dify-0.36.0

Release v0.36.0

This release removes deprecated values, brings quality of life improvements and bumps Dify to 1.12.1.

What's Changed

• Add configuration options for hostAliases (#372) @BorisPolonsky
• refactor: Unify indentation in templates (#373) @BorisPolonsky
• Set Redis and Celery domain names regarding customized fullname in built-in Redis (#374) @BorisPolonsky
• Set domain names regarding customized fullname in built-in PostgreSQL (#375) @BorisPolonsky
• Fix sandbox service discovery for triggers (#379) @hutchisr
• Add CVE scan workflow for chart default images (#380) @BorisPolonsky
• Update default image tags for Dify 1.12.1 (#384) @BorisPolonsky
• feat(charts): include API config in worker and fix sandbox FQDN (#381) @Oscaner
• Refactor config template and standardize LOG_LEVEL handling (#385) @BorisPolonsky
• Remove deprecated values (#386) @BorisPolonsky
• Bump chart version to 0.36.0 and app version to 1.12.1 (#387, #392, #393) @BorisPolonsky

Breaking Changes

The values deprecated since 0.35.0 are now obsolete and no longer take effect. Migrate them to the global.* equivalents. No action required for users with default setups.

Removed	Replacement	Description
api.url.consoleApi	global.consoleApiDomain	Backend domain of the console API
api.url.consoleWeb	global.consoleWebDomain	Front-end domain of the console web
api.url.serviceApi	global.serviceApiDomain	Service API domain
api.url.appApi	global.appApiDomain	WebApp API backend domain
api.url.appWeb	global.appWebDomain	WebApp domain
api.url.files	global.filesDomain	File preview or download domain
api.url.marketplaceApi	global.marketplace.apiUrl	Marketplace API URL
api.url.marketplace	global.marketplace.url	Marketplace URL
api.secretKey	global.appSecretKey	Secret key for securely signing session cookies and encrypting sensitive database information
pluginDaemon.marketplace.enabled	global.marketplace.enabled	Enable marketplace for plugin daemon
pluginDaemon.marketplace.apiProxyEnabled	global.marketplace.apiProxyEnabled	Enable API proxy for marketplace (routes through built-in nginx)

New Contributors

• @hutchisr made their first contribution in #379
• @Oscaner made their first contribution in #381

Full Changelog: dify-0.35.0...dify-0.36.0

dify-0.36.0-rc2

Release v0.36.0-rc2

This release removes deprecated values, brings quality of life improvements and bumps Dify to 1.12.1.

What's Changed

• Add configuration options for hostAliases (#372) @BorisPolonsky
• refactor: Unify indentation in templates (#373) @BorisPolonsky
• Set Redis and Celery domain names regarding customized fullname in built-in Redis (#374) @BorisPolonsky
• Set domain names regarding customized fullname in built-in PostgreSQL (#375) @BorisPolonsky
• Fix sandbox service discovery for triggers (#379) @hutchisr
• Add CVE scan workflow for chart default images (#380) @BorisPolonsky
• Update default image tags for Dify 1.12.1 (#384) @BorisPolonsky
• feat(charts): include API config in worker and fix sandbox FQDN (#381) @Oscaner
• Refactor config template and standardize LOG_LEVEL handling (#385) @BorisPolonsky
• Remove deprecated values (#386) @BorisPolonsky
• Bump chart version to 0.36.0-rc1 and app version to 1.12.1 (#387) @BorisPolonsky

Breaking Changes

The values deprecated since 0.35.0 are now obsolete and no longer take effect. Migrate them to the global.* equivalents. No action required for users with default setups.

Removed	Replacement	Description
api.url.consoleApi	global.consoleApiDomain	Backend domain of the console API
api.url.consoleWeb	global.consoleWebDomain	Front-end domain of the console web
api.url.serviceApi	global.serviceApiDomain	Service API domain
api.url.appApi	global.appApiDomain	WebApp API backend domain
api.url.appWeb	global.appWebDomain	WebApp domain
api.url.files	global.filesDomain	File preview or download domain
api.url.marketplaceApi	global.marketplace.apiUrl	Marketplace API URL
api.url.marketplace	global.marketplace.url	Marketplace URL
api.secretKey	global.appSecretKey	Secret key for securely signing session cookies and encrypting sensitive database information
pluginDaemon.marketplace.enabled	global.marketplace.enabled	Enable marketplace for plugin daemon
pluginDaemon.marketplace.apiProxyEnabled	global.marketplace.apiProxyEnabled	Enable API proxy for marketplace (routes through built-in nginx)

No action required for users with default setups.

