# deer-flow changelog

> deer-flow release notes.

- Vendor: deer-flow
- Category: AI
- License: MIT
- Language: Python
- Official site: https://deerflow.tech/
- Tracked by: What's New (https://whatsnew.fyi/product/deer-flow)
- Harvested from: GitHub (bytedance/deer-flow)
- Entries below: 2 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v2.1.0 — v2.1.0 Release

- Date: 2026-09-24
- Version: v2.1.0
- Original notes: https://github.com/bytedance/deer-flow/releases/tag/v2.1.0
- Permalink: https://whatsnew.fyi/product/deer-flow/releases/v2.1.0

- **added** — Verifiable agent execution with tamper-evident runtime-stamped receipts and bounded receipt ledger in model context
- **added** — Subagent acceptance criteria checked deterministically parent-side with file existence and recorded test-command exit status verification
- **added** — System-maintained delegation ledger to prevent redundant re-delegation with total cap bounding fan-out
- **added** — Durable, resumable batch_task tool for large collections of independent items with leases, retries, pause/resume/cancel, and chat progress panel
- **added** — Subagent step history persisted and displayed in the thread
- **added** — Interval schedules for scheduled tasks alongside once and cron
- **added** — Preview of upcoming cron occurrences before saving
- **added** — Scheduled task run history filters server-side by status and pages backwards in the UI
- **added** — Scheduled tasks can pin lead_agent or a custom agent
- **added** — New OpenViking, mem0, and Honcho memory backends over HTTP
- **added** — Built-in FTS5/BM25 retrieval adapter for memory
- **added** — LLM-assisted consolidation and staleness pruning for memory
- **added** — Incremental per-agent fact storage
- **added** — Guaranteed correction-fact injection for memory
- **added** — New E2B, BoxLite, Tenki, and OpenSandbox sandbox providers
- **added** — Opt-in isolated and domain-allowlist network egress for local Docker sandboxes with Human Input card approval flow
- **added** — Python extensions contributing middleware, lifecycle observers, Gateway services, and HTTP routers managed via deerflow extensions command
- **added** — Extension API 0.2 for extensions to observe agent execution
- **added** — Generic OIDC/SSO authentication with Keycloak support
- **added** — Personal access tokens with scoped route policies

#### DeerFlow 2.1.0

DeerFlow 2.1 builds on the 2.0 super-agent harness with a focus on **trust,
scale, and operability**: verifiable agent execution, durable batch delegation,
pluggable memory backends, four new sandbox providers, an out-of-tree extension
system, and enterprise-grade authentication and authorization — wrapped in a
much richer workspace with projects, conversation branching, and referenced
conversations.

This release closes the [2.1.0 milestone](https://github.com/bytedance/deer-flow/milestone/2)
with **772 merged PRs** since the 2.0.0 release.

> 📖 Full notes: [CHANGELOG.md](CHANGELOG.md) · [中文版](CHANGELOG_zh.md)

---

##### ⚠️ Breaking changes

- **Trace ids are unconditional** — every Gateway HTTP response carries an
  `X-Trace-Id` header, and `logging.enhance.enabled` now controls log output
  only. Client-supplied `deerflow_trace_id` values in run metadata are
  overwritten so header, logs, and the persisted run cannot disagree — send
  the `X-Trace-Id` request header to pin a correlation id. ([#5119])
- **`/mnt/skills` is reserved** for managed enabled-only skill projections.
  `DEER_FLOW_HOST_SKILLS_PATH` / `SKILLS_HOST_PATH` are no longer used, and
  E2B operator mounts targeting that path are skipped with a warning.
  ([#4178])
- **`sandbox.replicas` is enforced** for E2B as a capacity limit; the default
  `wait` policy can now fail the agent turn instead of growing past the cap.
  ([#4391])
- **A `SKILL.md` directory is a runtime package boundary** — nested `SKILL.md`
  files are supporting data, no longer registered as independent skills.
  ([#4098])
- **Memory is pluggable** (`memory.manager_class`): DeerMem-private settings
  move into `memory.backend_config` (auto-migrated with a warning),
  `/memory/config` changed shape, `storage_path` is now a root directory
  (legacy file-style values are dropped with a warning), custom storage classes
  move to a new path and take `config` in `__init__`, and a backend without
  `search()` fails fast in `tool` mode. ([#4122], [#4023], [#4324])
- **`database.checkpoint_delta_snapshot_frequency`** moved to
  `database.checkpoint_delta.snapshot_frequency` and its default changed from
  `1000` to `10` — set it explicitly to keep the old cadence. ([#4516])
- **Docker binds loopback by default** — the published entry port binds
  `127.0.0.1` in both compose files, matching the documented local-trust
  deployment model; set `BIND_HOST` to expose the stack on other interfaces.
  ([#4618])

