Dify 1.19.0 brings nested workflow tracing to your observability tools. Follow a workflow into the Workflow Tools it calls, inspect the steps inside each invocation, and keep the LLM context alongside the execution tree.

This release also makes Workflow Tools portable with App packages, adds Skill Hub automation, and makes Agent files easier to upload and preview. The bundled plugin daemon is upgraded to 0.6.14-local.

Release highlights · Upgrade guide · Detailed changes

Release highlights

Nested workflow tracing

See what happens inside a Workflow Tool, all the way down to its LLM calls.

Building on the Console drilldown introduced in 1.18.0, new external traces now include the persisted execution steps inside called Workflow Tools. Child steps appear beneath the Tool span that invoked them, preserving the hierarchy across nested and repeated calls. (#44673)

From the outer workflow to a nested LLM call: the execution tree and formatted messages, together in Langfuse. Screenshot from #44673.

• Follow the hierarchy. Expand called Workflow Tools to see their internal execution steps under the invoking Tool span.
• Understand each invocation. Repeated calls and failures retain their place in the trace.
• Keep the LLM context. Inspect formatted prompts and responses, token usage, and project, trace, and observation links.

Take Workflow Tools with your apps

Export an app and bring the workflows behind its Workflow Tools with it. .ifpkg packages include those workflows at their bound versions, including transitive dependencies. Import reuses tools already in the destination workspace and recreates, publishes, and registers missing ones, remapping their references. (#44592)

All Dify app exports now use package format v2, including apps without Workflow Tools. Existing v1 imports and explicit YAML export remain supported. See the upgrade guide before importing new packages into older installations. (#45353)

Upload together. Preview in place.

Select or drop multiple Agent configuration files and upload them in parallel. Successful uploads are bound in one atomic batch, concurrent Composer saves preserve the latest files, and Prompt uploads keep the cursor position while inserting multiple references. (#44947)

Read PDFs inline, inspect source files with syntax highlighting, and see when text has been truncated. Previews cover configured files, Skill members, and working-directory files, with a download action when a PDF cannot be loaded. (#45032, #45045)

Developer spotlight

Manage workspace Skills through OpenAPI and difyctl. Find and inspect Skills, export a draft or published version, import local files, and publish a new version from the command line. (#44941)

These operations require an account caller, the corresponding workspace permissions, and Skills to be enabled. Import does not publish. Importing over an existing Skill is classified as destructive; the operation catalog and CLI help distinguish read, write, and destructive operations. (#44941, #45314, #44587)

Upgrade guide

Compatibility and rollout

1. Back up first. Retain the database, vector-store data, uploaded files, Agent snapshot/workspace storage, deployment secrets, and environment files. Use a maintenance window for a single-stack upgrade.
2. Upgrade the components together. Use matching 1.19.0 API, worker, web, Agent Backend, and Local sandbox images, with plugin daemon 0.6.14-local. Keep the existing Local sandbox authentication token and any configured PASSWORD_PEPPER unchanged. If upgrading from before 1.18.0, also follow the 1.18.0 upgrade guide.
3. Use Docker Compose 2.35.0 or later. This is the minimum supported version for root .env overrides to take precedence when Compose resolves service defaults. Check your installed version with docker compose version. (#45359)
4. Keep tracked defaults separate from local overrides. Bundled docker/envs/**/*.defaults files load automatically. Customize a service through its matching local .env file, using the override path documented in the defaults file; root docker/.env holds deployment inputs and explicit overrides. Preserve existing .env files and edit them in place. Review accidentally empty assignments and values pinned by older template copies before upgrading. (#45359, #45376)
5. Existing shared.env files remain supported. Common API, worker, and Beat customizations now belong in docker/envs/core-services/api-worker.env. Compose still reads legacy docker/envs/core-services/shared.env first, then api-worker.env, so api-worker.env wins when both set conflicting values. Root docker/.env takes precedence over both. An unchanged copy of api-worker.defaults preserves existing shared.env customizations. See the Docker configuration guide. (#45376)
6. Separate tracing queues during a rolling upgrade. New tasks default to OPS_TRACE_QUEUE=ops_trace_v2; API, workers, and Beat must agree. Custom CELERY_QUEUES, CELERY_WORKER_QUEUES, or --queues lists must include the new queue. Keep old tracing workers on ops_trace until old producers and all their queued, active, reserved, scheduled, and retry work have finished. Do not purge the old queue or ask the new retired handler to export legacy messages. See the tracing rollout guide. (#44673)
7. Upgrade package destinations before importing new App packages. New app packages always use format v2. Older importers, including builds with the earlier strict v2 rule, may reject them. Version 1 imports remain supported on 1.19.0. Explicit YAML export remains available, but does not carry bundled Workflow Tool dependencies. (#44592, #45353)

cd dify/docker
docker compose stop -t -1
git fetch --tags
git checkout 1.19.0
# Merge required configuration changes into existing env files here.
docker compose pull
docker compose up -d

Dify 1.18.0 brings Agents that route workflows, portable app packages, deeper visibility into nested workflow runs, and the opt-in Agent Knowledge Base experience. OpenAPI and the new difyctl expand how you build and manage apps from the command line.

Release highlights

Agents that choose the next step

Let an Agent decide which workflow branch to take. Enable Output Routes, give each route a selection condition, and connect it to the next step—such as resolving a request directly or handing it to a specialist. The read-only switch output exposes the chosen route. (#42599)

Output Routes configuration with two branches in the workflow editor.

Plain Agent v2 nodes also stream text as it is generated. Structured results, routed results, and nodes using default-value error handling remain buffered. (#43986)

Portable apps in one package

Move an app with its supported resources in a single .ifpkg package. Workflow and Chatflow packages carry inline Agents, Skills, and their files; imports recreate those resources in the destination workspace and remap references. File and URL imports support both packages and YAML, and explicit YAML export remains available. (#42066, #42579, #42626, #42863)

Studio's .ifpkg import preview.

See inside nested workflow runs

Open a Workflow Tool invocation from the run history and inspect the child workflow's individual steps. Nested tools now run as child graphs with coordinated pause, resume, stop, and file outputs. Access checks protect the source app's details. (#40277, #42819, #42820, #42821, #42822)

Trace drilldown into a successful Workflow Tool invocation.

Nested usage and step totals can still be approximate, particularly after a pause or stop. Console drilldown and external trace export have different scopes; see the full feature details below.

Agent Knowledge Base · Beta

Create a knowledge space for your agents, add files or connect sources, and inspect document processing, metadata, retrieval traces, and quality evaluations in one place. The new Knowledge Retrieval node and Agent integrations share access-controlled KnowledgeFS spaces. Classic Knowledge remains available. This is an opt-in integration with a separate service and database; see the deployment requirements below. (#44165)

Will soon be available on cloud.dify.ai

Developer spotlight

Build and manage apps with OpenAPI and difyctl. The CLI discovers commands from the server's operation catalog, with searchable help and support for Workflow and Chatflow creation, DSL import/export, settings, environment variables, publishing, and version restoration. Draft hashes protect concurrent edits. (#42487, #42608, #43067)

Install the bundled skill for agents building Dify apps:

difyctl install skills <dir>

The new client requires a fresh sign-in; see the deployment instructions below. (#43819)

Upgrade guide

Compatibility and Rollout

1. Back up first. Retain the database, vector-store data, uploaded files, Agent snapshot/workspace storage, and all deployment secrets and env files. Use a maintenance window for a single-stack upgrade.
2. Upgrade the Agent components together. /runs now accepts composition v2 and rejects v1 requests. Existing session snapshots are converted on read and saved as v2; old runtimes cannot read newly saved v2 snapshots. Direct Agent Backend integrations must update their request format. The old Agent-specific AskHuman tool and deferred resume path are removed: historical Agent forms no longer resume execution, while shared Workflow Human Input nodes remain supported. (#43833)
3. Retire old workflow consumers before admitting new-version traffic. Let in-flight runs finish, then replace legacy workers/resume consumers so they cannot process the shared queue without the new cancellation guards. Legacy paused task IDs can be recovered from valid saved invocation snapshots within the existing access scope; missing or invalid snapshots require separate recovery. Nested usage totals retain the limitation noted above. (#40277)
4. Configure the Local sandbox token before restart. Supply a high-entropy secret through the shared Compose interpolation source. The 1.17.1 runtime image does not support the new --require-auth-token flag; deploy the matching 1.18.0 Agent Backend and Local sandbox images. (#44152)
5. Preserve password hashing configuration. Existing installations without a pepper should leave PASSWORD_PEPPER empty. Setting a new pepper during the upgrade is not a transparent migration and requires an explicit password-reset plan. Keep any configured pepper unchanged across all instances and restore it with the database.
6. Review the proxy boundary. Bundled Nginx replaces X-Forwarded-For with its resolved client address, and Compose enables forwarded-header handling. Keep direct API access restricted to trusted callers. If a load balancer or Cloudflare sits before Nginx, configure trusted real-IP handling there; otherwise visitors may share the proxy’s rate-limit bucket. See client IP and trusted proxies.
7. Enable KnowledgeFS deliberately. Default Compose installations keep it off; local Community Edition development requires the explicit Community development opt-in. Configure its separate database and migrations, Capability v2 public verifier, Dify signing keys, model profile (embedding, reasoning, and rerank), and Workspace cutover gates before enabling traffic. The optional service must pass /ready, not only /health. Standard Dify API images do not contain the separate KnowledgeFS engine used by the optional engine-worker profile; the published default KnowledgeFS API image is currently amd64 only. Follow the KnowledgeFS deployment and recovery guide.

