Flowise End of Life: What Happens Now, and 7 Alternatives

Short answer, as of 26 October 2026: Flowise has reached end of life, but nothing in the sunset notice switches off a self-hosted install. The team froze the code on 29 July 2026, GitHub shows the repository archived on 13 August, and the sunset notice set 31 August as the end of the core team's presence. A self-hosted install keeps running. What ended is maintenance, which is a slower problem than a shutdown and a more confusing one, because everything still works on the morning you read about it.

The notice lives at flowiseai.com/sunset and is signed "Henry & Flowise Team" (Henry Heng is Flowise's co-founder). I read it when this post first went up on 13 September 2026 and again on 26 October 2026. If you fork, the part that matters is the enterprise directory, which sits under a commercial licence.

What stopped is the releases. When I checked the NVD on 26 October 2026, at least 11 CVEs published since the freeze described Flowise "through 3.1.4", the final release, as vulnerable. No fixed release exists, and the project's SECURITY.md says it no longer accepts new vulnerability reports.

So this post does three jobs. It sets out what happened and what it means for your flows, including the murkier question of Flowise Cloud. It answers the question most alternatives lists skip, which is whether to fork. Then it lists seven places to land, with my own product last and the reasons you would not pick it stated in the same section as the reasons you would.

Flowise end of life: what happened, and what did not

Two different things are easy to blur here: an open-source project being archived, and your instance stopping. Only one of them happened.

Left-hand columns: the Flowise sunset notice at flowiseai.com/sunset, read 13 September and 26 October 2026. Right-hand column: the GitHub repository, the npm registry and Docker Hub, read 26 October 2026, when the GitHub API returned archived: true for FlowiseAI/Flowise, a last push of 13 August 2026 and 55,529 stars.

The archive row needs a sentence of care, because the vendor's own sources disagree with each other. The notice planned the archive for 10 August, and on 26 October 2026 it still said so. GitHub's banner says the repository was archived on 13 August, and Henry Heng's "The Future of Flowise" post on GitHub, created that same day, gives 13 August as the archival date.

Read the right-hand column again. None of those rows deletes an account, expires a licence or stops a container. I have written about tools that did exactly that, and this is materially gentler than the way Relay.app wound down, where dated deadlines came attached to the data.

The vendor's stated reason, from the sunset notice, is worth quoting in full, because it explains the shape of this list.

"As AI models become more capable at reasoning, we've noticed that developers are increasingly relying on new coding agents such as Claude Code/OpenClaw to handle complex tasks. The typical rigid workflow low code approach quickly hits the limit when it comes to complexity."

Where Workday fits

On 14 August 2025, Workday announced that it had acquired Flowise, which had "over 42,000 GitHub stars" at the time, and its CTO Peter Bailis spoke of "investing in its open-source foundation". Workday's November 2025 release on acquiring Pipedream still listed Flowise among its recent acquisitions.

The sunset notice is signed by the Flowise team and does not mention Workday. I found no Workday statement about the sunset in the two Workday releases I read, so I will not offer a reason beyond the one the Flowise team wrote, quoted above.

The security ledger since the freeze

Now the part that decides your week. The final published version is flowise@3.1.4, dated 29 July 2026, the same day as the freeze. Since then, the US National Vulnerability Database (NVD) has published at least 11 CVEs whose descriptions name Flowise "through 3.1.4" as vulnerable.

NVD entries published between 1 July and 26 October 2026 that mention Flowise and describe it as vulnerable through 3.1.4, read 26 October 2026. The six September entries carry NVD status "Deferred", and four of them state that no patched version is available. The count is a floor: it only includes entries whose descriptions name 3.1.4.

CVE-2026-67622 is the worst of them. It is an insecure direct object reference in the OpenAI Assistants integration: an authenticated attacker supplies an arbitrary credential UUID and reads credentials belonging to other workspaces, enumerates assistant metadata, retrieves file and vector-store listings, and uploads files into somebody else's workspace. VulnCheck, the CVE numbering authority for this entry, scores it 9.9 (critical) under CVSS 3.1. NVD published it on 6 August 2026 and gives no primary score of its own.

