v1.12.0

<!-- Release notes generated using configuration in .github/release.yml at v1.12.0 -->

## What's Changed
### ✨ New Features
* feat(models): add pluggable provider policy by @erichare in https://github.com/langflow-ai/langflow/pull/14137
* feat: make langflow-core the shared bundle-free distribution by @erichare in https://github.com/langflow-ai/langflow/pull/14100
* feat: add scoped authorization visibility prefilter by @erichare in https://github.com/langflow-ai/langflow/pull/14102
* feat: automate bundle version propagation and release ordering by @erichare in https://github.com/langflow-ai/langflow/pull/14160
* feat(ci): add declarative downstream bundle profiles by @erichare in https://github.com/langflow-ai/langflow/pull/14208
* feat: Complete release 1.12 RBAC authorization foundations by @erichare in https://github.com/langflow-ai/langflow/pull/14215
* feat: Complete RBAC and distribution contracts by @erichare in https://github.com/langflow-ai/langflow/pull/14230
* feat: export application telemetry to any OTLP backend by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14213
* feat: Unified KBs and MBs to use common vector db backends by @dkaushik94 in https://github.com/langflow-ai/langflow/pull/14239
* feat: add event-loop lag and DB pool saturation metrics by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14340
* feat: pgVector implementation for MBs and KBs by @dkaushik94 in https://github.com/langflow-ai/langflow/pull/14287
* feat(models): establish provider governance foundation by @erichare in https://github.com/langflow-ai/langflow/pull/14323
* feat(authz): add source-aware role assignment grants by @erichare in https://github.com/langflow-ai/langflow/pull/14333
* feat(models): add approved provider policy store by @erichare in https://github.com/langflow-ai/langflow/pull/14324
* feat: agent catalog foundations and migration by @erichare in https://github.com/langflow-ai/langflow/pull/14316
* feat: support externally managed provider and catalog policies by @erichare in https://github.com/langflow-ai/langflow/pull/14377
* feat: SSO foundations, login seams, and remove OSS Admin Page by @deon-sanchez in https://github.com/langflow-ai/langflow/pull/14276
* feat: add shared database-backed policy bundle by @erichare in https://github.com/langflow-ai/langflow/pull/14426
* feat: Remove use of vertex builds table in workflow API background mode by @Jkavia in https://github.com/langflow-ai/langflow/pull/14353
* feat(security): opt-in exec-sandbox microVM backend for code-execution components by @erichare in https://github.com/langflow-ai/langflow/pull/14400
* feat(agentic): Langflow Assistant improvements — flow building, model portability, and robustness by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14007
* feat: add deterministic project deployment artifacts by @erichare in https://github.com/langflow-ai/langflow/pull/14437
* feat(a11y): scan-first accessibility report and make test_frontend_a11y_suite by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14479
* feat: deployment-profile based pre-flight checks by @dkaushik94 in https://github.com/langflow-ai/langflow/pull/14393
* feat: add enterprise lifespan hook registry and run-event store by @erichare in https://github.com/langflow-ai/langflow/pull/14504
* feat: scope per-user memory to end-user identity header by @Jkavia in https://github.com/langflow-ai/langflow/pull/14443
* feat: add deployment-wide blocked-model deny-list to policy bundle by @erichare in https://github.com/langflow-ai/langflow/pull/14507
* feat: add catalog-policy component usage endpoints by @erichare in https://github.com/langflow-ai/langflow/pull/14510
* feat: add an opt-in warm graph registry for sync execution by @Jkavia in https://github.com/langflow-ai/langflow/pull/14290
* feat(authz): add durable audit persistence by @erichare in https://github.com/langflow-ai/langflow/pull/14496
* feat: flow-execution span on every execution path, labelled by protocol by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14403
* feat: leak-safe LLM-provider latency and error metrics by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14231
* feat: add an OTLP doctor to confirm telemetry delivery by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14226
* feat: spans for MCP tool calls, emitted at the call site by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14423
* feat: database spans, and pin that sampling stays env-driven by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14420
* feat(authz): add anonymous PUBLIC authorization by @erichare in https://github.com/langflow-ai/langflow/pull/14497
* feat: add telemetry for run executions by @Adam-Aghili in https://github.com/langflow-ai/langflow/pull/14501
* feat: span for outbound A2A calls, emitted at the call site by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14520
* feat(api): add id-keyed project upsert endpoint by @jordanrfrazier in https://github.com/langflow-ai/langflow/pull/14521
* feat: let operators turn off database spans by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14552
* feat: add OrcaRouter bundle component by @Marc-oss-hub in https://github.com/langflow-ai/langflow/pull/14549
* feat(VectorDBs): Removed sidecar dependency and disk links for KBs and MBs by @dkaushik94 in https://github.com/langflow-ai/langflow/pull/14413
* feat(bundles): lfx-confluent bundle + watsonx.data components (IBM streamhouse) by @erichare in https://github.com/langflow-ai/langflow/pull/14612