cd dify/docker
docker compose stop -t -1
git fetch --tags
git checkout 1.18.0
# Merge required configuration changes into existing env files here.
docker compose pull
docker compose up -d

uv sync --project api --frozen
uv run --directory api flask db upgrade
pnpm install --frozen-lockfile

difyctl login --server https://your-dify.example.com
difyctl help

Detailed changes

New Features

Dataset-Scoped Knowledge Base API Keys

• Knowledge base service-API keys were scoped to the whole workspace: one key could read and write every knowledge base in the tenant, so giving an integration access to a single knowledge base meant giving it access to all of them. Keys can now be bound to specific knowledge bases from the knowledge base's API access panel, with a workspace / this-knowledge-base scope selector at creation time. A bound key returns 403 for any other dataset — both documents and retrieval — and for endpoints that carry no dataset ID, such as list-all. Existing keys are unbound and keep their workspace-wide behavior, so nothing changes when you upgrade. (#37569)

Keyboard Movement for Workflow Nodes and Comments

• The workflow canvas required a mouse to reposition anything. Nodes, multi-node selections, comment markers, and draft comments can now be moved with the arrow keys — hold Shift for larger steps — including Note, Iteration, and Loop nodes. Continuous movement is committed on key release or blur, so it produces one undo entry rather than one per keypress, and read-only mode, container boundaries, and collaboration updates are all still respected. (#41967)

Marketplace Creator Profiles and Homepage Redesign

• Plugin authors now have public profile pages at /marketplace/creator/<handle>, listing their creations with a publisher sidebar, reachable from a new Creator Center entry in the sidebar help menu. The marketplace homepage was rebuilt around a hero, a banner carousel, sticky search, catalog tabs, and tag/language filters, with a stacked-and-swipeable mobile layout. Bundles are no longer mixed into plugin categories. (#41538)

Configurable Markdown Form Field Name Length

• The Markdown form field-name limit was hard-coded at 128 characters, with no way to accommodate longer generated field names. It is now configurable through MARKDOWN_FORM_FIELD_NAME_MAX_LENGTH (Docker) or NEXT_PUBLIC_MARKDOWN_FORM_FIELD_NAME_MAX_LENGTH (direct Web deployments), defaulting to the previous 128. Character validation and prototype-pollution protections are unchanged. (#41697)

Bug Fixes

Knowledge Base

This release fixes a cluster of extraction bugs that changed document content without reporting an error. Re-import affected documents after upgrading; indexed text is not retroactively repaired.

• CSV cells were passed through pandas type inference before indexing. Leading-zero codes became floats (00123 → 123.0), empty cells became the literal string nan, and cells containing NA or NULL became missing values. The extractor now reads everything as text and disables missing-value inference; an explicit csv_args still overrides this for callers that want typed parsing. (#41922)
• Notion table rows lost or gained columns. Each rich-text segment inside a cell was emitted as its own Markdown column, so any cell with mixed formatting — bold, links, mentions — produced extra columns and corrupted the table, while an empty cell was skipped entirely and shifted the rest of the row left. Cells are now emitted one-per-column with their segments concatenated. (#41993)
• Notion database properties were truncated at the first formatting change. rich_text and title properties read only their first segment, so a title of Hello world with world in bold was indexed as just Hello . All segments are now joined. (#42050)
• .xls cells containing double quotes corrupted the row. The extractor emits "column":"value" pairs; the .xlsx path escaped embedded quotes but the legacy .xls path interpolated them raw, so he said "hi" became "note":"he said "hi"". Both engines now behave the same for the same content. (#42049)
• Any PDF loaded from a URL crashed with a bare AssertionError. After tenant context was added to the PDF extractor, the code path used by load_from_url — including the built-in web scraper whenever a target returns Content-Type: application/pdf — asserted on an upload record that URL loads never have. Tenant context is now optional, image extraction is skipped when it is absent, and text extraction works again. (#41950)
• The built-in web scraper returned Python data structures instead of page text. readabilipy hands back plain_text as a list of dicts, which was interpolated straight into the output template, so every scraped page came back as [{'text': '<p>…</p>'}, …] — dict syntax, quotes, and HTML tags included. The items are now flattened into readable text. (#41954)
• Partial segment updates wiped attachments. A segment update that omitted attachment_ids was treated as "replace with nothing", deleting the segment's attachment bindings and multimodal vectors. Attachments are now left alone unless attachment_ids is explicitly provided; passing [] still clears them. (#41777)
• Documents with invalid Markdown image links could stall the indexing queue. Relative, protocol-relative, data:, ftp:, and malformed image targets were all handed to the remote image fetcher and entered its SSRF retry loop, so a single document with many bad references could hold an indexing worker long enough to back up everything behind it. Non-fetchable targets are now validated and skipped. (#41343)
• Deleting content left orphaned files in object storage. Segment deletion, multimodal re-indexing, and batch document deletion each removed the database rows but left the physical attachment objects behind. All three paths now delete the underlying objects after the database commit, with an orphan check so attachments shared by other segments survive. (#41400, #41999, #41256)
• Text file previews were misreported as binary. When the preview byte limit cut through a multi-byte UTF-8 character, strict decoding failed and the whole file was classified as binary — reproducible on a default preview with a single non-ASCII character at the 256 KiB boundary. Previews now keep the longest complete UTF-8 prefix; files with genuinely invalid encoding are still reported as binary. (#41761)

Model Providers

• Upgrades from pre-1.15 no longer leave models unusable, and no longer need a manual command. Installations older than 1.15 still carry legacy model type values (text-generation, embeddings, reranking) in their provider tables, which makes model-related API requests fail and prevents affected models from loading. Both 1.16.1 and 1.17.0 shipped this as a separate flask data-migrate legacy-model-types step that had to be run by hand. It now runs as part of flask db upgrade: legacy values are canonicalized to llm / text-embedding / rerank, legacy-versus-canonical row collisions are resolved deterministically while preserving credential references, and the provider cache namespace is rotated so stale cached credentials cannot shadow the migrated rows. (#41326, fixes #41294)
• The built-in file upload data source asked for authorization it does not need. When creating a RAG Pipeline knowledge base, local file upload showed "Please authorize first" and the creation checklist flagged it, because providers that declare no credentials schema never have a stored-credential row and were therefore always reported as unauthorized. Credential-free providers are now marked authorized directly. (#39772)
• Provider-scoped credential validation rules are now applied, and missing tool credentials are surfaced instead of failing opaquely. (#41659, #41726)

Workflow & Triggers

• Human Input forms could finish a workflow while leaving it looking stuck. Since the HITL callback migration in 1.17.0, submitting a form left its approval buttons on screen and the published Web App input blocked, because the engine emitted a generic node-success event without the form-filled or timeout events the response pipeline expects. Those events are now reconstructed, preserving submitted file values, original timeout deadlines, and execution metadata. (#42082)
• Human Input could not be placed inside Iteration or Loop nodes, even though 1.17.0 shipped the runtime support for it — two stale editor guards still blocked selecting, connecting, and pasting the node inside a container. (#40061)
• The Human Input timeout edge could fire the wrong branch. The editor writes the timeout edge as __timeout, but the backend compared against __timeout__, so at runtime a timeout could take a user-action branch instead of the timeout branch the author drew. (#40746)
• A second Human Input pause in the same run could become unresumable. If object storage rejected deleting the previous pause snapshot, the exception aborted the transaction — the run was already persisted as PAUSED, but its only pause row was the previous, already-resumed one, so the next submission failed with Cannot resume an already resumed pause. Snapshot cleanup is now best-effort, with the orphaned object key logged for later cleanup, so the run's durable state stays correct. (#41581)
• Workflow-as-Tool only exposed the first End node's outputs. Output declarations are now collected from every End node, with the source node listed for each, one warning per output affected by a duplicate or reserved name, and a fallback to the published schema when live draft metadata is unavailable. (#41517)
• Loop Boolean break conditions never matched. New conditions stored "true" / "false" as strings rather than booleans. Values are now stored and k...

