Skip to content

fix(initial_setup): preserve variable bindings when loading flows from disk - #14053

Merged
erichare merged 2 commits into
release-1.11.0from
fix/preserve-load-flow-variable-bindings
Jul 14, 2026
Merged

fix(initial_setup): preserve variable bindings when loading flows from disk#14053
erichare merged 2 commits into
release-1.11.0from
fix/preserve-load-flow-variable-bindings

Conversation

@erichare

@erichare erichare commented Jul 13, 2026

Copy link
Copy Markdown
Member

Summary

  • Preserve global-variable bindings configured in the UI when an existing flow is reloaded from LANGFLOW_LOAD_FLOWS_PATH.
  • Keep explicit bindings and all non-binding flow structure from the mounted file authoritative.
  • Apply the same preservation recursively to grouped/nested flows.
  • Add LANGFLOW_LOAD_FLOWS_PRESERVE_VARIABLE_BINDINGS (default true) with a false opt-out for the previous blind-overwrite behavior.

Root cause

Startup re-imports every mounted flow JSON and replaces the existing row's entire Flow.data value. Global-variable selections are stored only in each component field's value and load_from_db attributes inside that JSON tree, so UI-configured bindings were erased on every restart even though the underlying variables remained in the database.

Fix

When updating an existing flow, merge only real variable bindings (load_from_db: true with a non-empty variable name) from the stored flow into matching nodes and fields in the incoming data. Node and field matching uses stable IDs/names, explicit incoming bindings win, new or removed nodes follow the file, and empty default secret fields are not treated as bindings.

Tests

  • 20 passedsrc/backend/tests/unit/initial_setup/test_upsert_flow_from_file.py
  • 28 passedsrc/lfx/tests/unit/services/settings/test_settings_composition.py (isolated src/lfx environment)
  • Ruff formatting and lint checks for all changed Python files
  • Pre-commit hooks, including detect-secrets

Summary by CodeRabbit

  • New Features

    • Added an option to preserve database-backed variable bindings when reloading flows from files.
    • Preservation is enabled by default and supports nested flows.
    • Added an embedded-mode setting to hide getting-started progress UI.
  • Documentation

    • Documented the new flow-reload and embedded-mode configuration options.
  • Bug Fixes

    • Flow reloads now retain existing variable bindings while still applying other file-based updates.

@coderabbitai

coderabbitai Bot commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fc2404d3-292a-49ea-9248-b5bad5fd781d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Walkthrough

Flow reloads now preserve existing database-backed variable bindings by default, with an environment-configurable opt-out. The merge handles nested flows and is covered by expanded upsert tests. Documentation also adds the embedded-mode onboarding-progress flag.

Changes

Flow binding preservation

Layer / File(s) Summary
Settings contract and documentation
src/lfx/src/lfx/services/settings/groups/components.py, src/lfx/tests/unit/services/settings/test_settings_composition.py, docs/docs/Develop/environment-variables.mdx
Adds load_flows_preserve_variable_bindings, defaulting to True, with environment-variable parsing and documentation.
Upsert merge implementation
src/backend/base/langflow/initial_setup/setup.py
Merges existing database-backed variable bindings into incoming flow data, recursively handling nested flows when preservation is enabled.
Binding preservation validation
src/backend/tests/unit/initial_setup/test_upsert_flow_from_file.py
Tests preserved bindings, explicit file overrides, nested groups, missing nodes, disabled preservation, and empty database defaults.

Embedded-mode documentation

Layer / File(s) Summary
Embedded-mode flag documentation
docs/docs/Develop/environment-variables.mdx
Documents LANGFLOW_HIDE_GETTING_STARTED_PROGRESS as an independent flag for hiding onboarding progress UI.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant FlowFile
  participant upsert_flow_from_file
  participant Settings
  participant ExistingFlow
  FlowFile->>upsert_flow_from_file: incoming flow data
  upsert_flow_from_file->>Settings: read preservation setting
  upsert_flow_from_file->>ExistingFlow: read existing flow data
  upsert_flow_from_file->>upsert_flow_from_file: merge variable bindings
  upsert_flow_from_file->>ExistingFlow: update flow
Loading

Possibly related PRs

  • langflow-ai/langflow#13132: Changes flow matching in the same upsert path, while this PR changes data merging after a flow is matched.

Suggested reviewers: ogabrielluiz, jordanrfrazier, aimurphy, andifilhohub, mendonk

🚥 Pre-merge checks | ✅ 9
✅ Passed checks (9 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and accurately summarizes the main behavior change in flow loading.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Test Coverage For New Implementations ✅ Passed The PR adds targeted backend regression tests for flow re-import binding preservation and unit tests for the new settings field/env var, all following naming conventions.
Test Quality And Coverage ✅ Passed Tests cover preserve/override/disable/nested/default cases and validate settings env-var/defaults with async pytest patterns; they assert behavior, not smoke.
Test File Naming And Structure ✅ Passed Both changed test files follow pytest naming/structure, use descriptive test names and fixtures/context managers, and cover positive and negative cases appropriately.
Excessive Mock Usage Warning ✅ Passed The new tests rely on real DB/settings behavior; no mock objects are used, and monkeypatch is only used to set env vars.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch fix/preserve-load-flow-variable-bindings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added the bug Something isn't working label Jul 13, 2026
@erichare
erichare requested review from mendonk and ogabrielluiz July 13, 2026 23:46
@github-actions
github-actions Bot requested a review from aimurphy July 13, 2026 23:46
@erichare
erichare requested a review from andifilhohub July 13, 2026 23:46
@erichare
erichare marked this pull request as ready for review July 13, 2026 23:46
@github-actions

Copy link
Copy Markdown
Contributor

✅ Test Coverage Advisor

No source changes detected without accompanying tests. Thanks for keeping coverage up! 🎉

Advisory check only — never blocks merge.

