flowise@3.1.2

FiloSottile/mkcertflowise@3.1.2Apr 14, 2026by HenryHengZJ
AI Summary

This release focuses heavily on critical security patches, addressing Mass Assignment vulnerabilities, IDOR issues, and credential leaks across various endpoints. It also introduces new MCP server integrations and significant enhancements to the AgentFlow component.
Key Highlights

Extensive security fixes for Mass Assignment, IDOR, and credential data leaks
New MCP integrations with Pipedream and Browserless
AgentFlow enhancements including Rich Text editor and state management
UI improvements for document store actions and accessible password toggles
New Features

Pipedream MCP support
Browserless MCP integration
Email change confirmation flow
AgentFlow variable system and syntax support
Document store rename/delete actions
Full Release Notes

## What's Changed

* Hardcoded CORS wildcard on TTS endpoint enables cross-origin credential abuse from any webpage by @christopherholland-workday in https://github.com/FlowiseAI/Flowise/pull/5901
* Additional Improvements to MCP Server Config security by @christopherholland-workday in https://github.com/FlowiseAI/Flowise/pull/5943
* fix: session cleanup when using mysql for storing sessions by @0xi4o in https://github.com/FlowiseAI/Flowise/pull/5984
* Fix Mass Assignment in Tools Endpoint by @christopherholland-workday in https://github.com/FlowiseAI/Flowise/pull/5954
* Fix Credential Data Leak by @christopherholland-workday in https://github.com/FlowiseAI/Flowise/pull/6042
* Fix Chatflow Query to Protect Against Cross-Workspace Chatflow Disclosure by @christopherholland-workday in https://github.com/FlowiseAI/Flowise/pull/6043
* fix(ui): limit Markdown rendering on RichInput by @jocelynlin-wd in https://github.com/FlowiseAI/Flowise/pull/6061
* Fix Mass Assignment in Variables Endpoints by @christopherholland-workday in https://github.com/FlowiseAI/Flowise/pull/5955
* Fix IDOR Takeover in PUT /api/v1/user by @christopherholland-workday in https://github.com/FlowiseAI/Flowise/pull/5986
* fix: redis pub/sub and streaming response issue by @0xi4o in https://github.com/FlowiseAI/Flowise/pull/6008
* Revert "fix: redis pub/sub and streaming response issue" by @yau-wd in https://github.com/FlowiseAI/Flowise/pull/6084
* chore: bump @flowiseai/agentflow to 0.0.0-dev.7 by @github-actions[bot] in https://github.com/FlowiseAI/Flowise/pull/6087
* Update README.md for @flowiseai/agentflow by @jocelynlin-wd in https://github.com/FlowiseAI/Flowise/pull/6088
* Fix/agentflow fix field name mismatch between SDK internal representation and server expectation by @j-sanaa in https://github.com/FlowiseAI/Flowise/pull/6092
* chore: bump @flowiseai/agentflow to 0.0.0-dev.8 by @github-actions[bot] in https://github.com/FlowiseAI/Flowise/pull/6096
* feat: add Pipedream MCP support by @rohan-patil2 in https://github.com/FlowiseAI/Flowise/pull/5858
* fix(models): correct sonar-deep-research model name in Perplexity config by @AbdulSamad94 in https://github.com/FlowiseAI/Flowise/pull/6069
* fix(models): correct o4-mini pricing under chatOpenAI by @AbdulSamad94 in https://github.com/FlowiseAI/Flowise/pull/6079
* mini-feat: Store page sizes of views in local storage by @Mewyii in https://github.com/FlowiseAI/Flowise/pull/5830
* Mass Assignment in Assistant Update Endpoint by @christopherholland-workday in https://github.com/FlowiseAI/Flowise/pull/5945
* Feat/agentflow add support for Variable System & Syntax Support by @j-sanaa in https://github.com/FlowiseAI/Flowise/pull/6067
* chore: bump @flowiseai/agentflow to 0.0.0-dev.9 by @github-actions[bot] in https://github.com/FlowiseAI/Flowise/pull/6106