New Contributors

• @hutchisr made their first contribution in #379
• @Oscaner made their first contribution in #381

Full Changelog: dify-0.35.0...dify-0.36.0-rc2

What's Changed

• Remove obsolete values from values.schema.json by @BorisPolonsky in #390
• Bump chart version to 0.36.0-rc2 by @BorisPolonsky in #392

Full Changelog: dify-0.36.0-rc1...dify-0.36.0-rc2

dify-0.36.0-rc1

Release v0.36.0-rc1

This release removes deprecated values, brings quality of life improvements and bumps Dify to 1.12.1.

What's Changed

• Add configuration options for hostAliases (#372) @BorisPolonsky
• refactor: Unify indentation in templates (#373) @BorisPolonsky
• Set Redis and Celery domain names regarding customized fullname in built-in Redis (#374) @BorisPolonsky
• Set domain names regarding customized fullname in built-in PostgreSQL (#375) @BorisPolonsky
• Fix sandbox service discovery for triggers (#379) @hutchisr
• Add CVE scan workflow for chart default images (#380) @BorisPolonsky
• Update default image tags for Dify 1.12.1 (#384) @BorisPolonsky
• feat(charts): include API config in worker and fix sandbox FQDN (#381) @Oscaner
• Refactor config template and standardize LOG_LEVEL handling (#385) @BorisPolonsky
• Remove deprecated values (#386) @BorisPolonsky
• Bump chart version to 0.36.0-rc1 and app version to 1.12.1 (#387) @BorisPolonsky

Breaking Changes

The values deprecated since 0.35.0 are now obsolete and no longer take effect. Migrate them to the global.* equivalents. No action required for users with default setups.

Removed	Replacement	Description
api.url.consoleApi	global.consoleApiDomain	Backend domain of the console API
api.url.consoleWeb	global.consoleWebDomain	Front-end domain of the console web
api.url.serviceApi	global.serviceApiDomain	Service API domain
api.url.appApi	global.appApiDomain	WebApp API backend domain
api.url.appWeb	global.appWebDomain	WebApp domain
api.url.files	global.filesDomain	File preview or download domain
api.url.marketplaceApi	global.marketplace.apiUrl	Marketplace API URL
api.url.marketplace	global.marketplace.url	Marketplace URL
api.secretKey	global.appSecretKey	Secret key for securely signing session cookies and encrypting sensitive database information
pluginDaemon.marketplace.enabled	global.marketplace.enabled	Enable marketplace for plugin daemon
pluginDaemon.marketplace.apiProxyEnabled	global.marketplace.apiProxyEnabled	Enable API proxy for marketplace (routes through built-in nginx)

No action required for users with default setups.

New Contributors

• @hutchisr made their first contribution in #379
• @Oscaner made their first contribution in #381

Full Changelog: dify-0.35.0...dify-0.36.0-rc1

dify-0.35.0

Release v0.35.0

This release focuses on nginx compatibility adaptations for OpenShift, additional persistence support and enhanced configuration options.

Highlights

Global values

Fundamental Dify configurations can could be applied in global section for better maintainability. Component-specific values take precedence over global values for more customized setup and backward compatibility, for instance:

global:
  # A global secret key for all inter-component API calls among Dify containers (e.g. `api`, `sandbox` and `pluginDaemon`).
  internalApiKey: "unified-sk-for-all-internal-calls"
sandbox:
  auth:
      apiKey: "sandbox-specific-sk"

What's Changed

• Update labels in Secret, ConfigMap and Job (#358) @BorisPolonsky
• Enable rootless settings for nginx containers by default (#363) @BorisPolonsky
• Switch nginx container port to 8080 for non-privileged environments (#361) @giladd123
• Add option for persistence for every deployment (#360) @giladd123
• refactor: migrate user defined persistence volumes to extraVolumes/extraVolumeMounts (#365) @BorisPolonsky
• feat(proxy): Make nginx worker_processes configurable (#366) @BorisPolonsky
• feat: add global values section with component override priority (#367) @BorisPolonsky
• Bump chart version to 0.35.0-rc1 (#368) @BorisPolonsky

Deprecated Values

The values below will continue to function for backward compatibility but are recommended to be migrated to the global equivalents for consistency and centralized configuration management.

Deprecated Value	New Value	Description
api.url.consoleApi	global.consoleApiDomain	Backend domain of the console API
api.url.consoleWeb	global.consoleWebDomain	Front-end domain of the console web
api.url.serviceApi	global.serviceApiDomain	Service API domain
api.url.appApi	global.appApiDomain	WebApp API backend domain
api.url.appWeb	global.appWebDomain	WebApp domain
api.url.files	global.filesDomain	File preview or download domain
api.url.marketplaceApi	global.marketplace.apiUrl	Marketplace API URL
api.url.marketplace	global.marketplace.url	Marketplace URL
api.secretKey	global.appSecretKey	Secret key for securely signing session cookies and encrypting sensitive database information
pluginDaemon.marketplace.enabled	global.marketplace.enabled	Enable marketplace for plugin daemon
pluginDaemon.marketplace.apiProxyEnabled	global.marketplace.apiProxyEnabled	Enable API proxy for marketplace (routes through built-in nginx)