@github-actions github-actions Bot added bug Something isn't working and removed bug Something isn't working labels Jul 13, 2026
@github-actions

This comment has been minimized.

@github-actions github-actions Bot added bug Something isn't working and removed bug Something isn't working labels Jul 14, 2026
@codecov

codecov Bot commented Jul 14, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 87.50000% with 8 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.75%. Comparing base (4e42308) to head (089d512).
⚠️ Report is 1 commits behind head on release-1.11.0.

Files with missing lines Patch % Lines
src/backend/base/langflow/initial_setup/setup.py 87.09% 8 Missing ⚠️
Additional details and impacted files

Impacted file tree graph

@@                Coverage Diff                 @@
##           release-1.11.0   #14053      +/-   ##
==================================================
- Coverage           60.89%   60.75%   -0.15%     
==================================================
  Files                2375     2375              
  Lines              234063   234125      +62     
  Branches            32988    33083      +95     
==================================================
- Hits               142532   142241     -291     
- Misses              89820    90173     +353     
  Partials             1711     1711              
Flag Coverage Δ
backend 67.10% <87.09%> (-0.66%) ⬇️
frontend 59.45% <ø> (-0.05%) ⬇️
lfx 59.26% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
...lfx/src/lfx/services/settings/groups/components.py 95.45% <100.00%> (+0.14%) ⬆️
src/backend/base/langflow/initial_setup/setup.py 60.58% <87.09%> (+1.12%) ⬆️

... and 80 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@github-actions

github-actions Bot commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Build successful! ✅
Deploying docs draft.
Deploy successful! View draft

@github-actions

Copy link
Copy Markdown
Contributor

Frontend Unit Test Coverage Report

Coverage Summary

Lines Statements Branches Functions
Coverage: 46%
46.55% (65631/140962) 70.21% (9148/13028) 44.95% (1505/3348)

Unit Test Results

Tests Skipped Failures Errors Time
5372 0 💤 0 ❌ 0 🔥 19m 19s ⏱️

@Cristhianzl Cristhianzl left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@github-actions github-actions Bot added the lgtm This PR has been approved by a maintainer label Jul 14, 2026
@erichare
erichare added this pull request to the merge queue Jul 14, 2026
@erichare
erichare removed this pull request from the merge queue due to the queue being cleared Jul 14, 2026
@erichare
erichare merged commit e53f92d into release-1.11.0 Jul 14, 2026
162 checks passed
@erichare
erichare deleted the fix/preserve-load-flow-variable-bindings branch July 14, 2026 16:50
erichare added a commit that referenced this pull request Jul 14, 2026
* fix(security): harden component code module access

* fix(security): protect Docling Serve requests

* fix(auth): verify current password on password changes

* fix(security): restrict MCP stdio package sources

* fix(security): confine AssemblyAI audio file access

* [autofix.ci] apply automated fixes

* fix(kb): enforce folder connector security settings

* fix(security): block native FFI imports in generated code

* fix: track module assignment aliases in code scanner

* fix(voice): enforce flow authorization on websocket

* fix(security): block MCP Docker host access

* fix(security): validate embedded MCP stdio configs

* fix: require executable-only MCP commands

* test: stub optional AssemblyAI dependency

* test: use allowed MCP commands in timeout tests

* fix(initial_setup): preserve variable bindings when loading flows from disk (#14053)

fix(initial_setup): preserve variable bindings on flow load

* fix(security): backport narrow tenant hardening

Backport the targeted security fixes from release-1.11.0, including public-flow secret scrubbing, tenant-scoped MCP caching, trusted custom-component builds, code-execution gating, environment fallback protection, and query/path/header hardening.

Source commits: 36c6d11 1f39a4b 331b637 2e7bfba 329f15f 359344b 3e3b70b 2f44a77 068c983 de0e232 8b473e4 a91b967 294effc b0a6350 9f15a60 79fca45

* fix(security): complete MCP tenant-isolation backport

* docs(security): describe release hardening controls

* fix(security): backport tenant isolation hardening

* fix(security): harden published image defaults

* fix(security): harden connector URLs against SSRF

* fix(security): address alias review findings

* fix(security): backport remaining hardening gaps

* fix(security): pin WebSearch result and RSS DNS

* fix(kb): enforce per-user path containment

* fix(security): complete release-1.10.3 hardening backport

* fix(security): harden AssemblyAI file submission

* fix: bind loop and comprehension aliases

* [autofix.ci] apply automated fixes

* fix(lfx): register code execution aliases

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working lgtm This PR has been approved by a maintainer needs-docs

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants