# Dify 1.13.1 — v1.13.1

- Product: Dify (https://whatsnew.fyi/product/dify)
- Vendor: LangGenius
- Date: 2026-03-17
- Version: 1.13.1
- Original notes: https://github.com/langgenius/dify/releases/tag/1.13.1
- Permalink: https://whatsnew.fyi/product/dify/releases/1.13.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add Hologres as a supported backend option for vector retrieval and full-text search
- **added** — Add Service API endpoints for dataset document downloads including batch ZIP download and signed URL download
- **changed** — HITL email content now uses markdown rendering before delivery
- **changed** — Draft variables are now user-scoped instead of app-scoped
- **added** — Add edge context menu support in workflow canvas including direct edge deletion
- **changed** — Preserve existing connections when changing node types in workflow editing
- **added** — Add configurable send-key behavior for embedded chat input
- **added** — Add file payloads in message-end stream responses
- **removed** — Remove GPT-4-specific hardcoded behavior from default model selection logic
- **added** — Add export-app-messages CLI command to export application messages and related feedback to JSONL.GZ
- **security** — Prevent SQL injection risks in vector-store query paths by switching to parameterized SQL
- **security** — Sanitize subject and body content in HITL email delivery
- **security** — Strip CR/LF from email subjects to prevent SMTP header-injection vectors
- **security** — Enforce ownership checks for conversation deletion APIs
- **security** — Clear stale provider credentials during plugin uninstall
- **security** — Improve enterprise API error handling and license-enforcement behavior for invalid or expired license states
- **added** — Add dedicated Celery queue dataset_summary for LLM-heavy summary generation tasks
- **added** — Add telemetry metrics for retention cleanup tasks and flush behavior for short-lived command jobs
- **added** — Add REDIS_MAX_CONNECTIONS configuration option
- **deprecated** — Deprecate PUBSUB_* event-bus settings in favor of EVENT_BUS_* settings
- **fixed** — Fix workflow_runs.started_at being overwritten on resume
- **fixed** — Fix metadata batch-edit silent failures caused by split-transaction edge cases
- **fixed** — Fix metadata filter extraction issues in knowledge retrieval
- **fixed** — Restore citation visibility in advanced chat applications
- **fixed** — Fix conversation variable reset behavior after HITL nodes
- **fixed** — Fix page crash in knowledge-retrieval node configuration flow
- **fixed** — Fix chat assistant blocking response-mode behavior
- **added** — Add doc_type handling in Weaviate vector attributes
- **changed** — Upgrade OpenTelemetry dependencies to resolve context-detach errors

##### 🚀 Major Functional Changes

###### Data platform and dataset operations

- Added **Hologres** as a supported backend option for both vector retrieval and full-text search.
- Added Service API endpoints for dataset document downloads:
  - Batch ZIP download for selected documents.
  - Signed URL download for single-document original files.

###### Workflow and chat experience improvements

- **Breaking change:** HITL email content now uses markdown rendering before delivery. 
  Existing email templates that relied on raw/plain behavior may render differently after upgrade.
- Draft variables are now user-scoped instead of app-scoped. Historical draft variables will not be available after upgrading.
- Added edge context menu support in workflow canvas, including direct edge deletion.
- Preserved existing connections when changing node types in workflow editing.
- Added configurable send-key behavior (`Enter` vs `Shift+Enter`) for embedded chat input.
- Added file payloads in message-end stream responses.
- Removed GPT-4-specific hardcoded behavior from default model selection logic.
- Added a new `export-app-messages` CLI command to export application messages and related feedback to `JSONL.GZ` (local or cloud storage).

##### 🔐 Security Updates

- Prevented SQL injection risks in vector-store query paths by switching to parameterized SQL in affected implementations.
- Hardened HITL email delivery:
  - Sanitize subject and body content.
  - Strip CR/LF from subjects to prevent SMTP header-injection vectors.
- Enforced ownership checks for conversation deletion APIs.
- Cleared stale provider credentials during plugin uninstall to reduce residual credential risk.
- Improved enterprise API error handling and license-enforcement behavior for invalid/expired license states.

##### 🏗️ Configuration, Architecture, and Deployment Updates

###### Deployment and operations
- Added a dedicated Celery queue: `dataset_summary` for LLM-heavy summary generation tasks.
  - Ensure workers subscribe to this queue to avoid summary-job backlog.
- Added telemetry metrics for retention cleanup tasks (messages/workflow runs), plus flush behavior for short-lived command jobs.

###### Configuration changes

- Added `REDIS_MAX_CONNECTIONS`.
- Deprecated `PUBSUB_*` event-bus settings in favor of `EVENT_BUS_*` settings.

##### 🛠 Other Noteworthy Changes

- Fixed `workflow_runs.started_at` being overwritten on resume.
- Fixed metadata batch-edit silent failures caused by split-transaction edge cases.
- Fixed metadata filter extraction issues in knowledge retrieval (`{{...}}` conditions).
- Restored citation visibility in advanced chat applications.
- Fixed conversation variable reset behavior after HITL nodes.
- Fixed a page crash in knowledge-retrieval node configuration flow.
- Fixed chat assistant blocking response-mode behavior.
- Added `doc_type` handling in Weaviate vector attributes for better compatibility.
- Upgraded OpenTelemetry dependencies to resolve context-detach errors.

---

##### Upgrade Guide

> [!IMPORTANT]
> If you use custom `CELERY_QUEUES`, make sure `workflow_based_app_execution` is included.  
> If `ENABLE_API_TOKEN_LAST_USED_UPDATE_TASK=true`, also include `api_token`.
> 
> For background and details, see **⚠️ Important Upgrade Note** and **🔧 Operational Note** above.

###### Docker Compose Deployments

1. Back up your customized docker-compose YAML file (optional)

   ```bash
   cd docker
   cp docker-compose.yaml docker-compose.yaml.$(date +%s).bak
   ```

2. Get the latest code from the main branch

   ```bash
   git checkout main
   git pull origin main
   ```

3. Stop the service. Please execute in the docker directory

   ```bash
   docker compose down
   ```

4. Back up data

   ```bash
   tar -cvf volumes-$(date +%s).tgz volumes
   ```

5. Upgrade services

   ```bash
   docker compose up -d
   ```

> [!NOTE]
> 
>

_[Truncated at 4000 characters — full notes: https://github.com/langgenius/dify/releases/tag/1.13.1]_