dify-0.38.0-rc2

Release v0.38.0-rc2

This release introduces the new Dify Agent from Dify 1.16.x, enables collaboration mode, and adds Gateway API support for modern traffic routing in Kubernetes.

What's Changed

• Add opt-in Gateway API HTTPRoute support to Dify chart (#419) @somaz94
• Add agent backend and local sandbox (#422, #430) @BorisPolonsky
• Migrate pluginDaemon.auth.difyApiKey to api.auth.internalApiKey (#423) @BorisPolonsky
• Update architecture documentation for collaboration mode (#424, #425, #426, #431) @BorisPolonsky
• Add optional apiWebsocket for workflow collaboration (#427) @BorisPolonsky
• Default localSandbox image tag to Chart.AppVersion (#428) @BorisPolonsky
• Cover agentBackend/localSandbox in CI image prep and fix Redis tag (#429) @BorisPolonsky
• Update architecture documentation for Ingress/Gateway API (#431, #432) @BorisPolonsky
• Add agentBackend ESO integration (#434, #435) @BorisPolonsky
• Bump GitHub Actions to Node 24-compatible majors (#436) @BorisPolonsky
• Stabilize OTEL collector in CI under Dify 1.16 load (#437) @BorisPolonsky
• Bump chart version to 0.38.0-rc1 and app version to 1.16.1 (#433) @BorisPolonsky
• Fix externalS3 IAM credentials and pathStyle propagation (#438, #439) @rcarvalhoxavier
• Allow direct access without nginx when routing via HTTPRoute (#440, #443) @BorisPolonsky
• Warn in NOTES.txt when obsolete pluginDaemon.auth.difyApiKey is still set (#444) @BorisPolonsky
• Bump chart version to 0.38.0-rc2 (#445) @BorisPolonsky

Breaking Changes

pluginDaemon.auth.difyApiKey no longer takes effect and has been migrated to api.auth.internalApiKey:

# before
pluginDaemon:
  auth:
    difyApiKey: "your-key"
# after
api:
  auth:
    internalApiKey: "your-key"

New Contributors

• @somaz94 made their first contribution in #419
• @rcarvalhoxavier made their first contribution in #438

Full Changelog: dify-0.37.0...dify-0.38.0-rc2

dify-0.38.0-rc1

Release v0.38.0-rc1

This release introduces the new Dify Agent from Dify 1.16.x, enables collaboration mode, and adds Gateway API support for modern traffic routing in Kubernetes.

What's Changed

• Add opt-in Gateway API HTTPRoute support to Dify chart (#419) @somaz94
• Add agent backend and local sandbox (#422, #430) @BorisPolonsky
• Migrate pluginDaemon.auth.difyApiKey to api.auth.internalApiKey (#423) @BorisPolonsky
• Update architecture documentation for collaboration mode (#424, #425, #426, #431) @BorisPolonsky
• Add optional apiWebsocket for workflow collaboration (#427) @BorisPolonsky
• Default localSandbox image tag to Chart.AppVersion (#428) @BorisPolonsky
• Cover agentBackend/localSandbox in CI image prep and fix Redis tag (#429) @BorisPolonsky
• Update architecture documentation for Ingress/Gateway API (#431, #432) @BorisPolonsky
• Add agentBackend ESO integration (#434, #435) @BorisPolonsky
• Bump GitHub Actions to Node 24-compatible majors (#436) @BorisPolonsky
• Stabilize OTEL collector in CI under Dify 1.16 load (#437) @BorisPolonsky
• Bump chart version to 0.38.0-rc1 and app version to 1.16.1 (#433) @BorisPolonsky

Breaking Changes

pluginDaemon.auth.difyApiKey no longer takes effect and has been migrated to api.auth.internalApiKey:

# before
pluginDaemon:
  auth:
    difyApiKey: "your-key"
# after
api:
  auth:
    internalApiKey: "your-key"

New Contributors

• @somaz94 made their first contribution in #419

Full Changelog: dify-0.37.0...dify-0.38.0-rc1

dify-0.37.0

Release v0.37.0

This release introduces options to mitigate unexpected process reaping, resolves code execution authentication for newer Dify architectures, and bumps Dify to 1.14.2.