Migration Note

For existing users with proxy.log.persistence.enabled: true (false by default):

• update the volume ownership before upgrading, or
• as alternative, disable security contexts for backward compatibility by setting:

proxy:
  podSecurityContext:
    enabled: false
  containerSecurityContext:
    enabled: false

New Contributors

• @giladd123 made their first contribution in #361

Full Changelog: dify-0.34.0...dify-0.35.0

dify-0.35.0-rc1

Release v0.35.0-rc1

This release focuses on nginx compatibility adaptations for OpenShift, additional persistence support and enhanced configuration options.

Highlights

Global values

Fundamental Dify configurations can could be applied in global section for better maintainability. Component-specific values take precedence over global values for more customized setup and backward compatibility, for instance:

global:
  # A global secret key for all inter-component API calls among Dify containers (e.g. `api`, `sandbox` and `pluginDaemon`).
  internalApiKey: "unified-sk-for-all-internal-calls"
sandbox:
  auth:
      apiKey: "sandbox-specific-sk"

What's Changed

• Update labels in Secret, ConfigMap and Job (#358) @BorisPolonsky
• Enable rootless settings for nginx containers by default (#363) @BorisPolonsky
• Switch nginx container port to 8080 for non-privileged environments (#361) @giladd123
• Add option for persistence for every deployment (#360) @giladd123
• refactor: migrate user defined persistence volumes to extraVolumes/extraVolumeMounts (#365) @BorisPolonsky
• feat(proxy): Make nginx worker_processes configurable (#366) @BorisPolonsky
• feat: add global values section with component override priority (#367) @BorisPolonsky
• Bump chart version to 0.35.0-rc1 (#368) @BorisPolonsky

Deprecated Values

The values below will continue to function for backward compatibility but are recommended to be migrated to the global equivalents for consistency and centralized configuration management.

Deprecated Value	New Value	Description
api.url.consoleApi	global.consoleApiDomain	Backend domain of the console API
api.url.consoleWeb	global.consoleWebDomain	Front-end domain of the console web
api.url.serviceApi	global.serviceApiDomain	Service API domain
api.url.appApi	global.appApiDomain	WebApp API backend domain
api.url.appWeb	global.appWebDomain	WebApp domain
api.url.files	global.filesDomain	File preview or download domain
api.url.marketplaceApi	global.marketplace.apiUrl	Marketplace API URL
api.url.marketplace	global.marketplace.url	Marketplace URL
api.secretKey	global.appSecretKey	Secret key for securely signing session cookies and encrypting sensitive database information
pluginDaemon.marketplace.enabled	global.marketplace.enabled	Enable marketplace for plugin daemon
pluginDaemon.marketplace.apiProxyEnabled	global.marketplace.apiProxyEnabled	Enable API proxy for marketplace (routes through built-in nginx)

Migration Note

For existing users with proxy.log.persistence.enabled: true (false by default):

• update the volume ownership before upgrading, or
• as alternative, disable security contexts for backward compatibility by setting:

proxy:
  podSecurityContext:
    enabled: false
  containerSecurityContext:
    enabled: false

New Contributors

• @giladd123 made their first contribution in #361

Full Changelog: dify-0.34.0...dify-0.35.0-rc1

dify-0.34.0

Release v0.34.0

This release focuses on MySQL support and rootless dify-api containers introduced in Dify 1.10.1.

What's Changed

• chore(api): Update security context to allow non-root access to persistent storage by default (#340) @BorisPolonsky
• Add external MySQL support (#343) @BorisPolonsky
• docs: Add MySQL to mermaid diagram in README (#344) @BorisPolonsky
• Update default image tags for Dify 1.10.1 (#345) @BorisPolonsky
• Update comments in values.yaml and related CI tests (#346) @BorisPolonsky
• Bump chart version to 0.34.0-rc1 and app version to 1.10.1 (#348) @BorisPolonsky
• Security update: Bump app version to 1.10.1-fix.1 (CVE-2025-55182) and chart version to 0.34.0-rc2 (#352) @BorisPolonsky
• Consolidate CI tests (#353) @BorisPolonsky
• Add CI test for external MySQL (#354) @BorisPolonsky
• Fix external DNS setups and unify bitnami images used in CI tests (#356) @BorisPolonsky
• Add name-pattern fallback for CI test script (missing app.kubernetes.io/instance label) (#357) @BorisPolonsky
• Bump chart version to 0.34.0 (#355) @BorisPolonsky

Migration Notice

For users running dify-api containers with existing PVCs provisioned with node-local storage (e.g. with local-path storage class), update the directory UID/GID on the node:

# Identify the bounded PersistentVolume for dify-api containers
kubectl get pvc -n $NAMESPACE | grep dify
# Get actual path that the persistent volume relies on
kubectl describe $DIFY_API_PV
# Change the path ownership (1001 for dify-api 1.10.1+) on the node for non-root access
sudo chown -R 1001:1001 $PV_LOCAL_PATH

Full Changelog: dify-0.33.0...dify-0.34.0

dify-0.34.0-rc2

Release v0.34.0-rc2

This release focuses on MySQL support and rootless dify-api containers introduced in Dify 1.10.1.

