Starstruk Logo MarkStarstruk

v1.10.2

fishaudio/fish-speechv1.10.2Jul 7, 2026by github-actions[bot]

AI Summary

Adds global variable model overrides and fixes multiple security and telemetry issues.

Key Highlights

  • Global variable model overrides
  • Disabled mem0 telemetry by default
  • Security fixes: removed hardcoded passwords, blocked dangerous MCP env vars
  • Fixed session auth token handling

New Features

  • Global variable model overrides
  • Security fixes
  • Mem0 telemetry fix

Full Release Notes

<!-- Release notes generated using configuration in .github/release.yml at v1.10.2 -->

## What's Changed
### ✨ New Features
* feat: add global variable model overrides by @erichare in https://github.com/langflow-ai/langflow/pull/13935
### 🐛 Bug Fixes
* fix: use session exec in telemetry writer by @erichare in https://github.com/langflow-ai/langflow/pull/13821
* fix: disable mem0 telemetry by default by @erichare in https://github.com/langflow-ai/langflow/pull/13824
* fix: handle invalid session auth tokens by @erichare in https://github.com/langflow-ai/langflow/pull/13823
* fix: remove hardcoded default superuser password by @erichare in https://github.com/langflow-ai/langflow/pull/13822
* fix: isolate FAISS persistence by user by @erichare in https://github.com/langflow-ai/langflow/pull/13871
* fix: block public builds of code execution agents by @erichare in https://github.com/langflow-ai/langflow/pull/13875
* fix: validate file paths by resolved cache containment by @erichare in https://github.com/langflow-ai/langflow/pull/13872
* fix: restrict log retrieval to superusers by @erichare in https://github.com/langflow-ai/langflow/pull/13873
* fix: block dangerous MCP stdio env vars by @erichare in https://github.com/langflow-ai/langflow/pull/13874
* fix: Block Python interpreter format traversal by @erichare in https://github.com/langflow-ai/langflow/pull/13880
* fix: constrain Directory component paths by @erichare in https://github.com/langflow-ai/langflow/pull/13878
* fix(mcp): launch stdio servers with shell=False (no bash -c / cmd /c wrapper) by @erichare in https://github.com/langflow-ai/langflow/pull/13900
* fix: gate litellm off Python 3.14 so pip install langflow resolves by @erichare in https://github.com/langflow-ai/langflow/pull/13814
* fix: scope local vector store collections by user by @erichare in https://github.com/langflow-ai/langflow/pull/13882
* fix: cascade span deletes when clearing traces for a flow by @andifilhohub in https://github.com/langflow-ai/langflow/pull/13960
### ✅ Tests
* test(frontend): harden model dropdown footer clicks in select-gpt-model by @erichare in https://github.com/langflow-ai/langflow/pull/13936
### Others
* chore: upgrade lock files by @Adam-Aghili in https://github.com/langflow-ai/langflow/pull/13971


**Full Changelog**: https://github.com/langflow-ai/langflow/compare/v1.10.1...v1.10.2