This release is exactly the same as v0.37.0-rc2.

What's Changed

• Add trigger URL configuration (#391) @BorisPolonsky
• Enable Celery beat by default for CRON-based triggers (#396) @BorisPolonsky
• Allow shareProcessNamespace on pod spec to prevent unexpected process reaping in pluginDaemon (#402) @wangchongyu
• Allow shareProcessNamespace configuration for all Dify workloads (#403) @BorisPolonsky
• Fix missing CODE_EXECUTION_API_KEY in worker pods (#407, #408, #411) @BorisPolonsky
• Drop CODE_MAX_* overrides in the default setup (#409) @BorisPolonsky
• Update default images tags to match Dify 1.14.2 (#410) @BorisPolonsky
• Update CVE scan workflow with trivy-action (#413) @BorisPolonsky
• fix: preserve newline before dify.common.config (#416) @luyang93
• Expand CVE report with per-image critical vulnerability tables (#414) @BorisPolonsky

New Contributors

• @wangchongyu made their first contribution in #402
• @luyang93 made their first contribution in #416

Full Changelog: dify-0.36.0...dify-0.37.0

dify-0.37.0-rc2

Release v0.37.0-rc2

This release candidate introduces options to mitigate unexpected process reaping, resolves code execution authentication for newer Dify architectures, and bumps Dify to 1.14.2.

What's Changed

• Add trigger URL configuration (#391) @BorisPolonsky
• Enable Celery beat by default for CRON-based triggers (#396) @BorisPolonsky
• Allow shareProcessNamespace on pod spec to prevent unexpected process reaping in pluginDaemon (#402) @wangchongyu
• Allow shareProcessNamespace configuration for all Dify workloads (#403) @BorisPolonsky
• Fix missing CODE_EXECUTION_API_KEY in worker pods (#407, #408, #411) @BorisPolonsky
• Drop CODE_MAX_* overrides in the default setup (#409) @BorisPolonsky
• Update default images tags to match Dify 1.14.2 (#410) @BorisPolonsky
• Update CVE scan workflow with trivy-action (#413) @BorisPolonsky
• fix: preserve newline before dify.common.config (#416) @luyang93
• Expand CVE report with per-image critical vulnerability tables (#414) @BorisPolonsky

New Contributors

• @wangchongyu made their first contribution in #402
• @luyang93 made their first contribution in #416

Full Changelog: dify-0.36.0...dify-0.37.0-rc2

dify-0.37.0-rc1

Release v0.37.0-rc1

This release candidate introduces options to mitigate unexpected process reaping, resolves code execution authentication for newer Dify architectures, and bumps Dify to 1.14.2.

What's Changed

• Add trigger URL configuration (#391) @BorisPolonsky
• Enable Celery beat by default for CRON-based triggers (#396) @BorisPolonsky
• Allow shareProcessNamespace on pod spec to prevent unexpected process reaping in pluginDaemon (#402) @wangchongyu
• Allow shareProcessNamespace configuration for all Dify workloads (#403) @BorisPolonsky
• Fix missing CODE_EXECUTION_API_KEY in worker pods (#407, #408, #411) @BorisPolonsky
• Drop CODE_MAX_* overrides in the default setup (#409) @BorisPolonsky
• Update default images tags to match Dify 1.14.2 (#410) @BorisPolonsky
• Update CVE scan workflow with trivy-action (#413) @BorisPolonsky

New Contributors

• @wangchongyu made their first contribution in #402

Full Changelog: dify-0.36.0...dify-0.37.0-rc1

dify-0.36.0

Release v0.36.0

This release removes deprecated values, brings quality of life improvements and bumps Dify to 1.12.1.

