used when contributing to the Langflow codebase, and you need to understand or call endpoints that support frontend-to-backend orchestration or other internal functionality. + +* Base (metadata): + * GET `/v1/all`: Return all available Langflow component types. See [Get all components](/api-reference-api-examples#get-all-components). + * GET `/v1/version`: Return Langflow version. See [Get version](/api-reference-api-examples#get-version). + * GET `/v1/config`: Return deployment configuration. See [Get configuration](/api-reference-api-examples#get-configuration). + * GET `/v1/starter-projects/`: Return a list of templates. + +* [Build endpoints](/api-build) (internal editor support): + * POST `/v1/build/{flow_id}/flow`: Start a flow build and return a job ID. + * GET `/v1/build/{job_id}/events`: Stream or fetch build events. + * POST `/v1/build/{job_id}/cancel`: Cancel a build job. + * POST `/v1/build_public_tmp/{flow_id}/flow`: Build a public flow without auth. + * POST `/v1/validate/prompt`: Validate a prompt payload. + +* [API keys and authentication](/api-keys-and-authentication): + * POST `/v1/login`: Login and set tokens as cookies. + * GET `/v1/auto_login`: Auto-login (if enabled) and set tokens. + * POST `/v1/refresh`: Refresh tokens using refresh cookie. + * POST `/v1/logout`: Logout and clear cookies. + +* [Monitor endpoints](/api-monitor): + * GET `/v1/monitor/builds`: Get vertex builds for a flow. + * DELETE `/v1/monitor/builds`: Delete vertex builds for a flow. + * GET `/v1/monitor/messages/sessions`: List message session IDs (auth required). + * GET `/v1/monitor/messages`: List messages with optional filters. + * DELETE `/v1/monitor/messages`: Delete messages by IDs (auth required). + * PUT `/v1/monitor/messages/{message_id}`: Update a message. + * PATCH `/v1/monitor/messages/session/{old_session_id}`: Change a session ID for all messages in that session. + * DELETE `/v1/monitor/messages/session/{session_id}`: Delete messages by session. + * GET `/v1/monitor/transactions`: List transactions for a flow (paginated). + +* Variables: + * POST `/v1/variables/`: Create a variable, such as an API key, for the user. + * GET `/v1/variables/`: List variables for the user. + * PATCH `/v1/variables/{variable_id}`: Update a variable. + * DELETE `/v1/variables/{variable_id}`: Delete a variable. + +* [Use voice mode](/concepts-voice-mode): + * WS `/v1/voice/ws/flow_as_tool/{flow_id}`: Bi-directional voice session exposing the flow as a tool. + * WS `/v1/voice/ws/flow_as_tool/{flow_id}/{session_id}`: Same as above with explicit session ID. + * WS `/v1/voice/ws/flow_tts/{flow_id}`: Voice-to-text session that runs a flow and returns TTS. + * WS `/v1/voice/ws/flow_tts/{flow_id}/{session_id}`: Same as above with explicit session ID. + * GET `/v1/voice/elevenlabs/voice_ids`: List available ElevenLabs voice IDs for the user. + + + + +The following endpoints are deprecated: + +* POST `/v1/predict/{flow_id}`: Use [`/v1/run/{flow_id}`](/api-flows-run) instead. +* POST `/v1/process/{flow_id}`: Use [`/v1/run/{flow_id}`](/api-flows-run) instead. +* GET `/v1/task/{task_id}`: Deprecated functionality. +* POST `/v1/upload/{flow_id}`: Use [`/files`](/api-files) instead. +* POST `/v1/build/{flow_id}/vertices`: Replaced by [`/monitor/builds`](/api-monitor). +* POST `/v1/build/{flow_id}/vertices/{vertex_id}`: Replaced by [`/monitor/builds`](/api-monitor). +* GET `/v1/build/{flow_id}/{vertex_id}/stream`: Replaced by [`/monitor/builds`](/api-monitor). + + + + ## Next steps -- Use the Langflow API to [run a flow](/api-flows-run). -- Use the Langflow API to [upload files](/api-files). -- Use the Langflow API to [get flow logs](/api-logs). -- Explore all endpoints in the [Langflow API specification](/api). \ No newline at end of file +* Use the Langflow API to [run a flow](/api-flows-run). +* Use the Langflow API to [upload files](/api-files). +* Use the Langflow API to [get flow logs](/api-logs). +* Explore all endpoints in the [Langflow API specification](/api). \ No newline at end of file diff --git a/docs/docs/Components/bundles-nvidia.mdx b/docs/docs/Components/bundles-nvidia.mdx index cbc5369f7..af16b55a9 100644 --- a/docs/docs/Components/bundles-nvidia.mdx +++ b/docs/docs/Components/bundles-nvidia.mdx @@ -44,6 +44,12 @@ For more information about using embedding model components in flows, see [**Emb | temperature | Float | Input parameter. The model temperature for embedding generation. Default: `0.1`. | | embeddings | Embeddings | Output parameter. An `NVIDIAEmbeddings` instance for generating embeddings. | +:::tip Tokenization considerations +Be aware of your embedding model's chunk size limit. +Tokenization errors can occur if your text chunks are too large. +For more information, see [Tokenization errors due to chunk size](/components-processing#chunk-size). +::: + ## NVIDIA Rerank This component finds and reranks documents using the NVIDIA API. @@ -53,7 +59,7 @@ This component finds and reranks documents using the NVIDIA