Traceary

Catalog / Dify

1.14.0

v1.14.0

4 months agosecurityaddedfixedOriginal notes

🚀 What's New in v1.14.0?

Collaboration

Collaboration allows workspace members to edit the same workflow together, with synced graph updates, online presence, and shared visibility into who is working where.

On self-hosted deployments, collaboration is turned off by default. Enable it by setting:

ENABLE_COLLABORATION_MODE = true
SERVER_WORKER_CLASS = geventwebsocket.gunicorn.workers.GeventWebSocketWorker
NEXT_PUBLIC_SOCKET_URL = your deployment’s WebSocket URL (e.g., wss://dify.example.com)

For more details, see Full Documentation

Human-in-the-loop (HITL)

  • Service API for HITL — programmatic support for human-in-the-loop flows alongside existing console behavior.

MCP and plugins

  • MCP tool metadata — refresh after updates so the UI stays in sync.
  • MCP server URL — fix double /v1 that could break OAuth and authorization (404).
  • MCP OAuth discovery — handle malformed JSON safely.
  • MCP schema publishing — map checkbox and json_object types correctly.
  • Plugins — auto-upgrade strategy persistence, local installer and file-input behavior, tenant scoping for inner API end-user lookup.

Marketplace and OAuth

  • Marketplace and OAuth — targeted fixes for marketplace flows and OAuth sign-in (including edge cases such as null email on GitHub OAuth).

UI kit and front-end platform

  • @langgenius/dify-ui — shared primitives (for example PreviewCard, Meter), design tokens, and broad migration from ad-hoc web/base/ui toward the package.
  • Accessibility — date and time pickers, auto-update strategy picker, scrollbars in plugin and model selectors, and related polish.
  • Goto Anything — recent items, /go command, deeper app sub-sections; fix for Cmd+K (removed problematic dynamic import).
  • Prompt editor — slash-triggered variable filtering; keyboard up/down in variable lists.
  • Follow-up questions — improved settings and token limits for suggested questions.
  • Modals — ApiKey, provider config, and others refactored toward a shared Dialog pattern with tests.

Observability and analytics

  • Langfuse — optional time-to-first-token (TTFT) reporting.
  • Explore — banner impression tracking; app preview event tracking on cards.

Billing and quotas

  • Quota v3 integration in the product stack.
  • Billing UI — Meter-based usage presentation; more resilient cleanup when billing APIs fail.
  • File uploader — billing-aware behavior and copy updates.

Data, RAG, and knowledge

  • Summary index and Weaviate — compatibility fixes when using the summary index with Weaviate.
  • Vector projection — include is_summary and original_chunk_id in default projection where relevant.
  • External and bound datasets — stronger tenant checks on knowledge APIs.

Infrastructure and operations

  • Docker Compose — healthchecks for api, worker, and worker_beat; template and env example updates (for example S3 address style).
  • Celery — default worker concurrency raised to 4; missing queue fix.
  • PostgreSQL — higher default max connections (200) for the updated app DB path.
  • Redis — configurable key prefix; retry logic for Redis operations.
  • TiDB — endpoint support and related auth binding migration (Qdrant endpoint on TiDB auth bindings).
  • Markdown — optional ALLOW_INLINE_STYLES environment variable to allow inline CSS in rendered Markdown when needed.

Security

  • Change-email flow — stricter phase-bound token handling (GHSA-4q3w-q5mc-45rq).
  • IDOR hardening — tenant validation on data-source binding; dataset and API ownership checks where gaps were found.

Performance

  • Optimized performance of graph initialization.

API and platform internals

  • Graphon — upgrade to standalone Graphon 0.2.2 (replacing in-tree dify_graph naming and packaging).
  • OpenAPI — script to generate OpenAPI v2 JSON and documentation pointer.
  • Deprecation — some legacy console APIs marked deprecated in favor of newer patterns.
  • Large SQLAlchemy 2.0 select() migration, Pydantic BaseModel for many console and service responses, and testcontainers-based tests for stability.

What's Changed

These notes run past the length kept in the archive. The rest is on the publisher’s page.