* feat: add CustomModelProvidersEmptyState seam for model provider modal by @deon-sanchez in https://github.com/langflow-ai/langflow/pull/14619
* feat(components): add MrScraper integration by @ai-mrscraper in https://github.com/langflow-ai/langflow/pull/14516
* feat: propagate end-user identity across the serving plane by @Jkavia in https://github.com/langflow-ai/langflow/pull/14550
* feat: link a queued run back to the request that queued it by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14616
* feat: enterprise readiness + telemetry exports by @Adam-Aghili in https://github.com/langflow-ai/langflow/pull/14663
* feat: add deployment tweak policy and close the graph-path tweak bypass by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14538
* feat: resolve flow KB/MB dependencies into the deploy artifact by @Jkavia in https://github.com/langflow-ai/langflow/pull/14728
* feat(frontend): add Settings password form gate seam for SSO overlays (LE-2318) by @deon-sanchez in https://github.com/langflow-ai/langflow/pull/14818
* feat: add SSO identity details and account-menu profile header seam by @deon-sanchez in https://github.com/langflow-ai/langflow/pull/14838
* feat(authz): audit role, team, assignment, and user admin mutations (LE-2350) by @deon-sanchez in https://github.com/langflow-ai/langflow/pull/14874
### 🐛 Bug Fixes
* fix(a11y): admin and auth pages accessibility by @viktoravelino in https://github.com/langflow-ai/langflow/pull/13998
* fix: assets/knowledge-base accessibility by @deon-sanchez in https://github.com/langflow-ai/langflow/pull/13973
* fix: settings/messages accessibility by @deon-sanchez in https://github.com/langflow-ai/langflow/pull/14064
* fix: complete shared resource access (LE-1828) by @erichare in https://github.com/langflow-ai/langflow/pull/14101
* fix: settings/db-provider accessibility by @deon-sanchez in https://github.com/langflow-ai/langflow/pull/13999
* fix(mcp): reap cancelled session transports by @erichare in https://github.com/langflow-ai/langflow/pull/14214
* fix: preserve secret values across graph edges by @erichare in https://github.com/langflow-ai/langflow/pull/14216
* fix: include Google as a default partner bundle by @erichare in https://github.com/langflow-ai/langflow/pull/14220
* fix(rbac): add permission checks in api and use owner id for provider sync by @HzaRashid in https://github.com/langflow-ai/langflow/pull/14104
* fix: graduate Azure and Ollama bundles by @erichare in https://github.com/langflow-ai/langflow/pull/14248
* fix: normalize MCP resource flow IDs by @erichare in https://github.com/langflow-ai/langflow/pull/14253
* fix: populate name and description on starter-projects API response by @erichare in https://github.com/langflow-ai/langflow/pull/14256
* fix: render flows whose nodes have no position instead of crashing the canvas by @erichare in https://github.com/langflow-ai/langflow/pull/14258
* fix(mcp): make agentic MCP server removal actually delete the row by @erichare in https://github.com/langflow-ai/langflow/pull/14272
* fix(mcp): optimistic-lock concurrent MCP server PATCHes by @thesaadmirza in https://github.com/langflow-ai/langflow/pull/14005
* fix: settings/mcp-client accessibility by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14112
* fix(a11y): label Password and Profile Picture form landmarks on settings/general by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/14030
* fix(mcp): pin MCP SDK <2.0 for uvx-launched servers by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14297
* fix: settings/mcp-servers accessibility by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14063
* fix: settings/model-provider Accessibility by @deon-sanchez in https://github.com/langflow-ai/langflow/pull/13997
* fix(a11y): fix invalid ARIA, unnamed buttons, list markup, and touch targets on flow page by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/14210
* fix(shortcuts): announce recorded key combo via aria-live and add accessibility test coverage by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/14072
* fix(a11y): resolve IBM Equal Access violations on sidebar, canvas, and note contrast by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/14212
* fix: clean up Write File local staging under remote storage by @Jkavia in https://github.com/langflow-ai/langflow/pull/14237
* fix(a11y): resolve Lighthouse button-name and aria-valid-attr-value failures in output modal by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/14278
* fix(playground): add accessible names to icon-only controls and fix invalid ARIA on animated/status elements by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/14110
* fix(deps): align system-metrics with the 0.65b0 opentelemetry family by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14350
* fix(frontend): don't trap users on a flow when save fails by @keval718 in https://github.com/langflow-ai/langflow/pull/14358
* fix: replace models of disconnected providers by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14362
* fix: align catalog policy component identities by @erichare in https://github.com/langflow-ai/langflow/pull/14385
* fix: release SQLite lock after API key auth by @erichare in https://github.com/langflow-ai/langflow/pull/14381
* fix: isolate CrewAI runtime state across build_crew calls by @Zhengcy05 in https://github.com/langflow-ai/langflow/pull/13852
* fix(components): run user code input in Python REPL tool's run_model by @erichare in https://github.com/langflow-ai/langflow/pull/14401