What's Changed

• Add configuration options for hostAliases (#372) @BorisPolonsky
• refactor: Unify indentation in templates (#373) @BorisPolonsky
• Set Redis and Celery domain names regarding customized fullname in built-in Redis (#374) @BorisPolonsky
• Set domain names regarding customized fullname in built-in PostgreSQL (#375) @BorisPolonsky
• Fix sandbox service discovery for triggers (#379) @hutchisr
• Add CVE scan workflow for chart default images (#380) @BorisPolonsky
• Update default image tags for Dify 1.12.1 (#384) @BorisPolonsky
• feat(charts): include API config in worker and fix sandbox FQDN (#381) @Oscaner
• Refactor config template and standardize LOG_LEVEL handling (#385) @BorisPolonsky
• Remove deprecated values (#386) @BorisPolonsky
• Bump chart version to 0.36.0 and app version to 1.12.1 (#387, #392, #393) @BorisPolonsky

Breaking Changes

The values deprecated since 0.35.0 are now obsolete and no longer take effect. Migrate them to the global.* equivalents. No action required for users with default setups.

Removed	Replacement	Description
api.url.consoleApi	global.consoleApiDomain	Backend domain of the console API
api.url.consoleWeb	global.consoleWebDomain	Front-end domain of the console web
api.url.serviceApi	global.serviceApiDomain	Service API domain
api.url.appApi	global.appApiDomain	WebApp API backend domain
api.url.appWeb	global.appWebDomain	WebApp domain
api.url.files	global.filesDomain	File preview or download domain
api.url.marketplaceApi	global.marketplace.apiUrl	Marketplace API URL
api.url.marketplace	global.marketplace.url	Marketplace URL
api.secretKey	global.appSecretKey	Secret key for securely signing session cookies and encrypting sensitive database information
pluginDaemon.marketplace.enabled	global.marketplace.enabled	Enable marketplace for plugin daemon
pluginDaemon.marketplace.apiProxyEnabled	global.marketplace.apiProxyEnabled	Enable API proxy for marketplace (routes through built-in nginx)

New Contributors

• @hutchisr made their first contribution in #379
• @Oscaner made their first contribution in #381

Full Changelog: dify-0.35.0...dify-0.36.0

dify-0.36.0-rc2

Release v0.36.0-rc2

This release removes deprecated values, brings quality of life improvements and bumps Dify to 1.12.1.

What's Changed

• Add configuration options for hostAliases (#372) @BorisPolonsky
• refactor: Unify indentation in templates (#373) @BorisPolonsky
• Set Redis and Celery domain names regarding customized fullname in built-in Redis (#374) @BorisPolonsky
• Set domain names regarding customized fullname in built-in PostgreSQL (#375) @BorisPolonsky
• Fix sandbox service discovery for triggers (#379) @hutchisr
• Add CVE scan workflow for chart default images (#380) @BorisPolonsky
• Update default image tags for Dify 1.12.1 (#384) @BorisPolonsky
• feat(charts): include API config in worker and fix sandbox FQDN (#381) @Oscaner
• Refactor config template and standardize LOG_LEVEL handling (#385) @BorisPolonsky
• Remove deprecated values (#386) @BorisPolonsky
• Bump chart version to 0.36.0-rc1 and app version to 1.12.1 (#387) @BorisPolonsky

Breaking Changes

The values deprecated since 0.35.0 are now obsolete and no longer take effect. Migrate them to the global.* equivalents. No action required for users with default setups.

Removed	Replacement	Description
api.url.consoleApi	global.consoleApiDomain	Backend domain of the console API
api.url.consoleWeb	global.consoleWebDomain	Front-end domain of the console web
api.url.serviceApi	global.serviceApiDomain	Service API domain
api.url.appApi	global.appApiDomain	WebApp API backend domain
api.url.appWeb	global.appWebDomain	WebApp domain
api.url.files	global.filesDomain	File preview or download domain
api.url.marketplaceApi	global.marketplace.apiUrl	Marketplace API URL
api.url.marketplace	global.marketplace.url	Marketplace URL
api.secretKey	global.appSecretKey	Secret key for securely signing session cookies and encrypting sensitive database information
pluginDaemon.marketplace.enabled	global.marketplace.enabled	Enable marketplace for plugin daemon
pluginDaemon.marketplace.apiProxyEnabled	global.marketplace.apiProxyEnabled	Enable API proxy for marketplace (routes through built-in nginx)

No action required for users with default setups.

