chore(Update Flowise@3.0.11)#726
Conversation
) * feat: Add header-based splitting to MarkdownTextSplitter - Add dropdown for header level selection (H1-H6) - Implement hierarchical splitting (H2 includes H1 headers) - Headers preserved with content sections - Prioritize semantic boundaries over chunk size * Update MarkdownTextSplitter.ts * Update MarkdownTextSplitter.ts --------- Co-authored-by: Henry Heng <henryheng@flowiseai.com>
feat: Implement caching for MCP toolkit in CachePool - Added methods to CachePool for managing MCP toolkit cache. - Integrated caching logic in CustomMCP to store and retrieve toolkit data based on workspaceId and configuration. - Updated node service to pass cachePool to CustomMCP for enhanced performance.
Enhance file upload capabilities by adding support for additional file types (html, css, js, xml, md, excel, powerpoint) and updating related MIME type mappings. Improve user interface for file type selection in FileUpload component.
* refactor: Implement SecureZodSchemaParser for safe Zod schema handling and add FilterParser for Supabase filters * Replaced direct Zod schema evaluation with SecureZodSchemaParser in StructuredOutputParserAdvanced and CustomTool. * Introduced FilterParser to safely handle Supabase filter strings, preventing arbitrary code execution. * Added new filterParser.ts file to encapsulate filter parsing logic. * Updated Supabase vector store to utilize the new FilterParser for RPC filters. * Created secureZodParser.ts for secure parsing of Zod schemas. * remove console log
Refactor: Update pnpm-lock.yaml and enhance UI components for safe HTML rendering - Updated pnpm-lock.yaml to improve dependency management and ensure consistency. - Refactored the JSONViewer component to utilize a new JsonToken for syntax highlighting. - Introduced SafeHTML component to sanitize and safely render HTML content in ViewMessagesDialog and NodeExecutionDetails. - Replaced direct HTML rendering with SafeHTML in ChatMessage component for enhanced security.
…ts (FlowiseAI#4904) refactor: Update code execution sandbox implementation across components - Replaced NodeVM usage with a new createCodeExecutionSandbox function for improved sandbox management. - Enhanced JavaScript code execution with executeJavaScriptCode function, allowing for better handling of libraries and output streaming. - Updated multiple components to utilize the new sandboxing approach, ensuring consistent execution environment. - Added validation for UUIDs and URLs in various tools to enhance input safety. - Refactored input handling in CustomFunction and IfElseFunction to streamline variable management.
* feat: add http deny list env variable * feat: add http deny list in HTTP node * feat: use generic error message for denied hosts in HTTP node
add session regeneration when login
* Fix: enable creating of documentstores with the loaders * Feature: Support posting credentials with a specific id to enabled infrastructure as code
…#4919) * fix: chatMessageFeedback unique violation * fix: sync chatMessage IDs and chatMessageFeedback messageIDs * feat: optimize chatMessageFeedback IDs replacement
Refactor account and evaluations routes to use POST for billing and run-again endpoints - Changed the billing route from GET to POST in account.route.ts and account.api.js for consistency with other account actions. - Updated the run-again route from GET to POST in evaluations/index.ts and evaluations.js to align with the API design for creating actions.
Refactor URL filtering logic in App class - Introduced a denylist for URLs using the DENYLIST_URLS environment variable. - Updated the whitelist logic to filter out denylisted URLs, ensuring improved request validation.
