Dify 1.14.1

Original release notes

What's New in v1.14.1?

v1.14.1 is a patch release focused on security hardening, workflow and knowledge-base stability, deployment cleanup, and continued UI platform migration after v1.14.0.

Security

Self-hosted SECRET_KEY hardening - Docker deployments no longer rely on a public default key. When SECRET_KEY is left empty, the API generates and persists a runtime key through the configured storage backend, while explicitly configured keys continue to work as before. Thanks @laipz8200 in #36049.
Internal metrics endpoint protection - /threads and /db-pool-stat are hardened to avoid unauthenticated exposure of internal runtime and database-pool details. Thanks @orbisai0security in #35665.
Account and tool isolation - fixed an IDOR issue in GET /account/avatar and scoped builtin-tool default-credential cleanup to the current tenant. Thanks @NeatGuyCoding and @GareArc in #35771 and #35887.
Dependency security - upgraded LiteLLM for CVE-2026-42208 and refreshed several backend dependencies, including urllib3, gunicorn, gitpython, mako, Google SDK packages, storage libraries, and OpenTelemetry exporter packages. Thanks @crazywoola in #35953, #35779, #35791, #35863, #35864, #35958, #36011, #36012, #36013, #36017, and #36050.

Workflow, HITL, and app runtime

Workflow stability - restored workflow-version loading through the backend API, fixed online-user polling for large app lists, prevented preview resize observer loops, and avoided schema model collisions in trial workflows. Thanks @hjlarry and @lyzno1 in #35817, #35786, #35936, and #36061.
Workflow authoring polish - fixed variable reference picker behavior for sub-variables, workflow node title overflow, condition operator popovers, workflow checklist semantics, and KB metadata filter field selection. Thanks @iamjoel, @hjlarry, @lyzno1, and @shawny011717 in #35732, #35740, #35828, #36006, and #34149.
Workflow execution correctness - preserved single-run input variable types, fixed structured_output_enabled validation, fixed file-preview URL handling in node output display, and unblocked plugin model selector tools on v1.14.0 workflows. Thanks @Jingyi-Dify, @fatelei, @shawny011717, and @sawyer-shi in #35710, #35747, #34150, and #35794.
Human input - exposed selected action values for Human-in-the-loop flows. Thanks @Blackoutta in #35451.
Question Classifier - added editable class labels. Thanks @Blackoutta in #35430.

Data, RAG, and knowledge

Knowledge-base image rendering - fixed image rendering failures in the knowledge base. Thanks @FFXN in #35914.
Document indexing - skip empty documents before vector embedding and validate missing text indexing techniques. Thanks @princepal9120 and @juyua9 in #35763 and #35941.
RAG deduplication - use doc_id as the deduplication key across providers, not only Dify-hosted providers. Thanks @ki3nd in #35759.
Dataset metadata filters - preserve dataset metadata filters in API paths and fix KB metadata filter field selection. Thanks @princepal9120 and @shawny011717 in #35700 and #34149.
Upload filename handling - clean upload filenames parsed from URLs and avoid doubled dots when standardizing datasource file extensions. Thanks @jonathanchang31 and @Beandon13 in #35706 and #35808.

Web UI and design system

Dify UI migration - continued migration from legacy overlays, tooltips, drawers, selects, tags, and searchable pickers to @langgenius/dify-ui primitives, including new Drawer, Tabs, ToggleGroup, Autocomplete, and Combobox support. Thanks @lyzno1 and @CodingOnStar in #35675, #35715, #35720, #35721, #35774, #35785, #35787, #35792, #35825, #35868, #35881, #35892, #35896, #35917, #35961, #35962, #35963, #35965, #35976, #35982, and #36066.
Accessibility and semantics - improved web accessibility, removed unnecessary data-testid usage, normalized select value handling, improved help glyph semantics, and refined premium badge button semantics. Thanks @lyzno1 in #35999, #36007, #36008, and #36026.
Overlay and navigation reliability - restored app navigation create submenu interaction, fixed transfer workspace dropdown display, normalized overlay control, aligned Tailwind v4 CSS migration, forwarded CSP nonce to the theme script, and aligned tag filter dropdown icons. Thanks @hjlarry, @iamjoel, and @lyzno1 in #35681, #35876, #35832, #35829, #35960, and #36041.
Publisher and launch flows - improved publisher confirmation dialog handling and fixed mismatched copy in prefilled WebApp launch descriptions. Thanks @CodingOnStar and @iamjoel in #35701 and #35964.
Audio and transcript behavior - explicitly resume AudioContext and play audio on first TTS load, and pass end_user.external_user_id correctly to transcript ASR. Thanks @ki3nd in #35901 and #35898.