New Features

Agent: E2B Sandbox, Home Snapshots, and Skill Management

• E2B sandbox backend: agent shell/code execution can now run on E2B cloud sandboxes in addition to the local sandbox. Select the backend with DIFY_AGENT_RUNTIME_BACKEND; a new docker-compose.e2b.yaml ships the E2B stack, E2B traffic is authenticated, and the E2B template is synced on release (#39480, #39705, #39873, #39996, #40858, #40871, #40891, #40892).
• Build-time Home Snapshots: when an agent build is applied (published), the agent's sandbox home directory — installed packages, prepared files, working state — is captured and subsequent runs of the published agent restore their home directory from that snapshot, so the agent starts from the exact filesystem state it had at build time. (#39702, #40876, #40996).
• Workspace-level Skill management: Skills are reusable, versioned capabilities packaged with code and tool definitions that agents can discover and invoke. A new workspace-level skills manager with draft → publish → version lifecycle ships alongside a web UI (skill listing, builder panel, file editor). (#39675, #39798, #39799, #41180).
• Context-aware history compaction: long agent conversations no longer blow past the model's context window — Dify resolves each model's effective window and tiers compaction (clear old tool results first, then summarize older history) so runs stay within budget without losing recent context (#40872).

Reusable LLM Environment Variables in Workflows

• Define a shared provider/model/mode/parameter configuration once (e.g. for_summarize, for_research) and reference it from any LLM node. Coordinated model changes now happen in one place instead of drifting node-by-node, and the references survive DSL import/export, snippets, RAG pipelines, and collaborative editing (#39125).

Human Input in Loops and Iterations

• Human-in-the-loop forms now work inside Loop and Iteration nodes, pausing and resuming correctly across page refreshes for both debug and installed apps — enabling review/approval steps within repeated work (#39243).

Provider-Neutral Unified Tracing

• Opt-in unified tracing (OPS_TRACE_UNIFIED_ENABLED) assembles the full parent-child span tree (workflows, chatflows, messages, nodes, loops, iterations, nested workflows) once in core and delegates only transport to lightweight adapters. Phoenix and LangSmith adapters ship first; disabled by default and fully backward compatible (#39451).
• New GenAI spans surface LLM TTFT, agent ReAct steps, tool calls, and failed LLM nodes for deeper observability (#39339).

Cloudflare Turnstile (CAPTCHA) Support

• Optional Turnstile challenge on sign-in and email-code login to protect authentication endpoints from abuse, with configurable site/secret keys and allowed hostnames (#40494).

Azure Key Vault / Pluggable KMS

• Introduces a KMS provider abstraction with Azure Key Vault support for key provisioning, encryption, and decryption, plus key rotation configuration — a step toward externally-managed encryption keys (#39933).

TiDB Vector Full-Text & Hybrid Search

• TiDB Vector deployments can now enable full-text and hybrid retrieval (TIDB_VECTOR_ENABLE_FULLTEXT_SEARCH, default off), using a multilingual full-text index alongside vector search (#38112).

Broader Model & File Handling

• LLM nodes and agents can now pass image files directly to multimodal models, and non-vision attachments are no longer silently dropped from agent chats (#39848, #40179).
• New multimodal retrieval guidance helps users pick embedding models correctly for image-bearing knowledge bases (#40566).
• Audio ASR now accepts audio/x-m4a, and audio MIME types are validated more accurately (#40776, #41043).

Go to Anything (⌘K / Ctrl+K)

• Press ⌘K (Ctrl+K on Windows/Linux) anywhere in the console to open the command palette and jump to apps, agents, skills, knowledge bases, plugins, or workflow nodes, or trigger quick actions via slash commands. New in this release: agents and skills are searchable, and the icon-command system was refactored across all domains for consistency (#40620, #40621, #40646–#40649, #41160).

Other Additions

• ODT (OpenDocument Text) document extraction support (#39973).
• New date / date-picker parameter type for tool plugins (#36163).
• Lao (lo-LA) language support (#39474).
• Automatic cleanup task for old conversations (ENABLE_CONVERSATION_CLEANUP_TASK) to bound data growth (#40889-era).
• Marketplace embedded directly into integration categories for smoother tool/plugin discovery (#40744).

Improvements

Accessibility (large a11y pass)

• A very large set of changes makes the console keyboard- and screen-reader-friendly: real <button> semantics for dozens of interactive controls, accessible names for icon-only actions (copy, close, delete, menus), primary headings on auth/install pages, keyboard-accessible member/tool selectors, and correct ARIA states (#40192–#40377 and many others).

Workflow Authoring

• The workflow generator now prefers already-installed and configured tools when suggesting nodes, so builders reach for the tools they actually have (#40611, #39850).

Workflow & Runtime Stability

• Reproducible web workflow runs, preserved canvas state after history updates, no more refresh render loops, and SSE streams now end cleanly on terminal events (#40010, #40489, #41105, #40042).
• stop is now honored between non-streaming nodes and paused workflows clear stale cancellation signals correctly (#41090, #40905, #40972).
• APP_MAX_EXECUTION_TIME and WORKFLOW_MAX_EXECUTION_TIME defaults raised from 1200s → 3600s to accommodate longer-running workflows.

Internal Quality

• Large migration of unit tests to real ORM models / SQLite sessions for more reliable coverage, plus stronger typing across migrated tests (many #38xxx–#39xxx). No user-facing behavior change.

Security Enhancements

• Authentication hardening: Turnstile challenge on login/email-code flows, hardened email-code verification with attempt limits and token expiry (EMAIL_CODE_LOGIN_MAX_ATTEMPTS, EMAIL_CODE_LOGIN_TOKEN_EXPIRY_MINUTES), suspended-email-domain handling, and short-lived agent authorization tokens (#40494, #40960, #41004, #40884).
• Access-control / ownership scoping: dataset, document, RAG, conversation, workspace-credential, and OAuth-client resources are now consistently bound to their owners and app scope, closing several unauthorized-access paths (#40989, #40888, #40790, #40745, #40893, #40786, and related).
• SSRF & outbound hardening: outbound HTTP connect phases are bounded (5s), agent/binding download and run timeouts are configurable, and the SSRF-blocked error message now points to the correct issue (#40807, #41027, #40605).

Bug Fixes (selected)

• Prevent dropped workflow_started events in Redis Streams and dropped/duplicated runs from superseded executions (#40964, #40699).
• Normalize workflow timestamps to naive UTC and preserve run snapshots/history for failed, cancelled, and interrupted runs (#40947, #40876, #40972).
• Prevent cross-tab chat conversation switching and stop dropping non-vision attachments in agent chat (#40709, #40179).
• Correct Qwen/VL system-message ordering by merging system messages first (#39136).
• Fix Elasticsearch-JA adapter document_id mapping and VectorType (#40400); avoid empty Bedrock schema fields (#40443).
• Use dynamic DNS resolution for all nginx upstreams (#39155); preserve UTF-8 byte size for text uploads (#40034).
• Numerous webapp/UI fixes: restore email-code and password form submissions, mobile sign-in overflow, toast stacking, model selector spacing (#40227, #40222, #40921, #40970, #8d612895).

Environment Variable Changes

Added

Agent runtime / sandbox (docker/envs/core-services/dify-agent.env.example)

• DIFY_AGENT_RUNTIME_BACKEND, DIFY_AGENT_RUN_TIMEOUT_SECONDS, DIFY_AGENT_SANDBOX_FILES_BASE_URL, DIFY_AGENT_STUB_UPLOAD_FILE_SIZE_LIMIT, DIFY_AGENT_BINDING_FILE_DOWNLOAD_COMMAND_TIMEOUT_SECONDS
• E2B: DIFY_AGENT_E2B_API_KEY, DIFY_AGENT_E2B_TEMPLATE, DIFY_AGENT_E2B_SHELLCTL_PORT, DIFY_AGENT_E2B_ACTIVE_TIMEOUT_SECONDS
• Local sandbox: DIFY_AGENT_LOCAL_SANDBOX_ENDPOINT, DIFY_AGENT_LOCAL_SANDBOX_AUTH_TOKEN
• Outbound HTTP tuning: DIFY_AGENT_OUTBOUND_HTTP_CONNECT_TIMEOUT, DIFY_AGENT_OUTBOUND_HTTP_READ_TIMEOUT, DIFY_AGENT_OUTBOUND_HTTP_WRITE_TIMEOUT, DIFY_AGENT_OUTBOUND_HTTP_POOL_TIMEOUT, DIFY_AGENT_OUTBOUND_HTTP_KEEPALIVE_EXPIRY, DIFY_AGENT_OUTBOUND_HTTP_MAX_CONNECTIONS, DIFY_AGENT_OUTBOUND_HTTP_MAX_KEEPALIVE_CONNECTIONS
• AGENT_BACKEND_BINDING_FILE_DOWNLOAD_TIMEOUT_SECONDS, AGENT_BACKEND_HOME_SNAPSHOT_TIMEOUT_SECONDS (api/.env.example)

