# deer-flow changelog

> deer-flow release notes.

- Vendor: deer-flow
- Category: AI
- Official site: https://deerflow.tech/
- Tracked by: What's New (https://whatsnew.fyi/product/deer-flow)
- Harvested from: GitHub (bytedance/deer-flow)
- Entries below: 1 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v2.0.0 — DeerFlow 2.0.0 released

- Date: 2026-06-25
- Version: v2.0.0
- Original notes: https://github.com/bytedance/deer-flow/releases/tag/v2.0.0
- Permalink: https://whatsnew.fyi/product/deer-flow/releases/v2.0.0

- **added** — Agents can persist edits to their own SOUL.md / config.yaml from a normal chat with full per-user isolation
- **added** — Users can bind their own Slack, Telegram, Discord, Feishu/Lark, DingTalk, WeChat, and WeCom accounts on top of operator-configured bots
- **added** — Support for StepFun and MiMo reasoning models, MiniMax for image/video/podcast skills, and a new music-generation skill
- **added** — Add Brave Search, SearXNG, Browserless, and Serper Google Images tools
- **added** — Discord gets mention-only mode, thread routing, and typing indicators
- **added** — Telegram streams replies by editing the placeholder message in place
- **added** — Configurable loop detection with per-tool frequency overrides and deferred warning injection
- **changed** — Subagent token usage streams to the header in real time, with spans attributed to the parent thread's Langfuse trace
- **changed** — Token-usage tracking on by default with refined display modes and usage attributed to the actual models
- **changed** — Opt out of tiktoken in restricted networks via memory.token_counting
- **changed** — Make AI follow-up suggestions optional
- **changed** — Clean lead_agent and custom-agent trace names; session_id and user_id propagated to Langfuse; non-ASCII memory traces no longer escape
- **changed** — Runs now hydrate from RunStore and persist interrupted status
- **changed** — Runs return ISO 8601 timestamps
- **changed** — Memory runs on a persistent event loop instead of a short-lived asyncio.run()
- **changed** — Docker Gateway defaults to a single worker
- **changed** — nginx resolves upstream names at request time
- **fixed** — Cancellation now requires the worker who owns the run; cross-worker cancels return 409 instead of silently appearing successful
- **fixed** — Runs hydrate from the persistent store after a gateway restart and have an idempotent cancel
- **security** — Reject symlinked upload destinations on Linux and Windows
- **security** — Mask sensitive values in MCP config responses and harden the endpoint

#### DeerFlow 2.0.0

DeerFlow 2.0 is a **ground-up rewrite** around a "super agent" harness that
orchestrates **sub-agents**, **persistent memory**, **sandboxed execution**,
and an extensible **skills/tools** system. It shares no code with the 1.x line,
which lives on the [`main-1.x` branch](https://github.com/bytedance/deer-flow/tree/main-1.x).

This release closes the [2.0.0 milestone](https://github.com/bytedance/deer-flow/milestone/1)
with **182 merged PRs** since the first 2.0 milestone tag.

> 📖 Full notes: [CHANGELOG.md](CHANGELOG.md) · [中文版](CHANGELOG_zh.md)

---

##### ⚠️ Breaking change

- **Run hydration** — runs now hydrate from `RunStore` and persist `interrupted`
  status. Cancellation now requires the worker who owns the run; cross-worker
  cancels return `409` instead of silently appearing successful. ([#2932])

##### ✨ Highlights

- **Custom agents that update themselves** — agents can persist edits to their
  own `SOUL.md` / `config.yaml` from a normal chat, with full per-user
  isolation. ([#2713])
- **User-owned IM channel connections** — users can bind their own Slack,
  Telegram, Discord, Feishu/Lark, DingTalk, WeChat, and WeCom accounts on top
  of operator-configured bots. ([#3487])
- **More models & community search** — StepFun and MiMo reasoning models,
  MiniMax for image/video/podcast skills plus a new music-generation skill,
  and Brave Search / SearXNG / Browserless / Serper Google Images tools.
  ([#3461], [#3298], [#3437], [#3528], [#3451], [#3575])
- **Richer channels** — Discord gets mention-only mode, thread routing, and
  typing indicators; Telegram streams replies by editing the placeholder
  message in place. ([#2842], [#3534])
- **Configurable loop detection** with per-tool frequency overrides and
  deferred warning injection. ([#2586], [#2711], [#2752])
- **Subagent token usage** streams to the header in real time, with spans
  attributed to the parent thread's Langfuse trace. ([#2882], [#3611])
- **Trace polish** — clean `lead_agent` / custom-agent trace names; `session_id`
  + `user_id` propagated to Langfuse; non-ASCII memory traces no longer escape.
  ([#3101], [#2944], [#3104])
- **Token-usage tracking on by default**, with refined display modes and usage
  attributed to the actual models. ([#2841], [#2329], [#3658])
- **Flexible memory & suggestions** — opt out of tiktoken in restricted
  networks via `memory.token_counting`; make AI follow-up suggestions optional.
  ([#3465], [#3591])

##### 🚀 Performance

- Push thread metadata filters into SQL. ([#2865])
- Index runs by `thread_id` in `RunManager` to eliminate O(n) scans. ([#3499])
- Index messages in `MemoryRunEventStore` to eliminate O(n) scans. ([#3531])
- Cache `Base.to_dict` column reflection per class. ([#3654])
- Speed up `should_ignore_name` in glob/grep sandbox walks. ([#3657])

##### 🔒 Security

- Reject symlinked upload destinations on Linux **and** Windows.
  ([#2623], [#2794])
- Mask sensitive values in MCP config responses; harden the endpoint.
  ([#2667], [#3425])
- Reject cross-site auth POSTs. ([#2740])
- Cap skill artifact preview decompression (zip-bomb defense). ([#2963])
- Mount the host Docker socket only in aio (DooD) sandbox mode. ([#3517])
- Don't bind-mount host CLI auth dirs by default. ([#3521])

##### 🐛 Notable fixes

- **Memory** runs on a persistent event loop instead of a short-lived one
  `asyncio.run()`; queued updates isolated per agent; wrapped JSON responses
  parsed correctly. ([#2627], [#2941], [#3252])
- **Runs** hydrate from the persistent store after a gateway restart, return
  ISO 8601 timestamps, and have an idempotent cancel. ([#2989], [#2599], [#3058])
- **Subagents** isolated from the parent run's checkpointer; timeout terminal
  state atomic; respect model overrides for tools/middleware. ([#3559],
  [#2583], [#2641])
- **Sandbox** readiness polling no longer blocks the event loop;
  `/mnt/user-data` c

_[Truncated at 4000 characters — full notes: https://github.com/bytedance/deer-flow/releases/tag/v2.0.0]_