v3.9.13

LTSRecommended

Released Sep 23, 2026·Supported until Sep 30, 2027·Community 1.13.x·Community commit 75bbcff·Enterprise 0.16.x·Helm chart·Docker Compose

Breaking

1 to verify

Security

Issues

Changes

0F · 6B

Downtime

Zero

Upgrade Impact

0 features · 6 fixes

Breaking:The default Enterprise API image still excludes the ChromaDB vector store, Weights & Biases tracing and ClickZetta, unchanged from 3.9.12; use the `-insecure` API image if you still need any of them.

API image: ChromaDB, W&B tracing and ClickZetta remain excluded from the default buildThe default dify-ee-api image continues to exclude the ChromaDB vector store (an unfixed critical CVE in the ChromaDB dependency), Weights & Biases (`wandb`) tracing and the ClickZetta vector database. The set of excluded integrations is unchanged from 3.9.12. If your deployment relies on any of them, use the docker.io/langgenius/dify-ee-api-insecure:3.9.13 image tag, which includes these integrations at the cost of the additional known vulnerabilities listed in the CVE report below.

CVEs for the opt-in api-insecure image is excluded from the aggregate counts above.

View api-insecure CVE report →

What Changed

Bug Fixes

Security: Python dependency updates in the API imagePicked up the dependency fixes landed on the community lts/1.13.x branch: anyio 4.11.0 → 4.14.2, which clears the critical improper-certificate-validation advisory (CVE-2026-63374) and the unbounded process-pool stderr allocation (CVE-2026-64847); gitpython 3.1.59 → 3.1.62 (CVE-2026-87817 / 87818 / 87819); pypdf 6.15.0 → 6.16.1 (CVE-2026-84309 / 84310 / 84311); soupsieve 2.8.4 → 2.9 (CVE-2026-85999 / 86000); pygments 2.19.2 → 2.20.0; plus a 15-package group bump covering starlette, sentry-sdk, unstructured, numpy, pandas, gevent, pyjwt, yarl, charset-normalizer and others. The default dify-ee-api image now scans with zero critical findings.

Security: Next.js upgraded to 16.3.6 in the Web imageThe community Web image now builds on Next.js 16.3.6 (up from 16.3.4), keeping the LTS line on the current patched framework release. No configuration change is required.

Security: OS-level CVEs cleared by a base-image refreshAll images were rebuilt on refreshed Chainguard base layers, which picks up the fixed zlib (CVE-2026-85091), node-gyp (CVE-2026-84890 / 84933 / 84961), wget (CVE-2026-16599) and glibc (CVE-2026-18374) packages. The Enterprise, Gateway, Audit, Collector, Enterprise Frontend, Web, Plugin Manager, Connector, Controller, Shader and Plugin Daemon images now report no critical and no high findings.

Security Notes

Release scope: dependency and base-image updates onlyThis is a security-maintenance release. The Enterprise services (0.16.x), Enterprise Frontend, plugin daemon and sandbox are built from the same source commits as 3.9.12 — only the community application (lts/1.13.x) moved forward, and only for dependency upgrades. There are no functional changes, no database migrations and no configuration changes in this release.

Security: setuptools / msgpack CVEs do not affect runtimeThe setuptools and msgpack CVEs flagged by this release's scanner are introduced by dependencies vendored inside the base image's system pip (pip/_vendor). They are not installed in the application virtualenv nor imported by the runtime (which uses uv-managed venvs), so they are not exploitable. The assessment is unchanged from 3.9.12 and covers the same three advisories; see the VEX (Vulnerability Exploitability eXchange) document linked in the Security & CVE section for the full details.

Security: nltk path-traversal advisory has no upstream fixCVE-2026-81726 (path traversal in nltk ≤ 3.10.3) is still reported against the API image and has no fixed release upstream. It is the only high-severity finding in the default dify-ee-api image that is not covered by the VEX document; we are tracking the upstream fix and will ship it as soon as one is published.

Upgrade Guide

Pre-Upgrade Checklist

Back up PostgreSQL database and Redis data

Confirm Kubernetes cluster has sufficient resources for rolling update

Review the manifest changes before applying: helm diff upgrade dify dify-ee/dify --version 3.9.13 -f values.yaml (helm-diff plugin), or render with helm template dify dify-ee/dify --version 3.9.13 -f values.yaml and compare it against helm get manifest dify

Zero-downtime rolling upgrade supported

Upgrade Command

# Back up the database and review the manifest diff first, then:

$ helm upgrade -i dify -f values.yaml dify-ee/dify --version 3.9.13

Rollback

$ helm rollback dify 0