Auth / security

• TURNSTILE_SITE_KEY, TURNSTILE_SECRET_KEY, TURNSTILE_ALLOWED_HOSTNAMES, TURNSTILE_EMAIL_CODE_VERIFY_REQUIRED
• EMAIL_CODE_LOGIN_MAX_ATTEMPTS, EMAIL_CODE_LOGIN_TOKEN_EXPIRY_MINUTES
• KEY_PROVIDER_TYPE, AZURE_KEYVAULT_VAULT_URL, AZURE_KEYVAULT_KEY_SIZE, AZURE_KEYVAULT_ROTATION_INTERVAL_DAYS

Knowledge / retrieval

• TIDB_VECTOR_ENABLE_FULLTEXT_SEARCH, TIDB_ON_QDRANT_ESTIMATED_STORAGE_LIMITS_MB, KNOWLEDGE_UPLOAD_FILE_SIZE_LIMIT_FOR_PAID_PLAN

Tracing / observability

• OPS_TRACE_UNIFIED_ENABLED, OPS_TRACE_PARENT_CONTEXT_TTL_SECONDS

Misc

• ENABLE_CONVERSATION_CLEANUP_TASK, CONVERSATION_CLEANUP_TASK_INTERVAL, CONVERSATION_CLEANUP_BATCH_SIZE
• UPLOAD_SKILL_FILE_SIZE_LIMIT, PLUGIN_MAX_FILE_SIZE, MARKDOWN_FORM_FIELD_NAME_EXTRA_CHARS
• DEPLOYMENT_EDITION (replaces EDITION, see below)

Removed

• EDITION → renamed to DEPLOYMENT_EDITION
• ENTERPRISE_ENABLED (enterprise gating consolidated)
• AGENT_BACKEND_RUN_TIMEOUT_SECONDS → replaced by DIFY_AGENT_RUN_TIMEOUT_SECONDS
• `DIFY_AGENT_SHELLCTL_AUT...

What's Changed

New Features

Tool Multi-Select Input

• Workflow tool nodes now support multi-select dropdown inputs, allowing users to choose multiple values from a predefined list when configuring tool parameters. (#39346)

Workflow Node Locator

• You can now click a node_id in workflow run logs or error messages to locate and highlight the corresponding node in the workflow editor canvas. (#38187)

Workflow Block Selector Improvements

• The block selector panel now features improved keyboard navigation, category previews, and a more intuitive search experience when adding nodes to workflows. (#39212)

Export Agent DSL from Sidebar

• Agent apps can now be exported as DSL YAML directly from the app sidebar menu, making it easy to back up or version-control agent configurations. (#39299)

Knowledge Tracing

• Added more observability traces to knowledge/RAG document processing operations, improving visibility into indexing pipelines. (#38959)

Bug Fixes

Workflow & Collaboration

• Fixed hidden-tab collaboration leader saving stale drafts when the tab is inactive (#38997)
• Fixed unsaved edits being dropped when collaboration never connects (#39579)
• Preserved latest collaboration session after reconnection (#39646)
• Fixed false draft save error during Strict Mode initialization (#39353)
• Show persistent error notification when workflow draft save fails (#39293)
• Wait for workflow worker threads to finish before Celery tasks complete, preventing orphaned executions (#39614)
• Lazy-load Loro collaboration runtime to reduce initial bundle size (#39631)
• Don't open node settings panel when clicking a node in comment mode (#39500)
• Don't close active comment panel when a different comment is resolved (#39491)

RAG & Knowledge

• Fixed document cleaner stripping valid characters ï (U+00EF), ¿ (U+00BF), ¾ (U+00BE) (#39215)
• Preserved spaces during recursive text splitting (#39498)
• Used flush() instead of commit() in dataset service to preserve caller transaction boundaries (#39223)
• Sent valid body in external knowledge validation probe (#39410)

Agent

• Fixed agent preview: start new Preview conversations without inheriting an old ID (#39463)
• Fixed agent chat input being replaced when conversation history updates (#39289)
• Preserved complete model usage pricing in agent logs (#39201)
• Show workflow node runs in agent execution logs (#39471)
• Include workflow runs in agent monitoring stats (#39354)
• Block unpublished agents from being used in workflows (#39532)
• Prevent agent preview actions from being clipped (#39510)
• Prevent build reset from clearing preview chat history (#39490)
• Fixed agent build draft UI flashing during apply (#39642)

Web App & UI

• Fixed webapp JWT expiration time being incorrectly set (#39537)
• Fixed TTS playback in Safari and Firefox (#39444)
• Fixed clipboard writes failing in embedded apps (#39511)
• Fixed text generation web app showing infinite loading after timeout (#39268)
• Fixed chat not passing document if model doesn't support vision (#39461)
• Stopped chunk length/overlap inputs collapsing to unusable width in narrow containers (#39600)
• Fixed search hotkey hydration mismatch (#39574)
• Improved DSL import/export dialog states (#39432, #39409)
• Fixed basePath doubling in auth refresh redirects (#39273)
• Show unavailable state for disabled Web Apps (#39392)
• Fixed permission selector semantics (#39269)
• Fixed customization page horizontal overflow (#39557)

API & Backend

• Fixed MCP tool output_schema being treated as required when it's optional (#39453)
• Honored array-element limit and byte budget for list[File] in VariableTruncator (#39220)
• Prevented identity logging deadlock (#39449)
• Rejected host:port-shaped PLUGIN_REMOTE_INSTALL_PORT values with an actionable hint (#39329)
• Fixed PaginatedResult.pages returning 1 instead of 0 for empty result sets (#39229)
• Used resource tenant for draft variable files (#39307)
• Scoped HITL snapshot message lookup to utilize database index (#39351)
• Returned 400 instead of 500 when file field is missing from audio-to-text endpoints (#39303, #39322)
• Fixed tool_meta missing tool_provider_type during tool execution (#39513)
• Applied configured timeout to enterprise inner API requests (#39335)
• Returned disabled auto-upgrade settings when strategy is missing (#39494)
• Enforced tool provider type contracts (#39380)
• Fixed WaterCrawl website crawler handling non-JSON error responses (#37514)
• Fixed can't create chat app when tenant default model schema errors (#39266)

Security Enhancements

• The Agent local sandbox now runs behind a dedicated Squid forward proxy with strict ACL rules, preventing the sandbox from reaching internal services directly. Only the /files/ endpoint on the API and /agent-stub/ on agent_backend are permitted, both protected with short-lived access tokens. This significantly reduces the blast radius of arbitrary code execution in the agent sandbox. (#39544)
• Communication between the Dify API and the agent backend now uses token-based authentication via DIFY_AGENT_API_TOKEN / AGENT_BACKEND_API_TOKEN, hardening the internal service boundary. (#39622)
• Switched Jinja2 template rendering to use SandboxedEnvironment, preventing template injection attacks in workflow code nodes (#39609)
• Patched React Server Components DoS vulnerability (#39539)
• Used re.fullmatch in email validator to reject trailing newlines, preventing bypass attacks (#39320)
• Validated account status before accepting workspace invitations (#39438)

Performance

• Lightweight recent apps endpoint — New GET /console/api/apps/recent endpoint reduces the home page "Continue Work" section latency by ~69% (3.2× faster), cutting SQL queries from 19+ to 1 projection SELECT and response size by ~50% (#39625)
• Lazy-load Home creation modals — Deferred loading of creation modal code until interaction, reducing initial JavaScript bundle (#39634)

Improvements

• Made agent composer save and publish state consistent (#39637)
• Simplified Dify logo theming (#39580)
• Improved workflow block selector UI (#39377)
• Improved web accessibility semantics (#39505)
• Nodes are no longer draggable when previewing a workflow (#39131)
• Display non-LLM settings in integration tool details (#39295)

Environment Variable Changes

New Variables

python -c 'import secrets; print(secrets.token_urlsafe(32))'

Docker Compose Changes

• Agent sandbox network isolation: local_sandbox is moved off the default network to dedicated agent_sandbox_network + local_sandbox_proxy_network. A new agent_ssrf_proxy service (Squid) is added.
• Bearer auth: AGENT_BACKEND_API_TOKEN / DIFY_AGENT_API_TOKEN are now passed to api, worker, and agent_backend services.
• Image tags updated to 1.16.1.

