docs: bump API spec and version to 1.11 (#14173)

* docs: bump API spec to 1.11

* docs: fix generation defs error

* docs: clarify superuser

* docs: release note cleanup

* docs: revert restricted docker env vars

* docs: fix link in env vars

* docs: bump version to 1.11.0

* docs: workflows api is available in the API pane

* docs: release note cleanup

* docs: version parity

* docs: tweaks pane moved to parameters

* docs: add global vars example for workflows v2

* docs: trim tweaks section

Author: mendonk

docs/docs/API-Reference/api-files.mdx

@@ -182,8 +182,7 @@ To change this limit, set the `LANGFLOW_MAX_FILE_SIZE_UPLOAD` [environment varia
     </Tabs>
 
     :::tip
-    For help with tweaks, use the **Input Schema** in a flow's [**API access** pane](/concepts-publish#api-access).
-    Setting tweaks with **Input Schema** also automatically populates the required component IDs.
+    For help with tweaks, expose fields in the component [**Parameters** panel](/concepts-publish#input-schema), and then click **Share** > **API access** to copy snippets with the required component IDs.
     :::
 
 ### List files (v1)

docs/docs/API-Reference/api-flows-run.mdx

@@ -34,7 +34,7 @@ To create, read, update, and delete flows, see [Flow management endpoints](/api-
 
 :::tip
 Langflow automatically generates Python, JavaScript, and curl code snippets for the `/v1/run/$FLOW_ID` endpoint for all flows.
-For more information, see [Generate API code snippets](/concepts-publish#generate-api-code-snippets).
+In the [**API access** pane](/concepts-publish#api-access), select **v1** for `/run` snippets, or **v2** (Beta) for [Workflow API](/workflow-api) snippets.
 :::
 
 Execute a specified flow by ID or name.

docs/docs/API-Reference/workflows-api.mdx

@@ -24,6 +24,7 @@ import exampleJavascriptWorkflowsApiExampleStreamAguiRequest from '!!raw-loader!
 
 import Tabs from '@theme/Tabs';
 import TabItem from '@theme/TabItem';
+import Icon from "@site/src/components/icon";
 import PartialAPISetup from '@site/docs/_partial-api-setup.mdx';
 
 :::warning Beta Feature
@@ -63,7 +64,7 @@ POST /api/v2/workflows
 | `stream_protocol` | `string` | No | `langflow` | Stream adapter name used for `stream` responses and background event re-attachment. Unknown values return a `422` code for any request mode because the API validates the field against the registered adapters before execution starts. |
 | `session_id` | `string` | No | - | Scopes message memory and chat history to this session. |
 | `tweaks` | `object` | No | `{}` | Per-component parameter overrides keyed by component id. See [Component tweaks](#component-tweaks). |
-| `globals` | `object` | No | `{}` | Request-level global variables (sync mode only). Keys are limited to 256 characters and values to 64 KB. See [Request-level global variables](#request-level-global-variables).
+| `globals` | `object` | No | `{}` | Request-level global variables. Available in sync mode only. Keys are limited to 256 characters and values to 64 KB. See [Pass request-level global variables](#request-level-global-variables).
 | `output_ids` | `array` | No | - | Output component ids to use when resolving sync-mode answers (sync mode only). |
 | `data` | `object` | No | - | Live-canvas override of nodes and edges (stream and background modes only). |
 | `files` | `array` | No | - | Pre-uploaded file paths to attach to the run (stream and background modes only). |
@@ -448,25 +449,43 @@ The `status` values are:
 }
 ```
 
-## Request-level global variables {#request-level-global-variables}
+## Pass request-level global variables {#request-level-global-variables}
 
-Pass request-scoped variables in the `globals` JSON field. They are available to workflow components for the duration of the run. Use this field when values may include Unicode or other characters that HTTP headers handle poorly.
+Pass request-scoped variables in the `globals` JSON field.
+They are available to workflow components for the duration of the run.
 
-`globals` is honored in **sync mode only**; stream and background runs ignore it.
+Use `globals` when values are large, shared across runs, or would exceed HTTP header size limits.
+[Tweaks](#component-tweaks) are better suited for one-off component overrides.
+`globals` is keyed by variable name and not component ID, so it stays stable when the UI regenerates node IDs when importing flows.
 
-```json
-{
-  "flow_id": "67ccd2be-17f0-8190-81ff-3bb2cf6508e6",
-  "input_value": "Summarize the attached file",
-  "globals": {
-    "FILENAME": "relatório—final.pdf",
-    "OWNER_NAME": "José"
-  }
-}
+`globals` is honored in **sync mode only**; stream and background runs ignore it.
+The Workflow API is in **Beta**, and this transport may continue to evolve.
+
+### Use a stable name in the UI and then pass it in `globals`
+
+To avoid depending on changing component IDs, rename a component, create a matching global variable, bind the field, and pass the value in the request.
+
+1. To rename the component in the UI, click <Icon name="PencilLine" aria-hidden="true"/> **Edit**, and then rename the component. This example uses `CUSTOMER_PROMPT`.
+2. Save the flow.
+3. Create a new global variable with the same name as the component, such as `CUSTOMER_PROMPT`, and save it.
+   For more about creating global variables, see [Global variables](/configuration-global-variables).
+4. In the field you want to fill at runtime, click the <Icon name="Globe" aria-hidden="true"/> **Globe** icon, select `CUSTOMER_PROMPT`, and save the flow.
+5. Call the v2 Workflow API in sync mode and pass the value in `globals`.
+
+```bash
+curl -X POST "http://localhost:7860/api/v2/workflows" \
+  -H "Content-Type: application/json" \
+  -H "x-api-key: YOUR_API_KEY" \
+  -d '{
+    "flow_id": "YOUR_FLOW_ID",
+    "mode": "sync",
+    "input_value": "hello",
+    "globals": {
+      "CUSTOMER_PROMPT": "The prompt with many words..."
+    }
+  }'
 ```
 
