chore: merge branch release-1.8.1 into main

[Adam-Aghili]

merge branch release-1.8.1 into main

Summary by CodeRabbit

Release Notes v1.8.1

• Bug Fixes

  • Improved knowledge base deletion with retry logic and better resource cleanup.
  • Fixed handling of missing MCP server configuration files to prevent errors.
  • Enhanced provider detection for language models across starter projects.
  • Improved API key preservation in exported flows when using environment variables or database-loaded credentials.

• Chores

  • Updated project version and dependencies including FastAPI and ChromaDB.
  • Docker images now include UV tooling for improved build environments.

[coderabbitai]

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7a4bbda9-e64d-4404-af14-84e5113692a0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

Walkthrough

This PR bumps versions to 1.8.1, adds uv and uvx binaries to Docker runtime stages, implements robust KB deletion with retry logic and resource cleanup, enhances model provider resolution across starter projects, and improves frontend handling of API keys and variable names. Includes comprehensive test coverage for deletion workflows and MCP installation checks.

Changes

Cohort / File(s)	Summary
Version & Dependency Updates pyproject.toml, src/backend/base/pyproject.toml, src/frontend/package.json, src/lfx/pyproject.toml	Bumps project versions from 1.8.0 to 1.8.1 (frontend/root) and 0.8.0 to 0.8.1 (backend/lfx). Updates dependencies: fastapi >=0.115.x to >=0.135.0, langflow-base 0.8.0 to 0.8.1, lfx ~0.3.0 to ~0.3.1.
Docker Build Enhancements docker/build_and_push*.Dockerfile (4 files)	Adds two COPY instructions in runtime stages to expose uv and uvx binaries from builder image at /usr/local/bin, making these tools available in final runtime images across all Dockerfile variants.
Knowledge Base Storage & Cleanup src/backend/base/langflow/api/utils/kb_helpers.py, src/backend/base/langflow/utils/kb_constants.py	Introduces robust KB deletion workflow: new delete_storage(kb_path, kb_name) -> bool with retry logic, exponential backoff, SQLite lock handling, and deferred rename fallback. Adds release_chroma_resources(kb_path) for resource cleanup. Removes teardown_storage. Adds DELETE_BACKOFF_SECONDS and MAX_DELETE_RETRIES constants. Helper methods for SQLite lock/file handling.
API Core Utilities src/backend/base/langflow/api/utils/core.py	Adds new helper function _get_provider_from_template(template: dict) -> str | None to extract provider names from template structure.
Knowledge Base API Endpoints src/backend/base/langflow/api/v1/knowledge_bases.py	Replaces direct gc.collect() and shutil.rmtree with KBStorageHelper.delete_storage() and release_chroma_resources() across create, delete, and retrieval paths. Adds finally blocks for guaranteed resource cleanup. Replaces GC with explicit resource nullification.
MCP Projects Error Handling src/backend/base/langflow/api/v1/mcp_projects.py	Adds FileNotFoundError exception handler in check_installed_mcp_servers to gracefully log missing client config files instead of propagating errors.
Starter Projects Provider Resolution src/backend/base/langflow/initial_setup/starter_projects/* (30+ JSON files)	Systematically adds provider resolution via get_provider_for_model_name import and provider-aware update_build_config logic across all starter projects. Enables fallback provider derivation from model name when explicit provider unavailable. Selected projects (Agent-based) add _get_llm() and _get_max_tokens_value() helpers. Updates astrapy dependency 2.1.0 → 2.2.1 in Hybrid Search RAG and Vector Store RAG.
Processing Tweaks Logic src/backend/base/langflow/processing/process.py	Enhances apply_tweaks and apply_tweaks_on_vertex to handle load_from_db field: explicitly sets to False for non-dict tweaks, tracks tweak load_from_db state, and updates vertex.load_from_db_fields accordingly.
Frontend Core Utilities src/frontend/src/utils/reactflowUtils.ts	Adds new utility function looksLikeVariableName(value: unknown): boolean to detect environment variable-like strings. Enhances removeApiKeys to preserve api_key when it resembles a variable name or has load_from_db=true, improving handling of imported flows with credentials.
Frontend API Key Removal Tests src/frontend/src/utils/__tests__/removeApiKeys.test.ts	New test suite validating removeApiKeys behavior: preserves variable-like api_keys and load_from_db flags, clears raw secrets, leaves non-password fields untouched.
Frontend Data Fetching Hook src/frontend/src/CustomNodes/hooks/use-fetch-data-on-mount.ts	Refactors fetch-on-mount condition with granular flags (isRealtimeOrRefresh, hasOptions, needApiKeyPrefill). Adds early return for missing template. Changes trigger to occur when realtime/refresh conditions met and options/prefill requirements satisfied.
Frontend Input Component src/frontend/src/components/core/parameterRenderComponent/components/inputGlobalComponent/index.tsx	Updates variable options generation to conditionally append currentValue when loading from DB or when it matches variable-name pattern (via looksLikeVariableName). Adjusts selectedOption logic for variable-like values.
Frontend Constants & Types src/frontend/src/constants/constants.ts, src/frontend/src/components/ui/__tests__/dialog.test.tsx	Updates ALERT_SAVE_WITH_API warning text to emphasize credential exposure risk on export. Changes test parameter type from ReactElement to React.ReactElement.
Frontend Icons & Modals src/frontend/src/icons/AstraDB/AstraDB.jsx, src/frontend/src/modals/exportModal/index.tsx	Makes AstraDB icon responsive by changing dimensions from fixed pixels to 1em with preserveAspectRatio. Changes ExportModal flowToExport from const to let, removes commented TODO notes.
Test Assets & Test Files src/frontend/tests/assets/outdated_flow.json, src/frontend/tests/core/regression/session-deletion-data-leakage.spec.ts	Changes default OpenAI API key in test asset from "dummy_api_key" to "". Updates session deletion test helper with explicit hover, menu interaction sequence, and visibility waits.
KB Storage Deletion Tests src/backend/tests/unit/test_kb_storage_deletion.py	Comprehensive test suite (392 lines) covering _remove_sqlite_lock_files, _truncate_sqlite_files, release_chroma_resources, and delete_storage with retry logic, exponential backoff, fallback rename, and integration scenarios.
Knowledge Base API Tests src/backend/tests/unit/test_knowledge_bases_api.py	Replaces teardown_storage mock with delete_storage mock in two test cases, updates patch targets and assertion names.
MCP Projects Tests src/backend/tests/unit/api/v1/test_mcp_projects.py	New test suite (212 lines) validating MCP installation state checks via _prepare_installed_check_env helper, covering missing config files, matching URLs, corrupt JSON, and directory existence scenarios.

Sequence Diagram

sequenceDiagram
    participant Client as API Client
    participant KBEndpoint as KB Endpoint
    participant KBHelper as KBStorageHelper
    participant FileSystem as File System
    participant Chroma as Chroma Resources
    participant SQLite as SQLite Locks

    Client->>KBEndpoint: DELETE /knowledge_bases/{kb_name}
    KBEndpoint->>KBHelper: delete_storage(kb_path, kb_name)
    
    activate KBHelper
    
    KBHelper->>Chroma: release_chroma_resources(kb_path)
    activate Chroma
    Chroma->>Chroma: Clear registry entries
    Chroma->>Chroma: Trigger garbage collection
    deactivate Chroma
    
    KBHelper->>SQLite: _remove_sqlite_lock_files(kb_path)
    activate SQLite
    SQLite->>FileSystem: Remove .wal/.shm/.journal files
    deactivate SQLite
    
    loop Retry with exponential backoff (MAX_DELETE_RETRIES)
        KBHelper->>FileSystem: Remove directory
        alt Success
            FileSystem-->>KBHelper: Directory removed
            KBHelper->>KBHelper: Return True
        else File-in-use error
            FileSystem-->>KBHelper: Error (transient)
            KBHelper->>KBHelper: Wait, retry
        else Persistent failure
            KBHelper->>FileSystem: Rename directory for deferred cleanup
            FileSystem-->>KBHelper: Renamed
            KBHelper->>KBHelper: Return True/False
        end
    end
    
    deactivate KBHelper
    
    KBHelper-->>KBEndpoint: Success/Failure status
    KBEndpoint-->>Client: 200/500 Response

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

Possibly related PRs

• chore: merge release 1.8.0 #12088: Modifies src/backend/base/langflow/api/utils/kb_helpers.py with similar KB ingestion and storage/teardown logic changes.
• fix: Handle params required for watsonX #10979: Adds provider-specific UI configuration and watsonx/ollama parameters to LanguageModelComponent, directly related to this PR's provider-resolution enhancements across starter projects.

