v3.11.1

Maintenance

Released Jul 15, 2026·Community 1.15.0·Community commit 56bf682·Enterprise 0.18.1·Helm chart·Docker Compose

Breaking

None

Security

Issues

Changes

1F · 6B

Downtime

brief

Upgrade Impact

1 features · 6 fixes

Non-breaking:This is a patch release on the 3.11.x line and introduces no new mandatory migrations. Workflow Collaboration ships as a dedicated websocket service; enabling it (or the rolling update itself) briefly reconnects active workflow editing sessions. If you are upgrading from a version earlier than 3.11.0, you must still complete the 3.11.0 RBAC and plugin auto-upgrade migrations first.

What Changed

New Features

Workflow Collaboration: Real-Time Multiplayer EditingReal-time multiplayer workflow editing is now generally available in Enterprise. Multiple editors can work on the same workflow simultaneously over a dedicated Socket.IO websocket service. Collaboration is opt-in via the Helm collaboration.enabled switch and requires Dify Enterprise 3.11.1 or later.

Bug Fixes

Security: SQL Injection HardeningHardened SQL query construction and added metadata key validation to close SQL injection vectors inherited from the Community Edition base.

Security: CVE Dependency RemediationBumped vulnerable dependencies (python-socketio, python-engineio, soupsieve) and upgraded the plugin-daemon Go builder to clear outstanding standard-library CVEs. See the Security & CVE section below for the full scan results.

RBAC: Editor Permission CorrectionsFixed several editor-role permission issues: editors no longer attempt member management, editors can now view application logs, and changing trace configuration now correctly requires edit access. A new app created by a member is now accessible by default to all members holding the corresponding role.

Plugin Management StabilityFixed integration marketplace install callbacks, debug-mode plugin permission settings that did not apply, plugin external user ID resolution in backwards invocations, and kept provider credential refreshes single-flight to avoid redundant work. Also enabled HTTP Range requests on the built-in object storage, fixing install failures for plugins larger than 5MB.

Workflow and API StabilityResolved "Working outside of application context" errors, corrected chunked workflow failure-tracking data, guarded against an infinite loop during batched record deletion, and wired a dedicated timeout into inner RBAC requests.

UI and Authentication FixesFixed main navigation item states, dataset creation layout height, app card overflow, dark-mode rendering with no plugins installed, the Human-in-the-Loop input save button visibility, toasts blocking page clicks, OAuth error display, a duplicated auth prefix, and broken pagination on the admin members page after filtering by group.

Upgrade Guide

Pre-Upgrade Checklist

Back up PostgreSQL database and Redis data

Confirm Kubernetes cluster has sufficient resources for the rolling update

If upgrading from a version earlier than 3.11.0: schedule a maintenance window — the RBAC migrations below are mandatory and the application is unusable until they complete (skip this entire block if you are already on 3.11.0)

Then run flask rbac-migrate-member-roles (mandatory from <3.11.0; members have no access until this finishes)

Then run flask rbac-migrate-dataset-permissions --apply (mandatory from <3.11.0; dataset access is incorrect under RBAC until this finishes)

Then run flask backfill-plugin-auto-upgrade (mandatory from <3.11.0) before restoring traffic

To enable Workflow Collaboration, set collaboration.enabled and deploy the websocket service (see Migration Notes)

Expect a brief reconnect of active workflow editing sessions during the rolling update

Upgrade Command

# Back up database first, then:

$ helm upgrade -i dify -f values.yaml dify-ee/dify --version 3.11.1

Rollback

$ helm rollback dify 0