* Fix Mass Assignment in Chatflow Endpoints by @christopherholland-workday in https://github.com/FlowiseAI/Flowise/pull/5953
* fix(models): correct multiple model label typos (Groq, Mistral, Bedrock) by @AbdulSamad94 in https://github.com/FlowiseAI/Flowise/pull/6104
* Fix IDOR in Evaluators and Evaluations Endpoints by @christopherholland-workday in https://github.com/FlowiseAI/Flowise/pull/6050
* feat: email change confirmation flow by @0xi4o in https://github.com/FlowiseAI/Flowise/pull/5992
* fix(gmail): include draft id in update_draft tool schema by @tsubasakong in https://github.com/FlowiseAI/Flowise/pull/5925
* fix: skip empty metadata filter in RetrieverTool to prevent vector store error by @majiayu000 in https://github.com/FlowiseAI/Flowise/pull/5976
* Add Permission Checks to Vector Store API's by @christopherholland-workday in https://github.com/FlowiseAI/Flowise/pull/6045
* fix: preserve sourceDocuments and metadata in ExecuteFlow node by @majiayu000 in https://github.com/FlowiseAI/Flowise/pull/5972
* fix: lint issues by @0xi4o in https://github.com/FlowiseAI/Flowise/pull/6115
* feat(ChatOllama): add 'think' input option for reasoning support by @HenryHengZJ in https://github.com/FlowiseAI/Flowise/pull/6116
* Fix: restore token-by-token streaming for chains using createTextOnlyOutputParser by @HenryHengZJ in https://github.com/FlowiseAI/Flowise/pull/6086
* fix(components): reuse extracted response content for ConditionAgent JSON parsing by @jslim-23 in https://github.com/FlowiseAI/Flowise/pull/6072
* fix: streaming response due to high number of redis pub/sub channels, better handling of connection issues by @0xi4o in https://github.com/FlowiseAI/Flowise/pull/6114
* Feature/Add Audit and Deletion  by @yau-wd in https://github.com/FlowiseAI/Flowise/pull/5994
* fix(ui): allow XML tag for markdown rich input by @jocelynlin-wd in https://github.com/FlowiseAI/Flowise/pull/6095
* Fix Mass Assignment in Dataset and DatasetRow Operations by @christopherholland-workday in https://github.com/FlowiseAI/Flowise/pull/6051
* feat(agentflow): enhance state management with StateKeyValueInput and variable support by @jocelynlin-wd in https://github.com/FlowiseAI/Flowise/pull/6119
* Feat/agentflow Port Markdown Editor & Edit/Source Toggle from legacy UI to agentflow by @j-sanaa in https://github.com/FlowiseAI/Flowise/pull/6125
* fix: better errors for sso login by @0xi4o in https://github.com/FlowiseAI/Flowise/pull/6113
* fix(agentflow): resolve stale $flow.state reads in iteration node by @manojnaidu619 in https://github.com/FlowiseAI/Flowise/pull/6099
* feat(ui): add document store rename/delete actions for cards and table by @sahil2448 in https://github.com/FlowiseAI/Flowise/pull/6041
* Fix Mass Assignment in Assistants Endpoints by @christopherholland-workday in https://github.com/FlowiseAI/Flowise/pull/6128
* Fix Mass Assignment on Save Custom Template by @christopherholland-workday in https://github.com/FlowiseAI/Flowise/pull/6129
* feat(agentflow): Add refresh button for Available Actions dropdown by @jocelynlin-wd in https://github.com/FlowiseAI/Flowise/pull/6134
* feat: add client-scoped filtering to node input params by @jchui-wd in https://github.com/FlowiseAI/Flowise/pull/6107
* Add barrel export and exports map to packages/components by @michaell-workday in https://github.com/FlowiseAI/Flowise/pull/6130
* Fix/agentflow Add support for XML tag in markdown input and render markdown conditionally by @j-sanaa in https://github.com/FlowiseAI/Flowise/pull/6145
* chore: bump @flowiseai/agentflow to 0.0.0-dev.10 by @github-actions[bot] in https://github.com/FlowiseAI/Flowise/pull/6162
* fix(agentflow): $flow.state inaccessible inside iteration node execution by @manojnaidu619 in https://github.com/FlowiseAI/Flowise/pull/6142