CVE-2026-67620 came two days later, scored 7.7 (high) by VulnCheck. It is a server-side request forgery in the guard in httpSecurity.ts, where the deny list omits the Oracle Cloud metadata endpoint at 192.0.0.192 and the Alibaba Cloud metadata endpoint at 100.100.100.200, so a crafted URL to the fetch-links API can reach cloud metadata services and disclose temporary role credentials. The NVD description adds that unauthenticated access is possible when URL-fetching nodes exist in public chatflows. VulnCheck scores the other two 6 August entries, CVE-2026-67621 and CVE-2026-70636, at 7.6 and 7.5.

The repository's own GitHub security advisories tell the same story. Six advisories published on 10 September 2026 list flowise <= 3.1.4 as vulnerable with no patched version, and two are rated critical, both SSO account takeovers (GHSA-cffm-583c-vffr and GHSA-vf3j-89vf-r697). Their topics match the six CVEs NVD published on 26 September. There is also nowhere upstream to send the next report. The project's SECURITY.md now reads: "we are no longer accepting new security vulnerability reports for this repository."

None of this reflects badly on the team. The first five disclosures landed within two weeks of the wind-down being public, and CVE-2026-67622 and CVE-2026-67620 roughly a week after it. I am not going to predict what does or does not get patched from here. The operational fact is enough on its own: if your Flowise is reachable from the internet, that is the thing to deal with before you shortlist a replacement.

If you are on anything older than 3.1.4, upgrade to 3.1.4 first. Advisories published in late July and late August 2026 list dozens of issues fixed in 3.1.3 or 3.1.4, including a critical remote code execution through the SQL Database Chain node (GHSA-pwfj-wh95-7mwp, patched in 3.1.4). 3.1.4 is the release that carries those fixes.

Flowise Cloud: what can be observed

The sunset notice, the GitHub announcement and the Flowise docs say nothing about Flowise Cloud. There is no shutdown notice and no date, so here is what is publicly observable, with the date of each observation:

• On 26 October 2026 the pricing section of the flowiseai.com homepage still listed Cloud plans: Free at $0 with 2 flows and 100 predictions a month, Starter at $35 a month with 10,000 predictions, and Pro at $65 a month with 50,000 predictions, 5 users and $15 a month per extra user.
• Every Get Started button on that page pointed to cloud.flowiseai.com/signin. On 26 October 2026 that address did not resolve: public DNS returned only an alias to Cloudflare and no address a browser could reach.
• The Internet Archive's last successful capture of that sign-in page is from 6 September 2026, with no captures after 7 September.
• flowiseai.com/pricing redirects to a login page, and has done since at least 2 September 2026.

That does not prove a shutdown, and I will not call it one, because Flowise has not said so. If you see a Cloud shutdown date quoted elsewhere, check its source: none appears on Flowise's sunset page, its GitHub announcement or its docs. If you had flows on Cloud, ask Flowise in writing what happened to your data. Public sources do not say.

Should you fork instead of switching?

Ask this before you open a single pricing page. Dead-tool posts default to a switch-now framing, and for Flowise that default skips a real option, because the licence and the notice itself make forking a supported path.

For the Apache-licensed code, the permission is explicit. Apache 2.0 grants a "perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license", which an archive does not undo, and the sunset notice encourages teams to fork the repo. The archive locks issues and pull requests. The code stays where it is, and you can clone it today.

The licence caveat most fork advice misses

Flowise is only partly Apache 2.0. Its LICENSE.md puts everything under packages/server/src/enterprise, plus files with their own copyright notice such as IdentityManager.ts, under FlowiseAI's commercial licence. That licence lets you copy and modify the code for development and testing, but allows production use only if you have "a valid FlowiseAI Inc Enterprise Edition subscription". GitHub's API reports the repository's licence as NOASSERTION.

For a fork, that means auditing what your instance actually uses. If you rely on SSO, role-based access or workspaces in production, find out whether that code sits in the enterprise directory before you build a business on the fork.

What a fork costs to keep alive

Forking is a maintenance contract you sign with yourself, and the first clause is every open CVE against 3.1.4. You also inherit model provider SDK updates, Node and Docker base-image upgrades for as long as the fork lives, and your own build and publish pipeline, because npm and Docker Hub stop at 3.1.4.

