# Dify 1.14.1 — v1.14.1 - Security hardening, workflow stability, and cleaner self-hosted deployments

- Product: Dify (https://whatsnew.fyi/product/dify)
- Vendor: LangGenius
- Date: 2026-05-12
- Version: 1.14.1
- Original notes: https://github.com/langgenius/dify/releases/tag/1.14.1
- Permalink: https://whatsnew.fyi/product/dify/releases/1.14.1

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Docker deployments no longer rely on a public default SECRET_KEY; when left empty, the API generates and persists a runtime key through the configured storage backend
- **security** — Protect /threads and /db-pool-stat endpoints from unauthenticated access to internal runtime and database-pool details
- **security** — Fix IDOR issue in GET /account/avatar endpoint and scope builtin-tool default-credential cleanup to the current tenant
- **security** — Upgrade LiteLLM for CVE-2026-42208 and refresh backend dependencies including urllib3, gunicorn, gitpython, mako, Google SDK packages, storage libraries, and OpenTelemetry exporter packages
- **fixed** — Restore workflow-version loading through the backend API
- **fixed** — Fix online-user polling for large app lists
- **fixed** — Prevent preview resize observer loops
- **fixed** — Avoid schema model collisions in trial workflows
- **fixed** — Fix variable reference picker behavior for sub-variables
- **fixed** — Fix workflow node title overflow
- **fixed** — Fix condition operator popovers
- **fixed** — Fix workflow checklist semantics
- **fixed** — Fix KB metadata filter field selection
- **fixed** — Preserve single-run input variable types
- **fixed** — Fix structured_output_enabled validation
- **fixed** — Fix file-preview URL handling in node output display
- **fixed** — Unblock plugin model selector tools on v1.14.0 workflows
- **added** — Expose selected action values for Human-in-the-loop flows
- **added** — Add editable class labels to Question Classifier
- **fixed** — Fix image rendering failures in the knowledge base
- **fixed** — Skip empty documents before vector embedding and validate missing text indexing techniques
- **changed** — Use doc_id as the deduplication key across all RAG providers, not only Dify-hosted providers

##### 🚀 What's New in v1.14.1?

v1.14.1 is a patch release focused on security hardening, workflow and knowledge-base stability, deployment cleanup, and continued UI platform migration after v1.14.0.

###### 🔐 Security

- **Self-hosted `SECRET_KEY` hardening** — Docker deployments no longer rely on a public default key. When `SECRET_KEY` is left empty, the API generates and persists a runtime key through the configured storage backend, while explicitly configured keys continue to work as before. Thanks @laipz8200 in [#36049](https://github.com/langgenius/dify/pull/36049).
- **Internal metrics endpoint protection** — `/threads` and `/db-pool-stat` are hardened to avoid unauthenticated exposure of internal runtime and database-pool details. Thanks @orbisai0security in [#35665](https://github.com/langgenius/dify/pull/35665).
- **Account and tool isolation** — fixed an IDOR issue in `GET /account/avatar` and scoped builtin-tool default-credential cleanup to the current tenant. Thanks @NeatGuyCoding and @GareArc in [#35771](https://github.com/langgenius/dify/pull/35771) and [#35887](https://github.com/langgenius/dify/pull/35887).
- **Dependency security** — upgraded LiteLLM for CVE-2026-42208 and refreshed several backend dependencies, including `urllib3`, `gunicorn`, `gitpython`, `mako`, Google SDK packages, storage libraries, and OpenTelemetry exporter packages. Thanks @crazywoola in [#35953](https://github.com/langgenius/dify/pull/35953), [#35779](https://github.com/langgenius/dify/pull/35779), [#35791](https://github.com/langgenius/dify/pull/35791), [#35863](https://github.com/langgenius/dify/pull/35863), [#35864](https://github.com/langgenius/dify/pull/35864), [#35958](https://github.com/langgenius/dify/pull/35958), [#36011](https://github.com/langgenius/dify/pull/36011), [#36012](https://github.com/langgenius/dify/pull/36012), [#36013](https://github.com/langgenius/dify/pull/36013), [#36017](https://github.com/langgenius/dify/pull/36017), and [#36050](https://github.com/langgenius/dify/pull/36050).

###### 🧩 Workflow, HITL, and app runtime

- **Workflow stability** — restored workflow-version loading through the backend API, fixed online-user polling for large app lists, prevented preview resize observer loops, and avoided schema model collisions in trial workflows. Thanks @hjlarry and @lyzno1 in [#35817](https://github.com/langgenius/dify/pull/35817), [#35786](https://github.com/langgenius/dify/pull/35786), [#35936](https://github.com/langgenius/dify/pull/35936), and [#36061](https://github.com/langgenius/dify/pull/36061).
- **Workflow authoring polish** — fixed variable reference picker behavior for sub-variables, workflow node title overflow, condition operator popovers, workflow checklist semantics, and KB metadata filter field selection. Thanks @iamjoel, @hjlarry, @lyzno1, and @shawny011717 in [#35732](https://github.com/langgenius/dify/pull/35732), [#35740](https://github.com/langgenius/dify/pull/35740), [#35828](https://github.com/langgenius/dify/pull/35828), [#36006](https://github.com/langgenius/dify/pull/36006), and [#34149](https://github.com/langgenius/dify/pull/34149).
- **Workflow execution correctness** — preserved single-run input variable types, fixed `structured_output_enabled` validation, fixed file-preview URL handling in node output display, and unblocked plugin model selector tools on v1.14.0 workflows. Thanks @Jingyi-Dify, @fatelei, @shawny011717, and @sawyer-shi in [#35710](https://github.com/langgenius/dify/pull/35710), [#35747](https://github.com/langgenius/dify/pull/35747), [#34150](https://github.com/langgenius/dify/pull/34150), and [#35794](https://github.com/langgenius/dify/pull/35794).
- **Human input** — exposed selected action values for Human-in-the-loop flows. Thanks @Blackoutta in [#35451](https://github.com/langgenius/dify/pull/35451).
- **Question Classifier** — added editable class labels. Thanks @Blackoutta in [#35430](https://github.com/langgenius/dify/pull/35430).

_[Truncated at 4000 characters — full notes: https://github.com/langgenius/dify/releases/tag/1.14.1]_