-Keys may use the same characters supported by the global variables panel in the Langflow UI. Keys are bounded to 256 characters; values are bounded to 64 KB.
-
 <details>
 <summary>Legacy: `X-LANGFLOW-GLOBAL-VAR-*` headers (Workflow API, sync mode only)</summary>
 
@@ -478,9 +497,9 @@ This note applies to the **Workflow API only**. The v1 [`/run`](/api-flows-run)
 
 </details>
 
-## Component tweaks
+## Component tweaks {#component-tweaks}
 
-Use the `tweaks` object to override component parameters. Keys are component ids; values are objects of field names and values to set on that component's template.
+Use the `tweaks` object for one-off component parameter overrides in a single run.
 
 ```json
 {
@@ -495,7 +514,7 @@ Use the `tweaks` object to override component parameters. Keys are component ids
 }
 ```
 
-To find a component id in the Langflow UI, open your flow, click the component, and then click **Controls**. The component id is at the top of the **Controls** pane.
+For more information, see [Tweaks (API inputs)](/concepts-publish#input-schema).
 
 ## Error handling
 

docs/docs/Deployment/deployment-block-custom-components.mdx

@@ -15,9 +15,7 @@ LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false
 When set to `false`, Langflow blocks creating custom components and changing code in the visual editor.
 
 When unset or `true`, Langflow allows custom code.
-Existing non-Docker installations keep the default `true` behavior until you opt in to this restriction.
-
-As of Langflow 1.11.x, official Langflow Docker images set `LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false` at image build time, along with related [component hardening](/api-keys-and-authentication#multi-tenant-component-hardening) flags.
+Existing installations keep the default `true` behavior until you opt in to this restriction.
 
 This environment variable is a beta feature, and should not be your only safeguard in production environments.
 

docs/docs/Deployment/deployment-docker.mdx

@@ -16,21 +16,24 @@ This guide demonstrates several ways to run Langflow with [Docker](https://docs.
 * [Customize the Docker Compose file](#customize): Package a flow or add your own code into a custom image built on top of the official Langflow image.
 * [Build and run the Docker image from source](#build-from-source): Build a Docker image from a local clone of the repo, or start a full development environment with hot reload on both frontend and backend.
 * [Upgrade the Langflow Docker image](#upgrade-the-langflow-docker-image): Upgrade to a newer image without losing your database or flows.
-* [Docker image security defaults](#docker-image-security-defaults): Hardened environment variables baked into published images, and how to override them for local use.
+* [Docker image defaults](#docker-image-security-defaults): Environment variables included in the Langflow image and how to override them.
 
 ## Quickstart {#quickstart}
 
 With Docker installed and running on your system, run the following command:
 
-```shell
-docker run -p 7860:7860 \
-  -e LANGFLOW_AUTO_LOGIN=true \
-  -e LANGFLOW_SUPERUSER_PASSWORD=SUPERUSER_PASSWORD \
-  langflowai/langflow:latest
-```
+    ```bash
+    docker run -p 7860:7860 \
+      -e LANGFLOW_AUTO_LOGIN=false \
+      -e LANGFLOW_SUPERUSER_PASSWORD=<SUPERUSER_PASSWORD> \
+      langflowai/langflow:latest
+    ```
 
-Replace `SUPERUSER_PASSWORD` with a strong password for the Langflow superuser.
-As of Langflow 1.11.x, images include [security defaults](#docker-image-security-defaults) that you may need to override for local workflows.
+    By default, the official Docker images set `LANGFLOW_AUTO_LOGIN=false` by default.
+
+    Replace `SUPERUSER_PASSWORD` with a strong password for the Langflow superuser.
+
+    For more information, see [Docker image defaults](#docker-image-security-defaults).
 
