fix(initial_setup): preserve variable bindings when loading flows from disk - #14053
Conversation
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughFlow reloads now preserve existing database-backed variable bindings by default, with an environment-configurable opt-out. The merge handles nested flows and is covered by expanded upsert tests. Documentation also adds the embedded-mode onboarding-progress flag. ChangesFlow binding preservation
Embedded-mode documentation
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant FlowFile
participant upsert_flow_from_file
participant Settings
participant ExistingFlow
FlowFile->>upsert_flow_from_file: incoming flow data
upsert_flow_from_file->>Settings: read preservation setting
upsert_flow_from_file->>ExistingFlow: read existing flow data
upsert_flow_from_file->>upsert_flow_from_file: merge variable bindings
upsert_flow_from_file->>ExistingFlow: update flow
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 9✅ Passed checks (9 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Test Coverage AdvisorNo source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉
|
This comment has been minimized.
This comment has been minimized.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## release-1.11.0 #14053 +/- ##
==================================================
- Coverage 60.89% 60.75% -0.15%
==================================================
Files 2375 2375
Lines 234063 234125 +62
Branches 32988 33083 +95
==================================================
- Hits 142532 142241 -291
- Misses 89820 90173 +353
Partials 1711 1711
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
|
Build successful! ✅ |
* fix(security): harden component code module access * fix(security): protect Docling Serve requests * fix(auth): verify current password on password changes * fix(security): restrict MCP stdio package sources * fix(security): confine AssemblyAI audio file access * [autofix.ci] apply automated fixes * fix(kb): enforce folder connector security settings * fix(security): block native FFI imports in generated code * fix: track module assignment aliases in code scanner * fix(voice): enforce flow authorization on websocket * fix(security): block MCP Docker host access * fix(security): validate embedded MCP stdio configs * fix: require executable-only MCP commands * test: stub optional AssemblyAI dependency * test: use allowed MCP commands in timeout tests * fix(initial_setup): preserve variable bindings when loading flows from disk (#14053) fix(initial_setup): preserve variable bindings on flow load * fix(security): backport narrow tenant hardening Backport the targeted security fixes from release-1.11.0, including public-flow secret scrubbing, tenant-scoped MCP caching, trusted custom-component builds, code-execution gating, environment fallback protection, and query/path/header hardening. Source commits: 36c6d11 1f39a4b 331b637 2e7bfba 329f15f 359344b 3e3b70b 2f44a77 068c983 de0e232 8b473e4 a91b967 294effc b0a6350 9f15a60 79fca45 * fix(security): complete MCP tenant-isolation backport * docs(security): describe release hardening controls * fix(security): backport tenant isolation hardening * fix(security): harden published image defaults * fix(security): harden connector URLs against SSRF * fix(security): address alias review findings * fix(security): backport remaining hardening gaps * fix(security): pin WebSearch result and RSS DNS * fix(kb): enforce per-user path containment * fix(security): complete release-1.10.3 hardening backport * fix(security): harden AssemblyAI file submission * fix: bind loop and comprehension aliases * [autofix.ci] apply automated fixes * fix(lfx): register code execution aliases --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Summary
LANGFLOW_LOAD_FLOWS_PATH.LANGFLOW_LOAD_FLOWS_PRESERVE_VARIABLE_BINDINGS(defaulttrue) with afalseopt-out for the previous blind-overwrite behavior.Root cause
Startup re-imports every mounted flow JSON and replaces the existing row's entire
Flow.datavalue. Global-variable selections are stored only in each component field'svalueandload_from_dbattributes inside that JSON tree, so UI-configured bindings were erased on every restart even though the underlying variables remained in the database.Fix
When updating an existing flow, merge only real variable bindings (
load_from_db: truewith a non-empty variable name) from the stored flow into matching nodes and fields in the incoming data. Node and field matching uses stable IDs/names, explicit incoming bindings win, new or removed nodes follow the file, and empty default secret fields are not treated as bindings.Tests
20 passed—src/backend/tests/unit/initial_setup/test_upsert_flow_from_file.py28 passed—src/lfx/tests/unit/services/settings/test_settings_composition.py(isolatedsrc/lfxenvironment)Summary by CodeRabbit
New Features
Documentation
Bug Fixes