Suggested reviewers

• erichare
• HimavarshaVS
• Cristhianzl

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 3 warnings)

Check name	Status	Explanation	Resolution
Test Coverage For New Implementations	❌ Error	PR includes tests for KB storage deletion, MCP projects, and removeApiKeys utility, but lacks tests for process.py apply_tweaks changes, core.py provider extraction, and frontend hook modifications.	Add unit tests for apply_tweaks load_from_db handling, _get_provider_from_template helper, use-fetch-data-on-mount hook changes, and inputGlobalComponent variable detection logic.
Docstring Coverage	⚠️ Warning	Docstring coverage is 37.50% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Test Quality And Coverage	⚠️ Warning	PR includes untested utility functions: _get_provider_from_template() in core.py, apply_tweaks logic in process.py, and looksLikeVariableName() in reactflowUtils.ts lack dedicated test coverage.	Add unit tests for _get_provider_from_template(), apply_tweaks load_from_db logic, and looksLikeVariableName(). Expand removeApiKeys tests and add integration tests for variable-name detection.
Excessive Mock Usage Warning	⚠️ Warning	Test files exhibit excessive mock usage with high mock-to-test ratios obscuring actual dependency integration.	Consolidate heavily-mocked tests into integration tests exercising real Chroma interactions or restructure to mock only component boundaries.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: merging the release-1.8.1 branch into main, which aligns with the PR's core objective of integrating the release branch.
Test File Naming And Structure	✅ Passed	All test files follow correct patterns and best practices with proper structure, naming conventions, and comprehensive coverage of edge cases.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch merge-release-1.8.1

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Frontend Unit Test Coverage Report

Coverage Summary

Lines	Statements	Branches	Functions
	24.17% (8626/35678)	16.93% (4757/28093)	16.91% (1264/7474)

Unit Test Results

Tests	Skipped	Failures	Errors	Time
2779	0 💤	0 ❌	0 🔥	46.469s ⏱️

[codecov]

Codecov Report

❌ Patch coverage is 62.40602% with 50 lines in your changes missing coverage. Please review.
✅ Project coverage is 38.50%. Comparing base (aea0796) to head (162985c).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
src/backend/base/langflow/api/utils/kb_helpers.py	77.94%	15 Missing ⚠️
...d/src/CustomNodes/hooks/use-fetch-data-on-mount.ts	0.00%	11 Missing ⚠️
src/backend/base/langflow/processing/process.py	25.00%	9 Missing ⚠️
src/backend/base/langflow/api/utils/core.py	12.50%	7 Missing ⚠️
...omponent/components/inputGlobalComponent/index.tsx	14.28%	6 Missing ⚠️
...rc/backend/base/langflow/api/v1/knowledge_bases.py	88.88%	1 Missing ⚠️
src/frontend/src/utils/reactflowUtils.ts	92.30%	0 Missing and 1 partial ⚠️

❌ Your project status has failed because the head coverage (44.41%) is below the target coverage (60.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #12185      +/-   ##
==========================================
+ Coverage   38.39%   38.50%   +0.10%     
==========================================
  Files        1630     1630              
  Lines       80290    80458     +168     
  Branches    12120    12152      +32     
==========================================
+ Hits        30830    30981     +151     
- Misses      47724    47726       +2     
- Partials     1736     1751      +15     

Flag	Coverage Δ
backend	57.40% <68.31%> (+0.11%)	⬆️
frontend	21.59% <43.75%> (+0.03%)	⬆️
lfx	44.41% <ø> (+0.13%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/backend/base/langflow/api/v1/mcp_projects.py	45.52% <100.00%> (+4.11%)	⬆️
src/backend/base/langflow/utils/kb_constants.py	100.00% <100.00%> (ø)
src/frontend/src/constants/constants.ts	95.04% <ø> (ø)
src/frontend/src/modals/exportModal/index.tsx	64.00% <100.00%> (ø)
src/lfx/src/lfx/base/models/unified_models.py	29.50% <ø> (+5.93%)	⬆️
src/lfx/src/lfx/processing/process.py	15.55% <ø> (-1.52%)	⬇️
...rc/backend/base/langflow/api/v1/knowledge_bases.py	71.96% <88.88%> (+0.41%)	⬆️
src/frontend/src/utils/reactflowUtils.ts	15.55% <92.30%> (+1.22%)	⬆️
...omponent/components/inputGlobalComponent/index.tsx	22.64% <14.28%> (-0.28%)	⬇️
src/backend/base/langflow/api/utils/core.py	69.20% <12.50%> (-1.47%)	⬇️
... and 3 more

... and 10 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[erichare]

LGTM! Did basic sanity checks, confirmed that backend functionality from 1.8.1 and from main exists

[coderabbitai]

Actionable comments posted: 11

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (3)

src/backend/tests/unit/test_knowledge_bases_api.py (1)

274-295: ⚠️ Potential issue | 🟡 Minor

mock_delete.called is too weak for bulk-delete validation.

At Line 295, this can pass even if only one KB deletion happened. The test should verify both expected deletions were attempted.

Suggested fix

+from unittest.mock import AsyncMock, MagicMock, call, patch
...
-        assert mock_delete.called
+        assert mock_delete.call_count == 2
+        mock_delete.assert_has_calls(
+            [
+                call(kb_user_path / "KB1", "KB1"),
+                call(kb_user_path / "KB2", "KB2"),
+            ],
+            any_order=True,
+        )

As per coding guidelines: "Verify tests cover both positive and negative scenarios where appropriate."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/tests/unit/test_knowledge_bases_api.py` around lines 274 - 295,
The test_bulk_delete_knowledge_bases currently only asserts mock_delete.called
which is too weak; update the assertion to verify both expected deletions were
attempted by checking mock_delete.call_count == 2 and that the calls include
deletions for "KB1" and "KB2" (use mock_delete.assert_has_calls or inspect
mock_delete.call_args_list) targeting KBStorageHelper.delete_storage with the
appropriate arguments for those two KB names in the
test_bulk_delete_knowledge_bases test.

src/backend/base/langflow/api/v1/knowledge_bases.py (2)

517-518: ⚠️ Potential issue | 🔴 Critical

This finally block can turn a 404 into a 500.

If _resolve_kb_path() raises on Line 518, kb_path is never bound and Line 596 then raises UnboundLocalError during cleanup.

Possible fix

 async def get_knowledge_base_chunks(
     kb_name: str,
     current_user: CurrentActiveUser,
     page: Annotated[int, Query(ge=1)] = 1,
     limit: Annotated[int, Query(ge=1, le=100)] = 50,
     search: Annotated[str, Query(description="Filter chunks whose text contains this substring")] = "",
 ) -> PaginatedChunkResponse:
     """Get chunks from a specific knowledge base with pagination."""
+    kb_path: Path | None = None
     try:
         kb_path = _resolve_kb_path(kb_name, current_user)
@@
     finally:
         client = None
         chroma = None
-        KBStorageHelper.release_chroma_resources(kb_path)
+        if kb_path is not None:
+            KBStorageHelper.release_chroma_resources(kb_path)

Also applies to: 593-596

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/base/langflow/api/v1/knowledge_bases.py` around lines 517 - 518,
The finally block can raise UnboundLocalError if _resolve_kb_path(kb_name,
current_user) fails because kb_path is not bound; initialize kb_path = None
before the try that calls _resolve_kb_path and update the finally/cleanup logic
(in the same function) to guard any use of kb_path (e.g., deletion/cleanup
steps) with an if kb_path is not None check so a raised 404/error from
_resolve_kb_path does not become a 500 during cleanup.

---

57-61: ⚠️ Potential issue | 🟠 Major

Guard the rollback path before touching kb_path.

If setup fails before Line 61 finishes assigning kb_path, the handler crashes on Line 130 with UnboundLocalError. Line 131 also ignores a False return from delete_storage(), so failed creates can leave a half-created KB behind.

Possible fix

 async def create_knowledge_base(
     request: CreateKnowledgeBaseRequest,
     current_user: CurrentActiveUser,
 ) -> KnowledgeBaseInfo:
     """Create a new knowledge base with embedding configuration."""
+    kb_name = request.name.strip().replace(" ", "_")
+    kb_path: Path | None = None
     try:
         kb_root_path = KBStorageHelper.get_root_path()
         kb_user = current_user.username
-        kb_name = request.name.strip().replace(" ", "_")
         kb_path = kb_root_path / kb_user / kb_name
@@
     except Exception as e:
         # Clean up if something went wrong
-        if kb_path.exists():
-            KBStorageHelper.delete_storage(kb_path, kb_name)
+        cleanup_failed = False
+        if kb_path is not None and kb_path.exists():
+            cleanup_failed = not KBStorageHelper.delete_storage(kb_path, kb_name)
         await logger.aerror("Error creating knowledge base: %s", e)
-        raise HTTPException(status_code=500, detail="Internal error creating knowledge base") from e
+        detail = "Internal error creating knowledge base"
+        if cleanup_failed:
+            detail += f". Cleanup for '{kb_name}' also failed."
+        raise HTTPException(status_code=500, detail=detail) from e

Also applies to: 128-133

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/base/langflow/api/v1/knowledge_bases.py` around lines 57 - 61,
The handler constructs kb_path using KBStorageHelper.get_root_path(),
current_user.username and request.name but if setup fails before kb_path is
fully assigned the rollback code references an uninitialized kb_path and may
crash; modify the create handler so kb_path is initialized to None before the
try, only attempt rollback/delete_storage(kb_path) if kb_path is not None and
exists, and handle delete_storage's boolean return (log or raise on False)
instead of ignoring it; update references to kb_path,
KBStorageHelper.get_root_path(), and delete_storage(...) accordingly to ensure
safe cleanup when setup fails.

🧹 Nitpick comments (13)

src/frontend/src/CustomNodes/hooks/use-fetch-data-on-mount.ts (1)

58-58: Missing dependencies in useEffect may cause stale closure issues.