Choose where the fork starts, too. The main branch is 10 commits ahead of the 3.1.4 tag. Those commits, dated 31 July to 13 August, include fixes such as "fix: upsert history permissions" and "add: permissions for bullmq endpoint" that never shipped in a release, so a fork built from the tag, from npm or from Docker Hub gets none of them. Starting from main gets them. Do not assume any of them closes a particular CVE, though; check each against the advisory text yourself.

Here is the rule of thumb I would use. Fork if Flowise is infrastructure: if you have already customised it, if real revenue depends on flows that would take weeks to rebuild, and if somebody on the payroll reads TypeScript and will still be there next year. Do not fork if Flowise was a convenience, which is the far more common case. A convenience is worth rebuilding. Infrastructure is worth owning.

There is a third answer, and for a lot of readers it is the correct one. Freeze it. Pull the instance off the public internet today, put it behind a VPN or an internal network boundary, keep it running for the flows that already work, and build nothing new on it. That buys you months to rebuild at a sane pace, and in most setups the cost is a small network change. Our AI agent security checklist covers what else to lock down while it stays up.

How I compared them

Same five questions for every tool on this page. They tell you more than a feature grid does, because they ask what you own after the move.

• Can you run it yourself, and under what licence? This is the question that sent you here. Apache 2.0 and MIT give you more than "source available" does, and the difference matters the next time a vendor changes direction.
• Who does the work? You sit at a canvas and wire the flow. Or somebody else built the worker already and your part is describing the task.
• What do you own after the move? Somebody still has to apply the next security patch. This question only asks who that is.
• How does the bill grow? Per run, per step, per seat, per credit, or flat. That one line explains most of the surprise invoices in this category.
• How close is the shape to a Flowise chatflow? A visual LLM graph, a general automation canvas and a Python state machine are three different jobs wearing similar words.

What I actually did, stated plainly so you can discount it correctly. On 13 September 2026 I read the Flowise sunset notice, the GitHub API record for the repository, the release history for version 3.1.4, and the first two CVE entries. On 26 October 2026 I re-read all of it for this update, along with the NVD entries and GitHub advisories filed against Flowise since the freeze, the npm and Docker Hub records, Flowise's licence files, and the pricing pages of n8n, Dify, Activepieces, Zapier and LangChain. Every figure below carries the date it was read.

For Langflow I report the licence, the cost of running it yourself and the free cloud account, and nothing about paid managed tiers. Check those before you budget. I have not run a bake-off across seven tools, and I am not going to pretend otherwise.

Quick comparison

n8n, Dify, Activepieces, Zapier and LangSmith figures are what those vendors' pricing pages showed on 26 October 2026. Langflow is shown by licence and its free options only. Gravity pricing is current as of October 2026. n8n prices in euros; no conversion applied.

Are the open-source options still shipping?

The whole reason you are here is a project that stopped shipping, so check the alternatives on that axis before anything else. Every self-hostable option on this list published a release in the week before this update.

GitHub API, read 26 October 2026. None of the five alternatives is archived.

1. n8n: a canvas with a company behind it

If what you want is a visual builder running on your own box by tomorrow, this is the shortest move on the page. n8n is self-hostable, the Community Edition costs nothing, and the node graph is close enough to a chatflow that an afternoon gets you productive.

Read the licence before you commit, because this is where a Flowise refugee gets caught. n8n ships under the Sustainable Use License, which the company calls fair-code. You can run it, modify it and use it internally without paying. You cannot sell it as a hosted product. If the Apache 2.0 grant was part of why Flowise was in your stack, moving here is a reduction in rights, and it is easy to miss on a pricing page. Files marked .ee. go further and need an n8n Enterprise License.

What you buy in exchange is the thing that just failed you. There is a company, a paid cloud and a release cadence (the latest release shipped on 26 October 2026), so the next security report has somewhere to go.

Why an n8n box costs about what a Flowise box cost

Self-hosting swaps an invoice for a person, and it is the same person you already have. The server, the upgrades and the backups stay yours exactly as they were. The single thing that changes is that upstream is still shipping, so patching is a docker pull.

Best for

A technical team that wants the canvas back on day one and will host it themselves anyway.

