v3.9.4
LTSRecommended
Released May 21, 2026·Supported until Dec 31, 2026·Community 1.13.3·Community commit c5d8c00·Enterprise 0.16.x·Helm chart·Docker Compose
Breaking
1 to verify
Security
Issues
Changes
0F · 3B
Downtime
Zero
Upgrade Impact
Breaking:The default Enterprise API image no longer ships Weights & Biases tracing or ClickZetta vector DB; use the `-insecure` API image if you still need them.
API image: W&B tracing and ClickZetta vector DB removed from default buildFor a smaller attack surface, Weights & Biases (`wandb`) tracing and the ClickZetta vector database integration are no longer included in the default API image. If you still need those integrations, use the
docker.io/langgenius/dify-ee-api-insecure:3.9.4 API image tag, which retains the previous behavior at the cost of additional known vulnerabilities.What Changed
3Security
Security: Vulnerability FixesFixed several vulnerabilities in previous version. Please see full CVE report for details.
Performance
Performance: TTFE OptimizationImproved Time To First Event (TTFE) latency through cache optimizations and reduced database roundtrips, delivering faster response times across LTS 3.9.x deployments.
Performance: Post-Run Delay OptimizationProvided a configurable EVENT_BUS_LISTENER_JOIN_TIMEOUT_MS to allow reducing idle delay after chatflow run completion, trading graceful stream disconnect for lower post-run latency in multi-turn conversations. 100 is a reasonable value.
Upgrade Guide
Pre-Upgrade Checklist
Back up PostgreSQL database and Redis data
Confirm Kubernetes cluster has sufficient resources for rolling update
Zero-downtime rolling upgrade supported
Upgrade Command
# Back up database first, then:
$ helm upgrade -i dify -f values.yaml dify-ee/dify --version 3.9.4
Rollback
$ helm rollback dify 0
Security & CVE
Security vulnerabilities found in this release.2 Critical · 44 High CVE across all container images
Image
low
6
2
0
0
1
0
0
1
1
1
0
0
0
1
0
0
1
1
Status
FAIL
FAIL
PASS
PASS
PASS
PASS
PASS
PASS
PASS
PASS
PASS
PASS
PASS
PASS
PASS
PASS
FAIL
PASS
ScannerDocker Scout
Scanned
May 20, 2026
Data Source
Docker
Benchmark Report
TTFE – Time To First Event (ms)
AVG
139.64
MIN
108
MAX
537
P50
122
P90
137.6
P95
158.8
Connections
Max Concurrent
11
Avg Active
9.7
Empty Workflow QPS
Max QPS
29.6
Avg QPS
27.93
Avg Duration (ms)
274.32
License Compliance
All dependencies compliant - no copyleft issues detected
Apache-2.0MITBSD-3-ClauseMPL-2.0BSD-2-ClauseISCCC0-1.0