* fix: honor Tool Name/Description inputs in Python REPL tool component by @erichare in https://github.com/langflow-ai/langflow/pull/14402
* fix(crewai): isolate shared agents per crew by @erichare in https://github.com/langflow-ai/langflow/pull/14399
* fix(tests): stub SSRF transport in spoofed-metadata policy tests by @erichare in https://github.com/langflow-ai/langflow/pull/14408
* fix: serialize model provider variable writes by @erichare in https://github.com/langflow-ai/langflow/pull/14405
* fix: show Global Variables permission loading state by @erichare in https://github.com/langflow-ai/langflow/pull/14404
* fix(a11y): name command palette, dialogs, and crash screen (LE-2043) by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14313
* fix(authz): support scoped project visibility by @erichare in https://github.com/langflow-ai/langflow/pull/14429
* fix: allow project-scoped flow creation by @erichare in https://github.com/langflow-ai/langflow/pull/14452
* fix: enforce approved catalog across alternate paths by @erichare in https://github.com/langflow-ai/langflow/pull/14449
* fix(api): end request-scoped transactions before long-running execution by @erichare in https://github.com/langflow-ai/langflow/pull/14448
* fix(frontend): drop stale refresh after code save by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14460
* fix: strip query strings from URL attributes before spans are exported by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14422
* fix(a11y): resolve ARIA violations in MCP selector and sidebar settings, add axe coverage by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/14250
* fix: right-click inside a modal opened from a node no longer acts on the node by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14462
* fix(lfx): correct "comparision" typo in Filter Values component description by @erichare in https://github.com/langflow-ai/langflow/pull/14476
* fix(tests): handle the Setup Provider state in selectGptModel (deterministic shard-65 failure) by @erichare in https://github.com/langflow-ai/langflow/pull/14478
* fix(tests): click Save in the provider modal before waiting for the key-saved toast (shard-65) by @erichare in https://github.com/langflow-ai/langflow/pull/14480
* fix(auth): add nested group-claim seam for LE-2102, LE-2103, and LE-2109 by @erichare in https://github.com/langflow-ai/langflow/pull/14410
* fix(tests): require exact MCP server name match by @erichare in https://github.com/langflow-ai/langflow/pull/14484
* fix(lfx): compare template keys directionally in the upgrade checker (1.12.0 port) by @erichare in https://github.com/langflow-ai/langflow/pull/14483
* fix(tests): handle the Setup Provider state in the right-click-dropdown spec by @erichare in https://github.com/langflow-ai/langflow/pull/14486
* fix(tests): require exact MCP server name match in remaining locators by @erichare in https://github.com/langflow-ai/langflow/pull/14485
* fix: reject prompt variables in the reserved underscore namespace by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14450
* fix(a11y): accessible names, dialog titles, keyboard controls, and toast dismissal across viewers, chat, and modals by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14300
* fix(authz): enforce execution principal boundaries by @erichare in https://github.com/langflow-ai/langflow/pull/14495
* fix: correct sync GET-status session_id; gate result cache behind a flag by @Jkavia in https://github.com/langflow-ai/langflow/pull/14512
* fix: validate production preflight secret key by @erichare in https://github.com/langflow-ai/langflow/pull/14499
* fix(deps): require cryptography 50 by @erichare in https://github.com/langflow-ai/langflow/pull/14514
* fix(deps): raise vulnerable Python dependency floors by @erichare in https://github.com/langflow-ai/langflow/pull/14513
* fix: stop shipping application telemetry to the LLM tracing vendor by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14357
* fix: keep LLM tracing vendors off the global tracer provider, and pin it by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14359
* fix: require stored credentials for DB providers by @erichare in https://github.com/langflow-ai/langflow/pull/14500
* fix: stop pre-selecting an unconfigured model by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14505
* fix(deps): mend dep upgrades by @Adam-Aghili in https://github.com/langflow-ai/langflow/pull/14528
* fix(lfx): stop reading output-side tool_mode as a tool-mode capability by @erichare in https://github.com/langflow-ai/langflow/pull/14525
* fix(frontend): order chat messages correctly on WebKit by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14518
* fix(a11y): make the shared playground navigable and motion-safe by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14451
* fix(a11y): label and keyboard-nav fixes for canvas fields and picker popovers by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/14444
* fix: rebuild drifted built-in components instead of refusing the flow by @erichare in https://github.com/langflow-ai/langflow/pull/14527
* fix: PGVector Collection/Indexes separation per KB and MB, locale fixes by @dkaushik94 in https://github.com/langflow-ai/langflow/pull/14473
* fix(observability): withhold log message bodies from OTLP export by default by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14524
* fix(security): complete image dependency remediation by @erichare in https://github.com/langflow-ai/langflow/pull/14542