The dependency array is empty but the effect closes over node, name, nodeId, setNodeClass, postTemplateValue, and setErrorData. While this is intentional "on mount" behavior (as the hook name suggests), consider adding an eslint-disable comment to suppress the exhaustive-deps warning and document the intent.

📝 Suggested documentation of intent

    fetchData();
-  }, []);
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- Intentionally run only on mount
+  }, []);

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/frontend/src/CustomNodes/hooks/use-fetch-data-on-mount.ts` at line 58,
The useEffect in the useFetchDataOnMount hook intentionally runs only on mount
but currently omits dependencies (node, name, nodeId, setNodeClass,
postTemplateValue, setErrorData) and will trigger an exhaustive-deps lint
warning; update the effect by adding a clear inline comment explaining that the
effect must run only once on mount and then add an eslint-disable-next-line
react-hooks/exhaustive-deps (or eslint-disable for that specific line)
immediately above the useEffect to suppress the warning so the intentional
mount-only behavior is documented and the linter is satisfied.

src/frontend/tests/core/regression/session-deletion-data-leakage.spec.ts (2)

77-80: Consider adding a test docstring per coding guidelines.

The test name is descriptive, but coding guidelines require documenting each test with a clear comment explaining its purpose, the scenario being tested, and expected outcomes.

📝 Suggested documentation

 test(
   "should prevent data leakage when default session is deleted and recreated",
   { tag: ["@release", "@regression"] },
   async ({ page }) => {
+    /**
+     * Purpose: Verify that deleting a session clears its messages and prevents data leakage.
+     * Scenario: Send a message in the default session, delete the session, then send a new message.
+     * Expected: The original message should not appear after deletion; only the new message should be visible.
+     */
     test.skip(

Based on learnings: "Document each frontend test with a clear docstring/comment explaining its purpose, the scenario being tested, and expected outcomes".

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/frontend/tests/core/regression/session-deletion-data-leakage.spec.ts`
around lines 77 - 80, Add a docstring comment immediately above the test(...)
declaration for "should prevent data leakage when default session is deleted and
recreated" that briefly describes the purpose (verify no cross-session data
leakage), the scenario steps (delete the default session, recreate it, perform
actions that previously leaked data), and the expected outcomes (no residual
data from prior session persists and assertions that confirm isolation); place
this comment directly above the test(...) block so it documents the test
function in
src/frontend/tests/core/regression/session-deletion-data-leakage.spec.ts.

---

47-63: Consider replacing waitForTimeout with condition-based waits.

Playwright's waitForTimeout is discouraged because fixed delays make tests slower and flakier. The helper could use more robust waits:

• Line 49: Wait for the more button to be visible after hover
• Line 56: Already followed by a waitFor, so this delay may be unnecessary
• Line 63: Wait for the session element to be removed from DOM

♻️ Proposed refactor using condition-based waits

       // Hover to make the more button visible
       await selector.hover();
-      await page.waitForTimeout(500); // Wait for hover effects

       // Click the more options button
       const moreButton = selector.locator('[aria-label="More options"]');
+      await moreButton.waitFor({ state: "visible", timeout: 5000 });
       await moreButton.click({ timeout: 5000 });

-      // Wait for the menu to open
-      await page.waitForTimeout(500);

       // Wait for delete option to be visible and click it
       await page
         .getByTestId("delete-session-option")
         .waitFor({ state: "visible", timeout: 5000 });
       await page.getByTestId("delete-session-option").click();
-      await page.waitForTimeout(1000);
+      // Wait for the session to be removed
+      await selector.waitFor({ state: "detached", timeout: 5000 });
       break;

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/frontend/tests/core/regression/session-deletion-data-leakage.spec.ts`
around lines 47 - 63, Replace fixed sleeps with condition-based Playwright
waits: after selector.hover() replace page.waitForTimeout(500) with waiting for
the more options button to be visible (e.g., await
selector.locator('[aria-label="More options"]').waitFor({ state: "visible",
timeout: 5000 }) or use expect(moreButton).toBeVisible()); remove the redundant
page.waitForTimeout(500) before waiting for delete option since you already call
getByTestId("delete-session-option").waitFor(...); and after clicking the delete
control replace page.waitForTimeout(1000) with a wait for the session row to be
removed (e.g., await selector.waitFor({ state: "detached", timeout: 5000 }) or
expect(selector).not.toBeVisible()). Ensure you update the code paths around
selector.hover(), moreButton (locator '[aria-label="More options"]'), and
getByTestId("delete-session-option") to use these condition-based waits.

src/frontend/src/modals/exportModal/index.tsx (1)

61-71: Prefer const since flowToExport is never reassigned.

The variable flowToExport is declared with let but is never reassigned in this function. It's either passed directly to downloadFlow or passed through removeApiKeys (which returns a new object). Using const is preferred here to signal immutability.

♻️ Suggested fix

-            let flowToExport: FlowType = {
+            const flowToExport: FlowType = {

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/frontend/src/modals/exportModal/index.tsx` around lines 61 - 71, Replace
the mutable declaration of flowToExport with an immutable one: change the `let
flowToExport` declaration in the export modal to `const` since `flowToExport` is
never reassigned (it is only passed to `removeApiKeys` or `downloadFlow`);
update the line where `flowToExport` is created in the function handling export
(referencing `flowToExport`, `currentFlow`, `removeApiKeys`, and `downloadFlow`)
to use `const` to signal immutability.

src/frontend/src/utils/__tests__/removeApiKeys.test.ts (1)

3-79: Good test coverage without mocking!

The tests effectively verify the core behavior of removeApiKeys:

• Preserving api_key fields with variable-like names
• Clearing api_key fields with raw secrets
• Preserving non-password fields

Consider adding edge case tests for completeness:

🧪 Suggested additional test cases

it("clears api_key when load_from_db is true but value is a raw secret", () => {
  // Edge case: load_from_db might be true but value could still be a raw secret
  // depending on how data was set. Current implementation preserves if load_from_db=true.
  const flow = makeFlow({
    api_key: {
      name: "api_key",
      value: "sk-secret-123",
      password: true,
      load_from_db: true,
    },
  });

  const result = removeApiKeys(flow);
  const template = result.data!.nodes[0].data.node!.template;

  // Document expected behavior: load_from_db=true preserves the value
  expect(template.api_key.value).toBe("sk-secret-123");
  expect(template.api_key.load_from_db).toBe(true);
});

it("preserves api_key with lowercase variable-like name", () => {
  const flow = makeFlow({
    api_key: {
      name: "api_key",
      value: "openai_api_key", // lowercase variable name
      password: true,
      load_from_db: false,
    },
  });

  const result = removeApiKeys(flow);
  const template = result.data!.nodes[0].data.node!.template;

  expect(template.api_key.value).toBe("openai_api_key");
});

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/frontend/src/utils/__tests__/removeApiKeys.test.ts` around lines 3 - 79,
Add the two suggested edge-case tests to
src/frontend/src/utils/__tests__/removeApiKeys.test.ts: create cases using
makeFlow and removeApiKeys that (1) pass an api_key with password: true and
load_from_db: true but value looks like a raw secret to assert current behavior
(preserved value and load_from_db true) and (2) pass an api_key with a lowercase
variable-like value (e.g., "openai_api_key") to assert it is preserved; place
assertions against result.data.nodes[0].data.node.template to mirror existing
tests.

src/frontend/src/utils/reactflowUtils.ts (1)

473-486: Note: Only fields named exactly api_key are preserved.

The special handling applies only when key === "api_key". Other password fields with different names (e.g., openai_api_key, anthropic_api_key) will still have their values cleared even if they contain variable-like names.

If this is intentional (and the test confirms it is), this is fine. Otherwise, consider whether the check should apply to any password field whose value looks like a variable name:

♻️ Alternative: Apply to all password fields with variable-like values

       if (field.password) {
-        // Preserve env/global variable names for api_key so imported flows
-        // can still resolve credentials, but strip any raw secrets.
-        if (
-          key === "api_key" &&
-          ((typeof field.value === "string" &&
-            looksLikeVariableName(field.value)) ||
-            field.load_from_db === true)
-        ) {
+        // Preserve env/global variable names so imported flows
+        // can still resolve credentials, but strip any raw secrets.
+        if (
+          (typeof field.value === "string" &&
+            looksLikeVariableName(field.value)) ||
+          field.load_from_db === true
+        ) {
           continue;
         }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/frontend/src/utils/reactflowUtils.ts` around lines 473 - 486, The current
branch inside the field.password handling only preserves values when key ===
"api_key"; update that condition so variable-like or DB-loaded credentials are
preserved for other API key-style fields too (e.g., openai_api_key,
anthropic_api_key) — replace the strict equality check with a broader predicate
(for example check that the key endsWith("_api_key") or simply drop the key
check and allow any password field where looksLikeVariableName(field.value) or
field.load_from_db === true to continue) while keeping the rest of the logic
that sets field.value = "" and field.load_from_db = false for raw secrets; refer
to the field.password branch and the helpers looksLikeVariableName and
field.load_from_db to locate and modify the condition.

src/backend/tests/unit/test_knowledge_bases_api.py (1)

262-273: Assert delete arguments, not only invocation count.