Pricing

Community Edition free to self-host. Cloud Starter 24 euros a month, or 20 euros a month billed annually, for 2,500 executions; Pro 60 euros monthly or 50 euros billed annually for 10,000. Above Pro, Business is 667 euros a month billed annually and listed as self-hosted only; Enterprise is quote-only. Read on n8n's pricing page on 26 October 2026, which bills by "monthly workflow executions, regardless of complexity". n8n pricing explained works through the self-hosting maths.

Free tier

The Community Edition is the free tier.

Verdict

The safest landing spot if you can live with fair-code. Best n8n alternatives covers the rest of that field, and Gravity vs n8n is the build-versus-buy version of the same question.

2. Langflow: the nearest thing to Flowise's exact shape

Langflow is the substitute if what you liked was the drag-and-drop LLM graph. IBM describes it as "a low-code, open-source app builder for RAG and multi-agent AI applications", Python-based and model-, API- and database-agnostic. Same idea, same shape on screen, different project.

The licence is MIT, so self-hosting costs you infrastructure and model tokens and nothing else. You can run it as Langflow Desktop on Windows or macOS, or locally with uv run langflow run on Python 3.10 to 3.14. If the whole point of leaving was to stop running servers, langflow.org also offers a free cloud account and promises the "same Langflow whether you're using OSS or Cloud".

Its creator, DataStax, is now part of IBM: datastax.com redirects to IBM's own DataStax product page, and when IBM announced the deal in February 2025 it said it would keep supporting the open-source Langflow community. Flowise had a large acquirer too, which is why the next paragraph matters.

One caution, and it applies to every open-source project you move to after this week. A repository being busy today is not a promise about next year. Flowise had 55,456 stars when I pulled the GitHub API record on 13 September 2026, and 55,529 on 26 October, and it is archived. Look at commit frequency over the last ninety days, at how many distinct people have merge rights, and at who is paying them.

The migration is a rebuild even here

Langflow is the closest visual match on this page and it still cannot import a Flowise chatflow: its import docs cover Langflow JSON files. You will be recreating the graph by hand, node by node, reading your exported JSON on one screen and rebuilding on the other.

The reason to pick it is continuity. You keep the mental model, your team keeps its vocabulary, and the diagrams in your internal docs still mean something. That is worth more than it sounds when you are also explaining to a client why the thing needs rebuilding at all.

If your instance was three chatflows and an embed, budget an afternoon per flow and start with the one you use daily. Gravity vs Langflow is the comparison to read if the rebuild itself is the part you were hoping to skip.

3. Dify: best if the flows were really RAG apps

Was your instance really document question-answering with a chat widget bolted to the front? Then Dify is the shorter rebuild, because retrieval is the product itself.

Read the licence before you build a product on it. Dify ships under "a modified version of the Apache License 2.0": operating it as a multi-tenant service, or removing Dify's logo and copyright from its frontend, needs a commercial licence from LangGenius. Check the workspace count before you assume internal use is covered: the licence counts each workspace as a tenant. If you intend to run it as a service for other organisations, that is a conversation with a lawyer.

What comes built in

Monitoring comes in the box. The docs list a dashboard, logs and annotation, integrations with LangSmith, Langfuse and Opik, and a retrieval test screen for checking what a knowledge base returns before you ship it. That is the part every team eventually builds badly for itself. Finished apps can be published as a web app, an API, an embed or an MCP server.

Best for

The team whose Flowise instance was a knowledge base with a chat box in front of it.

Pricing

Self-hosting the community edition is free, plus your server and model tokens. Dify Cloud: Sandbox free (200 message credits, 5 apps, 1 member); Professional $59 per workspace a month or $590 a year; Team $159 a month or $1,590 a year. Read on Dify's pricing page on 26 October 2026. Dify pricing history tracks how those tiers have moved.

Free tier

Yes, the Sandbox tier on Cloud, and self-hosting costs no licence fee.

Verdict

The shortest rebuild of the seven if your use case was retrieval.

4. Activepieces: open source without owning the box

Activepieces answers the specific problem that brought you here, which is that owning a server is how you ended up with an unpatched CVE in the first place. The core is MIT licensed (its ee directories are commercial), and the pricing table lists "Cloud or on-prem" hosting on every plan. You pick which one.

How the credits add up

The billing unit is as simple as n8n's for flows without AI in them. One credit covers a whole run however many steps it has, so you can price a plain automation before you build it. AI steps are the exception: 2, 10 or 20 credits each depending on the model, or 1 with your own provider keys on Plus and up. The free plan includes 1,000 monthly credits with no card on file.