Database Migrations

This release includes 4 new migrations:

1. 2026_07_15_1600-3c9f8e2a1d7b_add_workflow_run_archive_bundle_cursor_indexes.py — Add indexes to workflow_run_archive_bundles (concurrent on PostgreSQL)
2. 2026_06_29_1200-b8c9d0e1f2a3_add_step_by_step_tour_state.py — Create account_step_by_step_tour_states table
3. 2026_07_22_1500-d2825e7b9c10_scope_agent_debug_conversations.py — Add draft_type column to agent_debug_conversations and update unique constraint
4. 2026_07_23_1200-6f5a9c2d8e1b_add_telemetry_fields_to_dify_setups.py — Add telemetry fields (instance_id, install_reported_at, last_heartbeat_at) to dify_setups

All migrations are additive (new tables, columns, indexes) and are safe to run without downtime.

Upgrade Guide

Model Type Migration

Docker Compose

Run from the docker directory.

# Apply after reviewing the dry-run output
docker compose exec -T api flask data-migrate legacy-model-types --apply \
  > legacy-model-types-apply.jsonl

Source Code Deployment

Run from the repository root after completing flask db upgrade.

# Apply after reviewing the dry-run output
uv run --project api flask data-migrate legacy-model-types --apply \
  > legacy-model-types-apply.jsonl

After applying the migration, run the dry-run...

Introducing Dify Agent (Beta): A New Agent Experience in Dify

As many of you know, the shell-based LLM agent paradigm has brought a major leap in agent capabilities and changed how we think about agents. Meanwhile, Skills provide a standardized way to package and distribute capabilities, making it easier to build powerful agents.

Today, we are launching Dify Agent. Like other leading agents, it runs in a Linux sandbox. This release includes:

• A builder for creating Dify Agents

  • You can build Dify Agents through the UI: set a base prompt, upload Skills and files, and connect tools and knowledge from the Dify ecosystem.
  • We also provide an agent that helps you build Dify Agents. Through conversation, it can configure the Linux sandbox environment, install required packages, and create new Skills and files that your Dify Agent can use later.

• Dify Workflow integration for Dify Agent

  • You can use an existing Dify Agent in a Dify Workflow, or temporarily create an inline Dify Agent. It will execute the task defined by the workflow node, generate the required output, and pass it to the next node.

• A new web app experience

  • The Dify Agent you build can be published and used as a web app. While the user experience remains familiar, it is now powered by Dify Agent.

Docs: https://docs.dify.ai/en/self-host/use-dify/build/new-agent/overview

⚠️ Action Required

OpenAI GPT-5.6 Compatibility Notice

The OpenAI plugin previously defaulted to using the Chat Completions API, which was deprecated by OpenAI earlier this year and has increasingly poor support for newer model series. The newly released GPT-5.6 family has many unusual and unique parameter combination restrictions when used with Chat Completions, because OpenAI now provides only minimal compatibility support for Chat Completions with new models. This is not a Dify system issue.

The default API type for new configurations has been changed from Chat Completions to Responses. However, users who previously saved a custom API key with the old default (Chat Completions) will retain that setting, which may cause unexpected errors that appear to originate from Dify.

If you have previously configured a custom OpenAI API key, please check your API type setting and switch to Responses if it is still set to Chat Completions, especially when using GPT-5.6 or later models.

New Features

Agent App (Open Beta)

• Agent App enters open beta and is now enabled by default for all users. It introduces a built-in sandbox for code execution and shell commands, a skill system that lets agents call tools and APIs, an agent roster for managing and reusing agents across a workspace, and support for referencing new agents from workflow agent nodes.

Smarter AI Workflow Generation

• The ⌘K → /create and /refine AI workflow generator has been enhanced end-to-end: the low-value "Ideal output" field was removed, static example chips replaced with AI-generated suggestions grounded in your workspace context, and node config generation is now parallelized for faster results. A configurable timeout (WORKFLOW_GENERATION_TIMEOUT_MS, default 180s) prevents long-running generations from hanging.

MCP Protocol Upgrade

• The workflow-as-MCP server now supports MCP protocol 2025-06-18 with version negotiation and structured tool output, while remaining backward compatible with older clients. MCPClient connections can now inject dynamic HTTP request headers at runtime using placeholders (e.g. {{request.headers.X-Custom-Auth}}), enabling per-request authentication passthrough.

Web App Customization

• App owners can now customize the chat input placeholder text (up to 64 chars) for Chatbot, Agent, and Chatflow web apps. The customization UI has been refined with clearer naming ("Custom Frontend" / "Branding") and better label handling. App descriptions are now displayed on chat and text-generation app screens with a collapsible view to avoid pushing the input form off screen.

Workflow Reliability & Operations

• Workflow run archives can now be exported, and active runs are properly aborted during Celery warm shutdown to prevent orphaned tasks. Redis connections are more resilient with TCP keepalive support and expanded retry coverage. Model providers now receive app_id for provider-side cost attribution (e.g. Bedrock requestMetadata, OpenAI metadata, Vertex AI labels). OAuth and SSO login flows now preserve redirect URLs more reliably, with a dedicated error view for failed SSO completions.

Bug Fixes

Workflow & Agent

• Fixed multiple issues with workflow draft imports losing references, node settlement after failures, retry detail visibility, and HITL resume state restoration
• Fixed SSE stream corruption with Unicode separators, agent final answer clearing after stream completion, and conversation title being overwritten with empty values
• Fixed workflow archive retry hardening, multi-worker collaboration support, and chat tree out-of-order parent nodes
• Fixed knowledge retrieval failures not being surfaced to users, and End output variable name collisions in built-in templates

Authentication & Access Control

• Fixed open redirect vulnerabilities in post-login and auth redirect flows
• Fixed login redirects not staying on current deployment, auth prefix duplication, and change email not working
• Fixed editor permission issues: editors can now view logs, no longer query billing subscriptions, and can no longer manage members
• Fixed trace config changes not requiring edit access, and trial app access hardening for recommended apps

Models & Plugins

• Fixed custom model cache not being cleared on deletion, model plugin debugging failures, and Xinference credential context handling
• Fixed max token params not being disableable in follow-up model parameters
• Fixed plugin provider cache stampedes, marketplace installation callbacks, and plugin permission settings

Web & UI

• Fixed app creation from Learn Dify, node search field input, workspace avatar consistency, and navigation profile display
• Fixed Streamdown fullscreen table actions, marketplace page header jitter, and install dialog accessibility
• Fixed chat attachments scrolling out of view, HITL input save button visibility, and app card meta overflow
• Fixed monitoring chart zero-value display, member invitation state handling, dark mode background, and Unicode characters in form field names
• Fixed markdown file-preview link downloads, Notion sync empty state, and blog UTM attribution under CSP

Other

• Fixed infinite loop in batch document deletion, invalid UTF-8 cache payloads, and swallowed document indexing errors
• Fixed PostgreSQL 18 native uuidv7() support and ADB-PG 7.0 compatibility
• Fixed CAN_REPLACE_LOGO defaulting to true, unsupported language errors in execute_code, and CLI --insecure flag not skipping TLS verification

Improvements

Performance

• Eliminated N+1 queries in advanced-chat workflow run lists and TokenBufferMemory message file loading
• Faster frontend startup via lazy-loaded Vite plugins and console contract shards
• Reduced database load by caching setup status, compressing large plugin model objects in Redis with zstd, and retrieving published workflows via direct foreign key

Architecture & Code Quality

• Migrated all console API endpoints to generated OpenAPI contracts with BaseModel, and frontend console contracts to generated routes and types
• Propagated explicit database sessions across backend paths for consistency and testability
• Replaced legacy app context providers with Jotai atoms across the frontend
• Upgraded to TypeScript 7 and Vite+ toolchain, enforced strict ESLint rules, and disallowed new direct SQLAlchemy in controllers

Security Enhancements

This release includes several security hardening fixes, some of which were addressed after the 1.16.0-rc1 release:

• SQL injection: Closed a SQL injection vulnerability and enhanced SQL query safety with metadata key validation
• SSRF: Fixed an SSRF bypass via raw httpx.get in API tool schema fetch
• Open redirects: Prevented open redirects in post-login and auth redirect flows
• Sandbox enforcement: Chatflow API now checks workflow_id and sandbox plan; sandbox plan will not execute special workflows
• Landlock protection: Agent HOME directory protected with Landlock; downgraded to v1 for broader kernel compatibility
• CVE dependency upgrades: httplib2, setuptools, wandb; python-engineio, python-socketio; fickling, pillow, click

Environment Variable Changes

Added

Introducing Dify Agent (Experimental): A New Agent Experience in Dify

As many of you know, the shell-based LLM agent paradigm has brought a major leap in agent capabilities and changed how we think about agents. Meanwhile, Skills provide a standardized way to package and distribute capabilities, making it easier to build powerful agents.