At Line 272, assert_called_once() misses whether the correct kb_path/kb_name was passed to delete_storage.

Suggested tightening

-        mock_delete.assert_called_once()
+        mock_delete.assert_called_once_with(
+            tmp_path / "activeuser" / "To_Delete",
+            "To_Delete",
+        )

As per coding guidelines: "Verify tests cover both positive and negative scenarios where appropriate."

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/tests/unit/test_knowledge_bases_api.py` around lines 262 - 273,
In test_delete_knowledge_base, replace the loose mock assertion with a precise
argument check: instead of mock_delete.assert_called_once(), assert that
KBStorageHelper.delete_storage was called with the expected kb path/name by
using mock_delete.assert_called_once_with(...) — e.g., pass the constructed path
(tmp_path / "activeuser" / "To_Delete") or the expected string/Path that the
implementation uses; update the expectation to match the actual signature used
by KBStorageHelper.delete_storage in the code under test so the test verifies
both invocation and correct arguments.

src/backend/tests/unit/api/v1/test_mcp_projects.py (1)

1115-1161: Consider extracting common monkeypatch setup to reduce duplication.

This test duplicates the URL-related monkeypatches from _prepare_installed_check_env. While the different path setup is intentional (non-existent directories), the URL-related patches could be extracted to a smaller helper or the existing helper could accept an optional parameter to skip directory creation.

♻️ Suggested refactor to reduce duplication

+def _patch_mcp_url_helpers(monkeypatch):
+    """Patch URL helper functions for MCP tests."""
+    monkeypatch.setattr("langflow.api.v1.mcp_projects.should_use_mcp_composer", lambda project: False)
+
+    async def fake_streamable(project_id):
+        return f"https://langflow.local/api/v1/mcp/project/{project_id}/streamable"
+
+    async def fake_sse(project_id):
+        return f"https://langflow.local/api/v1/mcp/project/{project_id}/sse"
+
+    monkeypatch.setattr("langflow.api.v1.mcp_projects.get_project_streamable_http_url", fake_streamable)
+    monkeypatch.setattr("langflow.api.v1.mcp_projects.get_project_sse_url", fake_sse)

Then use this helper in both _prepare_installed_check_env and the test_should_report_available_false_when_app_directory_does_not_exist test.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/tests/unit/api/v1/test_mcp_projects.py` around lines 1115 - 1161,
Extract the duplicated URL monkeypatch setup into a reusable helper (or extend
the existing _prepare_installed_check_env to accept a flag to skip creating app
directories) so tests can reuse the same stream/SSE monkeypatches; specifically
move the fake_streamable and fake_sse functions and the monkeypatch.setattr
calls for get_project_streamable_http_url and get_project_sse_url into that
helper, and in
test_should_report_available_false_when_app_directory_does_not_exist call the
helper (or call the extended _prepare_installed_check_env with
skip-directory-creation) while keeping the unique fake_get_config_path
monkeypatch in the test.

src/backend/base/langflow/initial_setup/starter_projects/Youtube Analysis.json (1)

661-661: Remove the dead memory_inputs scaffolding from this snapshot.

set_advanced_true() and memory_inputs are still evaluated at class-definition time even though *memory_inputs is commented out. That adds unnecessary work on load and makes the exported starter project drift from the inputs it actually exposes.

Possible cleanup inside the embedded AgentComponent code

-def set_advanced_true(component_input):
-    component_input.advanced = True
-    return component_input
@@
-    memory_inputs = [set_advanced_true(component_input) for component_input in MemoryComponent().inputs]
@@
-        # removed memory inputs from agent component
-        # *memory_inputs,

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/base/langflow/initial_setup/starter_projects/Youtube`
Analysis.json at line 661, Remove the dead scaffolding by deleting the
set_advanced_true function and the memory_inputs attribute from the
AgentComponent class (they are evaluated at import time even though
*memory_inputs is commented out); update any references within the snippet to
stop using memory_inputs (e.g., the declaration memory_inputs = [...] and its
helper function set_advanced_true) so class-definition work is not performed on
load and the exported starter project matches the actual inputs.

src/backend/base/langflow/initial_setup/starter_projects/Search agent.json (1)

1100-1100: Drop the unused memory-input helpers from this embedded agent too.

Same issue here: set_advanced_true() and memory_inputs are still built even though the inputs are no longer exposed. Keeping them in the snapshot just adds dead setup work and extra drift across starter projects.

Possible cleanup inside the embedded AgentComponent code

-def set_advanced_true(component_input):
-    component_input.advanced = True
-    return component_input
@@
-    memory_inputs = [set_advanced_true(component_input) for component_input in MemoryComponent().inputs]
@@
-        # removed memory inputs from agent component
-        # *memory_inputs,

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/base/langflow/initial_setup/starter_projects/Search` agent.json
at line 1100, The embedded AgentComponent still defines the helper function
set_advanced_true and builds memory_inputs = [set_advanced_true(...)] even
though memory inputs are no longer used; remove the dead helper and attribute to
avoid unnecessary setup. Delete the set_advanced_true function and the
memory_inputs class attribute from the AgentComponent definition (and any
references to it) and ensure AgentComponent.inputs no longer depends on
memory_inputs; run tests/lint to catch any leftover references that need
removal.

src/backend/base/langflow/initial_setup/starter_projects/Instagram Copywriter.json (1)

2786-2786: Normalize max_tokens in LanguageModelComponent.build_model before calling get_llm.

In this block, build_model still passes raw max_tokens (getattr(self, "max_tokens", None)). If the UI sends 0/empty, this can propagate an invalid token limit. The Agent block already normalizes this pattern; applying the same logic here avoids provider-side errors.

♻️ Proposed patch (inside the embedded Python code)

 class LanguageModelComponent(LCModelComponent):
@@
+    def _get_max_tokens_value(self):
+        val = getattr(self, "max_tokens", None)
+        if val in {"", 0}:
+            return None
+        return val
+
     def build_model(self) -> LanguageModel:
         return get_llm(
             model=self.model,
             user_id=self.user_id,
             api_key=self.api_key,
             temperature=self.temperature,
             stream=self.stream,
-            max_tokens=getattr(self, "max_tokens", None),
+            max_tokens=self._get_max_tokens_value(),
             watsonx_url=getattr(self, "base_url_ibm_watsonx", None),
             watsonx_project_id=getattr(self, "project_id", None),
             ollama_base_url=getattr(self, "ollama_base_url", None),
         )

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/base/langflow/initial_setup/starter_projects/Instagram`
Copywriter.json at line 2786, The build_model method in LanguageModelComponent
currently forwards raw max_tokens (getattr(self, "max_tokens", None)) to get_llm
which can propagate invalid values like 0; change
LanguageModelComponent.build_model to normalize max_tokens first (e.g., read
max_tokens = getattr(self, "max_tokens", None) and set max_tokens = None if
max_tokens in (0, "", None) or not int-positive) and then pass that normalized
max_tokens into get_llm so providers never receive an invalid token limit.

src/backend/tests/unit/test_kb_storage_deletion.py (2)

299-305: Assert that the happy-path handlers actually delete storage.

Both success cases only check the 200 response/deleted_count, so they would still pass if the route stopped calling KBStorageHelper.delete_storage and just reported success. Add a spy on the helper or assert the KB directories are gone after the request.

Also applies to: 334-350

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/tests/unit/test_kb_storage_deletion.py` around lines 299 - 305,
Update the test_should_delete_kb_successfully (and the similar test at 334-350)
to verify the storage was actually removed rather than only checking the HTTP
response: either attach a spy/mock to KBStorageHelper.delete_storage to assert
it was called with the expected user/KB name, or perform filesystem assertions
against tmp_path (e.g., assert that (tmp_path / "activeuser" / "My_KB") no
longer exists after the DELETE request); ensure you reference the test function
test_should_delete_kb_successfully and the KBStorageHelper.delete_storage helper
so the test fails if deletion is not performed.

---

227-246: Avoid duplicating the retry schedule in the assertion.

This hard-codes [1.0, 2.0, 4.0], so the test will start failing whenever the configured backoff changes even if the implementation is still correct. Build the expected sequence from the same retry/backoff configuration the helper uses.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/tests/unit/test_kb_storage_deletion.py` around lines 227 - 246,
The test currently hard-codes the sleep sequence [1.0, 2.0, 4.0]; instead
compute the expected backoff sequence from KBStorageHelper's retry/backoff
configuration used by delete_storage: read KBStorageHelper.RETRIES and
KBStorageHelper.BACKOFF_SECONDS (or the actual constant names used in the
class), then build expected = [initial_backoff * (2 ** i) for i in
range(KBStorageHelper.RETRIES - 1)] (or the equivalent formula if the helper
uses different names like INITIAL_BACKOFF/BACKOFF_MULTIPLIER), and assert
sleep_values == expected so the test adapts to config changes.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/backend/base/langflow/api/v1/knowledge_bases.py`:
- Around line 637-639: The bulk-delete currently treats a False return from
KBStorageHelper.delete_storage(kb_path, kb_name) as a silent success; update the
try block handling around the delete loop so that when delete_storage returns
False you record that KB as failed (e.g., add kb_name or a failure tuple to a
failed_kbs list or increment a failed_count) and do not increment deleted_count,
and include that failure in the final response construction (the same response
path that uses deleted_count/failed list later), ensuring any exception from
delete_storage is still caught by the existing except but non-exceptional False
returns are reported back to the caller.