* fix(authz): make public playground links work — canonical shares and anonymous visitors by @erichare in https://github.com/langflow-ai/langflow/pull/14539
* fix(frontend): keep a file attachment a stale file-list response omits by @erichare in https://github.com/langflow-ai/langflow/pull/14541
* fix(authz): restrict PUBLIC flow shares to execute by @erichare in https://github.com/langflow-ai/langflow/pull/14548
* fix(observability): correct MCP tool span attributes by @erichare in https://github.com/langflow-ai/langflow/pull/14537
* fix: let the caller own the flow span so a run's spans nest under it by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14511
* fix(a11y): keep menu arrow keys from dragging the node underneath by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14543
* fix(a11y): show where keyboard focus is on the canvas, and keep it after a rename by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14544
* fix(test): run the bundle-guarded tests that CI was silently skipping by @erichare in https://github.com/langflow-ai/langflow/pull/14556
* fix(a11y): give the knowledge base provider picker its field's name by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14560
* fix(db): ignore foreign tables in alembic check by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14534
* fix(ci): assert the base wheel's real console script name by @erichare in https://github.com/langflow-ai/langflow/pull/14571
* fix(auth): stop IdP bearer defects from breaking authentication (LE-2099) by @erichare in https://github.com/langflow-ai/langflow/pull/14579
* fix(frontend): gate the add component affordance on the pending permission check by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14523
* fix(ci): assert the base wheel's real console script name (forward-port of #14571) by @erichare in https://github.com/langflow-ai/langflow/pull/14582
* fix(tests): finish the public build before closing the popup; widen the messages loading-state wait by @erichare in https://github.com/langflow-ai/langflow/pull/14595
* fix(tests): finish the public build before closing the popup; widen the messages loading-state wait (release-1.12.0) by @erichare in https://github.com/langflow-ai/langflow/pull/14596
* fix(a11y): keep visible text in Setup Provider button's accessible name by @erichare in https://github.com/langflow-ai/langflow/pull/14569
* fix(auth): reconcile a group set the user moved past instead of serving it from cache (LE-2099) by @erichare in https://github.com/langflow-ai/langflow/pull/14594
* fix(security): replace eval() with safe Literal construction in schema.py by @Varshith-Kali in https://github.com/langflow-ai/langflow/pull/14502
* fix: keep the sqlite file path out of exported database spans by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14559
* fix: guard against logging the caught exception on the flow execution path by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14561
* fix(mcp): scope tool calls and surface failures on the execution plane by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14522
* fix(a11y): resolve dialog naming, nested-interactive, and label defects across the deploy flow by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/14299
* fix(ci): realign release contracts with the confluent/watsonx bundle changes by @erichare in https://github.com/langflow-ai/langflow/pull/14625
* fix(ci): stop uv run from half-reverting the bundle install it runs against by @erichare in https://github.com/langflow-ai/langflow/pull/14631
* fix(authz): answer denials honestly and let owners work in their own projects (LE-1905) by @erichare in https://github.com/langflow-ai/langflow/pull/14621
* fix(a11y): distinct tab titles per route, html lang that follows the locale, no nested main by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14629
* fix(a11y): wire field labels to their controls across remaining widgets by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/14461
* fix: Handle duplicate name in flows batch create with 409 response by @Jkavia in https://github.com/langflow-ai/langflow/pull/14634
* fix(ci): keep skipped package releases green and stop sending target_commitish by @erichare in https://github.com/langflow-ai/langflow/pull/14649
* fix(ci): keep skipped package releases green and stop sending target_commitish (release-1.12.0) by @erichare in https://github.com/langflow-ai/langflow/pull/14650
* fix(ci): stop uv run from half-reverting the bundle install it runs against (forward-port of #14631) by @erichare in https://github.com/langflow-ai/langflow/pull/14653
* fix(a11y): name badged sidebar items by their visible text and stop phantom contrast failures in a11y scans by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14630
* fix(a11y): make keyboard focus visible on every AG-Grid table by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14627
* fix(a11y): make the flow canvas readable to a screen reader by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/14209
* fix(security): apply the caller-aware component policy to stored flow graphs by @erichare in https://github.com/langflow-ai/langflow/pull/14646
* fix(security): refuse MCP stdio server configuration on the public flow path by @erichare in https://github.com/langflow-ai/langflow/pull/14644
* fix(security): scope storage-key resolution to the executing graph's namespace by @erichare in https://github.com/langflow-ai/langflow/pull/14645