* Refactor URL filtering logic in App class - Introduced a denylist for URLs using the DENYLIST_URLS environment variable. - Updated the whitelist logic to filter out denylisted URLs, ensuring improved request validation. * revery whitelist url changes * revert whitelist url changes
* feat: Implement SSO token caching and retrieval in CachePool This implementation improves the authentication process by securely caching SSO tokens and managing user sessions. * Removed commented code * feat: add deleteSSOTokenCache in ssoSuccess --------- Co-authored-by: Ong Chung Yau <33013947+chungyau97@users.noreply.github.com> Co-authored-by: chungyau97 <chungyau97@gmail.com>
Fix chroma authentication
…es (FlowiseAI#4947) * allow overrideconfig from executeflow node to take in variables * update array object schema
* allow overrideconfig from executeflow node to take in variables * update array object schema * add chatflowId to config
prevent reading runtime vars for cloud
* improve logging * Update logger.ts --------- Co-authored-by: Henry Heng <henryheng@flowiseai.com>
- update lc community and openai version - fix chatfireworks - update reasonings for openai models - update openai apikey param
add filePath sanitization
chore: remove importchatflows
Fix: ignored structuredOutput keys
* - Implemented a validation function to check for banned commands and dangerous patterns. - Added checks for potential shell injection attempts in command and arguments. - Security validation is conditionally enabled based on environment variable CUSTOM_MCP_SECURITY_CHECK. * Enhance security by implementing command and argument validation in SupergatewayMCP. Added checks for banned commands, dangerous patterns, and potential shell injection attempts. Security validation is conditionally enabled based on the CUSTOM_MCP_SECURITY_CHECK environment variable. * add validateMCPServerSecurity
add http denylist checks
fix nvidia node name
Addressed issue of casting value to a string
- Add redirect to /api/auth/login in axios 401 interceptor - Add session validation in StudioLayout with redirect - Add session validation in MainUiLayout with redirect - Ensures users are redirected to login when unauthenticated
PR Review: Flowise 3.0.11 UpgradeSummaryThis is a major upstream dependency upgrade from Flowise to version 3.0.11, incorporating ~100 upstream commits with significant new features, bug fixes, and security improvements. The PR touches 1,108 files with 171k additions and 72k deletions. Critical Review Items🔴 BLOCKING ISSUES1. Missing Database Migration Plan
2. TheAnswer Multi-Tenancy Compatibility Verification Needed
3. TheAnswer Component Tag Compliance
4. Breaking Changes Not Documented
|
| Risk Level | Category | Mitigation |
|---|---|---|
| 🔴 HIGH | Database schema changes | Generate and review migrations |
| 🔴 HIGH | Multi-tenancy breakage | Manual security testing |
| 🟡 MEDIUM | Dependency conflicts | Full rebuild and test |
| 🟡 MEDIUM | Auth flow changes | E2E auth testing |
| 🟢 LOW | UI component changes | Visual regression testing |
✅ FINAL VERDICT
STATUS: REQUIRES CHANGES ❌
This PR cannot be approved until:
- ✅ Database migration plan documented and executed
- ✅ Multi-tenancy security verified through testing
- ✅ PR description added with changelog and testing notes
- ✅ Test suite passes (
test:auth,test:e2e) - ✅ Build verification on clean install
Estimated Effort: 4-6 hours for proper validation
💡 SUGGESTIONS FOR FUTURE UPGRADES
- Create upgrade checklist in .github/PULL_REQUEST_TEMPLATE.md for Flowise version bumps
- Add integration tests specifically for multi-tenancy
- Document TheAnswer-specific customizations to track during upgrades
- Set up staging auto-deploy to test major upgrades before manual review
Reviewer: Claude Code (AI Assistant)
Review Date: 2025-12-20
Flowise Version: 3.0.11
PR Target: staging ✅ (correct per CLAUDE.md)
cc: @maxtechera
- Replace deprecated layout='fill' and objectFit with fill boolean and style - Use width=0, height=0, sizes='100vw' pattern for responsive full-width - Add unoptimized prop for data: URLs to bypass Vercel optimization - Ensure all markdown images render at 100% width