In `@src/backend/base/langflow/initial_setup/starter_projects/Basic`
Prompting.json:
- Line 1040: The starter metadata's last_tested_version is stale (still "1.8.0")
for this JSON that now includes the new LanguageModelComponent; locate the JSON
object's metadata key last_tested_version and update its string value to "1.8.1"
so the bundled starter reflects the correct release; ensure you only change the
metadata field and do not modify the LanguageModelComponent class or other
fields.

In `@src/backend/base/langflow/initial_setup/starter_projects/Market`
Research.json:
- Line 1352: The model prompt currently asks the LLM to "Output (only JSON
schema)" which makes it echo the schema instead of returning data; update the
schema_info text in json_response() (the variable schema_info) to instruct the
agent to return JSON data that conforms to the provided schema (e.g., "Return
only JSON data that conforms to the schema, do NOT return the schema itself").
Also broaden the JSON extraction in build_structured_output_base() by changing
json_pattern to match both objects and arrays (e.g., allow \[...\] as well as
{...}) and ensure the fallback parsing logic accepts and preserves top-level
arrays so prose-wrapped arrays are extracted and validated just like single
objects (see json_pattern and the JSON parsing/fallback branches in
build_structured_output_base()).

In `@src/backend/base/langflow/initial_setup/starter_projects/News`
Aggregator.json:
- Line 1176: The footer field "last_tested_version" in this JSON is stale (still
"1.6.0") after you refreshed the embedded AgentComponent (see "code_hash":
"40d1976f4718"); update the "last_tested_version" property to the actual
LangFlow version used when validating this starter snapshot so the metadata
matches the embedded code (replace the existing "1.6.0" value with the correct
version string).

In `@src/backend/base/langflow/initial_setup/starter_projects/Nvidia` Remix.json:
- Line 1893: The serialized template still exports the Embedding Model node as a
plain DropdownInput string which conflicts with EmbeddingModelComponent
expecting self.model to be a list; update the template so the node uses a
ModelInput (not DropdownInput) matching EmbeddingModelComponent.inputs
(model_type="embedding", input value as a list[dict] with keys "provider" and
"name" like the runtime ModelInput payload) so update_build_config() can resolve
provider and build_embeddings() will receive a non-empty list; locate the
EmbeddingModelComponent.inputs block and replace the stale
DropdownInput/Dropdown value for the model node with the proper ModelInput/list
payload in the serialized JSON template.
- Line 1893: The watsonx UI toggles truncate_input_tokens and input_text are
never added to the instantiated embedding kwargs, so update both _build_kwargs
and _build_kwargs_for_model to read self.truncate_input_tokens and
self.input_text (with hasattr checks) and, when those values are present, add
them to the returned kwargs using the param names defined in
metadata["param_mapping"] (i.e., if param_mapping maps "truncate_input_tokens"
or "input_text" to a target kwarg name, set
kwargs[param_mapping["truncate_input_tokens"]] = int(self.truncate_input_tokens)
and kwargs[param_mapping["input_text"]] = bool(self.input_text)); keep this
logic alongside the existing Watson-specific block so update_build_config,
_build_kwargs, and _build_kwargs_for_model remain consistent.

In `@src/backend/base/langflow/initial_setup/starter_projects/Pokédex` Agent.json:
- Line 1241: The JSON footer's last_tested_version value is stale after
refreshing the embedded AgentComponent snapshot (code_hash "40d1976f4718");
update the "last_tested_version" field in this starter's metadata to the correct
version string used when validating this snapshot (i.e., bump the footer value
to match the snapshot/validation version) so the starter metadata and embedded
code_hash stay consistent, and verify there are no other duplicate
last_tested_version entries remaining.

In `@src/backend/base/langflow/initial_setup/starter_projects/Price` Deal
Finder.json:
- Line 1768: Structured-response failures come from
build_structured_output_base() only searching for object braces "{...}" so valid
JSON arrays are missed and json_response() instructs the model to "Return it as
valid JSON" in a way that can force a schema-only reply; fix by updating
build_structured_output_base (json_pattern and parsing logic) to detect and
extract both JSON objects and arrays (e.g., try full-string json.loads first,
then regex for r"\{.*\}" OR r"\[.*\]" and attempt to json.loads the match), and
also relax the schema prompt built in json_response() (the schema_info variable)
to ask the model to return the JSON schema OR a JSON instance but not to return
only the schema text so downstream parsing/validation can accept arrays like
[{"name":...}, ...]; target functions/vars: build_structured_output_base,
json_pattern, json_response, schema_info, combined_instructions.

In `@src/backend/base/langflow/initial_setup/starter_projects/Simple` Agent.json:
- Line 1100: The json parsing in build_structured_output_base and the
json_response flow is too narrow (only matches object fragments) causing valid
JSON arrays or wrapped JSON to be rejected; update build_structured_output_base
(and any related regex/logic used by json_response) to accept both object and
array JSON fragments by changing the json_pattern to match either {…} or […],
try parsing the full content first, then search for either array or object
fragments using re.DOTALL (e.g., r"(\{.*\}|\[.*\])"), and when a fragment is
found json.loads() it and proceed; ensure the function still returns parsed
lists unchanged (and downstream json_response handles list results correctly)
and keep existing validation via _preprocess_schema/build_model_from_schema and
error fallbacks intact (targets: functions build_structured_output_base,
json_response, and the json_pattern variable).

In `@src/frontend/tests/core/regression/session-deletion-data-leakage.spec.ts`:
- Around line 192-195: The current assertion using
expect(responseText?.toLowerCase()).not.toContain("victor") can false-fail when
the LLM mentions "Victor" while explicitly denying knowledge; update the
assertion to allow either a clear denial phrase or absence of the name: create a
boolean like indicatesNoKnowledge that checks
responseText?.toLowerCase().includes("don't know") || .includes("haven't told")
|| .includes("not sure"), then assert expect(indicatesNoKnowledge ||
!responseText?.toLowerCase().includes("victor")).toBe(true); reference the
existing responseText variable in the test to implement this replacement.

In `@src/lfx/pyproject.toml`:
- Line 15: The pyproject FastAPI dependency bump may break compatibility: update
pyproject.toml (the "fastapi>=0.135.0,<1.0.0" entry) and the project metadata to
require a Python version that FastAPI v0.135+ supports (remove/raise support for
3.8/3.9 via python_requires), verify and migrate all Pydantic usage to Pydantic
v2 APIs, replace deprecated ORJSONResponse/UJSONResponse usages (search for
ORJSONResponse and UJSONResponse classes) with supported response classes or
custom JSONResponse, and fix strict Content-Type handling by adding explicit
content-type checks or configuring request handling middleware/route decorators
to accept requests without Content-Type (search handlers/middleware that parse
JSON bodies); run the test suite and update dependency specs to reflect Pydantic
v2 and the new Python minimum.

---

Outside diff comments:
In `@src/backend/base/langflow/api/v1/knowledge_bases.py`:
- Around line 517-518: The finally block can raise UnboundLocalError if
_resolve_kb_path(kb_name, current_user) fails because kb_path is not bound;
initialize kb_path = None before the try that calls _resolve_kb_path and update
the finally/cleanup logic (in the same function) to guard any use of kb_path
(e.g., deletion/cleanup steps) with an if kb_path is not None check so a raised
404/error from _resolve_kb_path does not become a 500 during cleanup.
- Around line 57-61: The handler constructs kb_path using
KBStorageHelper.get_root_path(), current_user.username and request.name but if
setup fails before kb_path is fully assigned the rollback code references an
uninitialized kb_path and may crash; modify the create handler so kb_path is
initialized to None before the try, only attempt
rollback/delete_storage(kb_path) if kb_path is not None and exists, and handle
delete_storage's boolean return (log or raise on False) instead of ignoring it;
update references to kb_path, KBStorageHelper.get_root_path(), and
delete_storage(...) accordingly to ensure safe cleanup when setup fails.

In `@src/backend/tests/unit/test_knowledge_bases_api.py`:
- Around line 274-295: The test_bulk_delete_knowledge_bases currently only
asserts mock_delete.called which is too weak; update the assertion to verify
both expected deletions were attempted by checking mock_delete.call_count == 2
and that the calls include deletions for "KB1" and "KB2" (use
mock_delete.assert_has_calls or inspect mock_delete.call_args_list) targeting
KBStorageHelper.delete_storage with the appropriate arguments for those two KB
names in the test_bulk_delete_knowledge_bases test.

---

Nitpick comments:
In `@src/backend/base/langflow/initial_setup/starter_projects/Instagram`
Copywriter.json:
- Line 2786: The build_model method in LanguageModelComponent currently forwards
raw max_tokens (getattr(self, "max_tokens", None)) to get_llm which can
propagate invalid values like 0; change LanguageModelComponent.build_model to
normalize max_tokens first (e.g., read max_tokens = getattr(self, "max_tokens",
None) and set max_tokens = None if max_tokens in (0, "", None) or not
int-positive) and then pass that normalized max_tokens into get_llm so providers
never receive an invalid token limit.