New Contributors

• @hutchisr made their first contribution in #379
• @Oscaner made their first contribution in #381

Full Changelog: dify-0.35.0...dify-0.36.0-rc2

What's Changed

• Remove obsolete values from values.schema.json by @BorisPolonsky in #390
• Bump chart version to 0.36.0-rc2 by @BorisPolonsky in #392

Full Changelog: dify-0.36.0-rc1...dify-0.36.0-rc2

dify-0.36.0-rc1

Release v0.36.0-rc1

This release removes deprecated values, brings quality of life improvements and bumps Dify to 1.12.1.

What's Changed

• Add configuration options for hostAliases (#372) @BorisPolonsky
• refactor: Unify indentation in templates (#373) @BorisPolonsky
• Set Redis and Celery domain names regarding customized fullname in built-in Redis (#374) @BorisPolonsky
• Set domain names regarding customized fullname in built-in PostgreSQL (#375) @BorisPolonsky
• Fix sandbox service discovery for triggers (#379) @hutchisr
• Add CVE scan workflow for chart default images (#380) @BorisPolonsky
• Update default image tags for Dify 1.12.1 (#384) @BorisPolonsky
• feat(charts): include API config in worker and fix sandbox FQDN (#381) @Oscaner
• Refactor config template and standardize LOG_LEVEL handling (#385) @BorisPolonsky
• Remove deprecated values (#386) @BorisPolonsky
• Bump chart version to 0.36.0-rc1 and app version to 1.12.1 (#387) @BorisPolonsky

Breaking Changes

The values deprecated since 0.35.0 are now obsolete and no longer take effect. Migrate them to the global.* equivalents. No action required for users with default setups.

Removed	Replacement	Description
api.url.consoleApi	global.consoleApiDomain	Backend domain of the console API
api.url.consoleWeb	global.consoleWebDomain	Front-end domain of the console web
api.url.serviceApi	global.serviceApiDomain	Service API domain
api.url.appApi	global.appApiDomain	WebApp API backend domain
api.url.appWeb	global.appWebDomain	WebApp domain
api.url.files	global.filesDomain	File preview or download domain
api.url.marketplaceApi	global.marketplace.apiUrl	Marketplace API URL
api.url.marketplace	global.marketplace.url	Marketplace URL
api.secretKey	global.appSecretKey	Secret key for securely signing session cookies and encrypting sensitive database information
pluginDaemon.marketplace.enabled	global.marketplace.enabled	Enable marketplace for plugin daemon
pluginDaemon.marketplace.apiProxyEnabled	global.marketplace.apiProxyEnabled	Enable API proxy for marketplace (routes through built-in nginx)

No action required for users with default setups.

New Contributors

• @hutchisr made their first contribution in #379
• @Oscaner made their first contribution in #381

Full Changelog: dify-0.35.0...dify-0.36.0-rc1

dify-0.35.0

Release v0.35.0

This release focuses on nginx compatibility adaptations for OpenShift, additional persistence support and enhanced configuration options.

Highlights

Global values

Fundamental Dify configurations can could be applied in global section for better maintainability. Component-specific values take precedence over global values for more customized setup and backward compatibility, for instance:

global:
  # A global secret key for all inter-component API calls among Dify containers (e.g. `api`, `sandbox` and `pluginDaemon`).
  internalApiKey: "unified-sk-for-all-internal-calls"
sandbox:
  auth:
      apiKey: "sandbox-specific-sk"

What's Changed

• Update labels in Secret, ConfigMap and Job (#358) @BorisPolonsky
• Enable rootless settings for nginx containers by default (#363) @BorisPolonsky
• Switch nginx container port to 8080 for non-privileged environments (#361) @giladd123
• Add option for persistence for every deployment (#360) @giladd123
• refactor: migrate user defined persistence volumes to extraVolumes/extraVolumeMounts (#365) @BorisPolonsky
• feat(proxy): Make nginx worker_processes configurable (#366) @BorisPolonsky
• feat: add global values section with component override priority (#367) @BorisPolonsky
• Bump chart version to 0.35.0-rc1 (#368) @BorisPolonsky

Deprecated Values

The values below will continue to function for backward compatibility but are recommended to be migrated to the global equivalents for consistency and centralized configuration management.

