langflow v1.13.1 — 1.13.1

Langflow 1.13.1 is a patch release made almost entirely of security and isolation fixes, and several of them harden the triggers system that 1.13.0 introduced, which lets a flow start on a schedule, a webhook or an event such as a Slack message. One fix fences stale listener delivery across trigger replicas (#15942). In systems that run several copies of a listener, fencing usually means stopping a copy whose claim on an event has lapsed from still delivering it; the title points to that problem but does not describe the mechanism. Slack workspace routing now requires OAuth attestation (#15981), listeners now stop when background consent is withdrawn (#16012), and SSO triggers are preserved during migration replay (#16058).

The largest remaining group concerns MCP, the Model Context Protocol, a standard for connecting AI applications to outside tools. Fixes protect reserved fields in the MCP component, isolate login and request state in batch calls (#15978), validate shell arguments after headers are applied, enforce a destination policy for MCP HTTP requests (#16041), and pin agentic MCP calls to the backend listener. Other fixes confine the Git loader's files to its repository (#15972) and limit the Oracle loader's local file access, redact credentials from query strings in logs (#16042), separate user and flow storage namespaces, and secure the quickstart PostgreSQL configuration. Two more, which block runtime readers in generated components (#16040) and block re-export bypasses through inspect (#16048), appear to continue the checks on generated component code that 1.12.7 tightened.

These descriptions come from the pull request titles alone. The pull request bodies were not read, so this explanation cannot say how each fix works, how serious the underlying problems were, or whether any was reported or exploited. The release also upgrades dependencies, works around CVEs in the image's dependencies, and clarifies the automatic-login behavior that 1.13.0 turned off by default.