[Tracker] Security Issue Tracker #11943

New Issue

2026-02-21T19:04:53-05:00

yindo commented

2026-02-21 19:04:53 -05:00

Originally created by @laipz8200 on GitHub (Mar 21, 2025).

Originally assigned to: @laipz8200 on GitHub.

Blockers

[Chore/Refactor] Fix login token , correct task 'clean message time'. (#16457)

PRs

Originally created by @laipz8200 on GitHub (Mar 21, 2025). Originally assigned to: @laipz8200 on GitHub. ## Blockers - [x] #16457 ## PRs - [x] #16454 - [x] #16433

yindo closed this issue

2026-02-21 19:04:53 -05:00

yindo referenced this issue

2026-02-21 20:41:29 -05:00

[PR #11943] fix:log error(#11942) #27423

Sign in to join this conversation.

Branches Tags

main

codex/strengthen-tool-provider-types

yanli/refactor-sandbox-and-e2b

0721-happy-path-smoke

feat/ws-proxy-support

chore/support-preview-mode-fe

gareth/esq1-170-rbac-for-agent

deploy/saas

linw/snp-549-reauth-after-accepting-invitation

0721-document-detail

feat/hitl-im-dev

deploy/enterprise

fix/empty-dataset-list-tip

feat/ce-telemetry-dev

0720-documents-tasks

deploy/agent

release/e-1.11.4

fix/cus-1422-enterprise-api-timeout

hotfix/cus-1422-enterprise-api-timeout

perf/optimize-markdown-renderer

feat/fix-undefined-answer-preview

hotfix/1.15.0-fix.15

dependabot/uv/dify-agent/pillow-12.3.0

0720-crawl-selection

0720-crawl-preview

0720-source-connections

0720-create-knowledge

0720-new-rag-contracts

laipz8200/human-input-loop-iteration

0720-new-rag-list

codex/migrate-knowledge-fs

hotfix/1.15.0-fix.14

lts/1.13.x

deploy/workflow-archive-catalog-discovery

dependabot/uv/api/pydantic-09001a97e5

laipz8200/completion-workflow-entry

dependabot/uv/api/lts/1.13.x/python-packages-6c2bf7110c

dependabot/uv/api/storage-4219cfbece

dependabot/uv/api/lts/1.13.x/dev-6fc4f8b90c

dependabot/uv/api/llm-46e0cee538

dependabot/uv/api/lts/1.13.x/vdb-72526f7860

dependabot/uv/api/opentelemetry-b8005594e1

dependabot/uv/api/lts/1.13.x/storage-4310e8b8d8

dependabot/uv/api/lts/1.13.x/database-c0fba9b420

dependabot/uv/api/lts/1.13.x/llm-5ce1d68736

dependabot/uv/api/lts/1.13.x/pydantic-09001a97e5

dependabot/uv/api/lts/1.13.x/opentelemetry-b8005594e1

dependabot/uv/api/google-68de7a6be5

dependabot/github_actions/lts/1.13.x/github-actions-dependencies-1a36b91cf1

dependabot/uv/api/lts/1.13.x/google-c93828e58f

dependabot/uv/api/lts/1.13.x/flask-1086fc46af

0717-knowledge-fs-contract

feat/secret-scrub-persistence

feat/llm-ft-timeout

feat/appdeploy-selected-workflow-dsl

0715-new-rag

laipz8200/llm-environment-variables

release/ee-1.15.0-hotfix

laipz8200/chore-remove-feature-preview-root-env

dependabot/go_modules/dify-agent-runtime/golang.org/x/net-0.55.0

hotfix/1.15.0-fix.12

hotfix/1.15.0-fix.12-cherrypick

hotfix/1.15.0-fix.13

build/invite-seats-precheck

hotfix/1.15.0-fix.11

laipz8200/workflow-persistence-mixed-mode

hotfix/1.15.0-fix.10

zhangxin/eng-558-licensed-seats-1.15

fix/wta-1307-effect-suspense-read

feat/cli-skills-agents

0713-vp-lint

deploy/dev

fix/agent-roster-answer-completion-main

feat/pay-by-invoice

codex/run-external-e2e-main-ci

agent/remove-sandbox-bind-mounts

feat/agent-v2-e2e-test

hotfix/1.15.0-fix.9

hotfix/1.15.0-fix.8

build/test-archive-export

linw/restore-agent-message-delta-feat

hotfix/1.15.0-fix.7

hotfix/1.15.0-fix.6

codex/pr-38227-session-types

codex/pr-38227-session-scope-split

fix/ui-fix

hotfix/1.15.0-fix.4

codex/review-pr-38480

hotfix/1.15.0-fix.2

copilot/fix-web-full-stack-e2e-job

fix/dify-2738-agent-node-dsl-export

hotfix/1.15.0-fix.3

fix/scope-segment-batch-delete

laipz8200/scope-segment-route-lookup

chore/i18n-sync-7b7956f3e7ca-e901a65a

codex/upgrade-orpc-v2-beta

hotfix/1.15.0-fix.1

codex/upgrade-openapi-ts-autofix

codex/upgrade-next-16-3-preview

hotfix/1.15.0-fix.0

hotfix/web-detail-adjustment-before-release

release/e-1.15.0

codex/replace-lamejs-with-mediabunny