* fix(security): require credentials on the MCP endpoints under AUTO_LOGIN by @erichare in https://github.com/langflow-ai/langflow/pull/14643
* fix(security): check assignment values whose binding escapes the scanner's scope by @erichare in https://github.com/langflow-ai/langflow/pull/14642
* fix(security): deny MCP stdio env vars by runtime family, not exact name by @erichare in https://github.com/langflow-ai/langflow/pull/14641
* fix(security): apply connector SSRF policy to model-provider base URLs by @erichare in https://github.com/langflow-ai/langflow/pull/14640
* fix(security): bind every cmd.exe execution switch to the MCP stdio wrapper allow-list by @erichare in https://github.com/langflow-ai/langflow/pull/14635
* fix(security): scrub all secret fields on flow and project export by @erichare in https://github.com/langflow-ai/langflow/pull/14639
* fix(security): validate the Db2 certificate fetch and contain its local-path branch by @erichare in https://github.com/langflow-ai/langflow/pull/14637
* fix(security): enforce local-file confinement on the S3 storage branch by @erichare in https://github.com/langflow-ai/langflow/pull/14638
* fix(security): apply the connector SSRF guard to the DataStax Data API endpoint by @erichare in https://github.com/langflow-ai/langflow/pull/14636
* fix(frontend): dedupe template flow names across projects by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14632
* fix(lfx): stop patching send_message on the shared component by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14570
* fix(frontend): surface components an administrator disabled by @keval718 in https://github.com/langflow-ai/langflow/pull/14614
* fix(a11y): stop decorative canvas graphics reporting as unnamed by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14660
* fix(a11y): keep a tabbable row in every AG-Grid table after scrolling by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14664
* fix(models): seed IBM WatsonX with current models and stop deprecated-flag overloading by @erichare in https://github.com/langflow-ai/langflow/pull/14670
* fix(a11y): scanner reported rules from no policy, inflating our violation counts by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14665
* fix(frontend): hide template destinations a catalog policy emptied by @keval718 in https://github.com/langflow-ai/langflow/pull/14667
* fix(a11y): let keyboard users move nodes, create connections, and hear the canvas respond by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14673
* fix(assistant): make the message length limit configurable by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14651
* fix(frontend): name a catalog policy only for components it blocks by @keval718 in https://github.com/langflow-ai/langflow/pull/14681
* fix(a11y): give every canvas node a unique accessible name by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14683
* fix(a11y): give the model-picker listbox its name instead of labelling an input that does not exist by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14682
* fix(a11y): give interactive controls a boundary users can actually see by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14684
* fix(kb): gate Knowledge Base creation on every remote backend, not just pgvector by @dkaushik94 in https://github.com/langflow-ai/langflow/pull/14686
* fix(models): keep a restricted model visible and name it in the runtime error by @erichare in https://github.com/langflow-ai/langflow/pull/14697
* fix(lfx): bootstrap and flush OTLP telemetry on the lfx run path by @erichare in https://github.com/langflow-ai/langflow/pull/14696
* fix(a11y): settings actions reachable at 320px, pointer targets at the 24px minimum by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14698
* fix(security): close model-provider SSRF follow-up gaps by @erichare in https://github.com/langflow-ai/langflow/pull/14704
* fix(security): harden public MCP project execution by @erichare in https://github.com/langflow-ai/langflow/pull/14706
* fix(security): harden generated-code boundaries by @erichare in https://github.com/langflow-ai/langflow/pull/14708
* fix(security): enforce MCP stdio policy in components by @erichare in https://github.com/langflow-ai/langflow/pull/14707
* fix(frontend): keep parameter visibility across a component refresh by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14736
* fix(a11y): associate form errors with their fields instead of toast-only announcements by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14701
* fix: stop requesting a project by an undefined id after the last one is deleted by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14661
* fix(frontend): report every alias of a blocked component to the editor by @keval718 in https://github.com/langflow-ai/langflow/pull/14719
* fix: correct typos in Astra DB component help text by @MsfPablo in https://github.com/langflow-ai/langflow/pull/14734
* fix: exempt runtime-generated tweaks from the deployment policy by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14695
* fix: emit the stable HTTP server metric names by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14688
* fix: re-parent exported spans whose parent was dropped by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14737
* fix: stop CI Success passing over a job set that never ran by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14395
* fix(release): keep wheels within Docker image profile by @erichare in https://github.com/langflow-ai/langflow/pull/14749