 Then, access Langflow at `http://localhost:7860/`.
 
@@ -230,7 +233,8 @@ Replace the following:
 * `SUPERUSER_PASSWORD`: a strong password for the Langflow superuser
 * `VERSION`: the version in `pyproject.toml` at the repo root
 
-The image sets `LANGFLOW_AUTO_LOGIN=false` and the [component hardening defaults](#docker-image-security-defaults), so a superuser password is required unless you set `LANGFLOW_AUTO_LOGIN=true`.
+The image sets `LANGFLOW_AUTO_LOGIN=false`, so a superuser password is required unless you set `LANGFLOW_AUTO_LOGIN=true`.
+For more information, see [Docker image defaults](#docker-image-security-defaults).
 
 To build only the LFX executor CLI image instead of the full Langflow application, run:
 
@@ -301,9 +305,10 @@ The following environment variables are set by default:
 |---|---|---|
 | `LANGFLOW_DATABASE_URL` | `postgresql://langflow:langflow@postgres:5432/langflow` | PostgreSQL connection string |
 | `LANGFLOW_SUPERUSER` | `langflow` | Initial admin username |
-| `LANGFLOW_SUPERUSER_PASSWORD` | `langflow` | Initial admin password |
 | `LANGFLOW_CONFIG_DIR` | `/var/lib/langflow` | Directory for Langflow config and data |
 
+`LANGFLOW_SUPERUSER_PASSWORD` is not set in the compose file. With the default `LANGFLOW_AUTO_LOGIN=true`, Langflow generates a random bootstrap password for the auto-login account. If you set `LANGFLOW_AUTO_LOGIN=false`, you must set `LANGFLOW_SUPERUSER_PASSWORD` to a strong password before startup. The legacy value `langflow` is not allowed.
+
 To override these values, edit `docker/dev.docker-compose.yml` directly.
 
 `docker/dev.docker-compose.yml` uses literal values in its `environment:` block, such as `- LANGFLOW_SUPERUSER=langflow`. Docker Compose v2 gives `environment:` block literal values higher precedence than shell-exported variables and `env_file:`, so neither `export LANGFLOW_SUPERUSER=myadmin` or a `.env` file will override them. Edit the file directly instead.
@@ -379,35 +384,18 @@ Set the custom image in your compose file or `docker run`, and then pull and res
 
 For a minimal Dockerfile that adds `uv` to the 1.8.0 image, see the [release notes](/release-notes) ("Docker image no longer includes uv or uvx").
 
-## Docker image security defaults {#docker-image-security-defaults}
+## Docker image defaults {#docker-image-security-defaults}
 
-As of Langflow 1.11.x, official Langflow Docker images set `LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false` at image build time, and include stricter defaults for the following environment variables:
+As of Langflow 1.11.x, official Langflow Docker images set `LANGFLOW_AUTO_LOGIN=false` at image build time.
+The Langflow application default for non-Docker installs remains `true`.
 
-| Variable | Image value | Application default (pip / local) |
-|----------|-------------|-----------------------------------|
-| `LANGFLOW_AUTO_LOGIN` | `false` | `true` |
-| `LANGFLOW_ALLOW_CUSTOM_COMPONENTS` | `false` | `true` |
-| `LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS` | `true` | `false` |
-| `LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS` | `true` | `false` |
-| `LANGFLOW_MCP_SERVER_DOCKER_HARDENING` | `true` (main `langflowai/langflow` image only) | `false` |
-
-These image values match the [component hardening for untrusted users](/api-keys-and-authentication#multi-tenant-component-hardening) recommendation.
-They apply whether you use `docker run`, Docker Compose, or Kubernetes with the published image, unless you override them.
-
-The image sets `LANGFLOW_AUTO_LOGIN=false`, so you must set `LANGFLOW_SUPERUSER_PASSWORD` (and optionally, `LANGFLOW_SUPERUSER`) unless you explicitly set `LANGFLOW_AUTO_LOGIN=true`.
-
-To disable the stricter defaults and use custom components, built-in code-execution components, or absolute local file paths, override the image defaults:
+Because auto-login is disabled, you must set `LANGFLOW_SUPERUSER_PASSWORD` (and optionally `LANGFLOW_SUPERUSER`) unless you explicitly set `LANGFLOW_AUTO_LOGIN=true`.
 
 ```bash
 docker run -p 7860:7860 \
   -e LANGFLOW_AUTO_LOGIN=true \
-  -e LANGFLOW_ALLOW_CUSTOM_COMPONENTS=true \
-  -e LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=false \
-  -e LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=false \
-  -e LANGFLOW_MCP_SERVER_DOCKER_HARDENING=false \
+  -e LANGFLOW_SUPERUSER_PASSWORD=<SUPERUSER_PASSWORD> \
   langflowai/langflow:latest
 ```
 