In `@src/backend/base/langflow/initial_setup/starter_projects/Search` agent.json:
- Line 1100: The embedded AgentComponent still defines the helper function
set_advanced_true and builds memory_inputs = [set_advanced_true(...)] even
though memory inputs are no longer used; remove the dead helper and attribute to
avoid unnecessary setup. Delete the set_advanced_true function and the
memory_inputs class attribute from the AgentComponent definition (and any
references to it) and ensure AgentComponent.inputs no longer depends on
memory_inputs; run tests/lint to catch any leftover references that need
removal.

In `@src/backend/base/langflow/initial_setup/starter_projects/Youtube`
Analysis.json:
- Line 661: Remove the dead scaffolding by deleting the set_advanced_true
function and the memory_inputs attribute from the AgentComponent class (they are
evaluated at import time even though *memory_inputs is commented out); update
any references within the snippet to stop using memory_inputs (e.g., the
declaration memory_inputs = [...] and its helper function set_advanced_true) so
class-definition work is not performed on load and the exported starter project
matches the actual inputs.

In `@src/backend/tests/unit/api/v1/test_mcp_projects.py`:
- Around line 1115-1161: Extract the duplicated URL monkeypatch setup into a
reusable helper (or extend the existing _prepare_installed_check_env to accept a
flag to skip creating app directories) so tests can reuse the same stream/SSE
monkeypatches; specifically move the fake_streamable and fake_sse functions and
the monkeypatch.setattr calls for get_project_streamable_http_url and
get_project_sse_url into that helper, and in
test_should_report_available_false_when_app_directory_does_not_exist call the
helper (or call the extended _prepare_installed_check_env with
skip-directory-creation) while keeping the unique fake_get_config_path
monkeypatch in the test.

In `@src/backend/tests/unit/test_kb_storage_deletion.py`:
- Around line 299-305: Update the test_should_delete_kb_successfully (and the
similar test at 334-350) to verify the storage was actually removed rather than
only checking the HTTP response: either attach a spy/mock to
KBStorageHelper.delete_storage to assert it was called with the expected user/KB
name, or perform filesystem assertions against tmp_path (e.g., assert that
(tmp_path / "activeuser" / "My_KB") no longer exists after the DELETE request);
ensure you reference the test function test_should_delete_kb_successfully and
the KBStorageHelper.delete_storage helper so the test fails if deletion is not
performed.
- Around line 227-246: The test currently hard-codes the sleep sequence [1.0,
2.0, 4.0]; instead compute the expected backoff sequence from KBStorageHelper's
retry/backoff configuration used by delete_storage: read KBStorageHelper.RETRIES
and KBStorageHelper.BACKOFF_SECONDS (or the actual constant names used in the
class), then build expected = [initial_backoff * (2 ** i) for i in
range(KBStorageHelper.RETRIES - 1)] (or the equivalent formula if the helper
uses different names like INITIAL_BACKOFF/BACKOFF_MULTIPLIER), and assert
sleep_values == expected so the test adapts to config changes.

In `@src/backend/tests/unit/test_knowledge_bases_api.py`:
- Around line 262-273: In test_delete_knowledge_base, replace the loose mock
assertion with a precise argument check: instead of
mock_delete.assert_called_once(), assert that KBStorageHelper.delete_storage was
called with the expected kb path/name by using
mock_delete.assert_called_once_with(...) — e.g., pass the constructed path
(tmp_path / "activeuser" / "To_Delete") or the expected string/Path that the
implementation uses; update the expectation to match the actual signature used
by KBStorageHelper.delete_storage in the code under test so the test verifies
both invocation and correct arguments.

In `@src/frontend/src/CustomNodes/hooks/use-fetch-data-on-mount.ts`:
- Line 58: The useEffect in the useFetchDataOnMount hook intentionally runs only
on mount but currently omits dependencies (node, name, nodeId, setNodeClass,
postTemplateValue, setErrorData) and will trigger an exhaustive-deps lint
warning; update the effect by adding a clear inline comment explaining that the
effect must run only once on mount and then add an eslint-disable-next-line
react-hooks/exhaustive-deps (or eslint-disable for that specific line)
immediately above the useEffect to suppress the warning so the intentional
mount-only behavior is documented and the linter is satisfied.

In `@src/frontend/src/modals/exportModal/index.tsx`:
- Around line 61-71: Replace the mutable declaration of flowToExport with an
immutable one: change the `let flowToExport` declaration in the export modal to
`const` since `flowToExport` is never reassigned (it is only passed to
`removeApiKeys` or `downloadFlow`); update the line where `flowToExport` is
created in the function handling export (referencing `flowToExport`,
`currentFlow`, `removeApiKeys`, and `downloadFlow`) to use `const` to signal
immutability.

In `@src/frontend/src/utils/__tests__/removeApiKeys.test.ts`:
- Around line 3-79: Add the two suggested edge-case tests to
src/frontend/src/utils/__tests__/removeApiKeys.test.ts: create cases using
makeFlow and removeApiKeys that (1) pass an api_key with password: true and
load_from_db: true but value looks like a raw secret to assert current behavior
(preserved value and load_from_db true) and (2) pass an api_key with a lowercase
variable-like value (e.g., "openai_api_key") to assert it is preserved; place
assertions against result.data.nodes[0].data.node.template to mirror existing
tests.

In `@src/frontend/src/utils/reactflowUtils.ts`:
- Around line 473-486: The current branch inside the field.password handling
only preserves values when key === "api_key"; update that condition so
variable-like or DB-loaded credentials are preserved for other API key-style
fields too (e.g., openai_api_key, anthropic_api_key) — replace the strict
equality check with a broader predicate (for example check that the key
endsWith("_api_key") or simply drop the key check and allow any password field
where looksLikeVariableName(field.value) or field.load_from_db === true to
continue) while keeping the rest of the logic that sets field.value = "" and
field.load_from_db = false for raw secrets; refer to the field.password branch
and the helpers looksLikeVariableName and field.load_from_db to locate and
modify the condition.

In `@src/frontend/tests/core/regression/session-deletion-data-leakage.spec.ts`:
- Around line 77-80: Add a docstring comment immediately above the test(...)
declaration for "should prevent data leakage when default session is deleted and
recreated" that briefly describes the purpose (verify no cross-session data
leakage), the scenario steps (delete the default session, recreate it, perform
actions that previously leaked data), and the expected outcomes (no residual
data from prior session persists and assertions that confirm isolation); place
this comment directly above the test(...) block so it documents the test
function in
src/frontend/tests/core/regression/session-deletion-data-leakage.spec.ts.
- Around line 47-63: Replace fixed sleeps with condition-based Playwright waits:
after selector.hover() replace page.waitForTimeout(500) with waiting for the
more options button to be visible (e.g., await
selector.locator('[aria-label="More options"]').waitFor({ state: "visible",
timeout: 5000 }) or use expect(moreButton).toBeVisible()); remove the redundant
page.waitForTimeout(500) before waiting for delete option since you already call
getByTestId("delete-session-option").waitFor(...); and after clicking the delete
control replace page.waitForTimeout(1000) with a wait for the session row to be
removed (e.g., await selector.waitFor({ state: "detached", timeout: 5000 }) or
expect(selector).not.toBeVisible()). Ensure you update the code paths around
selector.hover(), moreButton (locator '[aria-label="More options"]'), and
getByTestId("delete-session-option") to use these condition-based waits.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7f54c188-3c57-4ee6-a113-038a00aaebb8

📥 Commits

Reviewing files that changed from the base of the PR and between e6d6d2e and 1515ef3.

⛔ Files ignored due to path filters (2)

• src/frontend/package-lock.json is excluded by !**/package-lock.json
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (70)