Focused PR Review: Flowise 3.0.11 UpgradeReviewer: Claude Code - Date: December 20, 2025 - Size: 171,935 additions, 72,326 deletions - Base: staging ✅ Executive SummaryExtremely large Flowise upstream merge. This review focuses on critical TheAnswer-specific issues requiring immediate attention. Status: 🔴 REQUEST CHANGES CRITICAL: New Authentication Architecture1. Session Enrichment - Security ConcernsNew Files:
What Changed: Completely new session enrichment architecture that:
SECURITY RISKS: A. Access Token Sent to BackendAuth0 access token sent to Flowise server could be logged or stored improperly. Questions:
Action Required: Verify backend endpoint security B. Base64 Domain DecodingCode includes unexplained base64 domain decoding logic (enrichSession.ts:47-62). Questions:
Action Required: Document purpose or remove if unnecessary C. Silent Enrichment FailuresEnrichment failures return unenriched session silently, potentially causing:
Action Required: Add monitoring and user-visible warnings 2. Console.log in ProductionMultiple console.log statements in auth flow (AAIAuthProvider:30, route.ts:24,36, enrichSession.ts:72-73,97) Action Required: Replace with proper logging framework HIGH PRIORITY: Multi-Tenancy3. Credential Category Logic ChangegetCredentialCategory.ts: Changed from includes mcp to includes mcp server Risk: TheAnswer MCP integrations might not categorize correctly Action Required: Test all MCP servers: answerai/answeragent-mcp, answerai/confluence-mcp, answerai/jira-mcp, answerai/salesforce-mcp 4. AssistantInfoCard ChangeLine 223 modified - unknown impact on multi-tenancy Action Required: Provide diff and verify organization isolation Mandatory TestingAuthentication:
Multi-Tenancy:
Integration:
Required Actions
Positive Aspects
Final VerdictStatus: CHANGES REQUIRED - Risk Level: HIGH - Undocumented auth architecture changes Address blocking issues before proceeding to staging testing. Claude Code PR Review |
- Expand user profile page to show all user data (identity, org, workspaces, roles, permissions, features) - Add empty state messaging with CTAs for unconfigured sections - Add inline workspace switcher to app drawer user menu - Display current org and workspace name in drawer footer - Create workspace switch API endpoint
Pull Request Review: Flowise 3.0.11 Upgrade📊 OverviewThis is a massive dependency upgrade PR updating Flowise from an earlier version to 3.0.11, with:
✅ Strengths
🚨 Critical Concerns & Required Actions1. Missing PR Description (BLOCKER)
2. Database Migration Status (CRITICAL)
3. Security Patches Review (HIGH PRIORITY)From commit messages, I see critical security fixes:
Required:
4. Breaking Changes (HIGH PRIORITY)Notable upstream changes that may affect TheAnswer:
Required:
5. Testing Strategy (BLOCKER)
6. Environment Variable Changes (MEDIUM)
7. Multi-Tenancy Validation (CRITICAL)Per CLAUDE.md, all changes must preserve multi-tenancy:
🔍 Specific Code Review PointsNew Features to TestBased on commits, test these new integrations:
Action: Verify these work with TheAnswer's multi-tenant architecture Dependency Security
Good: These appear properly maintained ✓ 📋 Pre-Merge ChecklistMUST complete before approval:
🎯 RecommendationsImmediate Actions
Testing Strategy# Recommended testing sequence:
pnpm nuke && pnpm install # Clean install
pnpm build-force # Force rebuild
pnpm db:migrate # Apply any migrations (ASK USER FIRST)
pnpm dev # Start dev environment
pnpm test:auth # Test authentication
pnpm test:chatflows # Test chatflows
pnpm test:e2e # Full E2E testsConsider Breaking Into Smaller PRsGiven the massive scope (1,115 files), consider:
🏷️ Suggested LabelsAdd these labels to the PR:
|
PR Review: Flowise 3.0.11 Upgrade (#726)Executive SummaryThis PR upgrades TheAnswer to Flowise version 3.0.11, a massive upstream merge with 1,115 files changed (+172,561/-72,395 lines). This upgrade includes critical security improvements, new features, and extensive refactoring. Risk Level: 🟡 MEDIUM-HIGH - Large scope requires comprehensive testing Critical Security & Compliance Review1. Multi-Tenancy Compliance ✅ PASSAnalysis:
Critical Checks Required Post-Merge:
2. Authentication Patterns ✅ PASSAnalysis:
Critical Checks Required Post-Merge:
3. Component AAI Tags ✅ PRESERVEDAnalysis:
Security AssessmentCritical Security Improvements from Flowise 3.0.11 ✅Code Execution Security:
Network Security:
Session Security:
