github langgenius/dify 1.14.1
v1.14.1 - Security hardening, workflow stability, and cleaner self-hosted deployments
on GitHub

5 hours ago

🚀 What's New in v1.14.1?

v1.14.1 is a patch release focused on security hardening, workflow and knowledge-base stability, deployment cleanup, and continued UI platform migration after v1.14.0.

🔐 Security

  • Self-hosted SECRET_KEY hardening — Docker deployments no longer rely on a public default key. When SECRET_KEY is left empty, the API generates and persists a runtime key through the configured storage backend, while explicitly configured keys continue to work as before. Thanks @laipz8200 in #36049.
  • Internal metrics endpoint protection — /threads and /db-pool-stat are hardened to avoid unauthenticated exposure of internal runtime and database-pool details. Thanks @orbisai0security in #35665.
  • Account and tool isolation — fixed an IDOR issue in GET /account/avatar and scoped builtin-tool default-credential cleanup to the current tenant. Thanks @NeatGuyCoding and @GareArc in #35771 and #35887.
  • Dependency security — upgraded LiteLLM for CVE-2026-42208 and refreshed several backend dependencies, including urllib3, gunicorn, gitpython, mako, Google SDK packages, storage libraries, and OpenTelemetry exporter packages. Thanks @crazywoola in #35953, #35779, #35791, #35863, #35864, #35958, #36011, #36012, #36013, #36017, and #36050.

🧩 Workflow, HITL, and app runtime

  • Workflow stability — restored workflow-version loading through the backend API, fixed online-user polling for large app lists, prevented preview resize observer loops, and avoided schema model collisions in trial workflows. Thanks @hjlarry and @lyzno1 in #35817, #35786, #35936, and #36061.
  • Workflow authoring polish — fixed variable reference picker behavior for sub-variables, workflow node title overflow, condition operator popovers, workflow checklist semantics, and KB metadata filter field selection. Thanks @iamjoel, @hjlarry, @lyzno1, and @shawny011717 in #35732, #35740, #35828, #36006, and #34149.
  • Workflow execution correctness — preserved single-run input variable types, fixed structured_output_enabled validation, fixed file-preview URL handling in node output display, and unblocked plugin model selector tools on v1.14.0 workflows. Thanks @Jingyi-Dify, @fatelei, @shawny011717, and @sawyer-shi in #35710, #35747, #34150, and #35794.
  • Human input — exposed selected action values for Human-in-the-loop flows. Thanks @Blackoutta in #35451.
  • Question Classifier — added editable class labels. Thanks @Blackoutta in #35430.

📚 Data, RAG, and knowledge

  • Knowledge-base image rendering — fixed image rendering failures in the knowledge base. Thanks @FFXN in #35914.
  • Document indexing — skip empty documents before vector embedding and validate missing text indexing techniques. Thanks @princepal9120 and @juyua9 in #35763 and #35941.
  • RAG deduplication — use doc_id as the deduplication key across providers, not only Dify-hosted providers. Thanks @ki3nd in #35759.
  • Dataset metadata filters — preserve dataset metadata filters in API paths and fix KB metadata filter field selection. Thanks @princepal9120 and @shawny011717 in #35700 and #34149.
  • Upload filename handling — clean upload filenames parsed from URLs and avoid doubled dots when standardizing datasource file extensions. Thanks @jonathanchang31 and @Beandon13 in #35706 and #35808.