Observability and tracing

Phoenix tracing - improved Phoenix workflow tracing. Thanks @Blackoutta in #35605.
LangSmith tracing - fixed trace_id mismatch in chatflow workflow traces. Thanks @ki3nd in #35979.

Deployment and operations

Docker env layout - split Docker Compose environment variables into organized docker/envs/** files and updated generation, cleanup, and middleware setup flows. Thanks @macatizm and @laipz8200 in #31586 and #35938.
Middleware setup - updated local setup and cleanup flows for the new middleware env template location. Thanks @laipz8200 in #35946.
Database pool behavior - added SQLALCHEMY_POOL_RESET_ON_RETURN configuration support. Thanks @fatelei in #31156.
WebSocket service - separated the WebSocket service for cleaner deployment boundaries. Thanks @hjlarry in #35981.
Explore categories - Explore recommended apps now support multiple configurable categories and adjustable category order. Thanks @hjlarry in #35723.
TiDB endpoint updates - fixed endpoint updates when TiDB status changes. Thanks @zyssyz123 in #35854.

Upgrade Guide

Important notes

This release includes a new database migration for configurable Explore app categories. Run database migrations as part of the upgrade.
Docker Compose environment variables are now split into categorized files under docker/envs/**. If you maintain a customized docker-compose.yaml or .env, review the new layout and re-apply local customizations carefully.
For self-hosted deployments, explicitly configured SECRET_KEY values continue to be respected. If SECRET_KEY is empty, Dify now generates and persists a runtime key automatically.

Docker Compose Deployments

Back up your customized docker-compose YAML and env files.

cd docker
cp docker-compose.yaml docker-compose.yaml.$(date +%s).bak
cp .env .env.$(date +%s).bak 2>/dev/null || true

2. Get the latest code from the release branch or tag.

git fetch --tags git checkout 1.14.1

Stop the service. Please execute in the docker directory.

docker compose down

4. Back up data.

tar -cvf volumes-$(date +%s).tgz volumes

Review the new docker/envs/** env file layout and re-apply any local customizations.

Upgrade services.

docker compose up -d

### Source Code Deployments

1. Stop the API server, Worker, and Web frontend Server.

2. Get the latest code from the release tag.

git fetch --tags git checkout 1.14.1

Update Python dependencies.

cd api
uv sync

4. Run the migration script.

uv run flask db upgrade

Restart the API server, Worker, and Web frontend Server.

---

What's Changed

fix: ensure generated password satisfies the password policy by @kurokobo in https://github.com/langgenius/dify/pull/35672
chore: update eslint suppressions codeowner by @lyzno1 in https://github.com/langgenius/dify/pull/35679
chore: update to pnpm 11 by @hyoban in https://github.com/langgenius/dify/pull/35673
refactor(web): migrate rich tooltip overlays by @lyzno1 in https://github.com/langgenius/dify/pull/35675
fix: restore app nav create submenu interaction by @hjlarry in https://github.com/langgenius/dify/pull/35681
fix(web): disable pnpm dependency checks during Docker build by @lyzno1 in https://github.com/langgenius/dify/pull/35686
chore: allow configurable Next.js dev origins by @hjlarry in https://github.com/langgenius/dify/pull/35683
fix(publisher): enhance confirm dialog handling and improve popup interactions by @CodingOnStar in https://github.com/langgenius/dify/pull/35701
refactor(auth): update OAuth button and settings modal for improved state management and UI consistency by @CodingOnStar in https://github.com/langgenius/dify/pull/35702
refactor: port WorkflowDraftVariableFile by @asukaminato0721 in https://github.com/langgenius/dify/pull/30923
refactor(web): migrate short tooltips to dify-ui by @lyzno1 in https://github.com/langgenius/dify/pull/35715
refactor(web): migrate subscription create modal to dialog by @lyzno1 in https://github.com/langgenius/dify/pull/35721
fix: ToolEntity data validation failed during workflow synchronization by @eldoradoel in https://github.com/langgenius/dify/pull/35696
refactor(web/select): base selects to dify-ui by @lyzno1 in https://github.com/langgenius/dify/pull/35720
fix(plugin): preserve multi-value HTTP response headers by @xr843 in https://github.com/langgenius/dify/pull/35726
fix: var reference picker can not choose sub vars by @iamjoel in https://github.com/langgenius/dify/pull/35732
chore: generate enterprise console API by @hyoban in https://github.com/langgenius/dify/pull/35735
fix: prevent workflow node titles from overflowing by @hjlarry in https://github.com/langgenius/dify/pull/35740
refactor(web): workflow hotkeys and history state by @lyzno1 in https://github.com/langgenius/dify/pull/35736
fix: fix structured_output_enabled miss in second validate by @fatelei in https://github.com/langgenius/dify/pull/35747
chore: generate contact from api by @hyoban in https://github.com/langgenius/dify/pull/35748