• .secrets.baseline
• docker/build_and_push.Dockerfile
• docker/build_and_push_backend.Dockerfile
• docker/build_and_push_base.Dockerfile
• docker/build_and_push_ep.Dockerfile
• docker/build_and_push_with_extras.Dockerfile
• pyproject.toml
• src/backend/base/langflow/api/utils/core.py
• src/backend/base/langflow/api/utils/kb_helpers.py
• src/backend/base/langflow/api/v1/knowledge_bases.py
• src/backend/base/langflow/api/v1/mcp_projects.py
• src/backend/base/langflow/initial_setup/starter_projects/Basic Prompt Chaining.json
• src/backend/base/langflow/initial_setup/starter_projects/Basic Prompting.json
• src/backend/base/langflow/initial_setup/starter_projects/Blog Writer.json
• src/backend/base/langflow/initial_setup/starter_projects/Custom Component Generator.json
• src/backend/base/langflow/initial_setup/starter_projects/Document Q&A.json
• src/backend/base/langflow/initial_setup/starter_projects/Hybrid Search RAG.json
• src/backend/base/langflow/initial_setup/starter_projects/Image Sentiment Analysis.json
• src/backend/base/langflow/initial_setup/starter_projects/Instagram Copywriter.json
• src/backend/base/langflow/initial_setup/starter_projects/Invoice Summarizer.json
• src/backend/base/langflow/initial_setup/starter_projects/Knowledge Retrieval.json
• src/backend/base/langflow/initial_setup/starter_projects/Market Research.json
• src/backend/base/langflow/initial_setup/starter_projects/Meeting Summary.json
• src/backend/base/langflow/initial_setup/starter_projects/Memory Chatbot.json
• src/backend/base/langflow/initial_setup/starter_projects/News Aggregator.json
• src/backend/base/langflow/initial_setup/starter_projects/Nvidia Remix.json
• src/backend/base/langflow/initial_setup/starter_projects/Pokédex Agent.json
• src/backend/base/langflow/initial_setup/starter_projects/Portfolio Website Code Generator.json
• src/backend/base/langflow/initial_setup/starter_projects/Price Deal Finder.json
• src/backend/base/langflow/initial_setup/starter_projects/Research Agent.json
• src/backend/base/langflow/initial_setup/starter_projects/Research Translation Loop.json
• src/backend/base/langflow/initial_setup/starter_projects/SEO Keyword Generator.json
• src/backend/base/langflow/initial_setup/starter_projects/SaaS Pricing.json
• src/backend/base/langflow/initial_setup/starter_projects/Search agent.json
• src/backend/base/langflow/initial_setup/starter_projects/Sequential Tasks Agents.json
• src/backend/base/langflow/initial_setup/starter_projects/Simple Agent.json
• src/backend/base/langflow/initial_setup/starter_projects/Social Media Agent.json
• src/backend/base/langflow/initial_setup/starter_projects/Text Sentiment Analysis.json
• src/backend/base/langflow/initial_setup/starter_projects/Travel Planning Agents.json
• src/backend/base/langflow/initial_setup/starter_projects/Twitter Thread Generator.json
• src/backend/base/langflow/initial_setup/starter_projects/Vector Store RAG.json
• src/backend/base/langflow/initial_setup/starter_projects/Youtube Analysis.json
• src/backend/base/langflow/processing/process.py
• src/backend/base/langflow/utils/kb_constants.py
• src/backend/base/pyproject.toml
• src/backend/tests/unit/api/v1/test_mcp_projects.py
• src/backend/tests/unit/test_kb_storage_deletion.py
• src/backend/tests/unit/test_knowledge_bases_api.py
• src/frontend/package.json
• src/frontend/src/CustomNodes/hooks/use-fetch-data-on-mount.ts
• src/frontend/src/components/core/parameterRenderComponent/components/inputGlobalComponent/index.tsx
• src/frontend/src/components/ui/__tests__/dialog.test.tsx
• src/frontend/src/constants/constants.ts
• src/frontend/src/icons/AstraDB/AstraDB.jsx
• src/frontend/src/modals/exportModal/index.tsx
• src/frontend/src/utils/__tests__/removeApiKeys.test.ts
• src/frontend/src/utils/reactflowUtils.ts
• src/frontend/tests/assets/outdated_flow.json
• src/frontend/tests/core/regression/session-deletion-data-leakage.spec.ts
• src/lfx/pyproject.toml
• src/lfx/src/lfx/_assets/component_index.json
• src/lfx/src/lfx/_assets/stable_hash_history.json
• src/lfx/src/lfx/base/models/unified_models.py
• src/lfx/src/lfx/components/llm_operations/lambda_filter.py
• src/lfx/src/lfx/components/llm_operations/llm_conditional_router.py
• src/lfx/src/lfx/components/models_and_agents/agent.py
• src/lfx/src/lfx/components/models_and_agents/embedding_model.py
• src/lfx/src/lfx/components/models_and_agents/language_model.py
• src/lfx/src/lfx/processing/process.py
• src/lfx/tests/unit/inputs/test_max_tokens_propagation.py

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Update the starter’s compatibility marker.

This file now embeds new LanguageModelComponent logic, but last_tested_version at Line 1578 still says 1.8.0. That leaves the bundled starter metadata stale for the 1.8.1 release.

Suggested metadata update

-  "last_tested_version": "1.8.0",
+  "last_tested_version": "1.8.1",

Also applies to: 1578-1578

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/base/langflow/initial_setup/starter_projects/Basic`
Prompting.json at line 1040, The starter metadata's last_tested_version is stale
(still "1.8.0") for this JSON that now includes the new LanguageModelComponent;
locate the JSON object's metadata key last_tested_version and update its string
value to "1.8.1" so the bundled starter reflects the correct release; ensure you
only change the metadata field and do not modify the LanguageModelComponent
class or other fields.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

The structured-output path is steering the agent toward the wrong payload.

In json_response(), schema_info asks for Output (only JSON schema), so the model is being told to echo the schema instead of returning extracted company data. Then build_structured_output_base() only tries to recover an object-shaped JSON block on fallback, which rejects prose-wrapped arrays when multiple objects are returned. The prompt needs to ask for JSON that conforms to the schema, and the fallback extraction needs to accept array payloads too.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/base/langflow/initial_setup/starter_projects/Market`
Research.json at line 1352, The model prompt currently asks the LLM to "Output
(only JSON schema)" which makes it echo the schema instead of returning data;
update the schema_info text in json_response() (the variable schema_info) to
instruct the agent to return JSON data that conforms to the provided schema
(e.g., "Return only JSON data that conforms to the schema, do NOT return the
schema itself"). Also broaden the JSON extraction in
build_structured_output_base() by changing json_pattern to match both objects
and arrays (e.g., allow \[...\] as well as {...}) and ensure the fallback
parsing logic accepts and preserves top-level arrays so prose-wrapped arrays are
extracted and validated just like single objects (see json_pattern and the JSON
parsing/fallback branches in build_structured_output_base()).

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Bump last_tested_version with this snapshot refresh.

Line 1176 refreshes the embedded AgentComponent hash, but Line 2185 still says last_tested_version: 1.6.0. Please update that footer to the version this starter was actually validated against so the metadata matches the embedded code.

Also applies to: 2185-2185

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/base/langflow/initial_setup/starter_projects/News`
Aggregator.json at line 1176, The footer field "last_tested_version" in this
JSON is stale (still "1.6.0") after you refreshed the embedded AgentComponent
(see "code_hash": "40d1976f4718"); update the "last_tested_version" property to
the actual LangFlow version used when validating this starter snapshot so the
metadata matches the embedded code (replace the existing "1.6.0" value with the
correct version string).

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Regenerate the serialized Embedding Model template.

This code now treats self.model as a ModelInput payload (list[dict]) and hard-fails otherwise, but Lines 1951-1975 still export the node as a DropdownInput with a plain string value ("text-embedding-3-small"). In the JSON as committed, that stale template shape will bypass provider resolution in update_build_config() and then hit ValueError("Model must be a non-empty list") in build_embeddings() unless the node is re-saved/re-exported with the new template.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/base/langflow/initial_setup/starter_projects/Nvidia` Remix.json
at line 1893, The serialized template still exports the Embedding Model node as
a plain DropdownInput string which conflicts with EmbeddingModelComponent
expecting self.model to be a list; update the template so the node uses a
ModelInput (not DropdownInput) matching EmbeddingModelComponent.inputs
(model_type="embedding", input value as a list[dict] with keys "provider" and
"name" like the runtime ModelInput payload) so update_build_config() can resolve
provider and build_embeddings() will receive a non-empty list; locate the
EmbeddingModelComponent.inputs block and replace the stale
DropdownInput/Dropdown value for the model node with the proper ModelInput/list
payload in the serialized JSON template.

---

⚠️ Potential issue | 🟠 Major

The new watsonx embedding controls are currently no-ops.

truncate_input_tokens and input_text are exposed in inputs and toggled in update_build_config(), but neither _build_kwargs() nor _build_kwargs_for_model() ever reads them. Right now those settings are silently ignored for every embedding instance this component builds.

Please mirror the same addition in both helper methods.

Possible fix

         optional_params = {
             "api_base": self.api_base if self.api_base else None,
             "dimensions": int(self.dimensions) if self.dimensions else None,
             "chunk_size": int(self.chunk_size) if self.chunk_size else None,
             "request_timeout": float(self.request_timeout) if self.request_timeout else None,
             "max_retries": int(self.max_retries) if self.max_retries else None,
             "show_progress_bar": self.show_progress_bar if hasattr(self, "show_progress_bar") else None,
             "model_kwargs": self.model_kwargs if self.model_kwargs else None,
+            "truncate_input_tokens": (
+                int(self.truncate_input_tokens) if getattr(self, "truncate_input_tokens", None) else None
+            ),
+            "input_text": getattr(self, "input_text", None),
         }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/base/langflow/initial_setup/starter_projects/Nvidia` Remix.json
at line 1893, The watsonx UI toggles truncate_input_tokens and input_text are
never added to the instantiated embedding kwargs, so update both _build_kwargs
and _build_kwargs_for_model to read self.truncate_input_tokens and
self.input_text (with hasattr checks) and, when those values are present, add
them to the returned kwargs using the param names defined in
metadata["param_mapping"] (i.e., if param_mapping maps "truncate_input_tokens"
or "input_text" to a target kwarg name, set
kwargs[param_mapping["truncate_input_tokens"]] = int(self.truncate_input_tokens)
and kwargs[param_mapping["input_text"]] = bool(self.input_text)); keep this
logic alongside the existing Watson-specific block so update_build_config,
_build_kwargs, and _build_kwargs_for_model remain consistent.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Bump last_tested_version with this snapshot refresh.