The shape is automation. Triggers, actions, branches, with AI steps available inside them. If your chatflows were agents with tools and memory, you will be re-expressing them, and that is a different mental model to learn on top of a migration you did not ask for. Count the AI steps in each flow before you estimate the bill, because they are where the credits go.

Best for

The reader who wants to stay in open source but has decided, this week, that they are finished being the ops team.

Pricing

Free with 1,000 monthly credits, no card. Plus $20 a month, or $16 billed yearly, for 10,000 credits, then $0.007 a credit; Team $200 a month, or $166 billed yearly, for 50,000 credits and 25 users. Read on the Activepieces pricing page on 26 October 2026. Activepieces pricing history shows how the plans got here.

Free tier

Yes, 1,000 monthly credits with no card.

Verdict

The best compromise between keeping the licence and dropping the pager.

5. LangGraph: if the flows belong in code

Go back to the reason the Flowise team gave. They said the rigid low-code workflow approach hits a limit when things get complex, and that developers are relying on coding agents such as Claude Code for complex tasks. The notice names no framework. If an engineer owns your flows, a code framework like LangGraph is the nearest destination in that direction.

LangGraph is an MIT-licensed Python library that treats an agent as a state machine: explicit nodes, explicit edges, explicit state. Its README promises durable execution, with agents "automatically resuming from exactly where they left off", and human-in-the-loop control for "inspecting and modifying agent state at any point during execution". It had 43,925 GitHub stars on 26 October 2026, and release 1.2.17 shipped two days earlier. Our open-source AI agent frameworks comparison sets it against the other code-first options.

You lose the canvas, and for a non-technical owner that single sentence ends the discussion. For a team already writing Python, losing the canvas is the point: version control, tests, code review and a diff you can read all come back, and moving to code raises the complexity ceiling the Flowise team described.

The trade the sunset notice describes

Flowise's own team said the low-code shape runs out of room. Moving into code raises that limit and puts an engineer in the path of every future change. Price that cost now. I make the longer version of this argument in why I'm betting against workflow platforms.

The library is free. If you want LangChain to host it, that is LangSmith Deployment: Plus is $39 a seat a month with one small serverless deployment included, per LangChain's pricing page on 26 October 2026.

Pick this if an engineer already owns the flows and they had outgrown the drag-and-drop shape before any of this happened. Read the frameworks comparison first, then write one flow in it before you commit the rest.

6. Zapier Agents: nothing to host, ever

The opposite end of the range from a forked repository. There is no source code to own, no container to patch, and no repository that can be archived out from under you. You describe what the agent should do in plain English, connect accounts through an ordinary login, and it runs on somebody else's infrastructure.

The trade is complete and you should look at it directly. No source, no self-hosting, and a vendor who can change the product whenever they like. After the week you have just had, some readers will find that disqualifying and some will find it restful. Both reactions are rational.

What the catalogue buys you

What it buys is reach. Zapier lists 9,000+ apps, the largest count on this page (Activepieces lists 770+), so the obscure app that had no Flowise node probably has a Zapier one. Agents sit inside the same account as your Zaps, and their allowance is listed separately from Zap tasks: Agents is an add-on metered in "activities". Agents Free gives 400 activities a month; Agents Pro is $50 a month, or $33.33 a month billed yearly ($400), for 1,500.

It fits the owner-operator who has concluded that running infrastructure was never their job. The platform plans page shows a free tier with 100 tasks a month, Professional from $19.99 a month on annual billing or $29.99 paid monthly, and Team from $69 a month on annual billing or $103.50 paid monthly. Read on 26 October 2026. Zapier pricing explained does the task maths in full.

7. Gravity: for the reader who is done owning infrastructure

This is my product, so weigh it accordingly. It is last because it is the least like Flowise of anything on this page, and because I would rather you read the six above first.

Gravity is a hosted platform. If the Apache 2.0 licence, or running the thing on your own box, was a real reason Flowise was in your stack, stop reading here and pick one of the six above. I would rather say that in the first two lines than have you discover it in week two.