Action Required:
New Environment Variables
|
- Clean up console.log statements across UI components - Fix design issues in various components - Merge Max's workspace switcher changes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
PR Review: Flowise 3.0.11 UpgradeOverviewThis PR merges 100 commits from upstream Flowise (v3.0.11), spanning July 14 to September 12, 2025. The changes include 1,123 files with 172,661 additions, making this one of the largest upgrades to date. ✅ Positive ChangesSecurity Enhancements (Critical)Based on commit messages, several important security improvements were implemented:
Feature Additions
Infrastructure & Developer Experience
|
- Add missing Business icon import from @mui/icons-material - Add name property to AppDrawerProps user interface - Fix broken JSX structure in drawer user info section - Clean up formatting in organization/workspace display
Pull Request Review: Flowise 3.0.11 UpgradeOverviewThis is a major upstream merge from Flowise 3.0.11 with 100 commits, 300+ files changed, and significant additions to core functionality. This upgrade brings in substantial new features including queue management, worker processes, and enhanced Docker configurations. 🔴 Critical Issues1. Missing PR Description
2. Insufficient Test Coverage
3. Authentication & Security Changes
|
- Convert organization badge to MenuItem with SwapHorizIcon - Remove separate "Switch Organization" menu item - Cleaner profile menu with organization close to user info
PR Review: Flowise Upstream Merge (68 commits, 1,123 files)OverviewThis is a massive upstream merge from Flowise incorporating 68 commits with significant additions (+172K/-72K lines). Given the scale, this review focuses on critical integration risks for TheAnswer rather than line-by-line analysis. 🔴 Critical Issues1. Security Changes Require ValidationThe merge includes several security-focused commits:
Action Required:
2. Authentication Flow ChangesNew file:
Action Required:
3. Breaking API ChangesMultiple commits refactor routes:
Action Required:
4. Database Schema ChangesCommits mention new fields and validation:
Action Required:
|
- Email header with + icon to add/switch accounts - Organization with checkmark (current) - Workspaces list with active checkmark - Add teammates & Workspace settings (admin/builder only) - Personalization (theme toggle) & Settings - Help link with arrow, Log out - User profile card at bottom with name/org - Invite team members button (admin/builder) - Upgrade plan button (if no subscription)
populateWorkspaceData() was always picking "Personal Workspace" or first workspace, ignoring the user's actual selection. Now uses WorkspaceUser lastLogin (which is set during switch) to select the most recently accessed workspace.
PR Review: Flowise 3.0.11 Upstream MergeOverviewThis is a massive upstream merge from Flowise 3.0.11 containing:
|
- Change users page API from organization to workspace endpoint - Show users in current workspace instead of entire organization - Update delete to remove from workspace, not org - Replace "Assigned Roles" count with single Role name column - Remove unused drawer for viewing roles across workspaces - Update profile sidebar link from /profile to /settings/user - Clean up unused imports and console.log statements 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
PR Review: Flowise v3.0.11 UpgradeReview Status: Comprehensive security and architecture review completed Executive SummaryThis is a major upgrade from Flowise upstream that introduces significant new features including enterprise workspace management, enhanced security controls, and numerous dependency updates. While the overall structure is sound, there are critical security concerns that must be addressed before merging. Recommendation: Critical Issues🔴 1. Workspace Switching Missing Authorization CheckLocation: Issue: The workspace switch endpoint validates that the workspace exists in Current Code: const assignedWorkspaces = session.user.assignedWorkspaces || []
const hasAccess = assignedWorkspaces.some((ws: { id: string }) => ws.id === workspaceId)Why This Is Critical: The Recommendation:
🔴 2. Enterprise Routes Missing enforceAbility MiddlewareLocation: Issue: The // Line 14: No feature flag because user with lower plan can switch to invited workspaces