##### ✨ Highlights

- **Verifiable agent execution** — every tool call carries a tamper-evident,
  runtime-stamped receipt and a bounded receipt ledger reaches the model
  context; subagent reports must cite tool receipts with verifiable deliverable
  handles that the lead agent cross-checks; and `acceptance_criteria` on
  delegations are checked deterministically parent-side (file existence,
  recorded test-command exit status), with anything undecidable reported
  UNVERIFIED. ([#4659], [#5076], [#5090], [#5109], [#4365])
- **Subagents at scale** — a system-maintained delegation ledger prevents
  redundant re-delegation and a total cap bounds fan-out ([#3877], [#4115]);
  one process-wide capacity controller governs concurrency, and the opt-in
  `batch_task` tool runs large collections of independent items as durable,
  resumable SQL-backed batches with leases, retries, pause/resume/cancel, and
  a chat progress panel ([#4998], [#5289]); `task(context_mode="snapshot")`
  carries a dispatch-time copy of the parent conversation ([#5367]); and
  subagent step history is persisted and displayed in the thread. ([#3845])
- **Scheduled tasks grow up** — `interval` schedules join `once` and `cron`
  ([#5291]); upcoming cron occurrences can be previewed before saving
  ([#5381]); run history filters server-side by status and pages backwards in
  the UI ([#5384], [#5363]); tasks can pin `lead_agent` or a custom agent
  ([

_[Truncated at 4000 characters — full notes: https://github.com/bytedance/deer-flow/releases/tag/v2.1.0]_

### v2.0.0 — DeerFlow 2.0.0 released

- Date: 2026-06-25
- Version: v2.0.0
- Original notes: https://github.com/bytedance/deer-flow/releases/tag/v2.0.0
- Permalink: https://whatsnew.fyi/product/deer-flow/releases/v2.0.0

- **added** — Agents can persist edits to their own SOUL.md / config.yaml from a normal chat with full per-user isolation
- **added** — Users can bind their own Slack, Telegram, Discord, Feishu/Lark, DingTalk, WeChat, and WeCom accounts on top of operator-configured bots
- **added** — Support for StepFun and MiMo reasoning models, MiniMax for image/video/podcast skills, and a new music-generation skill
- **added** — Add Brave Search, SearXNG, Browserless, and Serper Google Images tools
- **added** — Discord gets mention-only mode, thread routing, and typing indicators
- **added** — Telegram streams replies by editing the placeholder message in place
- **added** — Configurable loop detection with per-tool frequency overrides and deferred warning injection
- **changed** — Subagent token usage streams to the header in real time, with spans attributed to the parent thread's Langfuse trace
- **changed** — Token-usage tracking on by default with refined display modes and usage attributed to the actual models
- **changed** — Opt out of tiktoken in restricted networks via memory.token_counting
- **changed** — Make AI follow-up suggestions optional
- **changed** — Clean lead_agent and custom-agent trace names; session_id and user_id propagated to Langfuse; non-ASCII memory traces no longer escape
- **changed** — Runs now hydrate from RunStore and persist interrupted status
- **changed** — Runs return ISO 8601 timestamps
- **changed** — Memory runs on a persistent event loop instead of a short-lived asyncio.run()
- **changed** — Docker Gateway defaults to a single worker
- **changed** — nginx resolves upstream names at request time
- **fixed** — Cancellation now requires the worker who owns the run; cross-worker cancels return 409 instead of silently appearing successful
- **fixed** — Runs hydrate from the persistent store after a gateway restart and have an idempotent cancel
- **security** — Reject symlinked upload destinations on Linux and Windows
- **security** — Mask sensitive values in MCP config responses and harden the endpoint

#### DeerFlow 2.0.0

DeerFlow 2.0 is a **ground-up rewrite** around a "super agent" harness that
orchestrates **sub-agents**, **persistent memory**, **sandboxed execution**,
and an extensible **skills/tools** system. It shares no code with the 1.x line,
which lives on the [`main-1.x` branch](https://github.com/bytedance/deer-flow/tree/main-1.x).