* fix(deployments): surface wxO create validation errors by @erichare in https://github.com/langflow-ai/langflow/pull/14752
* fix(deployments): validate watsonx flow eligibility by @erichare in https://github.com/langflow-ai/langflow/pull/14753
* fix(frontend): preserve dependency callback types by @erichare in https://github.com/langflow-ai/langflow/pull/14757
* fix(amazon): send Top K only to providers with it by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14758
* fix(agui): key tool and content dedup by ordinal by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14759
* fix(frontend): keep canvas edits made during a save, fix Windows-flaky specs by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14765
* fix(frontend): keep local edits over stale refresh by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14741
* fix: send string input to OpenAI-compatible embeddings by @erichare in https://github.com/langflow-ai/langflow/pull/14766
* fix(file): preserve raw content output for multiple files by @erichare in https://github.com/langflow-ai/langflow/pull/14764
* fix: normalize OpenAI-compatible API base URLs by @erichare in https://github.com/langflow-ai/langflow/pull/14774
* fix: detect Google retired-model 404 for fallback by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14778
* fix: fail closed on provider variable read errors by @erichare in https://github.com/langflow-ai/langflow/pull/14783
* fix: fail closed on primary API key read errors by @erichare in https://github.com/langflow-ai/langflow/pull/14785
* fix(observability): start every request task from a clean context by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14769
* fix(frontend): keep sidebar add and drag affordances inside the row by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14779
* fix(amazon): strip all Bedrock geo prefixes for Top K by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14784
* fix(frontend): disable legacy Store tags bootstrap by @erichare in https://github.com/langflow-ai/langflow/pull/14804
* fix(store): stop a Langflow Store outage from breaking the app by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14803
* fix(jobs): reconcile Redis fallback orphaned jobs by @erichare in https://github.com/langflow-ai/langflow/pull/14794
* fix(knowledge): validate Chroma collection names by @erichare in https://github.com/langflow-ai/langflow/pull/14810
* fix(mrscraper): restore component registration by @erichare in https://github.com/langflow-ai/langflow/pull/14797
* fix(extensions): accept release prerelease versions by @erichare in https://github.com/langflow-ai/langflow/pull/14796
* fix(models): scope provider authorization by @erichare in https://github.com/langflow-ai/langflow/pull/14819
* fix: allow resetting optional model provider settings by @erichare in https://github.com/langflow-ai/langflow/pull/14799
* fix(frontend): refetch flow list when upload lands mid first load by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14826
* fix(datastax): stop batch_size from breaking Cassandra ingest by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14795
* fix(ollama): keep one unreachable model from emptying the picker by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14817
* fix(api): run the caller-aware component policy on the vertex build seam by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14808
* fix(frontend): hide "Discover more components" when it cannot navigate by @keval718 in https://github.com/langflow-ai/langflow/pull/14798
* fix: use writable ToolGuard work directory by @erichare in https://github.com/langflow-ai/langflow/pull/14805
* fix(security): validate runtime file tweaks by @erichare in https://github.com/langflow-ai/langflow/pull/14809
* fix(api): preserve v2 sync tweak refusals (LE-2380) by @erichare in https://github.com/langflow-ai/langflow/pull/14828
* fix(api): enforce targeted-input policy (LE-2386) by @erichare in https://github.com/langflow-ai/langflow/pull/14830
* fix(security): encrypt background request overrides (LE-2381) by @erichare in https://github.com/langflow-ai/langflow/pull/14831
* fix(frontend): keep catalog policy warning persistent by @erichare in https://github.com/langflow-ai/langflow/pull/14807
* fix(mcp): honor API exposure in tool schemas by @erichare in https://github.com/langflow-ai/langflow/pull/14837
* fix(security): resolve annotations without execution by @erichare in https://github.com/langflow-ai/langflow/pull/14811
* fix(security): close component code scan gaps by @erichare in https://github.com/langflow-ai/langflow/pull/14812
* fix(api): preserve tweak refusal reasons (LE-2387) by @erichare in https://github.com/langflow-ai/langflow/pull/14829
* fix(frontend): show final file extension (LE-2391) by @erichare in https://github.com/langflow-ai/langflow/pull/14840
* fix(mcp): fail on missing server dependency (LE-2388) by @erichare in https://github.com/langflow-ai/langflow/pull/14842
* fix(ci): address release branch regressions by @erichare in https://github.com/langflow-ai/langflow/pull/14843
* fix(frontend): fit the canvas once the whole graph is measured by @keval718 in https://github.com/langflow-ai/langflow/pull/14832
* fix(frontend): date the UI in the language it is showing by @keval718 in https://github.com/langflow-ai/langflow/pull/14836
* fix(frontend): translate the keys missing from every non-English locale by @keval718 in https://github.com/langflow-ai/langflow/pull/14834