* docs: fix Hugging Face deployment links by @ming1523 in https://github.com/FlowiseAI/Flowise/pull/6124
* chore: update GitHub Actions dependency version by @jocelynlin-wd in https://github.com/FlowiseAI/Flowise/pull/6165
* feat(ui): add accessible show/hide password toggle on signin by @sahil2448 in https://github.com/FlowiseAI/Flowise/pull/6098
* update eslint-plugin-jsx-a11y and remove pinned version for es-iterat… by @mmattu-wd in https://github.com/FlowiseAI/Flowise/pull/6159
* Feat/docstore rename delete actions (optimised for dark theme) by @sahil2448 in https://github.com/FlowiseAI/Flowise/pull/6144
* fix: flowise-317 by @0xi4o in https://github.com/FlowiseAI/Flowise/pull/6168
* Fix/agentflow Integration and verification test fixes by @j-sanaa in https://github.com/FlowiseAI/Flowise/pull/6175
* fix(evaluations): use correct total_cost property in CostCalculator by @aviu16 in https://github.com/FlowiseAI/Flowise/pull/6183
* feat: Browserless MCP integration by @andyMrtnzP in https://github.com/FlowiseAI/Flowise/pull/6171
* fix(evaluations): correct DoesNotContainAny/All operator logic by @aviu16 in https://github.com/FlowiseAI/Flowise/pull/6182
* fix: remove basic auth by @0xi4o in https://github.com/FlowiseAI/Flowise/pull/5680
* refactor(api): update caching mechanism in deduplicatedClient to differentiate TTL for GET and load-method responses by @jocelynlin-wd in https://github.com/FlowiseAI/Flowise/pull/6188
* Fix/agentflow - Fixes for minor UI issues in extracted canvas by @j-sanaa in https://github.com/FlowiseAI/Flowise/pull/6190
* Bugfix/add compact table transformer for NotionAPILoader by @HenryHengZJ in https://github.com/FlowiseAI/Flowise/pull/6187
* Bugfix/add groq sdk by @HenryHengZJ in https://github.com/FlowiseAI/Flowise/pull/6194
* Chore/include action metadata from API responses by @HenryHengZJ in https://github.com/FlowiseAI/Flowise/pull/6204
* Bugfix/Silent fallback to vm2 for sandbox execution by @HenryHengZJ in https://github.com/FlowiseAI/Flowise/pull/6206
* feat(components): improve Baidu Wenxin chat model configuration by @jimmyzhuu in https://github.com/FlowiseAI/Flowise/pull/6140
* feat(components): add Baidu Qianfan embeddings node by @jimmyzhuu in https://github.com/FlowiseAI/Flowise/pull/6147
* fix/agentflow: Update default values and auto-add Start node for empty state by @jocelynlin-wd in https://github.com/FlowiseAI/Flowise/pull/6210
* Release/3.1.2 by @HenryHengZJ in https://github.com/FlowiseAI/Flowise/pull/6215

## New Contributors
* @michaell-workday made their first contribution in https://github.com/FlowiseAI/Flowise/pull/6044
* @AbdulSamad94 made their first contribution in https://github.com/FlowiseAI/Flowise/pull/6069
* @tsubasakong made their first contribution in https://github.com/FlowiseAI/Flowise/pull/5925
* @majiayu000 made their first contribution in https://github.com/FlowiseAI/Flowise/pull/5976
* @jslim-23 made their first contribution in https://github.com/FlowiseAI/Flowise/pull/6072
* @manojnaidu619 made their first contribution in https://github.com/FlowiseAI/Flowise/pull/6099
* @sahil2448 made their first contribution in https://github.com/FlowiseAI/Flowise/pull/6041
* @ming1523 made their first contribution in https://github.com/FlowiseAI/Flowise/pull/6124
* @mmattu-wd made their first contribution in https://github.com/FlowiseAI/Flowise/pull/6159
* @andyMrtnzP made their first contribution in https://github.com/FlowiseAI/Flowise/pull/6171
* @jimmyzhuu made their first contribution in https://github.com/FlowiseAI/Flowise/pull/6140

**Full Changelog**: https://github.com/FlowiseAI/Flowise/compare/flowise@3.1.1...flowise@3.1.2