Dify 1.14.0

1.14.0

v1.14.0

Added 10
  • Collaboration allows workspace members to edit the same workflow together with synced graph updates, online presence, and shared visibility into who is working where
  • Service API for human-in-the-loop (HITL) provides programmatic support for human-in-the-loop flows
  • MCP tool metadata refreshes after updates to keep the UI in sync
  • Goto Anything command includes recent items, /go command, and deeper app sub-sections
  • Prompt editor supports slash-triggered variable filtering and keyboard up/down navigation in variable lists
  • Langfuse integration includes optional time-to-first-token (TTFT) reporting
Changed 10
  • MCP server URL double /v1 path issue that could break OAuth and authorization fixed
  • MCP OAuth discovery now handles malformed JSON safely
  • MCP schema publishing maps checkbox and json_object types correctly
  • Plugin auto-upgrade strategy persistence, local installer and file-input behavior improved
  • Celery default worker concurrency raised to 4
  • PostgreSQL default max connections increased to 200
Fixed 1
  • Change-email flow implements stricter phase-bound token handling
Security 1
  • IDOR hardening through tenant validation on data-source binding and dataset and API ownership checks
🚀 What's New in v1.14.0?
Collaboration

Collaboration allows workspace members to edit the same workflow together, with synced graph updates, online presence, and shared visibility into who is working where.

On self-hosted deployments, collaboration is turned off by default. Enable it by setting:

ENABLE_COLLABORATION_MODE = true
SERVER_WORKER_CLASS = geventwebsocket.gunicorn.workers.GeventWebSocketWorker
NEXT_PUBLIC_SOCKET_URL = your deployment’s WebSocket URL (e.g., wss://dify.example.com)

For more details, see Full Documentation

Human-in-the-loop (HITL)
  • Service API for HITL — programmatic support for human-in-the-loop flows alongside existing console behavior.
MCP and plugins
  • MCP tool metadata — refresh after updates so the UI stays in sync.
  • MCP server URL — fix double /v1 that could break OAuth and authorization (404).
  • MCP OAuth discovery — handle malformed JSON safely.
  • MCP schema publishing — map checkbox and json_object types correctly.
  • Plugins — auto-upgrade strategy persistence, local installer and file-input behavior, tenant scoping for inner API end-user lookup.
Marketplace and OAuth
  • Marketplace and OAuth — targeted fixes for marketplace flows and OAuth sign-in (including edge cases such as null email on GitHub OAuth).
UI kit and front-end platform
  • @langgenius/dify-ui — shared primitives (for example PreviewCard, Meter), design tokens, and broad migration from ad-hoc web/base/ui toward the package.
  • Accessibility — date and time pickers, auto-update strategy picker, scrollbars in plugin and model selectors, and related polish.
  • Goto Anything — recent items, /go command, deeper app sub-sections; fix for Cmd+K (removed problematic dynamic import).
  • Prompt editor — slash-triggered variable filtering; keyboard up/down in variable lists.
  • Follow-up questions — improved settings and token limits for suggested questions.
  • Modals — ApiKey, provider config, and others refactored toward a shared Dialog pattern with tests.
Observability and analytics
  • Langfuse — optional time-to-first-token (TTFT) reporting.
  • Explore — banner impression tracking; app preview event tracking on cards.
Billing and quotas
  • Quota v3 integration in the product stack.
  • Billing UI — Meter-based usage presentation; more resilient cleanup when billing APIs fail.
  • File uploader — billing-aware behavior and copy updates.
Data, RAG, and knowledge
  • Summary index and Weaviate — compatibility fixes when using the summary index with Weaviate.
  • Vector projection — include is_summary and original_chunk_id in default projection where relevant.
  • External and bound datasets — stronger tenant checks on knowledge APIs.
Infrastructure and operations
  • Docker Compose — healthchecks for api, worker, and worker_beat; template and env example updates (for example S3 address style).
  • Celery — default worker concurrency raised to 4; missing queue fix.
  • PostgreSQL — higher default max connections (200) for the updated app DB path.
  • Redis — configurable key prefix; retry logic for Redis operations.
  • TiDB — endpoint support and related auth binding migration (Qdrant endpoint on TiDB auth bindings).
  • Markdown — optional ALLOW_INLINE_STYLES environment variable to allow inline CSS in rendered Markdown when needed.
Security
  • Change-email flow — stricter phase-bound token handling (GHSA-4q3w-q5mc-45rq).
  • IDOR hardening — tenant validation on data-source binding; dataset and API ownership checks where gaps were found.
Performance
  • Optimized performance of graph initialization.
API and platform internals
  • Graphon — upgrade to standalone Graphon 0.2.2 (replacing in-tree dify_graph naming and packaging).
  • OpenAPI — script to generate OpenAPI v2 JSON and documentation pointer.
  • Deprecation — some legacy console APIs marked deprecated in favor of newer patterns.
  • Large SQLAlchemy 2.0 select() migration, Pydantic BaseModel for many console and service responses, and testcontainers-based tests for stability.
What's Changed

…

View original

Upgraded? How did it go?

Discussion