This release closes the [2.0.0 milestone](https://github.com/bytedance/deer-flow/milestone/1)
with **182 merged PRs** since the first 2.0 milestone tag.

> 📖 Full notes: [CHANGELOG.md](CHANGELOG.md) · [中文版](CHANGELOG_zh.md)

---

##### ⚠️ Breaking change

- **Run hydration** — runs now hydrate from `RunStore` and persist `interrupted`
  status. Cancellation now requires the worker who owns the run; cross-worker
  cancels return `409` instead of silently appearing successful. ([#2932])

##### ✨ Highlights

- **Custom agents that update themselves** — agents can persist edits to their
  own `SOUL.md` / `config.yaml` from a normal chat, with full per-user
  isolation. ([#2713])
- **User-owned IM channel connections** — users can bind their own Slack,
  Telegram, Discord, Feishu/Lark, DingTalk, WeChat, and WeCom accounts on top
  of operator-configured bots. ([#3487])
- **More models & community search** — StepFun and MiMo reasoning models,
  MiniMax for image/video/podcast skills plus a new music-generation skill,
  and Brave Search / SearXNG / Browserless / Serper Google Images tools.
  ([#3461], [#3298], [#3437], [#3528], [#3451], [#3575])
- **Richer channels** — Discord gets mention-only mode, thread routing, and
  typing indicators; Telegram streams replies by editing the placeholder
  message in place. ([#2842], [#3534])
- **Configurable loop detection** with per-tool frequency overrides and
  deferred warning injection. ([#2586], [#2711], [#2752])
- **Subagent token usage** streams to the header in real time, with spans
  attributed to the parent thread's Langfuse trace. ([#2882], [#3611])
- **Trace polish** — clean `lead_agent` / custom-agent trace names; `session_id`
  + `user_id` propagated to Langfuse; non-ASCII memory traces no longer escape.
  ([#3101], [#2944], [#3104])
- **Token-usage tracking on by default**, with refined display modes and usage
  attributed to the actual models. ([#2841], [#2329], [#3658])
- **Flexible memory & suggestions** — opt out of tiktoken in restricted
  networks via `memory.token_counting`; make AI follow-up suggestions optional.
  ([#3465], [#3591])

##### 🚀 Performance

- Push thread metadata filters into SQL. ([#2865])
- Index runs by `thread_id` in `RunManager` to eliminate O(n) scans. ([#3499])
- Index messages in `MemoryRunEventStore` to eliminate O(n) scans. ([#3531])
- Cache `Base.to_dict` column reflection per class. ([#3654])
- Speed up `should_ignore_name` in glob/grep sandbox walks. ([#3657])

##### 🔒 Security

- Reject symlinked upload destinations on Linux **and** Windows.
  ([#2623], [#2794])
- Mask sensitive values in MCP config responses; harden the endpoint.
  ([#2667], [#3425])
- Reject cross-site auth POSTs. ([#2740])
- Cap skill artifact preview decompression (zip-bomb defense). ([#2963])
- Mount the host Docker socket only in aio (DooD) sandbox mode. ([#3517])
- Don't bind-mount host CLI auth dirs by default. ([#3521])

##### 🐛 Notable fixes

- **Memory** runs on a persistent event loop instead of a short-lived one
  `asyncio.run()`; queued updates isolated per agent; wrapped JSON responses
  parsed correctly. ([#2627], [#2941], [#3252])
- **Runs** hydrate from the persistent store after a gateway restart, return
  ISO 8601 timestamps, and have an idempotent cancel. ([#2989], [#2599], [#3058])
- **Subagents** isolated from the parent run's checkpointer; timeout terminal
  state atomic; respect model overrides for tools/middleware. ([#3559],
  [#2583], [#2641])
- **Sandbox** readiness polling no longer blocks the event loop;
  `/mnt/user-data` c

_[Truncated at 4000 characters — full notes: https://github.com/bytedance/deer-flow/releases/tag/v2.0.0]_