Today, we are experimentally launching Dify Agent. Like other leading agents, it runs in a Linux sandbox. This release includes:

• A builder for creating Dify Agents

  • You can build Dify Agents through the UI: set a base prompt, upload Skills and files, and connect tools and knowledge from the Dify ecosystem.
  • We also provide an agent that helps you build Dify Agents. Through conversation, it can configure the Linux sandbox environment, install required packages, and create new Skills and files that your Dify Agent can use later.

• Dify Workflow integration for Dify Agent

  • You can use an existing Dify Agent in a Dify Workflow, or temporarily create an inline Dify Agent. It will execute the task defined by the workflow node, generate the required output, and pass it to the next node.

• A new web app experience

  • The Dify Agent you build can be published and used as a web app. While the user experience remains familiar, it is now powered by Dify Agent.

Docs: https://docs.dify.ai/en/self-host/use-dify/build/new-agent/overview

Limitations

Please note that in the current experimental release, all Dify Agents run in the same sandbox. This means:

• Under normal circumstances, each Dify Agent configures its environment and executes tasks within its own workspace without interfering with others.
• However, with simple instructions, any Dify Agent can read or interfere with the environments and data of other Dify Agents, including user data.

Strict isolation will be implemented in a future release. For now,

Similarly, because Dify Agent is not fully ready yet, you may find that some features are not available for Dify Agent. For example, Dify Workflow DSL export is unavailable when the workflow contains nodes that reference Dify Agent.

Upgrade Guide

Docker Compose Deployments

1. Back up your customized docker-compose YAML and env files.

   cd docker
   cp docker-compose.yaml docker-compose.yaml.$(date +%s).bak
   cp .env .env.$(date +%s).bak 2>/dev/null || true

2. Get the latest code for the 1.16.0-rc1 release.

   git fetch --tags
   git checkout 1.16.0-rc1

3. Stop the services (run inside the docker directory).

   docker compose down

4. Back up data.

   tar -cvf volumes-$(date +%s).tgz volumes

5. Review any env file changes and re-apply local customizations.
6. Upgrade services.

   docker compose up -d

Source Code Deployments

1. Stop the API server, Worker, and Web frontend server.
2. Get the latest code for the 1.16.0-rc1 release.

   git fetch --tags
   git checkout 1.16.0-rc1

3. Update Python dependencies.

   cd api
   uv sync

4. Run database migrations.

   uv run flask db upgrade

5. Restart the API server, Worker, and Web frontend server. To experiment with the new agent feature, you also need to start dify-agent and shellctl. Important: shellctl does not include built‑in authentication — for security, it is strongly recommended to run it inside a container.

What's Changed

• chore(api): surface pyrefly output on type-check failures by @QuantumGhost in #37934
• test: replace logger mock with caplog in workflow collaboration test by @ojasarora77 in #37971
• ci: emit pyrefly diagnostics as GitHub workflow commands by @ojasarora77 in #37974
• refactor(api): migrate response contract tooling to BaseModel by @cqjjjzr in #37950
• fix(cli): use a(n) article in difyctl prerelease warning by @GareArc in #37976
• fix(api): require edit access for trace config changes by @laipz8200 in #37973
• feat(webapp): display app description on chat and text-generation app screens by @kurokobo in #37345
• fix: decouple deployment access control dialog by @hyoban in #37936
• refactor(tests): use caplog in workflow collaboration service tests (#37468) by @hikariming in #37991
• fix(web): make marketplace URL builder SSR-safe by @lyzno1 in #37944
• refactor: simplify deployment access ownership by @hyoban in #37994
• refactor: Use pytest caplog instead of logger patching in test_spec.py by @DevCube24 in #37997
• refactor: align deployment detail state ownership by @hyoban in #38008
• fix: isolate node selector keyboard events by @lyzno1 in #37998
• fix(web): keep HITL input-field save button visible in the edit dialog by @manan-tech in #38007
• refactor(api): enforce enums over string literals on openapi surface by @GareArc in #38009
• chore: migrate account role test to testcontainers by @escape0707 in #38010
• refactor: pass db session into service calls (#37403) by @xiejl001 in #38016
• feat(api): cache workflow provider configurations by @linw1995 in #37980
• fix(web): capture blog UTM/slug attribution reliably under CSP by @CodingOnStar in #38022
• fix: plugin installation task popover layout when some failed too long by @hjlarry in #38000
• feat(web): add customizable input placeholder for Agent/Chatflow/Chatbot web app by @CyberPU2099 in #37790
• refactor: replace patch logger with caplog in test_version.py by @EvanYao826 in #38029
• docs(web): fix testing guide link by @Harsh23Kashyap in #38006
• feat(agent-v2): sync nightly updates to main (2026-06-25) by @BeautyyuYanli in #37915
• chore: inject session by @asukaminato0721 in #37941
• fix(web): download markdown file-preview links as attachments by @uxgnod in #38030
• chore(i18n): sync translations with en-US by @github-actions[bot] in #38035
• fix: remove aria-busy from loading button by @lyzno1 in #38036
• fix: improve members role chip accessibility by @lyzno1 in #38037
• fix: improve workflow run archive idempotency and batching by @41tair in #38027
• refactor(web): organize deployment feature state by @hyoban in #38065
• fix: prevent exiting toasts from blocking page clicks by @lyzno1 in #38063
• fix: gate deployments in route layout by @lyzno1 in #38078
• refactor: shell provider protocol by @wylswz in #38077
• fix: simplify scroll area composition by @lyzno1 in #38113
• fix(web): improve main nav focus outline by @lyzno1 in #38114
• fix: CAN_REPLACE_LOGO should be false by @fatelei in #38126
• chore: update deps by @hyoban in #38128
• chore: downgrade openapi-ts by @hyoban in #38141
• fix: support Unicode characters in form field names by @WTW0313 in #38138
• feat: refine snippet siderbar and support RBAC. by @FFXN in #38134
• fix(web): align web app nav item width by @lyzno1 in #38146
• fix(api): isolate side-effect database writes by @lin-hongkuan in #37895
• fix(api): wire dedicated timeout into inner RBAC requests by @GareArc in #38150
• fix: multimodal segment attachment indexing by @Blackoutta in #38080
• fix: agent app log detail modal not display well by @hjlarry in #38014
• fix(vdb): remove deprecated SQL options for ADB-PG 7.0 compatibility by @shiyuanfang2nd in #38004
• fix: editor should not query billing subscriptions by @hjlarry in #38157
• perf(api): retrieve published workflows via app.workflow_id by @linw1995 in https://github.com/langgenius/...

Dify 1.15.0 Release Note

What's Changed

UX & UI Enhancements

• Redesigned landing / onboarding for an easier first-run experience (#37433, #37844, #37800)
• Faster navigation — improved "go to anything" palette and autofocused search inputs (#32130, #37175)
• Safer deletes — one-click confirmation before removing an app (#37263)
• Cleaner workflow editor with collapsible panels (#37276)
• Clearer notifications — consistent toasts that show long errors in full (#37382, #37581)
• More accessible — plugin permission hints, restored contact-us menu, skip-nav link, and keyboard focus polish (#37310, #37774, #37644)

New Features

difyctl — drive Dify from the command line (Docs)

• difyctl is a command-line client for Dify: you can now run apps and workflows straight from your terminal, so personal agents, scripts, and CI pipelines can invoke Dify workflows without opening the web UI (#37036)
• Install it on any platform (macOS, Linux, Windows) with a single command and no access token — binaries are published as public releases with checksum verification (#37036, #37454)
• Pass scoped environment variables to CLI tool runs, and get clearer, consistent error messages (including friendly rate-limit handling) across both difyctl and the /openapi/v1 API (#37324, #37285, #37313, #36896)

See CoT in Workflow & Chatflow & CLI

• Chat Flow / Workflow can now stream the model's reasoning into a dedicated live "thinking" panel while keeping the final answer clean and readable. The reasoning is preserved so it's still there after a page refresh, and the same reasoning is visible in CLI and workflow run previews (#37460, #37828)

Richer Human-in-the-Loop forms

• When a workflow pauses to ask a person for input, the form can now include dropdown selects and file / multi-file uploads — not just free text — so people can answer with structured choices and attachments (#36322)

Support for slow, long-running models

• Workflows can now use generation models that take a long time to respond (such as image or video generation) via a polling mechanism: the node patiently waits for the final result instead of timing out (#37462)

Knowledge from richer spreadsheets

• Images embedded inside Excel files are now extracted during knowledge import, so spreadsheet content that relies on pictures (diagrams, screenshots, charts) is no longer lost (#37104)

Deeper observability

• Set your own trace session id for Phoenix so traces line up with your application's sessions, and follow document-retrieval steps in traces to understand how RAG results were produced (#37056, #37283)

Workflow authoring polish

• A refreshed start node makes it clearer how a workflow begins, and a smarter output node gives you more control over what a workflow returns (#37348, #35511)
• Friendlier errors when an app or workspace ID is malformed, instead of confusing failures (#37212)

Faster plugin installs in certain regions

• The plugin daemon now auto-detects your region at startup and, where network connectivity to PyPI is poor, automatically picks a nearby package mirror — so installing plugins is faster and more reliable without any manual setup. You can still pin a specific mirror if you prefer (dify-plugin-daemon#750)

Security Updates

This release fixes a path traversal issue in plugin-daemon forwarding (cve-2026-41948).

