# Dify 1.14.0 — v1.14.0 - Product: Dify (https://whatsnew.fyi/product/dify) - Vendor: LangGenius - Date: 2026-04-29 - Version: 1.14.0 - Original notes: https://github.com/langgenius/dify/releases/tag/1.14.0 - Permalink: https://whatsnew.fyi/product/dify/releases/1.14.0 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **added** — Collaboration allows workspace members to edit the same workflow together with synced graph updates, online presence, and shared visibility into who is working where - **added** — Service API for human-in-the-loop (HITL) provides programmatic support for human-in-the-loop flows - **added** — MCP tool metadata refreshes after updates to keep the UI in sync - **added** — Goto Anything command includes recent items, /go command, and deeper app sub-sections - **added** — Prompt editor supports slash-triggered variable filtering and keyboard up/down navigation in variable lists - **added** — Langfuse integration includes optional time-to-first-token (TTFT) reporting - **added** — Quota v3 integration in the product stack - **added** — Optional ALLOW_INLINE_STYLES environment variable to allow inline CSS in rendered Markdown - **added** — Healthchecks added for api, worker, and worker_beat in Docker Compose - **added** — Shared UI primitives including PreviewCard and Meter in @langgenius/dify-ui package - **changed** — MCP server URL double /v1 path issue that could break OAuth and authorization fixed - **changed** — MCP OAuth discovery now handles malformed JSON safely - **changed** — MCP schema publishing maps checkbox and json_object types correctly - **changed** — Plugin auto-upgrade strategy persistence, local installer and file-input behavior improved - **changed** — Celery default worker concurrency raised to 4 - **changed** — PostgreSQL default max connections increased to 200 - **changed** — Redis operations include configurable key prefix and retry logic - **changed** — TiDB endpoint support and auth binding migration including Qdrant endpoint on TiDB - **changed** — Graph initialization performance optimized - **changed** — Graphon upgraded to standalone version 0.2.2 replacing in-tree dify_graph - **fixed** — Change-email flow implements stricter phase-bound token handling - **security** — IDOR hardening through tenant validation on data-source binding and dataset and API ownership checks ##### 🚀 What's New in v1.14.0? ###### Collaboration img_v3_02117_67a67218-1ae5-4d68-a45b-3ada592f87fg Collaboration allows workspace members to edit the same workflow together, with synced graph updates, online presence, and shared visibility into who is working where. On self-hosted deployments, collaboration is turned off by default. Enable it by setting: ``` ENABLE_COLLABORATION_MODE = true SERVER_WORKER_CLASS = geventwebsocket.gunicorn.workers.GeventWebSocketWorker NEXT_PUBLIC_SOCKET_URL = your deployment’s WebSocket URL (e.g., wss://dify.example.com) ``` For more details, see [Full Documentation](https://docs.dify.ai/en/use-dify/build/workflow-collaboration) ###### Human-in-the-loop (HITL) - **Service API for HITL** — programmatic support for human-in-the-loop flows alongside existing console behavior. ###### MCP and plugins - **MCP tool metadata** — refresh after updates so the UI stays in sync. - **MCP server URL** — fix double `/v1` that could break OAuth and authorization (404). - **MCP OAuth discovery** — handle malformed JSON safely. - **MCP schema publishing** — map `checkbox` and `json_object` types correctly. - **Plugins** — auto-upgrade strategy persistence, local installer and file-input behavior, tenant scoping for inner API end-user lookup. ###### Marketplace and OAuth - **Marketplace and OAuth** — targeted fixes for marketplace flows and OAuth sign-in (including edge cases such as null email on GitHub OAuth). ###### UI kit and front-end platform - **`@langgenius/dify-ui`** — shared primitives (for example **PreviewCard**, **Meter**), design tokens, and broad migration from ad-hoc `web/base/ui` toward the package. - **Accessibility** — date and time pickers, auto-update strategy picker, scrollbars in plugin and model selectors, and related polish. - **Goto Anything** — recent items, `/go` command, deeper app sub-sections; fix for **Cmd+K** (removed problematic dynamic import). - **Prompt editor** — slash-triggered **variable filtering**; keyboard **up/down** in variable lists. - **Follow-up questions** — improved settings and token limits for suggested questions. - **Modals** — ApiKey, provider config, and others refactored toward a shared **Dialog** pattern with tests. ###### Observability and analytics - **Langfuse** — optional **time-to-first-token (TTFT)** reporting. - **Explore** — banner impression tracking; app preview event tracking on cards. ###### Billing and quotas - **Quota v3** integration in the product stack. - **Billing UI** — Meter-based usage presentation; more resilient cleanup when billing APIs fail. - **File uploader** — billing-aware behavior and copy updates. ###### Data, RAG, and knowledge - **Summary index and Weaviate** — compatibility fixes when using the summary index with Weaviate. - **Vector projection** — include `is_summary` and `original_chunk_id` in default projection where relevant. - **External and bound datasets** — stronger tenant checks on knowledge APIs. ###### Infrastructure and operations - **Docker Compose** — **healthchecks** for `api`, `worker`, and `worker_beat`; template and env example updates (for example S3 address style). - **Celery** — default worker **concurrency raised to 4**; missing queue fix. - **PostgreSQL** — higher default **max connections (200)** for the updated app DB path. - **Redis** — **configurable key prefix**; **retry** logic for Redis operations. - **TiDB** — endpoint support and related auth binding migration (**Qdrant endpoint on TiDB auth bindings**). - **Markdown** — optional **`ALLOW_INLINE_STYLES`** environment variable to allow inline CSS in rendered Markdown when needed. ###### Security - **Change-email flow** — stricter phase-bound token handling ([GHSA-4q3w-q5mc-45rq](https://github.com/advisories?query=GHSA-4q3w-q5 _[Truncated at 4000 characters — full notes: https://github.com/langgenius/dify/releases/tag/1.14.0]_