router.post('/switch', workspaceController.switchWorkspace)Why This Is Problematic:
Recommendation: router.post('/switch',
// At minimum, verify the user is authenticated
IdentityManager.ensureAuthenticated,
workspaceController.switchWorkspace
)🔴 3. Debug Logging May Expose Sensitive DataLocation: Issue: Debug logging includes request headers which may contain sensitive tokens: const debugLog = (message: string, data?: any) => {
if (process.env.AUTH0_DEBUG === 'true' || process.env.DEBUG === 'true') {
// ... logs data which includes req.headers
}
}Later in line 66: headers: Object.fromEntries(req.headers.entries())Why This Is Critical: Headers contain Authorization tokens, cookies, and other sensitive data that should never be logged. Recommendation: const sanitizeHeaders = (headers: Headers) => {
const safe = Object.fromEntries(headers.entries())
delete safe['authorization']
delete safe['cookie']
delete safe['x-api-key']
return safe
}
// Then use:
headers: sanitizeHeaders(req.headers)Major Concerns🟡 4. Missing Multi-Tenancy Filter in Workspace ReadLocation: Issue: The if (query.id) {
workspace = await workspaceService.readWorkspaceById(query.id, queryRunner)
}Why This Matters: Without explicit organizationId filtering, there's a risk of cross-tenant data access if workspace IDs are predictable. Recommendation: Verify that if (query.id) {
workspace = await workspaceService.readWorkspaceById(query.id, queryRunner)
// Add check
if (workspace && workspace.organizationId !== req.user.activeOrganizationId) {
throw new InternalFlowiseError(StatusCodes.FORBIDDEN, 'Access denied')
}
}🟡 5. New Security Environment Variables Need DocumentationLocation: New Variables Added: # HTTP_DENY_LIST=
# CUSTOM_MCP_SECURITY_CHECK=true
# CUSTOM_MCP_PROTOCOL=sse #(stdio | sse)
# TRUST_PROXY=trueIssue: These new security-critical variables lack documentation in CLAUDE.md and deployment guides. Recommendation:
🟡 6. Docker Compose Exposes Many Environment VariablesLocation: Issue: The Docker Compose file passes through many environment variables including sensitive ones like Auth0 credentials directly from Concern: This makes it easy to accidentally commit secrets if the Recommendation:
Minor Issues & Suggestions🟢 7. Inconsistent Error Handling in Auth RouteLocation: Issue: The catch (error: any) {
console.error('[auth/me] Error:', error.message)
// Fallback to default profile handler
return Auth0.handleProfile()(req)
}Suggestion: This might mask errors. Consider returning a 500 error instead of falling back: catch (error: any) {
console.error('[auth/me] Error:', error.message)
return new Response(JSON.stringify({ error: 'Internal server error' }), {
status: 500,
headers: { 'Content-Type': 'application/json' }
})
}🟢 8. Session Modification in Workspace SwitchLocation: Issue: Direct session modification using // @ts-ignore
req.session.passport.user = {
...req.user,
...loggedInUser
}Suggestion:
Positive Observations✅ Good security patterns observed:
✅ Code quality:
Breaking Changes Assessment
|
- Add secondaryTypographyProps to ListItemText to render secondary as div - Update usePlans hook to use pricingApi from @/api/pricing - Update useUserPlan hook to use plansApi from @/api/plans - Adapt data transformations for Flowise API response structure 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
PR Review: Flowise 3.0.11 UpgradeReviewer: Claude Code Executive SummaryThis is a massive upstream merge bringing in Flowise 3.0.11 updates. Given the scale (100+ commits, 1,125 files), I've focused on high-risk areas specific to TheAnswer's architecture and compliance requirements per CLAUDE.md. Overall Assessment: 🚨 BLOCKING ISSUES1. Missing PR Description (CRITICAL)Issue: No description explaining:
Required Action: Add comprehensive PR description with:
2. Insufficient Testing Evidence (CRITICAL)Issue: No evidence of testing provided despite massive scope. Required Testing Before Merge: # Build verification
pnpm build
# TheAnswer-specific tests
pnpm test:auth # Authentication flows
pnpm test:e2e # End-to-end tests
pnpm test:chatflows # Chatflow configurations
# Database verification
pnpm migration:show # Check for pending migrations
pnpm db:healthcheck # Database connectivityDocument test results in PR description.