Bug Fixes

• Hardened outbound HTTP with bounded timeouts for Firecrawl, Jina, Watercrawl, Nacos, and Marketplace requests, and hardened default SSRF proxy egress (#37638, #37637, #37515, #37444, #37424, #36332)
• Fixed Lindorm vector store errors caused by the opensearch-py update (#37862) and Tongyi credential compatibility (#37942)
• Invalidated credential cache after OAuth refresh (#37630)
• Improved workflow execution error handling, eagerly validated conversations to prevent hanging, and prevented legacy stop from interrupting GraphEngine runs (#37919, #37224, #37129)
• Resolved DetachedInstanceError via session management refactoring (#37847) and stabilized deployment state hydration (#37818)
• Fixed conversation variable description length validation to prevent varchar(255) truncation (#33038) and stored Chinese as unicode so search works (#37446)
• Numerous web UI and accessibility/focus-ring polish fixes

Improvements

• Refactored session management across services to accept db.session explicitly via dependency injection for consistency (#37639, #37832, #37695, #37694, and related)
• Modernized typing (removed redundant type: ignore/cast, converted ABCs to Protocol, replaced isinstance chains with match-case)
• Reduced workflow startup latency for Chatflow (#36773) and lowered workflow termination latency so stopping a run takes effect faster (#37106, #37129)
• Upgraded dependencies for CVE fixes (Bleach, PyJWT, starlette, storage group) (#37860, #37008, #37076, #37861)

Environment Variable Changes

Added

• DEVICE_FLOW_APPROVE_RATE_LIMIT_PER_HOUR (docker/envs/core-services/shared.env.example)
• DIFY_ENV_NACOS_CONNECT_TIMEOUT, DIFY_ENV_NACOS_REQUEST_TIMEOUT (api/.env.example)
• ENABLE_LEARN_APP (api/.env.example)
• ENABLE_OAUTH_BEARER (docker/envs/core-services/shared.env.example)
• MILVUS_SECURE, MILVUS_SERVER_NAME, MILVUS_SERVER_PEM_PATH (docker/envs/vectorstores/milvus.env.example)
• NEXT_PUBLIC_ENABLE_FEATURE_PREVIEW (docker/envs/core-services/web.env.example)
• OPENAPI_CORS_ALLOW_ORIGINS, OPENAPI_ENABLED, OPENAPI_KNOWN_CLIENT_IDS, OPENAPI_RATE_LIMIT_PER_TOKEN (docker/envs/core-services/shared.env.example)
• PLUGIN_MODEL_PROVIDERS_CACHE_TTL (api/.env.example)
• SERVER_CONSOLE_API_URL (docker/.env.example)
• SSRF_PROXY_ALLOW_PRIVATE_DOMAINS, SSRF_PROXY_ALLOW_PRIVATE_IPS, SSRF_SANDBOX_PROXY_HOST, SSRF_SANDBOX_PROXY_PORT (docker/envs/middleware.env.example)
• PIP_MIRROR_AUTO_DETECT (plugin daemon; default true) — auto-select a nearby PyPI mirror at startup for regions with poor connectivity
• PIP_MIRROR_URL (plugin daemon; default empty) — manually pin the PyPI mirror; takes precedence over auto-detection

Removed

• SSRF_REVERSE_PROXY_PORT, SSRF_SANDBOX_HOST (docker/envs/middleware.env.example)

Modified

• UV_CACHE_DIR: /tmp/.uv-cache → /tmp/uv_cache

Docker Compose Files

• docker/docker-compose.yaml (modified)
• docker/docker-compose.middleware.yaml (modified)
• docker/docker-compose.pytest.ports.yaml (added)

Database Migrations

This release includes new database migrations. Run flask db upgrade (or uv run --project api flask db upgrade) after updating the code. Notable schema additions:

• OAuth access tokens (ENABLE_OAUTH_BEARER)
• Credential visibility
• Human Input upload tables and conversation linkage
• Category-scoped plugin auto-upgrade strategy (add_plugin_auto_upgrade_category)
• App stars, learn-dify / cloud-only flags on recommended apps
• Normalized legacy end-user type

Upgrade Guide

Model Type Migration

Docker Compose

Run from the docker directory.

# Apply after reviewing the dry-run output
docker compose exec -T api flask data-migrate legacy-model-types --apply \
  > legacy-model-types-apply.jsonl

Source Code Deployment

Run from the repository root after completing flask db upgrade.

# Apply after reviewing the dry-run output
uv run --project api flask data-migrate legacy-model-types --apply \
  > legacy-model-types-apply.jsonl

After applying the migration, run the dry-run command again. If it reports no additional row updates or deletions, restart the relevant services and verify that existing models can be loaded and invoked successfully.

Docker Compose Deployments

1. Back up your customized docker-compose YAML and env files.

   cd docker
   cp docker-compose.yaml docker-compose.yaml.$(date +%s).bak
   cp .env .env.$(date +%s).bak 2>/dev/null || true

2. Get the latest code for the 1.15.0 release.

   git fetch --tags
   git checkout 1.15.0

3. Stop the services (run inside the docker directory).

   docker compose down

4. Back up data.

...

🚀 What's New in v1.14.2?

v1.14.2 is a patch release focused on security hardening, workflow and knowledge reliability, observability fixes, agent groundwork, and deployment/runtime tuning after v1.14.1.

🔐 Security and administration

• Tenant-scoped sensitive endpoints — strengthened tenant isolation for app trace-config endpoints and FilePreview text extraction. Thanks @xr843 in #35793 and #35797.
• Tool credential safety — restricted default builtin tool credential updates to workspace admins and owners, and cleaned stale tenant tool credentials during reset-encrypt-key-pair. Thanks @NeatGuyCoding and @xr843 in #36264 and #35843.

🧩 Workflow, HITL, and app runtime

• Workflow execution reliability — restored tracing after HITL workflow resume, improved workflow run callback tracking, reduced message-update database roundtrips, fixed memory fetches outside Flask context, and closed base64 file lookup sessions correctly. Thanks @Blackoutta, @CodingOnStar, @wylswz, @hjlarry, and @escape0707 in #36064, #36149, #36213, #36253, and #36308.
• Workflow and model selection polish — fixed loading behavior when no model is selected, filtered model presets by supported parameters, and improved API extension dialog controls. Thanks @iamjoel and @lyzno1 in #36342, #36339, and #36323.

📚 Data, RAG, and knowledge

• Knowledge-base stability — fixed knowledge hit-testing rendering, empty knowledge creation, recommended app category ordering, and null handling in recommended app detail retrieval. Thanks @FFXN, @laipz8200, @hjlarry, and @EvanYao826 in #36106, #36336, #36161, and #36153.
• RAG and document processing — allowed LLM nodes to access retrieved knowledge files, regenerated document summaries after API updates, fixed pipeline template rendering, and handled credential fetch failures in RAG pipelines more gracefully. Thanks @laipz8200, @EvanYao826, @FFXN, and @linw1995 in #36175, #36035, #36168, and #36165.

🎨 Web UI and product experience

• App creation and onboarding — tracked app creation source and template ID, initialized user timezone and language from the browser, and fixed WebApp icon and description display. Thanks @CodingOnStar, @lyzno1, and @JzoNgKVO in #36369, #36170, #36206, and #36209.
• Annotation and datasets UI — allowed annotation reply score thresholds below 0.8, redirected unauthorized knowledge editors back to datasets, and fixed tag rename without type payload. Thanks @JzoNgKVO, @iamjoel, and @lyzno1 in #36337, #36073, and #36182.
• UI platform migration and polish — added Checkbox and CheckboxGroup primitives, migrated more controls to @langgenius/dify-ui, improved dialog overflow layouts, and refined account avatar and install-flow interactions. Thanks @lyzno1 and @CodingOnStar in #36271, #36295, #36255, #36302, #36111, #36199, and #36210.

🔎 Observability and tracing

• Tracing reliability — isolated Langfuse v3 SDK tracer providers to prevent cross-task interference and added Phoenix parent trace fallback behavior. Thanks @GareArc and @Blackoutta in #36136 and #36290.

