# Flowise 3.1.0

- Product: Flowise (https://whatsnew.fyi/product/flowise)
- Vendor: FlowiseAI
- Date: 2026-03-16
- Version: 3.1.0
- Original notes: https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.0
- Permalink: https://whatsnew.fyi/product/flowise/releases/3.1.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Enable HTTP security validation by default to prevent requests to unsafe or internal domains
- **added** — Add HTTP_SECURITY_CHECK environment variable to enable or disable built-in domain security checks
- **added** — Add HTTP_DENY_LIST environment variable to specify additional custom domains to block
- **added** — Add Azure Blob Storage support and refactor storage layer
- **added** — Add AWS STS AssumeRole support for AWS credentials
- **added** — Add Bearer Token Authentication and SSL certificate support for JIRA
- **added** — Add Google Docs option to include tab content in get actions
- **added** — Implement initial version of @flowiseai/agentflow SDK
- **added** — Add ConditionBuilder with dynamic output ports to AgentFlow
- **added** — Add MessagesInput, StructuredOutputBuilder, and ExpandTextDialog components to AgentFlow
- **added** — Add async data fetching infrastructure to AgentFlow
- **added** — Add async input handlers to AgentFlow
- **added** — Add array input component to AgentFlow
- **added** — Add field visibility engine with conditional show and hide functionality
- **added** — Add requestInterceptor prop for API customization in AgentFlow
- **added** — Add nvmrc and Node engine support
- **added** — Add test infrastructure and unit tests for AgentFlow
- **changed** — Migrate to LangChain v1 and upgrade AI SDK and models
- **changed** — Improve node palette drawer and typography
- **changed** — Improve canvas node drag and drop behavior
- **fixed** — Fix missing regex handler in Condition node

##### ⚠️ Breaking Changes

###### HTTP security checks enabled by default

Flowise now enables **HTTP security validation by default** to prevent requests to unsafe or internal domains.

A built-in deny list blocks potentially dangerous domains (for example `localhost`, `127.0.0.1`, and other internal addresses) to mitigate SSRF and similar attacks.

Two new environment variables control this behavior:

```bash
#### Enable/disable built-in security checks (default: true)
HTTP_SECURITY_CHECK=true

#### Additional domains to block
HTTP_DENY_LIST=localhost,127.0.0.1,internal.company.com
```

* `HTTP_SECURITY_CHECK`
  Enables the built-in domain security checks. It is **enabled by default** and can be disabled by setting it to `false`.

* `HTTP_DENY_LIST`
  Allows you to specify an **additional custom list of domains** to block. This list is **empty by default**.

⚠️ If your Flowise deployment previously accessed **internal services or localhost endpoints**, you may need to:

* disable the check (`HTTP_SECURITY_CHECK=false`), or
* adjust your configuration accordingly.

---

#### What's Changed

##### 🚀 Core

* **Reasoning support, LangChain v1 migration, and AI SDK/model upgrades** (#5893)
* Add **Azure Blob Storage support** and storage refactor (#5604)
* Add **AWS STS AssumeRole support** for AWS credentials (#5731)
* Add **Bearer Token Authentication and SSL certificate support for JIRA** (#5674)
* Add **Google Docs option to include tab content** in get actions (#5883)
* Add **nvmrc and Node engine support** (#5770)
* Update **environment and initialization logic** (#5683)

---

##### 🤖 AgentFlow

###### New Features

* Initial implementation of **`@flowiseai/agentflow` SDK** (#5733)
* Add **ConditionBuilder with dynamic output ports** (#5957)
* Add **MessagesInput, StructuredOutputBuilder, ExpandTextDialog** (#5965)
* Add **async data fetching infrastructure** (#5937)
* Add **async input handlers** (#5956)
* Add **array input component** (#5887)
* Add **field visibility engine with conditional show/hide** (#5890)
* Add **requestInterceptor prop for API customization** (#5936)

###### UI / Editor Improvements

* Improve **node palette drawer and typography** (#5806)
* Improve **canvas node drag & drop behavior** (#5774)
* Add **node editing functionality** (#5786)
* Improve **flow date change & save handling** (#5833)

###### Refactors

* Rename package to **`@flowiseai/agentflow`** (#5825)
* Simplify **ReactFlow and context state synchronization** (#5827)
* Strip **server-only metadata from node data** (#5966)
* Improve **validation feedback system** (#5915)
* Use **design tokens for validation colors** (#5934)

###### Testing / Tooling

* Add **test infrastructure and unit tests** (#5749)
* Improve **test coverage and ESLint configuration** (#5866)
* Remove **console warnings in tests** (#5878)
* Bump **agentflow version to 0.0.0-dev.2 / dev.3** (#5920, #5952)

###### Bug Fixes

* Fix **duplicate node and drag behavior** (#5850)
* Fix **duplicate node handling and tests** (#5840)
* Fix **async multi-rendering issues** (#5964)
* Fix **ConditionAgent silent failure** (#5760)
* Fix **streaming field default in chat model configs** (#5856)
* Fix **AgentFlow variable interpolation issue** (#5818)
* Fix **package.json sideEffects configuration** (#5899)

---

##### 🔌 Nodes

* Fix **missing regex handler in Condition node** (#5651)
* Improve **form value resolution in executeNode** (#5762)
* Extract **loadNodesFromDir() from NodesPool for reuse** (#5904)

---

##### 🔒 Security

Major security hardening across the platform:

* Create **default HTTP deny list** (#5702)
* Always include **default deny list values** (#5708)
* Allow deny list configuration via **environment variable** (#5862)
* Enforce **HTTPS for user-provided URLs** (#5728)
* Remove ability to use **unprotected HTTP modules** (#5727)
* Implement **propriet

_[Truncated at 4000 characters — full notes: https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.1.0]_