v3.9.10

LTSRecommended

Released Aug 13, 2026·Supported until Dec 31, 2026·Community 1.13.x·Community commit 26a1dd2·Enterprise 0.16.x·Helm chart·Docker Compose

Breaking

None

Security

Issues

Changes

0F · 5B

Downtime

Zero

Upgrade Impact

0 features · 5 fixes

Non-breaking:Bug fixes only. No breaking changes.

What Changed

Bug Fixes

Form: Markdown form field names support more fullwidth charactersRemoved hard-coded punctuation from the field-name allowlist and added the self-hosted NEXT_PUBLIC_MARKDOWN_FORM_FIELD_NAME_EXTRA_CHARS setting so operators can opt in additional characters such as （）！＊＆－。.;；+=—. Also fixes a Streamdown issue where a stray trailing * was appended when form attributes contained punctuation. (ESQ1-226)

Form: Workspace custom brand logo ignored on human-input formThe HITL/form page hard-coded the Dify logo and ignored the workspace-configured "Powered by" brand image. It now reads the workspace branding configuration and renders the custom logo. (ESQ1-238)

Model: Credential fields cleared when switching model typesCredential schemas can reuse the same variable (e.g. context_size, video_support) across multiple model types. A stale timer from a hidden schema entry could delete the value used by the currently visible sibling, leaving fields empty after switching model types. Values are now preserved per visible schema and video_support consistently restores its default. (ESQ1-242)

OSS: Built-in object storage ignored HTTP Range, breaking plugin installs >5MBThe built-in object storage (server/pkg/oss, used when persistence.type != s3) ignored the Range header and always returned the full object. Kaniko downloads plugin build contexts via parallel ranged GETs (5MB parts), so every part received the full body and corrupted objects larger than one part — plugin installs >5MB failed with EOF. Single-range requests are now handled per RFC 9110 (206/416), restoring normal plugin installation. (ESQ1-234)

Security Notes

Security: CVEs from pip-vendored setuptools / msgpack are non-runtimeThe setuptools and msgpack CVEs flagged in this release's scan are introduced by the latest pip version as vendored dependencies. They cannot be fixed on our side without forking pip. They are not related to runtime behavior — pip does not import pip._vendor.setuptools at runtime. Per the pip maintainers (pypa/pip#14031): "A security issue in a vendored library does not necessarily represent a security issue in pip." These findings are accepted as non-actionable.