Traceary

Catalog / Dify

1.13.1

v1.13.1

5 months agobreakingsecurityaddedOriginal notes

🚀 Major Functional Changes

Data platform and dataset operations

  • Added Hologres as a supported backend option for both vector retrieval and full-text search.
  • Added Service API endpoints for dataset document downloads:
    • Batch ZIP download for selected documents.
    • Signed URL download for single-document original files.

Workflow and chat experience improvements

  • Breaking change: HITL email content now uses markdown rendering before delivery. Existing email templates that relied on raw/plain behavior may render differently after upgrade.
  • Draft variables are now user-scoped instead of app-scoped. Historical draft variables will not be available after upgrading.
  • Added edge context menu support in workflow canvas, including direct edge deletion.
  • Preserved existing connections when changing node types in workflow editing.
  • Added configurable send-key behavior (Enter vs Shift+Enter) for embedded chat input.
  • Added file payloads in message-end stream responses.
  • Removed GPT-4-specific hardcoded behavior from default model selection logic.
  • Added a new export-app-messages CLI command to export application messages and related feedback to JSONL.GZ (local or cloud storage).

🔐 Security Updates

  • Prevented SQL injection risks in vector-store query paths by switching to parameterized SQL in affected implementations.
  • Hardened HITL email delivery:
    • Sanitize subject and body content.
    • Strip CR/LF from subjects to prevent SMTP header-injection vectors.
  • Enforced ownership checks for conversation deletion APIs.
  • Cleared stale provider credentials during plugin uninstall to reduce residual credential risk.
  • Improved enterprise API error handling and license-enforcement behavior for invalid/expired license states.

🏗️ Configuration, Architecture, and Deployment Updates

Deployment and operations

  • Added a dedicated Celery queue: dataset_summary for LLM-heavy summary generation tasks.
    • Ensure workers subscribe to this queue to avoid summary-job backlog.
  • Added telemetry metrics for retention cleanup tasks (messages/workflow runs), plus flush behavior for short-lived command jobs.

Configuration changes

  • Added REDIS_MAX_CONNECTIONS.
  • Deprecated PUBSUB_* event-bus settings in favor of EVENT_BUS_* settings.

🛠 Other Noteworthy Changes

  • Fixed workflow_runs.started_at being overwritten on resume.
  • Fixed metadata batch-edit silent failures caused by split-transaction edge cases.
  • Fixed metadata filter extraction issues in knowledge retrieval ({{...}} conditions).
  • Restored citation visibility in advanced chat applications.
  • Fixed conversation variable reset behavior after HITL nodes.
  • Fixed a page crash in knowledge-retrieval node configuration flow.
  • Fixed chat assistant blocking response-mode behavior.
  • Added doc_type handling in Weaviate vector attributes for better compatibility.
  • Upgraded OpenTelemetry dependencies to resolve context-detach errors.

Upgrade Guide

[!IMPORTANT] If you use custom CELERY_QUEUES, make sure workflow_based_app_execution is included.
If ENABLE_API_TOKEN_LAST_USED_UPDATE_TASK=true, also include api_token.

For background and details, see ⚠️ Important Upgrade Note and 🔧 Operational Note above.

Docker Compose Deployments

  1. Back up your customized docker-compose YAML file (optional)

    cd docker
cp docker-compose.yaml docker-compose.yaml.$(date +%s).bak

  2. Get the latest code from the main branch

    git checkout main
git pull origin main

  3. Stop the service. Please execute in the docker directory

    docker compose down

  4. Back up data

    tar -cvf volumes-$(date +%s).tgz volumes

  5. Upgrade services

    docker compose up -d

[!NOTE]

If you encounter errors like below

2025/11/26 11:37:57 /app/internal/db/pg/pg.go:30
[error] failed to initialize database, got error failed to connect to `host=db_postgres user=postgres database=dify_plugin`: hostname resolving error (lookup db_postgres on 127.0.0.11:53: server misbehaving)

2025/11/26 11:37:57 /app/internal/db/pg/pg.go:34
[error] failed to initialize database, got error failed to connect to `host=db_postgres user=postgres database=postgres`: hostname > resolving error (lookup db_postgres on 127.0.0.11:53: server misbehaving)
2025/11/26 11:37:57 init.go:99: [PANIC]failed to init dify plugin db: failed to connect to `host=db_postgres user=postgres database=postgres`: hostname resolving error (lookup db_postgres on 127.0.0.11:53: server misbehaving)
panic: [PANIC]failed to init dify plugin db: failed to connect to `host=db_postgres user=postgres database=postgres`: hostname resolving error (lookup db_postgres on 127.0.0.11:53: server misbehaving)

Please use the following command instead. For details, please read this https://github.com/langgenius/dify/issues/28706

docker compose --profile postgresql up -d

Source Code Deployments

  1. Stop the API server, Worker, and Web frontend Server.

  2. Get the latest code from the release branch:

    git checkout 1.13.1

  3. Update Python dependencies:

    cd api
uv sync

  4. Then, let's run the migration script:

    uv run flask db upgrade

  5. Finally, run the API server, Worker, and Web frontend Server again.

What's Changed

These notes run past the length kept in the archive. The rest is on the publisher’s page.