v3.13.2
LTSRecommended
Released Oct 30, 2026·Supported until Mar 31, 2028·Community 1.17.x·Community commit 5642a5d·Enterprise 0.20.x·Helm chart·Docker Compose
Breaking
None
Security
Issues
Changes
1F · 6B
Downtime
Zero
Upgrade Impact
Non-breaking:Review the excluded API integrations and the migration requirements for upgrades from earlier 3.13 releases before upgrading.
API image: Existing integration exclusionsThe default API image continues to exclude ChromaDB, Weights & Biases (
wandb) tracing and ClickZetta. Deployments requiring these integrations must use docker.io/langgenius/dify-ee-api-insecure:3.13.2; review its additional known vulnerabilities in the security report below.Agent: Migration requirements for earlier 3.13 releasesWhen upgrading from an earlier release, review the Agent permission migration requirements in the 3.13.1 upgrade guide. Deployments that already completed the migration do not need to repeat it.
CVEs for the opt-in
api-insecure image is excluded from the aggregate counts above.What Changed
7Improvements
Workspace: Resource cleanupAdds workspace resource cleanup support and storage cleanup for deleted apps and datasets.
Bug Fixes
Apps and datasets: Visibility and ownershipApp maintainers can see the apps they maintain, editors can see newly created apps, and dataset lists include owned datasets.
Agent: Permission editing and Redis 6.0 event replayAgent owners can edit their Agents. Agent event replay now works with Redis 6.0.
Marketplace: Template links and Qwen Flash model selectionThe home template link respects the Marketplace setting. Agent model selection supports current Qwen flash models.
Prompt editor: Variable search highlightingVariable search highlighting escapes matched text in the prompt editor.
Security Notes
Security: Dependency updatesUpdates API LiteLLM to 1.100.4 and patches API, Agent, gateway and app-runner dependencies. Enterprise Frontend updates Next.js to 16.4.1.
Security: Remaining scanner findingsRaw scanner findings remain visible below. The linked OpenVEX report documents pip-vendored msgpack and setuptools findings; it does not cover all remaining vulnerabilities.
Upgrade Guide
Pre-Upgrade Checklist
Back up PostgreSQL database and Redis data
Review the Agent permission migration requirements in the 3.13.1 release notes when upgrading from earlier releases
Review rendered manifest changes with helm diff or helm template before applying the upgrade
Confirm Kubernetes cluster has sufficient resources for rolling update
Zero-downtime rolling upgrade supported
Upgrade Command
# Back up database first, then:
$ helm upgrade -i dify -f values.yaml dify-ee/dify --version 3.13.2
Rollback
$ helm rollback dify 0
Security & CVE
Security vulnerabilities found in this release.0 Critical · 19 High CVE across all container images
Image
critical
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
low
35
40
3
35
40
3
3
4
0
3
34
34
34
3
3
3
37
3
3
2
37
0
Status
FAIL
FAIL
PASS
FAIL
FAIL
PASS
PASS
PASS
PASS
FAIL
FAIL
FAIL
FAIL
PASS
PASS
PASS
FAIL
PASS
PASS
PASS
FAIL
PASS
ScannerDocker Scout
Scanned
Oct 30, 2026
Data Source
Docker
CVEs for the opt-in
api-insecure image is excluded from the CVE table above.VEX (Vulnerability Exploitability eXchange) documents record why the flagged CVEs are not exploitable in Dify Enterprise.
Benchmark Report
TTFE – Time To First Event (ms)
AVG
204.25
MIN
168
MAX
260
P50
192
P90
254.8
P95
258.35
Connections
Max Concurrent
18
Avg Active
17.3
Empty Workflow QPS
Max QPS
43
Avg QPS
39.79
Avg Duration (ms)
293.03
Previous benchmark: 3.13.1
License Compliance
All dependencies compliant - no copyleft issues detected
Apache-2.0MITBSD-3-ClauseMPL-2.0BSD-2-ClauseISCCC0-1.0