* fix(mcp): keep advertising inputs for flows that declared no allowlist by @erichare in https://github.com/langflow-ai/langflow/pull/14855
* fix(assistant): keep in-scope builds from stalling by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14792
* fix(memory): support non-ASCII Memory Base names by @erichare in https://github.com/langflow-ai/langflow/pull/14875
* fix(agent): let structured output hold more than one record by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14839
* fix(mcp): preserve public variables and expose stdio headers by @erichare in https://github.com/langflow-ai/langflow/pull/14873
* fix: backport security and correctness fixes to 1.11.6 by @erichare in https://github.com/langflow-ai/langflow/pull/14876
* fix(frontend): stop offering components the catalog policy blocks by @keval718 in https://github.com/langflow-ai/langflow/pull/14827
* fix: report root error type on flow execution spans by @erichare in https://github.com/langflow-ai/langflow/pull/14890
* fix: propagate v2 stream run ID to telemetry by @erichare in https://github.com/langflow-ai/langflow/pull/14891
* fix(workflows): reject unsupported inline run cancellation by @erichare in https://github.com/langflow-ai/langflow/pull/14892
* fix(api): stop the sync ceiling from capping background runs by @thesaadmirza in https://github.com/langflow-ai/langflow/pull/14332
* fix(frontend): fetch a routed flow once per open, not once per render by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14894
### 📝 Documentation Updates
* docs(authz): correct role-assignment domain types in model docstring by @erichare in https://github.com/langflow-ai/langflow/pull/14295
* docs: database migrations by @mendonk in https://github.com/langflow-ai/langflow/pull/14441
* docs: use EmpirioLabs AI consistently by @Adam-Dalloul in https://github.com/langflow-ai/langflow/pull/14251
* docs: document the OpenTelemetry export and add a New Relic guide by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14557
* docs: add MrScraper bundle documentation by @riandradiva18 in https://github.com/langflow-ai/langflow/pull/14655
* docs: add an Instana page for exporting Langflow telemetry over OTLP by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14680
* docs: clarify Arize observability setup by @arizedatngo in https://github.com/langflow-ai/langflow/pull/14679
* docs: document the HTTP semconv rename and how to migrate by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14756
* docs: custom components in publicly shared flows by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14773
* docs: 1.12 updates by @mendonk in https://github.com/langflow-ai/langflow/pull/14744
* docs: build 1.12 APIs and bump version to 1.12 by @mendonk in https://github.com/langflow-ai/langflow/pull/14780
### 🛠 Maintenance Tasks
* refactor(frontend): remove legacy Store page and routes by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/14141
* refactor(frontend): remove broken orphaned /flow/:id/view route by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14303
* refactor(frontend): add customization seams for telemetry toggle and registration data by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14336
* refactor: consolidate Langflow 1.12 on langflow-base by @erichare in https://github.com/langflow-ai/langflow/pull/14339
* refactor(frontend): re-file use-refresh-model-inputs into services and utils by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14045
* refactor(frontend): decompose dropdown and prompt components into hooks and helpers by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14054
* refactor(frontend): extract shared primitives and remove duplicated ui clones by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14042
* refactor(frontend): decompose DBProvidersPage into components hooks and helpers by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14049
* refactor: extract useGlobalVariableUpsert and adopt it in global variable modal and settings page by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14273
* refactor: unify prompt modals into a strategy driven PromptEditorModal by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14235
* refactor(frontend): decompose oversized modelInput, nodeToolbar and flowSidebar into hooks and presentational components by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14329
* refactor: unify the stepper machinery behind a shared provider and rebuild the deployment stepper on it by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14284
* refactor: align the deploy choice phase machine with the shared stepper primitive by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14296
* refactor: extract shared DataTableTab shell for files and knowledge tabs by @tarciorodrigues in https://github.com/langflow-ai/langflow/pull/14249
* perf(tests): seed the loopback provider into starter templates instead of reloading by @erichare in https://github.com/langflow-ai/langflow/pull/14589
* perf(tests): seed the loopback provider into starter templates instead of reloading (release-1.12.0) by @erichare in https://github.com/langflow-ai/langflow/pull/14593
* chore: back-merge release-1.12.0 into main (fast-forward only) by @erichare in https://github.com/langflow-ai/langflow/pull/14652
* chore: upgrade 1.12.0 deps by @Adam-Aghili in https://github.com/langflow-ai/langflow/pull/14743
* refactor(sandbox): make LANGFLOW_SANDBOX_BACKEND a registry by @pratikbin in https://github.com/langflow-ai/langflow/pull/14694