|
- Refactor PlanCard to use AAI billing service (useBillingData) - Move profile/billing menu items from drawer to avatar menu - Add product expansion to getActiveSubscription for full Stripe data - Update billing types for dynamic price, interval, currency fields - Update getUsageSummary and getCustomerStatus to extract plan info from Stripe product name, price, and metadata
PR Review: Flowise 3.0.11 Upgrade (#726)SummaryThis PR upgrades TheAnswer from Flowise base to version 3.0.11, incorporating 60 upstream commits with extensive changes across 1,129 files (+172,935/-72,806 lines). The upgrade brings significant security enhancements, new features, and critical bug fixes while maintaining TheAnswer-specific customizations. Target Branch: 🚨 Critical Issues - MUST ADDRESS1. Security Vulnerabilities - ACTION REQUIREDSeverity: Critical Required Actions: # Add to .env file
CUSTOM_MCP_SECURITY_CHECK=true # Enable MCP security validation
CUSTOM_MCP_PROTOCOL=stdio # Restrict to stdio protocol only
DENYLIST_URLS=localhost,127.0.0.1,169.254.169.254,metadata.google.internalWhy: Flowise 3.0.11 introduces command validation and protocol restrictions for MCP servers to prevent code injection and unauthorized system access. Recommendation: Set 2. Database Migrations RequiredSeverity: Critical New Migrations:
Multi-Tenancy Impact: Action Required: # Before deploying to any environment:
pnpm db:migrate # Run migrations in dev/staging
pnpm db:deploy # Run in production (non-interactive)
# Verify migrations
pnpm migration:show
3. Breaking Changes in AgentFlow V1Severity: Major Why: V1 agentflows may stop working in future Flowise releases. TheAnswer has custom AAI agentflow components that may be affected. Suggested Actions:
|
| Category | Risk Level | Mitigation |
|---|---|---|
| Database Migrations | Medium | Test in staging first, backup production DB |
| Auth Session Changes | Medium | Comprehensive auth testing, gradual rollout |
| MCP Security | Low | Configuration required but backward compatible |
| AAI Components | Low | No changes to AAI-tagged components |
| Multi-Tenancy | Low | Patterns maintained, new fields added correctly |
| OpenAI API Changes | Low | Updates are additive, not breaking |
| Code Execution | Medium | Sandbox changes may affect custom functions |
Overall Risk: Medium - Manageable with proper testing and staged deployment.
🎯 Final Recommendation
✅ Approve with Conditions
This upgrade brings critical security improvements and valuable new features. The changes are well-structured and maintain TheAnswer's multi-tenancy and authentication patterns.
Conditions for approval:
- ✅ Add required environment variables (CUSTOM_MCP_SECURITY_CHECK=true)
- ✅ Run database migrations successfully in staging
- ✅ Pass comprehensive E2E test suite
- ✅ Verify Auth0 authentication flow works correctly
- ✅ Test workspace switching and API key authentication
Suggested Actions:
- Merge to staging after environment variable updates
- Run full test suite in staging environment
- Conduct manual QA for critical flows
- Deploy to production with database backup ready
The upgrade is production-ready pending successful staging validation.
Review conducted by Claude Code PR Review Agent
🔍 PR Review: Flowise Upgrade 3.0.x → 3.0.11Overall Risk: 🟡 MEDIUM-HIGH - Block merge until critical issues are resolved This is a massive upgrade with 173,984 additions across the codebase. The good news: no changes to core Flowise packages means our 4-layer architecture is safe. The concerning news: authentication refactoring introduces 3 critical security vulnerabilities. 🚨 3 CRITICAL ISSUES (BLOCKERS)1. Workspace Switching - Missing
|
PR Review: Flowise 3.0.11 Upgrade📊 OverviewThis is a massive upstream upgrade bringing in Flowise 3.0.11 with:
🚨 Critical Blocking Issues1. Missing PR Description (CRITICAL)
2. Vercel Deployment Failure (CRITICAL)
3. Removed CI/CD Workflows (MAJOR)
4. Major Environment Variable Changes (MAJOR)New variables in docker/.env.example (+112 lines):
Required:
5. TheAnswer UI Changes Need Explanation (MAJOR)Files modified that are TheAnswer-specific (not Flowise upstream):
Required: Explain why TheAnswer-specific files changed in an upstream upgrade ✅ Security Review - Excellent ImprovementsFlowise 3.0.11 includes 9 major security enhancements:
These security improvements make this upgrade worthwhile ✨ 🎉 New Features Included
|
20 participants
No description provided.