What's Changed

• chore(api): Update security context to allow non-root access to persistent storage by default (#340) @BorisPolonsky
• Add external MySQL support (#343) @BorisPolonsky
• docs: Add MySQL to mermaid diagram in README (#344) @BorisPolonsky
• Update default image tags for Dify 1.10.1 (#345) @BorisPolonsky
• Update comments in values.yaml and related CI tests (#346) @BorisPolonsky
• Bump chart version to 0.34.0-rc1 and app version to 1.10.1 (#348) @BorisPolonsky
• Security update: Bump app version to 1.10.1-fix.1 (CVE-2025-55182) and chart version to 0.34.0-rc2 (#352) @BorisPolonsky

Migration Notice

For users running dify-api containers with existing PVCs provisioned with node-local storage (e.g. with local-path storage class), update the directory UID/GID on the node:

# Identify the bounded PersistentVolume for dify-api containers
kubectl get pvc -n $NAMESPACE | grep dify
# Get actual path that the persistent volume relies on
kubectl describe $DIFY_API_PV
# Change the path ownership (1001 for dify-api 1.10.1+) on the node for non-root access
sudo chown -R 1001:1001 $PV_LOCAL_PATH

Full Changelog: dify-0.33.0...dify-0.34.0-rc2

dify-0.34.0-rc1

Release v0.34.0-rc1

This release focuses on MySQL support and rootless dify-api containers introduced in Dify 1.10.1.

Important

The default image tags for Dify in this release candidate are subject to CVE-2025-55182. Please upgrade to a newer chart version or update the dify-api/dify-web image tags to 1.10.1-fix.1. Refer to langgenius/dify#29277.

What's Changed

• chore(api): Update security context to allow non-root access to persistent storage by default (#340) @BorisPolonsky
• Add external MySQL support (#343) @BorisPolonsky
• docs: Add MySQL to mermaid diagram in README (#344) @BorisPolonsky
• Update default image tags for Dify 1.10.1 (#345) @BorisPolonsky
• Update comments in values.yaml and related CI tests (#346) @BorisPolonsky
• Bump chart version to 0.34.0-rc1 and app version to 1.10.1 (#348) @BorisPolonsky

Migration Notice

For users running dify-api containers with existing PVCs provisioned with node-local storage (e.g. with local-path storage class), update the directory UID/GID on the node:

# Identify the bounded PersistentVolume for dify-api containers
kubectl get pvc -n $NAMESPACE | grep dify
# Get actual path that the persistent volume relies on
kubectl describe $DIFY_API_PV
# Change the path ownership (1001 for dify-api 1.10.1+) on the node for non-root access
sudo chown -R 1001:1001 $PV_LOCAL_PATH

Full Changelog: dify-0.33.0...dify-0.34.0-rc1

dify-0.33.0

Release v0.33.0

This release introduces quality-of-life updates and minor patches for deploying Dify 1.10.0.

What's Changed

• Add permissions for GitHub Actions (#333, #334)@BorisPolonsky
• Add missing /triggers route in Nginx for Dify 1.10.0 (#337, #338) @BorisPolonsky
• Allow configurable Redis DB for cache and Celery broker (#331) @H2CO3Bearcard
• Resolve plugin-daemon NPE in multi-replica environments (#207) @gaoyue1989 @BorisPolonsky

New Contributors

• @H2CO3Bearcard made their first contribution in #331

Full Changelog: dify-0.32.0...dify-0.33.0

dify-0.33.0-rc1

Release v0.33.0-rc1

This release introduces quality-of-life updates and minor patches for deploying Dify 1.10.0.

What's Changed

• Add permissions for GitHub Actions (#333, #334)@BorisPolonsky
• Add missing /triggers route in Nginx for Dify 1.10.0 (#337, #338) @BorisPolonsky
• Allow configurable Redis DB for cache and Celery broker (#331) @H2CO3Bearcard
• Resolve plugin-daemon NPE in multi-replica environments (#207) @gaoyue1989 @BorisPolonsky

New Contributors

• @H2CO3Bearcard made their first contribution in #331

Full Changelog: dify-0.32.0...dify-0.33.0-rc1