Deprecated Value	New Value	Description
api.url.consoleApi	global.consoleApiDomain	Backend domain of the console API
api.url.consoleWeb	global.consoleWebDomain	Front-end domain of the console web
api.url.serviceApi	global.serviceApiDomain	Service API domain
api.url.appApi	global.appApiDomain	WebApp API backend domain
api.url.appWeb	global.appWebDomain	WebApp domain
api.url.files	global.filesDomain	File preview or download domain
api.url.marketplaceApi	global.marketplace.apiUrl	Marketplace API URL
api.url.marketplace	global.marketplace.url	Marketplace URL
api.secretKey	global.appSecretKey	Secret key for securely signing session cookies and encrypting sensitive database information
pluginDaemon.marketplace.enabled	global.marketplace.enabled	Enable marketplace for plugin daemon
pluginDaemon.marketplace.apiProxyEnabled	global.marketplace.apiProxyEnabled	Enable API proxy for marketplace (routes through built-in nginx)

Migration Note

For existing users with proxy.log.persistence.enabled: true (false by default):

• update the volume ownership before upgrading, or
• as alternative, disable security contexts for backward compatibility by setting:

proxy:
  podSecurityContext:
    enabled: false
  containerSecurityContext:
    enabled: false

New Contributors

• @giladd123 made their first contribution in #361

Full Changelog: dify-0.34.0...dify-0.35.0

dify-0.35.0-rc1

Release v0.35.0-rc1

This release focuses on nginx compatibility adaptations for OpenShift, additional persistence support and enhanced configuration options.

Highlights

Global values

Fundamental Dify configurations can could be applied in global section for better maintainability. Component-specific values take precedence over global values for more customized setup and backward compatibility, for instance:

global:
  # A global secret key for all inter-component API calls among Dify containers (e.g. `api`, `sandbox` and `pluginDaemon`).
  internalApiKey: "unified-sk-for-all-internal-calls"
sandbox:
  auth:
      apiKey: "sandbox-specific-sk"

What's Changed

• Update labels in Secret, ConfigMap and Job (#358) @BorisPolonsky
• Enable rootless settings for nginx containers by default (#363) @BorisPolonsky
• Switch nginx container port to 8080 for non-privileged environments (#361) @giladd123
• Add option for persistence for every deployment (#360) @giladd123
• refactor: migrate user defined persistence volumes to extraVolumes/extraVolumeMounts (#365) @BorisPolonsky
• feat(proxy): Make nginx worker_processes configurable (#366) @BorisPolonsky
• feat: add global values section with component override priority (#367) @BorisPolonsky
• Bump chart version to 0.35.0-rc1 (#368) @BorisPolonsky

Deprecated Values

The values below will continue to function for backward compatibility but are recommended to be migrated to the global equivalents for consistency and centralized configuration management.

Deprecated Value	New Value	Description
api.url.consoleApi	global.consoleApiDomain	Backend domain of the console API
api.url.consoleWeb	global.consoleWebDomain	Front-end domain of the console web
api.url.serviceApi	global.serviceApiDomain	Service API domain
api.url.appApi	global.appApiDomain	WebApp API backend domain
api.url.appWeb	global.appWebDomain	WebApp domain
api.url.files	global.filesDomain	File preview or download domain
api.url.marketplaceApi	global.marketplace.apiUrl	Marketplace API URL
api.url.marketplace	global.marketplace.url	Marketplace URL
api.secretKey	global.appSecretKey	Secret key for securely signing session cookies and encrypting sensitive database information
pluginDaemon.marketplace.enabled	global.marketplace.enabled	Enable marketplace for plugin daemon
pluginDaemon.marketplace.apiProxyEnabled	global.marketplace.apiProxyEnabled	Enable API proxy for marketplace (routes through built-in nginx)

Migration Note

For existing users with proxy.log.persistence.enabled: true (false by default):

• update the volume ownership before upgrading, or
• as alternative, disable security contexts for backward compatibility by setting:

proxy:
  podSecurityContext:
    enabled: false
  containerSecurityContext:
    enabled: false

New Contributors

• @giladd123 made their first contribution in #361

Full Changelog: dify-0.34.0...dify-0.35.0-rc1