Flowise

Flowise's core proposition was a drag-and-drop canvas over LangChain/LlamaIndex-style primitives that you could run entirely on your own infrastructure — npm install -g flowise or a Docker image, no account required. The integration breadth was real rather than marketed: the final release ships 29 chat-model integrations, 24 vector-store integrations and 40 tool integrations, alongside separate node categories for document loaders, embeddings, memory, retrievers, text splitters, moderation, output parsers, caching and speech-to-text, plus agentflow, multiagent and sequential-agent node sets. Adoption backed this up: 55,370 GitHub stars and 24,900 forks, 6,786,404 Docker Hub pulls, and 13,940 npm downloads in the month to 9 August 2026. For teams who wanted a visual layer non-specialists could touch, on-prem, without handing prompts to a SaaS, it was a credible and unusually complete answer — which is why the shutdown matters rather than being a footnote.

The GitHub repository now carries the banner 'This repository was archived by the owner on Aug 13, 2026. It is now read-only.' Maintainer Henry Heng posted the reasoning in Discussion #6727 and on flowiseai.com/sunset, and it is worth reading in the team's own words rather than paraphrase: 'As AI models become more capable at reasoning, we've noticed that developers are increasingly relying on new coding agents such as Claude Code/OpenClaw to handle complex tasks. The typical rigid workflow low code approach quickly hits the limit when it comes to complexity.' The published timeline is: 29 July 2026 code freeze and no further PR reviews; repository archival (the sunset page says 10 August, the GitHub banner records 13 August); and 31 August 2026 end of life, when 'official core team presence in Discord and GitHub will conclude.' Two small factual corrections to that timeline, both verifiable: pull requests were in fact still being merged after the stated code freeze, with the last merge on 13 August 2026; and as of 16 August 2026 the npm package has not actually been marked deprecated — the string does not appear anywhere in the registry metadata — despite the announcement saying npm packages and Docker images would be flagged at archival. The last release is [email protected] (29 July 2026) and the last Docker image push was 31 July 2026. The source stays online and Apache 2.0; the team explicitly encourages forking.

The sunset announcement does not mention it, but Flowise has been owned by Workday since 14 August 2025. Workday's own press release described acquiring 'an industry-leading agent builder' and said that by 'bringing Flowise into Workday and investing in its open-source foundation, we are empowering our customers and partners to build and deploy their own AI agents on Workday.' The wind-down came roughly twelve months later. Workday did not disclose deal terms in the release. This context is not an accusation — post-acquisition wind-downs are ordinary — but it is directly relevant to a buyer weighing whether the codebase has an institutional sponsor who might revive it, and to anyone reading the 2025 commitment to the open-source foundation as a durability signal.

The hosted product remains on sale today. The homepage lists Free at $0/month (2 flows and assistants, 100 predictions/month, 5MB storage), Starter at $35/month (unlimited flows, 10,000 predictions/month, 1GB storage, community support), and Pro at $65/month (50,000 predictions/month, 10GB storage, unlimited workspaces, 5 users then +$15/user/month, admin roles and permissions, priority support), with Enterprise via email. The Starter tier is still labelled 'Most Popular' and its button still reads 'Get Started — First Month Free'; the affiliate programme offering '20% commission for 12 months' is also still live. A site-wide banner says 'We're sunsetting Flowise' and links to the sunset page — but that page's table is headed 'Impact on OSS Repository' and every row concerns the GitHub repo. There is no stated shutdown date for the hosted service, no migration or data-export guidance, and no refund policy for annual or in-flight subscriptions. The cloud sign-in page at cloud.flowiseai.com carries no wind-down notice at all. Anyone considering paying should get an end-of-service date and an export path in writing from [email protected] before entering card details.

This needs stating carefully, because the raw numbers flatter nobody but the trend is to the team's credit. OSV lists 112 published advisories affecting the npm flowise package. Of the 100 most recent, 25 are rated critical, 57 high and 18 medium — and 26 of them were published in August 2026 alone. Crucially, almost all are already fixed: patched versions cluster at 3.1.0 (39), 3.1.3 (36) and 3.1.2 (19), all at or below the final 3.1.4 release, meaning the team was absorbing a heavy stream of researcher reports and shipping fixes right up to the freeze. So a self-hoster on 3.1.4 today is patched against nearly everything known. The exposure is what comes next: four advisories in that set have no patched version at all and now never will, including two rated critical — GHSA-2vv2-3x8x-4gv7 ('Flowise OS command remote code execution', August 2025) and GHSA-hmgh-466j-fx4c ('Flowise vulnerable to RCE via Dynamic function constructor injection', October 2025). The practical risk is well demonstrated: CVE-2025-59528, a CVSS 10.0 code-injection flaw in the CustomMCP node, was patched in 3.0.6 back in September 2025, yet BleepingComputer reported it being actively exploited in attacks in April 2026 — against deployments that had not updated. From now on there is no update to miss, because there will not be one. If you keep Flowise in production, treat it as unmaintained software: put it behind authentication and network controls, assume the node-execution surface is hostile, and accept that you own the patching.

Flowise was never uniformly Apache 2.0, and the distinction becomes sharper once the company is gone. Everything under packages/server/src/enterprise — which contains the sso and rbac modules, plus their controllers, routes, services, middleware and database code — is covered by a separate FlowiseAI Commercial License. Its terms state the software 'may only be used in production' if you hold a valid Enterprise Edition subscription for the correct number of hosts; copying, modifying and testing for development is permitted without one. So single sign-on and role-based access control, the two features most likely to be required by the enterprise buyers most inclined to self-host abandoned software, are precisely the parts you cannot lawfully run in production without a subscription from a company that is winding down. Everything outside that directory is Apache 2.0 and genuinely yours to fork, as the sunset announcement says. If SSO or RBAC are on your requirements list, that is a legal question to resolve before a technical one.

The team's recommendation is that teams 'fork the repo to maintain their own internal updates or community-led forks.' As of 16 August 2026 — three days after archival — no community successor has emerged with any traction: the most-starred forks of the repository top out at around 15 stars and are personal or derivative projects rather than maintained continuations. That is not surprising this early, and it may well change; but a buyer should not treat 'just fork it' as a plan that someone else has already executed. Forking Flowise means owning a large TypeScript monorepo with an active vulnerability-research audience pointed at it. Documentation is still live at docs.flowiseai.com, though the FlowiseDocs repository is archived too, so mirror anything you depend on rather than assuming it persists.

Independent commentary on Flowise is thinner than its star count suggests, and much of what surfaces in search is written by direct competitors — several commenters in the Hacker News thread on the shutdown disclosed that they sell rival products, and those views are not cited here. One hands-on account from a reader who evaluated the self-hosted version for an internal tool is worth relaying with the caveat that it is a single anonymous recollection rather than a benchmark: they reported that it 'became increasingly slow as I added flows (felt like a O(n^2) ish bottleneck)', along with 'many bugs and bad UX', a 'flow variable system [that] was underbaked and underdocumented', and feature gaps, concluding they were not the target audience. That matches the general shape of the category — visual builders that are pleasant at small scale and awkward as graphs grow — and it is also, notably, close to the reason the team themselves gave for winding down.