v3.11.0

LatestNon-skippable

Released Jun 30, 2026·Community 1.15.0·Community commit 64e29f2·Enterprise 0.18.0·Helm chart·Docker Compose

Breaking

3 to verify

Security

Issues

Changes

8F · 2B

Downtime

required

Upgrade Impact

8 features · 2 fixes

Breaking:This release requires mandatory database migrations. The application is unusable until they complete: workspace members have no RBAC roles (access denied), dataset permissions are not mapped to RBAC, and plugin auto-upgrade state is uninitialized. Plan a maintenance window and run all migrations immediately after upgrade, before restoring traffic.

RBAC: Member Role Migration Required (mandatory)Workspace Role-Based Access Control replaces the legacy fixed member roles. Until flask rbac-migrate-member-roles runs, existing members map to no RBAC role and access is denied across workspaces, so the app is effectively down. See Migration Notes for instructions.

RBAC: Dataset Permission Migration Required (mandatory)RBAC also governs dataset access. Until flask rbac-migrate-dataset-permissions --apply runs, legacy dataset permissions (all-team / partial-members / only-me) are not mapped to RBAC dataset access bindings, so knowledge base access is incorrect under RBAC. See Migration Notes for instructions.

Plugin Auto-Upgrade Backfill Required (mandatory)Run flask backfill-plugin-auto-upgrade from the Dify API container immediately after upgrading to initialize plugin auto-upgrade state for existing installations.

What Changed

New Features

RBAC: Workspace Role-Based Access ControlWorkspaces now support fine-grained Role-Based Access Control. Administrators can define custom roles and permission sets, assign resource-level access (apps, knowledge bases, tools, credentials, monitoring), and manage role assignment from both the workspace UI and the enterprise admin console. Includes system-preset roles, multi-language role/permission templates, resource default access policies, and per-resource ACLs. When RBAC is disabled, the product falls back to legacy role behavior.

Community Edition 1.15.0 BaseThis release upgrades the Dify base to Community Edition 1.15.0. All upstream 1.15.0 features and fixes are now part of the enterprise distribution.

difyctl: Command-Line ClientA new command-line client lets users invoke apps and workflows directly from the terminal without the web UI. Available for macOS, Linux, and Windows with checksum-verified releases.

Chain-of-Thought Reasoning VisualizationChat flows and workflows can now stream model reasoning into a dedicated thinking panel while keeping the final answer clean. Reasoning persists across page refreshes and displays consistently in CLI and workflow previews.

Human-in-the-Loop: Dropdowns and File UploadsWorkflow pause forms now support dropdown selections and file uploads in addition to text inputs, so reviewers can give structured responses and attach files during human review steps.

Long-Running Model SupportWorkflows now accommodate slow models such as image and video generation through polling, waiting for results instead of timing out.

Knowledge Import: Excel Embedded Image ExtractionKnowledge import now extracts images embedded inside Excel files, so diagram-based content that was previously dropped is retained.

Observability: Custom Trace Session IDs and Retrieval TracingUsers can set custom trace session IDs for Phoenix, and document-retrieval steps are now traceable for better RAG transparency.

Bug Fixes

Security: Path Traversal in Plugin Daemon Forwarding (CVE-2026-41948)Fixed CVE-2026-41948, a path traversal vulnerability in plugin-daemon request forwarding, inherited from the Community Edition 1.15.0 base.

Workflow and RAG Stability ImprovementsHardened HTTP timeouts, fixed vector store compatibility issues, refined workflow execution error handling, and reduced workflow startup and termination latency.