github langgenius/dify 1.14.2
v1.14.2 - Security fixes, agent groundwork, workflow reliability, and deployment updates
on GitHub

6 hours ago

🚀 What's New in v1.14.2?

v1.14.2 is a patch release focused on security hardening, workflow and knowledge reliability, observability fixes, agent groundwork, and deployment/runtime tuning after v1.14.1.

🔐 Security and administration

  • Tenant-scoped sensitive endpoints — strengthened tenant isolation for app trace-config endpoints and FilePreview text extraction. Thanks @xr843 in #35793 and #35797.
  • Tool credential safety — restricted default builtin tool credential updates to workspace admins and owners, and cleaned stale tenant tool credentials during reset-encrypt-key-pair. Thanks @NeatGuyCoding and @xr843 in #36264 and #35843.

🧩 Workflow, HITL, and app runtime

  • Workflow execution reliability — restored tracing after HITL workflow resume, improved workflow run callback tracking, reduced message-update database roundtrips, fixed memory fetches outside Flask context, and closed base64 file lookup sessions correctly. Thanks @Blackoutta, @CodingOnStar, @wylswz, @hjlarry, and @escape0707 in #36064, #36149, #36213, #36253, and #36308.
  • Workflow and model selection polish — fixed loading behavior when no model is selected, filtered model presets by supported parameters, and improved API extension dialog controls. Thanks @iamjoel and @lyzno1 in #36342, #36339, and #36323.

📚 Data, RAG, and knowledge

  • Knowledge-base stability — fixed knowledge hit-testing rendering, empty knowledge creation, recommended app category ordering, and null handling in recommended app detail retrieval. Thanks @FFXN, @laipz8200, @hjlarry, and @EvanYao826 in #36106, #36336, #36161, and #36153.
  • RAG and document processing — allowed LLM nodes to access retrieved knowledge files, regenerated document summaries after API updates, fixed pipeline template rendering, and handled credential fetch failures in RAG pipelines more gracefully. Thanks @laipz8200, @EvanYao826, @FFXN, and @linw1995 in #36175, #36035, #36168, and #36165.

🎨 Web UI and product experience

  • App creation and onboarding — tracked app creation source and template ID, initialized user timezone and language from the browser, and fixed WebApp icon and description display. Thanks @CodingOnStar, @lyzno1, and @JzoNgKVO in #36369, #36170, #36206, and #36209.
  • Annotation and datasets UI — allowed annotation reply score thresholds below 0.8, redirected unauthorized knowledge editors back to datasets, and fixed tag rename without type payload. Thanks @JzoNgKVO, @iamjoel, and @lyzno1 in #36337, #36073, and #36182.
  • UI platform migration and polish — added Checkbox and CheckboxGroup primitives, migrated more controls to @langgenius/dify-ui, improved dialog overflow layouts, and refined account avatar and install-flow interactions. Thanks @lyzno1 and @CodingOnStar in #36271, #36295, #36255, #36302, #36111, #36199, and #36210.

🔎 Observability and tracing

  • Tracing reliability — isolated Langfuse v3 SDK tracer providers to prevent cross-task interference and added Phoenix parent trace fallback behavior. Thanks @GareArc and @Blackoutta in #36136 and #36290.

⚙️ Deployment, dependencies, and developer experience

  • Deployment tuning — upgraded plugin-daemon to 0.6.1, increased the default GraphEngine minimum worker count, and refreshed Docker README references. Thanks @laipz8200, @kenwoodjw, and @RiskeyL in #36312, #35650, and #36303.
  • Backend and CI maintenance — moved static analysis toward Pyrefly, upgraded Graphon to 0.4.0, added hotfix cherry-pick provenance checks, and improved generated contract workflows. Thanks @cqjjjzr, @laipz8200, and @hyoban in #36154, #36124, #36340, and #36286.
  • Dependency updates — refreshed backend and agent dependencies including authlib, ujson, langsmith, and urllib3. Thanks @dependabot[bot] in #36112, #36121, #36142, and #36160.

Upgrade Guide

Important

  • This release includes a new database migration for configurable Explore app categories. Run database migrations as part of the upgrade.
  • Docker Compose environment variables are now split into categorized files under docker/envs/**. If you maintain a customized docker-compose.yaml or .env, review the new layout and re-apply local customizations carefully.
  • For self-hosted deployments, explicitly configured SECRET_KEY values continue to be respected. If SECRET_KEY is empty, Dify now generates and persists a runtime key automatically.

Docker Compose Deployments

  1. Back up your customized docker-compose YAML and env files. 

    cd docker
cp docker-compose.yaml docker-compose.yaml.$(date +%s).bak
cp .env .env.$(date +%s).bak 2>/dev/null || true

  2. Get the latest code from the release branch or tag. 

    git fetch --tags
git checkout 1.14.2

  3. Stop the service. Please execute in the docker directory. 

    docker compose down

  4. Back up data. 

    tar -cvf volumes-$(date +%s).tgz volumes

  5. Review the new docker/envs/** env file layout and re-apply any local customizations.

  6. Upgrade services. 

    docker compose up -d

Source Code Deployments

  1. Stop the API server, Worker, and Web frontend Server.

  2. Get the latest code from the release tag. 

    git fetch --tags
git checkout 1.14.2

  3. Update Python dependencies. 

    cd api
uv sync

  4. Run the migration script. 

    uv run flask db upgrade

  5. Restart the API server, Worker, and Web frontend Server.

What's Changed

New Contributors

Full Changelog: 1.14.1...1.14.2

Check out latest releases or
releases around langgenius/dify 1.14.2

Don't miss a new dify release

NewReleases is sending notifications on new releases.

Get notifications