🎨 Web UI and design system

  • Dify UI migration — continued migration from legacy overlays, tooltips, drawers, selects, tags, and searchable pickers to @langgenius/dify-ui primitives, including new Drawer, Tabs, ToggleGroup, Autocomplete, and Combobox support. Thanks @lyzno1 and @CodingOnStar in #35675, #35715, #35720, #35721, #35774, #35785, #35787, #35792, #35825, #35868, #35881, #35892, #35896, #35917, #35961, #35962, #35963, #35965, #35976, #35982, and #36066.
  • Accessibility and semantics — improved web accessibility, removed unnecessary data-testid usage, normalized select value handling, improved help glyph semantics, and refined premium badge button semantics. Thanks @lyzno1 in #35999, #36007, #36008, and #36026.
  • Overlay and navigation reliability — restored app navigation create submenu interaction, fixed transfer workspace dropdown display, normalized overlay control, aligned Tailwind v4 CSS migration, forwarded CSP nonce to the theme script, and aligned tag filter dropdown icons. Thanks @hjlarry, @iamjoel, and @lyzno1 in #35681, #35876, #35832, #35829, #35960, and #36041.
  • Publisher and launch flows — improved publisher confirmation dialog handling and fixed mismatched copy in prefilled WebApp launch descriptions. Thanks @CodingOnStar and @iamjoel in #35701 and #35964.
  • Audio and transcript behavior — explicitly resume AudioContext and play audio on first TTS load, and pass end_user.external_user_id correctly to transcript ASR. Thanks @ki3nd in #35901 and #35898.

🔎 Observability and tracing

  • Phoenix tracing — improved Phoenix workflow tracing. Thanks @Blackoutta in #35605.
  • LangSmith tracing — fixed trace_id mismatch in chatflow workflow traces. Thanks @ki3nd in #35979.

⚙️ Deployment and operations

  • Docker env layout — split Docker Compose environment variables into organized docker/envs/** files and updated generation, cleanup, and middleware setup flows. Thanks @macatizm and @laipz8200 in #31586 and #35938.
  • Middleware setup — updated local setup and cleanup flows for the new middleware env template location. Thanks @laipz8200 in #35946.
  • Database pool behavior — added SQLALCHEMY_POOL_RESET_ON_RETURN configuration support. Thanks @fatelei in #31156.
  • WebSocket service — separated the WebSocket service for cleaner deployment boundaries. Thanks @hjlarry in #35981.
  • Explore categories — Explore recommended apps now support multiple configurable categories and adjustable category order. Thanks @hjlarry in #35723.
  • TiDB endpoint updates — fixed endpoint updates when TiDB status changes. Thanks @zyssyz123 in #35854.

Upgrade Guide

Important notes

  • This release includes a new database migration for configurable Explore app categories. Run database migrations as part of the upgrade.
  • Docker Compose environment variables are now split into categorized files under docker/envs/**. If you maintain a customized docker-compose.yaml or .env, review the new layout and re-apply local customizations carefully.
  • For self-hosted deployments, explicitly configured SECRET_KEY values continue to be respected. If SECRET_KEY is empty, Dify now generates and persists a runtime key automatically.

Docker Compose Deployments

  1. Back up your customized docker-compose YAML and env files. 

    cd docker
cp docker-compose.yaml docker-compose.yaml.$(date +%s).bak
cp .env .env.$(date +%s).bak 2>/dev/null || true

  2. Get the latest code from the release branch or tag. 

    git fetch --tags
git checkout 1.14.1

  3. Stop the service. Please execute in the docker directory. 

    docker compose down

  4. Back up data. 

    tar -cvf volumes-$(date +%s).tgz volumes

  5. Review the new docker/envs/** env file layout and re-apply any local customizations.

  6. Upgrade services. 

    docker compose up -d

Source Code Deployments

  1. Stop the API server, Worker, and Web frontend Server.

  2. Get the latest code from the release tag. 

    git fetch --tags
git checkout 1.14.1

  3. Update Python dependencies. 

    cd api
uv sync

  4. Run the migration script. 

    uv run flask db upgrade

  5. Restart the API server, Worker, and Web frontend Server.

What's Changed

New Contributors

Full Changelog: 1.14.0...1.14.1

Check out latest releases or
releases around langgenius/dify 1.14.1

Don't miss a new dify release

NewReleases is sending notifications on new releases.

Get notifications