Line 1241 updates the embedded AgentComponent hash, but Line 1796 still advertises last_tested_version: 1.4.3. Please update the footer to the version this starter was actually validated against so the starter metadata does not drift from the embedded code.

Also applies to: 1796-1796

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/base/langflow/initial_setup/starter_projects/Pokédex` Agent.json
at line 1241, The JSON footer's last_tested_version value is stale after
refreshing the embedded AgentComponent snapshot (code_hash "40d1976f4718");
update the "last_tested_version" field in this starter's metadata to the correct
version string used when validating this snapshot (i.e., bump the footer value
to match the snapshot/validation version) so the starter metadata and embedded
code_hash stay consistent, and verify there are no other duplicate
last_tested_version entries remaining.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Structured-response mode will reject valid schema-based outputs.

Line 1768 embeds an AgentComponent whose json_response() prompt tells the model to return only the JSON schema, while build_structured_output_base() can only recover {...} fragments if the model wraps JSON in prose. With output_schema enabled, that makes common valid responses—especially arrays like [{"name": "..."}, {"name": "..."}]—fail validation even when the model returned usable JSON.

💡 Suggested fix inside the embedded `AgentComponent`

-        json_pattern = r"\{.*\}"
         schema_error_msg = "Try setting an output schema"
@@
-                    schema_info = (
-                        "You are given some text that may include format instructions, "
-                        "explanations, or other content alongside a JSON schema.\n\n"
-                        "Your task:\n"
-                        "- Extract only the JSON schema.\n"
-                        "- Return it as valid JSON.\n"
-                        "- Do not include format instructions, explanations, or extra text.\n\n"
-                        "Input:\n"
-                        f"{json.dumps(schema_dict, indent=2)}\n\n"
-                        "Output (only JSON schema):"
-                    )
+                    schema_info = (
+                        "Return only valid JSON that matches this schema.\n"
+                        "Do not include explanations, markdown fences, or extra text.\n\n"
+                        f"Schema:\n{json.dumps(schema_dict, indent=2)}"
+                    )
@@
         try:
             json_data = json.loads(content)
         except json.JSONDecodeError:
-            json_match = re.search(json_pattern, content, re.DOTALL)
-            if json_match:
-                try:
-                    json_data = json.loads(json_match.group())
-                except json.JSONDecodeError:
-                    return {"content": content, "error": schema_error_msg}
-            else:
+            decoder = json.JSONDecoder()
+            for start_char in ("[", "{"):
+                start = content.find(start_char)
+                if start == -1:
+                    continue
+                try:
+                    json_data, _ = decoder.raw_decode(content[start:])
+                    break
+                except json.JSONDecodeError:
+                    continue
+            if json_data is None:
                 return {"content": content, "error": schema_error_msg}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/base/langflow/initial_setup/starter_projects/Price` Deal
Finder.json at line 1768, Structured-response failures come from
build_structured_output_base() only searching for object braces "{...}" so valid
JSON arrays are missed and json_response() instructs the model to "Return it as
valid JSON" in a way that can force a schema-only reply; fix by updating
build_structured_output_base (json_pattern and parsing logic) to detect and
extract both JSON objects and arrays (e.g., try full-string json.loads first,
then regex for r"\{.*\}" OR r"\[.*\]" and attempt to json.loads the match), and
also relax the schema prompt built in json_response() (the schema_info variable)
to ask the model to return the JSON schema OR a JSON instance but not to return
only the schema text so downstream parsing/validation can accept arrays like
[{"name":...}, ...]; target functions/vars: build_structured_output_base,
json_pattern, json_response, schema_info, combined_instructions.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Mirror the structured-output fix in this Agent snapshot too.

Line 1100 embeds the same json_response()/build_structured_output_base() pair as the other starter: the prompt steers the model toward echoing the schema, and the fallback parser only accepts object fragments. output_schema mode will break here for the same valid array and wrapped-JSON responses unless the fix is applied in this copy as well.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/backend/base/langflow/initial_setup/starter_projects/Simple` Agent.json
at line 1100, The json parsing in build_structured_output_base and the
json_response flow is too narrow (only matches object fragments) causing valid
JSON arrays or wrapped JSON to be rejected; update build_structured_output_base
(and any related regex/logic used by json_response) to accept both object and
array JSON fragments by changing the json_pattern to match either {…} or […],
try parsing the full content first, then search for either array or object
fragments using re.DOTALL (e.g., r"(\{.*\}|\[.*\])"), and when a fragment is
found json.loads() it and proceed; ensure the function still returns parsed
lists unchanged (and downstream json_response handles list results correctly)
and keep existing validation via _preprocess_schema/build_model_from_schema and
error fallbacks intact (targets: functions build_structured_output_base,
json_response, and the json_pattern variable).

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Assertion may have edge-case false positives.

The current assertion checks that the response doesn't contain "victor". However, the LLM might respond with phrases like "I don't know anyone named Victor" or "You haven't told me your name is Victor", which would cause a false test failure.

Consider a more robust assertion approach, though this may be acceptable given the low likelihood and the test's intent.

💡 Alternative assertion approach

One option is to verify the response contains phrases indicating lack of knowledge:

// Verify the AI indicates it doesn't know the name
const indicatesNoKnowledge = 
  responseText?.toLowerCase().includes("don't know") ||
  responseText?.toLowerCase().includes("haven't told") ||
  responseText?.toLowerCase().includes("not sure");
expect(indicatesNoKnowledge || !responseText?.toLowerCase().includes("victor")).toBe(true);

However, this adds complexity. The current approach may be sufficient if the LLM reliably doesn't echo back the name when it has no context.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/frontend/tests/core/regression/session-deletion-data-leakage.spec.ts`
around lines 192 - 195, The current assertion using
expect(responseText?.toLowerCase()).not.toContain("victor") can false-fail when
the LLM mentions "Victor" while explicitly denying knowledge; update the
assertion to allow either a clear denial phrase or absence of the name: create a
boolean like indicatesNoKnowledge that checks
responseText?.toLowerCase().includes("don't know") || .includes("haven't told")
|| .includes("not sure"), then assert expect(indicatesNoKnowledge ||
!responseText?.toLowerCase().includes("victor")).toBe(true); reference the
existing responseText variable in the test to implement this replacement.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

What is the latest version of FastAPI and what breaking changes were introduced after 0.115?

💡 Result:

Latest FastAPI version

FastAPI 0.135.1 (released March 1, 2026) is the latest version on PyPI. (pypi.org)

Breaking changes introduced after FastAPI 0.115.x

From FastAPI’s official release notes, these versions introduced “Breaking Changes” sections after 0.115:

• 0.125.0 (2025-12-17): Dropped support for Python 3.8. (fastapi.tiangolo.com)
• 0.127.0 (2025-12-21): Added deprecation warnings when using pydantic.v1. (fastapi.tiangolo.com)
• 0.128.0 (2025-12-27): Dropped support for pydantic.v1. (fastapi.tiangolo.com)
• 0.129.0 (2026-02-12): Dropped support for Python 3.9. (fastapi.tiangolo.com)
• 0.131.0 (2026-02-22): Deprecated ORJSONResponse and UJSONResponse. (fastapi.tiangolo.com)
• 0.132.0 (2026-02-23): Enabled default strict Content-Type checking for JSON requests (strict_content_type=True by default), rejecting JSON requests without a valid JSON Content-Type unless disabled. (fastapi.tiangolo.com)

Citations:

• 1: https://pypi.org/project/fastapi/
• 2: https://fastapi.tiangolo.com/release-notes/
• 3: https://fastapi.tiangolo.com/release-notes/
• 4: https://fastapi.tiangolo.com/release-notes/
• 5: https://fastapi.tiangolo.com/release-notes/
• 6: https://fastapi.tiangolo.com/release-notes/
• 7: https://fastapi.tiangolo.com/release-notes/

---

Verify FastAPI version compatibility and breaking changes.

The FastAPI minimum version has been bumped significantly from 0.135.0 to 0.135.0, introducing several breaking changes that require verification:

• Python 3.8 and 3.9 support dropped (in v0.125.0 and v0.129.0 respectively)
• Pydantic v1 support removed (in v0.128.0) — codebase must use Pydantic v2
• Strict Content-Type checking enabled by default (in v0.132.0) — JSON requests without valid Content-Type headers will be rejected unless explicitly disabled
• ORJSONResponse and UJSONResponse deprecated (in v0.131.0)

Ensure the codebase and its Python version requirement meet these constraints and handle strict Content-Type validation appropriately.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/lfx/pyproject.toml` at line 15, The pyproject FastAPI dependency bump may
break compatibility: update pyproject.toml (the "fastapi>=0.135.0,<1.0.0" entry)
and the project metadata to require a Python version that FastAPI v0.135+
supports (remove/raise support for 3.8/3.9 via python_requires), verify and
migrate all Pydantic usage to Pydantic v2 APIs, replace deprecated
ORJSONResponse/UJSONResponse usages (search for ORJSONResponse and UJSONResponse
classes) with supported response classes or custom JSONResponse, and fix strict
Content-Type handling by adding explicit content-type checks or configuring
request handling middleware/route decorators to accept requests without
Content-Type (search handlers/middleware that parse JSON bodies); run the test
suite and update dependency specs to reflect Pydantic v2 and the new Python
minimum.