### ✅ Tests
* test(authz): align share-level double with enterprise enforcement semantics by @erichare in https://github.com/langflow-ai/langflow/pull/14293
* test(a11y): shared playground IBM scan and jest-axe coverage for untested modals and primitives by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14302
* test(frontend): stabilize grouped node readiness by @erichare in https://github.com/langflow-ai/langflow/pull/14411
* test(observability): run the claims that admit the database and URL spans by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14526
* test: verify log-to-trace correlation against a real OTLP collector by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14519
* test(observability): assert the flow span carries no exception event by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14535
* test: fix playground send race on Windows CI by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14611
* test: sweep the protocol attribute across every flow entry point by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14613
* test(frontend): fix flaky sidebar typeahead wait in connect-tools spec by @Cristhianzl in https://github.com/langflow-ai/langflow/pull/14691
* test: assert telemetry is inert when nothing is configured by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14739
* test: assert logs can be turned off while traces keep exporting by @ogabrielluiz in https://github.com/langflow-ai/langflow/pull/14745
* test(frontend): stabilize sidebar affordance regression by @erichare in https://github.com/langflow-ai/langflow/pull/14821
* test(frontend): classify assistant mock model by @erichare in https://github.com/langflow-ai/langflow/pull/14833
### Others
* chore: remove lfx-bundles from default Langflow install by @erichare in https://github.com/langflow-ai/langflow/pull/13869
* chore: bump release versions to 1.12.0 by @erichare in https://github.com/langflow-ai/langflow/pull/14196
* ci: add core/full release inventory gates by @erichare in https://github.com/langflow-ai/langflow/pull/14203
* chore: remove unused delete-account flow (dead route, stub page, orphaned translations) by @olayinkaadelakun in https://github.com/langflow-ai/langflow/pull/14111
* chore: add bob context file to .gitignore by @Adam-Aghili in https://github.com/langflow-ai/langflow/pull/14558
* chore(deps): remediate Mend scan findings on release-1.12.0 by @erichare in https://github.com/langflow-ai/langflow/pull/14555
* ci: harden nightly builds and test reliability by @erichare in https://github.com/langflow-ai/langflow/pull/14540
* chore: back port the new workflow updates from 1.12 by @erichare in https://github.com/langflow-ai/langflow/pull/14581
* fix(test): stop the live smoke suite inheriting the loopback server list by @erichare in https://github.com/langflow-ai/langflow/pull/14583
* fix(ci): assert the base console script the 1.12 line actually ships by @erichare in https://github.com/langflow-ai/langflow/pull/14584
* fix(ci): assert the base console script the 1.12 line actually ships (main) by @erichare in https://github.com/langflow-ai/langflow/pull/14586
* fix(tests): measure the flow persistence barrier from the reload, not before it by @erichare in https://github.com/langflow-ai/langflow/pull/14587
* fix(tests): measure the flow persistence barrier from the reload, not before it (release-1.12.0) by @erichare in https://github.com/langflow-ai/langflow/pull/14588
* fix(ci): grant the label job pull-requests write (release-1.12.0) by @erichare in https://github.com/langflow-ai/langflow/pull/14591
* fix(ci): grant the label job pull-requests write by @erichare in https://github.com/langflow-ai/langflow/pull/14590
* ci: run backend tests for provider bundle changes by @erichare in https://github.com/langflow-ai/langflow/pull/14605
* ci: run backend tests for provider bundle changes by @erichare in https://github.com/langflow-ai/langflow/pull/14606
* ci(a11y): cut the IBM Equal Access scan from ~73 min to ~13 min per PR by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14633
* ci: stabilize nightly Windows Playwright shards by @erichare in https://github.com/langflow-ai/langflow/pull/14726
* ci: stabilize nightly Windows Playwright shards by @erichare in https://github.com/langflow-ai/langflow/pull/14727
* ci(a11y): stop one empty grid from killing the whole real-backend scan by @viktoravelino in https://github.com/langflow-ai/langflow/pull/14738

## New Contributors
* @Zhengcy05 made their first contribution in https://github.com/langflow-ai/langflow/pull/13852
* @Adam-Dalloul made their first contribution in https://github.com/langflow-ai/langflow/pull/14251
* @Varshith-Kali made their first contribution in https://github.com/langflow-ai/langflow/pull/14502
* @Marc-oss-hub made their first contribution in https://github.com/langflow-ai/langflow/pull/14549
* @ai-mrscraper made their first contribution in https://github.com/langflow-ai/langflow/pull/14516
* @riandradiva18 made their first contribution in https://github.com/langflow-ai/langflow/pull/14655
* @MsfPablo made their first contribution in https://github.com/langflow-ai/langflow/pull/14734
* @arizedatngo made their first contribution in https://github.com/langflow-ai/langflow/pull/14679
* @pratikbin made their first contribution in https://github.com/langflow-ai/langflow/pull/14694

**Full Changelog**: https://github.com/langflow-ai/langflow/compare/v1.11.5...v1.12.0