What it does instead is remove the build. You type the task in plain words, Gravity matches it to an expert-built agent, and that agent runs it. Recurring automations can run on a schedule. There is no graph for you to wire and no instance for you to patch, and that is the entire pitch after an archived repository.

The one argument for it after an archived repo

Flowise's wind-down handed you a maintenance job you never applied for. Gravity is the option where you describe the outcome and never open the hood. Gravity is in public beta, and as of 26 October 2026 the catalogue lists eight agents, Inbox assistant (Gmail) and Slack ops review among them, so check that the job your chatflow did is covered before you count on it.

Best for

The solo operator or small team whose Flowise instance was doing one recurring job, and who never wanted a server in the first place.

Pricing

Basic is free with one agent, no card. Pro is $5 a month during the beta, and Max is $20 a month. Buy more usage if you run out. Details on the pricing page, as of October 2026.

Free tier

Yes. Basic: one agent, free, no card.

Verdict

Right only for the reader who concluded from all this that they do not want to maintain infrastructure at all. Gravity vs Flowise puts the two models side by side.

Migration: what you actually carry over

Rebuild is the realistic path, whichever of the six you pick. Flowise's own docs describe an Export option in the dashboard: select the data you want, then save the exported JSON file. That JSON is a portable record of what you built. Langflow, the closest tool here, documents imports of Langflow JSON only, so plan on rebuilding by hand.

The thinking transfers, and it is worth more than the file. Your prompts, your chunking choices, your tool list, your retry logic and the order of operations are all reusable in any of these. Copy them out of the JSON into a plain document before you open a new tool, because that document is the actual asset and it survives every future migration too.

Credentials do not transfer. The docs are blunt about it: "Credentials are not exported. You will have to create new credentials and use those in the flows and assistants." Custom nodes written against the Flowise runtime do not transfer either, because nothing else runs them. Anything that depended on a component unique to Flowise becomes a design decision.

A migration checklist for Flowise

1. Close the network first. Take the instance off the public internet, and if it runs anything older than 3.1.4, upgrade to 3.1.4.
2. Export everything you might need. Use the dashboard Export to save each flow and assistant as JSON, and keep the files somewhere that outlives the instance.
3. List every credential by hand. API keys, OAuth connections and model settings are not in the export, so write down what each flow used.
4. Write the spec. Copy prompts, chunking choices, tool lists and retry logic into a plain document, flow by flow.
5. Mark the Flowise-only parts. Custom nodes and unusual components each need a decision before the rebuild starts.
6. Rebuild the flow you use most, first. Run old and new side by side on the same inputs until the outputs match well enough to trust.
7. Switch over, then retire. Point users and embeds at the new flow, keep the old instance closed off for a short rollback window, then shut it down.

Our AI agent migration planning guide covers the same sequence in more depth, including shadow runs and decommissioning, for a move off any automation tool.

Which one should you choose?

Start from what you want to own after the move. Owning things is what just cost you a week.

Want the canvas and happy to keep a server running? n8n, with the fair-code caveat read properly, or Langflow if the visual LLM graph was the appeal and MIT matters to you.

Documents and a chat box? Dify, and it is the shortest rebuild of the seven.

Open source, and you never want to patch a box again. Activepieces runs the same product on their cloud at the price of your own.

An engineer already owns this and the flows had outgrown drag-and-drop before July. LangGraph is the code route. The Flowise team said developers are relying on coding agents such as Claude Code for complex tasks; the notice names no framework, but a code framework like LangGraph is the nearest destination in that direction.

If you never want to read another licence, Zapier Agents. You give up every right you had, and you get back the evenings.

If Flowise is load-bearing infrastructure you have already customised, and somebody who reads TypeScript will still be on the payroll in a year, fork it. Budget for the 11 CVEs against 3.1.4 in the first sprint, read the enterprise licence before you ship, and treat the fork as a product you now maintain.

If your flows lived on Flowise Cloud, none of the above comes first. Ask Flowise in writing what happened to your data, gather whatever exports and notes you still have, and then choose.

My own bias, stated plainly. For a recurring business task that a published agent already covers, I would pick the option where you build nothing. That is Gravity, where your first 5 agent runs are free, and if you want the cheaper end of the whole category instead, the cheapest AI agent platforms and the best platforms under $50 both include options I did not list here.

FAQ

Sources