⚙️ Deployment, dependencies, and developer experience

• Deployment tuning — upgraded plugin-daemon to 0.6.1, increased the default GraphEngine minimum worker count, and refreshed Docker README references. Thanks @laipz8200, @kenwoodjw, and @RiskeyL in #36312, #35650, and #36303.
• Backend and CI maintenance — moved static analysis toward Pyrefly, upgraded Graphon to 0.4.0, added hotfix cherry-pick provenance checks, and improved generated contract workflows. Thanks @cqjjjzr, @laipz8200, and @hyoban in #36154, #36124, #36340, and #36286.
• Dependency updates — refreshed backend and agent dependencies including authlib, ujson, langsmith, and urllib3. Thanks @dependabot[bot] in #36112, #36121, #36142, and #36160.

Upgrade Guide

Docker Compose Deployments

1. Back up your customized docker-compose YAML and env files.

   cd docker
   cp docker-compose.yaml docker-compose.yaml.$(date +%s).bak
   cp .env .env.$(date +%s).bak 2>/dev/null || true

2. Get the latest code from the release branch or tag.

   git fetch --tags
   git checkout 1.14.2

3. Stop the service. Please execute in the docker directory.

   docker compose down

4. Back up data.

   tar -cvf volumes-$(date +%s).tgz volumes

5. Review the new docker/envs/** env file layout and re-apply any local customizations.

6. Upgrade services.

   docker compose up -d

Source Code Deployments

1. Stop the API server, Worker, and Web frontend Server.

2. Get the latest code from the release tag.

   git fetch --tags
   git checkout 1.14.2

3. Update Python dependencies.

   cd api
   uv sync

4. Run the migration script.

   uv run flask db upgrade

5. Restart the API server, Worker, and Web frontend Server.

What's Changed

• fix: redirect unauthorized dataset access to /datasets for knowledge editors by @iamjoel in #36073
• chore: admin also has the permission of changing role by @iamjoel in #36069
• fix: fixed relative by @CodingOnStar in #36078
• chore: some match case by @asukaminato0721 in #36080
• fix: fix plugin miss version and checksum by @fatelei in #36083
• fix: restore tracing after HITL workflow resume by @Blackoutta in #36064
• chore: update deps by @hyoban in #36091
• fix: use Trans component for delete app confirmation text on editing page by @Copilot in #36092
• refactor: stabilize selector preview cards by @lyzno1 in #36105
• ci: Update pyrefly dependency version to 1.0.0 by @asukaminato0721 in #36100
• fix: knowledge hit-testing render failed. by @FFXN in #36106
• chore: remove obsolete admin console routes by @hjlarry in #35637
• fix(web): refine account avatar interactions by @lyzno1 in #36111
• chore(deps): bump ujson from 5.12.0 to 5.12.1 in /api by @dependabot[bot] in #36112
• chore(i18n): sync translations with en-US by @github-actions[bot] in #36115
• chore(deps): bump authlib from 1.6.11 to 1.6.12 in /api by @dependabot[bot] in #36121
• fix: isolate Langfuse v3 SDK TracerProvider to prevent cross-task interference by @GareArc in #36136
• chore(deps): bump langsmith from 0.7.31 to 0.8.0 in ...

🚀 What's New in v1.14.1?

v1.14.1 is a patch release focused on security hardening, workflow and knowledge-base stability, deployment cleanup, and continued UI platform migration after v1.14.0.

🔐 Security

• Self-hosted SECRET_KEY hardening — Docker deployments no longer rely on a public default key. When SECRET_KEY is left empty, the API generates and persists a runtime key through the configured storage backend, while explicitly configured keys continue to work as before. Thanks @laipz8200 in #36049.
• Internal metrics endpoint protection — /threads and /db-pool-stat are hardened to avoid unauthenticated exposure of internal runtime and database-pool details. Thanks @orbisai0security in #35665.
• Account and tool isolation — fixed an IDOR issue in GET /account/avatar and scoped builtin-tool default-credential cleanup to the current tenant. Thanks @NeatGuyCoding and @GareArc in #35771 and #35887.
• Dependency security — upgraded LiteLLM for CVE-2026-42208 and refreshed several backend dependencies, including urllib3, gunicorn, gitpython, mako, Google SDK packages, storage libraries, and OpenTelemetry exporter packages. Thanks @crazywoola in #35953, #35779, #35791, #35863, #35864, #35958, #36011, #36012, #36013, #36017, and #36050.

🧩 Workflow, HITL, and app runtime

• Workflow stability — restored workflow-version loading through the backend API, fixed online-user polling for large app lists, prevented preview resize observer loops, and avoided schema model collisions in trial workflows. Thanks @hjlarry and @lyzno1 in #35817, #35786, #35936, and #36061.
• Workflow authoring polish — fixed variable reference picker behavior for sub-variables, workflow node title overflow, condition operator popovers, workflow checklist semantics, and KB metadata filter field selection. Thanks @iamjoel, @hjlarry, @lyzno1, and @shawny011717 in #35732, #35740, #35828, #36006, and #34149.
• Workflow execution correctness — preserved single-run input variable types, fixed structured_output_enabled validation, fixed file-preview URL handling in node output display, and unblocked plugin model selector tools on v1.14.0 workflows. Thanks @Jingyi-Dify, @fatelei, @shawny011717, and @sawyer-shi in #35710, #35747, #34150, and #35794.
• Human input — exposed selected action values for Human-in-the-loop flows. Thanks @Blackoutta in #35451.
• Question Classifier — added editable class labels. Thanks @Blackoutta in #35430.

📚 Data, RAG, and knowledge

• Knowledge-base image rendering — fixed image rendering failures in the knowledge base. Thanks @FFXN in #35914.
• Document indexing — skip empty documents before vector embedding and validate missing text indexing techniques. Thanks @princepal9120 and @juyua9 in #35763 and #35941.
• RAG deduplication — use doc_id as the deduplication key across providers, not only Dify-hosted providers. Thanks @ki3nd in #35759.
• Dataset metadata filters — preserve dataset metadata filters in API paths and fix KB metadata filter field selection. Thanks @princepal9120 and @shawny011717 in #35700 and #34149.
• Upload filename handling — clean upload filenames parsed from URLs and avoid doubled dots when standardizing datasource file extensions. Thanks @jonathanchang31 and @Beandon13 in #35706 and #35808.

🎨 Web UI and design system

• Dify UI migration — continued migration from legacy overlays, tooltips, drawers, selects, tags, and searchable pickers to @langgenius/dify-ui primitives, including new Drawer, Tabs, ToggleGroup, Autocomplete, and Combobox support. Thanks @lyzno1 and @CodingOnStar in #35675, #35715, #35720, #35721, #35774, #35785, #35787, #35792, #35825, #35868, #35881, #35892, #35896, #35917, #35961, #35962, #35963, #35965, #35976, #35982, and #36066.
• Accessibility and semantics — improved web accessibility, removed unnecessary data-testid usage, normalized select value handling, improved help glyph semantics, and refined premium badge button semantics. Thanks @lyzno1 in #35999, #36007, #36008, and #36026.
• Overlay and navigation reliability — restored app navigation create submenu interaction, fixed transfer workspace dropdown display, normalized overlay control, aligned Tailwind v4 CSS migration, forwarded CSP nonce to the theme script, and aligned tag filter dropdown icons. Thanks @hjlarry, @iamjoel, and @lyzno1 in #35681, #35876, #35832, #35829, #35960, and #36041.
• Publisher and launch flows — improved publisher confirmation dialog handling and fixed mismatched copy in prefilled WebApp launch descriptions. Thanks @CodingOnStar and @iamjoel in #35701 and #35964.
• Audio and transcript behavior — explicitly resume AudioContext and play audio on first TTS load, and pass end_user.external_user_id correctly to transcript ASR. Thanks @ki3nd in #35901 and #35898.

🔎 Observability and tracing

• Phoenix tracing — improved Phoenix workflow tracing. Thanks @Blackoutta in #35605.
• LangSmith tracing — fixed trace_id mismatch in chatflow workflow traces. Thanks @ki3nd in #35979.

⚙️ Deployment and operations

• Docker env layout — split Docker Compose environment variables into organized docker/envs/** files and updated generation, cleanup, and middleware setup flows. Thanks @macatizm and @laipz8200 in #31586 and #35938.
• Middleware setup — updated local setup and cleanup flows for the new middleware env template location. Thanks @laipz8200 in #35946.
• Database pool behavior — added SQLALCHEMY_POOL_RESET_ON_RETURN configuration support. Thanks @fatelei in #31156.
• WebSocket service — separated the WebSocket service for cleaner deployment boundaries. Thanks @hjlarry in #35981.
• Explore categories — Explore recommended apps now support multiple configurable categories and adjustable category order. Thanks @hjlarry in #35723.
• TiDB endpoint updates — fixed endpoint updates when TiDB status c...