# Dify 1.14.2 — v1.14.2 - Security fixes, agent groundwork, workflow reliability, and deployment updates

- Product: Dify (https://whatsnew.fyi/product/dify)
- Vendor: LangGenius
- Date: 2026-05-19
- Version: 1.14.2
- Original notes: https://github.com/langgenius/dify/releases/tag/1.14.2
- Permalink: https://whatsnew.fyi/product/dify/releases/1.14.2

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Strengthened tenant isolation for app trace-config endpoints and FilePreview text extraction
- **security** — Restrict default builtin tool credential updates to workspace admins and owners
- **security** — Clean stale tenant tool credentials during reset-encrypt-key-pair
- **fixed** — Restore tracing after HITL workflow resume
- **fixed** — Improve workflow run callback tracking
- **fixed** — Reduce message-update database roundtrips
- **fixed** — Fix memory fetches outside Flask context
- **fixed** — Close base64 file lookup sessions correctly
- **fixed** — Fix loading behavior when no model is selected
- **changed** — Filter model presets by supported parameters
- **changed** — Improve API extension dialog controls
- **fixed** — Fix knowledge hit-testing rendering
- **fixed** — Fix empty knowledge creation
- **fixed** — Fix recommended app category ordering
- **fixed** — Fix null handling in recommended app detail retrieval
- **changed** — Allow LLM nodes to access retrieved knowledge files
- **fixed** — Regenerate document summaries after API updates
- **fixed** — Fix pipeline template rendering
- **changed** — Handle credential fetch failures in RAG pipelines more gracefully
- **changed** — Track app creation source and template ID

##### 🚀 What's New in v1.14.2?

v1.14.2 is a patch release focused on security hardening, workflow and knowledge reliability, observability fixes, agent groundwork, and deployment/runtime tuning after v1.14.1.

###### 🔐 Security and administration

- **Tenant-scoped sensitive endpoints** — strengthened tenant isolation for app trace-config endpoints and FilePreview text extraction. Thanks @xr843 in [#35793](https://github.com/langgenius/dify/pull/35793) and [#35797](https://github.com/langgenius/dify/pull/35797).
- **Tool credential safety** — restricted default builtin tool credential updates to workspace admins and owners, and cleaned stale tenant tool credentials during `reset-encrypt-key-pair`. Thanks @NeatGuyCoding and @xr843 in [#36264](https://github.com/langgenius/dify/pull/36264) and [#35843](https://github.com/langgenius/dify/pull/35843).

###### 🧩 Workflow, HITL, and app runtime

- **Workflow execution reliability** — restored tracing after HITL workflow resume, improved workflow run callback tracking, reduced message-update database roundtrips, fixed memory fetches outside Flask context, and closed base64 file lookup sessions correctly. Thanks @Blackoutta, @CodingOnStar, @wylswz, @hjlarry, and @escape0707 in [#36064](https://github.com/langgenius/dify/pull/36064), [#36149](https://github.com/langgenius/dify/pull/36149), [#36213](https://github.com/langgenius/dify/pull/36213), [#36253](https://github.com/langgenius/dify/pull/36253), and [#36308](https://github.com/langgenius/dify/pull/36308).
- **Workflow and model selection polish** — fixed loading behavior when no model is selected, filtered model presets by supported parameters, and improved API extension dialog controls. Thanks @iamjoel and @lyzno1 in [#36342](https://github.com/langgenius/dify/pull/36342), [#36339](https://github.com/langgenius/dify/pull/36339), and [#36323](https://github.com/langgenius/dify/pull/36323).

###### 📚 Data, RAG, and knowledge

- **Knowledge-base stability** — fixed knowledge hit-testing rendering, empty knowledge creation, recommended app category ordering, and null handling in recommended app detail retrieval. Thanks @FFXN, @laipz8200, @hjlarry, and @EvanYao826 in [#36106](https://github.com/langgenius/dify/pull/36106), [#36336](https://github.com/langgenius/dify/pull/36336), [#36161](https://github.com/langgenius/dify/pull/36161), and [#36153](https://github.com/langgenius/dify/pull/36153).
- **RAG and document processing** — allowed LLM nodes to access retrieved knowledge files, regenerated document summaries after API updates, fixed pipeline template rendering, and handled credential fetch failures in RAG pipelines more gracefully. Thanks @laipz8200, @EvanYao826, @FFXN, and @linw1995 in [#36175](https://github.com/langgenius/dify/pull/36175), [#36035](https://github.com/langgenius/dify/pull/36035), [#36168](https://github.com/langgenius/dify/pull/36168), and [#36165](https://github.com/langgenius/dify/pull/36165).

###### 🎨 Web UI and product experience

- **App creation and onboarding** — tracked app creation source and template ID, initialized user timezone and language from the browser, and fixed WebApp icon and description display. Thanks @CodingOnStar, @lyzno1, and @JzoNgKVO in [#36369](https://github.com/langgenius/dify/pull/36369), [#36170](https://github.com/langgenius/dify/pull/36170), [#36206](https://github.com/langgenius/dify/pull/36206), and [#36209](https://github.com/langgenius/dify/pull/36209).
- **Annotation and datasets UI** — allowed annotation reply score thresholds below `0.8`, redirected unauthorized knowledge editors back to datasets, and fixed tag rename without type payload. Thanks @JzoNgKVO, @iamjoel, and @lyzno1 in [#36337](https://github.com/langgenius/dify/pull/36337), [#36073](https://github.com/langgenius/dify/pull/36073), and [#36182](https://github.com/langgenius/dify/pull/36182).
- **UI platform migration and polish** — added Checkbox and CheckboxGroup primitives, m

_[Truncated at 4000 characters — full notes: https://github.com/langgenius/dify/releases/tag/1.14.2]_