-In Docker Compose, add the same keys under `services.langflow.environment`.
-
 For more information, see [Component hardening for untrusted users](/api-keys-and-authentication#multi-tenant-component-hardening) and [Block custom components](/deployment-block-custom-components).

docs/docs/Develop/api-keys-and-authentication.mdx

@@ -167,7 +167,7 @@ All users share the same visual editor environment without password protection,
 API requests still require a Langflow API key unless you also set [`LANGFLOW_SKIP_AUTH_AUTO_LOGIN`](#langflow-skip-auth-auto-login) to `true`.
 
 The Langflow application default is `True`.
-Official Langflow Docker images set `false`. For more information, see [Docker image security defaults](/deployment-docker#docker-image-security-defaults).
+Official Langflow Docker images set `false`. For more information, see [Docker image defaults](/deployment-docker#docker-image-security-defaults).
 
 #### LANGFLOW_SKIP_AUTH_AUTO_LOGIN {#langflow-skip-auth-auto-login}
 
@@ -494,7 +494,7 @@ In a shared server where users you do not fully trust can build flows, set `LANG
 
 Use these variables when users who can build or run flows on your server should not get host-level code execution, arbitrary file reads, or  MCP mounts.
 
-As of Langflow 1.11.x, Langflow application defaults remain permissive for trusted single-user installations, while official Docker images enable the hardened values. For more information, see [Docker image security defaults](/deployment-docker#docker-image-security-defaults).
+For more information, see [Docker image defaults](/deployment-docker#docker-image-security-defaults).
 
 | Variable | Format | Default | Description |
 |----------|--------|---------|-------------|
@@ -747,7 +747,7 @@ This configuration is recommended for any deployment where Langflow is exposed t
 :::tip Docker images
 Official Langflow Docker images already set `LANGFLOW_AUTO_LOGIN=false`.
 You still must set `LANGFLOW_SUPERUSER_PASSWORD` (and optionally `LANGFLOW_SUPERUSER`) before the container can start.
-For more information, see [Docker image security defaults](/deployment-docker#docker-image-security-defaults).
+For more information, see [Docker image defaults](/deployment-docker#docker-image-security-defaults).
 :::
 
 With authentication enabled, all users must sign in to the visual editor with valid credentials, and API requests require authentication with a Langflow API key.

docs/docs/Develop/authorization.mdx

@@ -158,5 +158,5 @@ Page size is capped at 200 rows.
 - [Authentication and authorization overview](./authentication-overview)
 - [API keys and authentication](/api-keys-and-authentication)
 - [External authentication](./external-authentication)
-- [JWT authentication](/jwt-authentication)
+- [JWT authentication](/api-keys-and-authentication#configure-jwt-token-signing)
 - [Security](/security)

docs/docs/Develop/concepts-file-management.mdx

@@ -61,12 +61,10 @@ To enable file input in your flow, do the following:
 
 1. Add a [**Read File** component](/read-file) to your flow.
 
-2. Click **Share**, select **API access**, and then click **Input Schema** to add [`tweaks`](/concepts-publish#input-schema) to the request payload in the flow's automatically generated code snippets.
+2. Select the **Read File** component, click **Parameters**, and then click **API** on the **Files** (path) field to expose it as a [`tweak`](/concepts-publish#input-schema).
 
-3. Expand the **File** section, find the **Files** row, and then enable **Expose Input** to allow the parameter to be set at runtime through the Langflow API.
-
-4. Close the **Input Schema** pane to return to the **API access** pane.
-The payload in each code snippet now includes `tweaks` with your **Read File** component's ID and the `path` key that you enabled in **Input Schema**:
+3. Open **Share** > **API access**.
+The payload in each code snippet now includes `tweaks` with your **Read File** component's ID and the `path` key:
 
     ```json
     "tweaks": {
@@ -76,7 +74,7 @@ The payload in each code snippet now includes `tweaks` with your **Read File** c
 	}
     ```
 
-5. When you run this flow programmatically, your script must upload a file to Langflow file management, and then pass the returned `file_path` to the `path` tweak in the `/run` request:
+4. When you run this flow programmatically, your script must upload a file to Langflow file management, and then pass the returned `file_path` to the `path` tweak in the `/run` request:
 
     ```json
     "tweaks": {