API. This component uses the NVIDIA `nv-ingest` microservice for data ingestion, processing, and extraction of text files. For more information, see [Integrate NVIDIA Retriever Extraction with Langflow](/integrations-nvidia-ingest). -## NVIDIA System-Assist +## NVIDIA G-Assist This component requires a specific system environment. For information about this component, see [Integrate NVIDIA G-Assist with Langflow](/integrations-nvidia-g-assist). \ No newline at end of file diff --git a/docs/docs/Components/bundles-perplexity.mdx b/docs/docs/Components/bundles-perplexity.mdx index fceaac1c3..e9aa6054c 100644 --- a/docs/docs/Components/bundles-perplexity.mdx +++ b/docs/docs/Components/bundles-perplexity.mdx @@ -29,9 +29,8 @@ You can toggle parameters through the -Loop example +### Loop example In the follow example, the **Loop** component iterates over a CSV file until there are no rows left to process. In this case, the **Item** port passes each row to a **Type Convert** component to convert the row into a `Message` object, passes the `Message` to a **Structured Output** component to be processed into structured data that is then passed back to the **Loop** component's **Looping** port. @@ -145,7 +154,13 @@ After processing all rows, the **Loop** component loads the aggregated list of s For more examples of the **Loop** component, try the **Research Translation Loop** template in Langflow, or see the video tutorial [Mastering the Loop Component & Agentic RAG in Langflow](https://www.youtube.com/watch?v=9Wx7WODSKTo). ::: - +### Conditional looping + +The **If-Else** component isn't compatible with the **Loop** component. +If you need conditional loop events, redesign your flow to process conditions before the loop. +For example, if you are looping over a `DataFrame`, you could use multiple [**DataFrame Operations** components](/components-processing#dataframe-operations) to conditionally filter data, and then run separate loops on each set of filtered data. + +![A flow with conditional looping.](/img/conditional-looping.png) ## Notify and Listen diff --git a/docs/docs/Components/components-models.mdx b/docs/docs/Components/components-models.mdx index dcad38225..24cffa26b 100644 --- a/docs/docs/Components/components-models.mdx +++ b/docs/docs/Components/components-models.mdx @@ -7,8 +7,8 @@ import Icon from "@site/src/components/icon"; **Language Model** components in Langflow generate text using a specified Large Language Model (LLM). -Langflow includes a **Language Model** core component that has built-in support for many LLMs, as well as an interface to connect any [additional **Language Model** component](#additional-language-model-components). -The built-in LLMs are appropriate for most text-based language model use cases in Langflow. +Langflow includes a **Language Model** core component that has built-in support for many LLMs. +Alternatively, you can use any [additional language model](#additional-language-models) in place of the core **Language Model** component. ## Use Language Model components in a flow @@ -18,19 +18,20 @@ These components accept inputs like chat messages, files, and instructions in or The flow must include [**Chat Input and Output** components](/components-io#chat-io) to allow chat-based interactions with the LLM. However, you can also use the **Language Model** component for actions that don't emit chat output directly, such as the **Smart Function** component. -The following example uses the **Language Model** core component and a built-in LLM to create a chatbot flow similar to the **Basic Prompting** template. -The example focuses on using the built-in models, but it also indicates where you can integrate another model. +The following example uses the **Language Model** core component to create a chatbot flow similar to the **Basic Prompting** template. +It also explains how you can replace the core component with another LLM. 1. Add the **Language Model** component to your flow. 2. In the **OpenAI API Key** field, enter your OpenAI API key. This example uses the default OpenAI model and a built-in Anthropic model to compare responses from different providers. - If you want to use a different provider, edit the **Model Provider**, **Model Name**, and **API Key** fields accordingly. - If you want to use provider or model that isn't built-in to the **Language Model** core component, see [Additional Language Model components](#additional-language-model-components) to learn how to connect a **Custom** model provider to the **Language Model** component. + :::tip My preferred provider or model isn't listed + If you want to use a provider or model that isn't built-in to the **Language Model** core component, you can replace this component with another compatible component, as explained in [Additional language models](#additional-language-models). Then, you can continue following these steps to build your flow. + ::: 3. In the [component's header menu](/concepts-components#component-menus), click