copilot/add-more-tests

deploy/archive-db-resilience

fix/studio-nav-home-button

hotfix/1.14.2-fix.13

worktree-token-expired-error-code

hotfix-1.14.2-fix.12

codex/agent-v2-state-graph

codex/refactor-deployment-detail-components

hotfix/1.14.2-fix.12

build/fix/workflow-error-hanging

work/dify-2585-agent-drafts-pr

fix/dify-2574-soul-files-kv

fix/dify-2554-debug-conversation-per-user

hotfix/1.14.2-fix.11

feat/openapi-rbac

test/cli-e2e-error-body-contract

build/optimize-clean-messages-eligible-apps

zhaohao1004/optimize-clean-messages-cursor

gh-readonly-queue/main/pr-37592-c71f03f5902031b7c02e61af3aff5c2dee6f7d85

build/optimize-clean-messages-cursor

feat/country

codex/vp-fmt-migration

hotfix/1.14.2-fix.10

hotfix/1.14.2-fix.9

hotfix/1.14.2-fix.8

hotfix/1.14.2-fix.7

hotfix/1.14.2-fix.6

codex/page-title-updates

feat/agent-mention-stable-ids

fix/guard-workspace-with-defualt-roles

build/pr-37227-free-plan-workflow-run-cleanup

feat/cli-e2e-test-suite

feat/ui-start-node

feat/hitl-file-in-body

copilot/dify-team-question-agent-node

fix/wta-438-device-sso-redirect-origin

hotfix/1.14.2-fix.5

feat/dev-snippet-fronted

feat/mcp-token-transfer

chore/keep-info-icon-the-same-postion

codex/local-app-list-tag-filter

feat/snippet-new

hotfix/1.14.2-fix.4

codex/migrate-var-reference-combobox

hotfix/1.14.2-fix.3

feat/marketplace-template

chore/deploy-saas-workflow

hotfix/1.14.2-fix.2

build/cli

codex/snp-406-pointer-position-ref

hotfix/1.14.1-fix.3

build/feat/model-type-migration-script

fix/webapp-disabled-not-jump-to-webapp-login

fix/lb-model-type-dedup

song/eng-379-file-output-check-executor

chore/bump-authlib-1.6.12

fix/tag-trigger-preserve-case

chore/bump-sendgrid-lts-1.13.x

fix/model-type-enum-construction

refactor/add-missing-override-decorator

work/web-mcp-1.14.1

copilot/check-runtime-limits

laipz8200/workflow-response-stream-filter

copilot/query-issues-pr-images

laipz8200/fix-autofix-contract-generation

copilot/fix-autofix-job-failure

codex/deprecate-sys-files-compat

codex/fix-scrolling-issue-with-overflow-visible

copilot/research-retrieval-attachment-consumption

copilot/research-agent-node-implementation

chore/upgrade-xyflow-v12

hotfix/1.14.1-fix.1

build/1.14.1-fix.1-langfuse

hotfix/1.14.1-fix.2

feat/lts-lazy-dialogue-count

fix/can-not-create-knowledge

codex/fix-marketplace-hero-shake

codex/tag-name-url-filter

upgrade-graphon-to-0-3-0

codex/app-delete-enter-confirm

build/sample-tidb

codex/revert-pr-35708

chore/remove-dify-deploy-script

chore/simpler-deploy

lts/1.13.x-fix-35910

feat/storage-path-prefix

hotfix/1.13.3-fix10

hotfix/1.13.3-fix9

hotfix/1.14.0-fix.4

hotfix/1.14.0-fix.3

hotfix/1.14.0-fix.2

revert-35748-4-30-open-api

feat/upgrade-graphon

copilot/research-celery-task-ttl

hotfix/1.14.0-fix.1

copilot/fix-css-issue

feat/s3-public-base-url

hotfix/1.13.3-fix8

build/depot-speed-benchmark-20260426

build/depot-speed-benchmark-20260426-warm

hotfix/1.13.3-fix7

feat/evaluation

fix/workflow-line

chore/dependency-upgrade

deploy/zhaohao

feat/replayable-stream

feat/show-the-hierarchy-in-phonenix-trace

p363-reviewed

build/billing-v3

copilot/list-contributions-to-dify

cursor/migrate-tooltip-to-popover-infotips

refactor/quota-service

feat/new-biliing-quota

hotfix/1.13.3-fix6

cursor/dify-ui-infra

p363-hjlarry

cursor/refactor-select-trigger-api

chore/lts-13x-bump-deps

codex/tighten-button-tone-types

locate-queue-autocreate-deps

hotfix/1.13.3-fix5

feat/new-agent-node

hotfix/1.13.3-fix4

feat/per-db-credential

chore/i18n-sync-208604a3a819-9220dd74

chore/i18n-sync-1b369cede4b4-0e13ce3f

chore/i18n-sync-c93e40212e4c-0e13ce3f

codex/fix-vite-audit-in-sdk-test

copilot/fix-agent-dialogue-input-limit

codex/dify-ui-package-migration

4-2-no-global-loading

fix/ps-not-send

3-18-no-global-loading

feat/support-agent-sandbox

hotfix/1.13.3-fix3

hotfix/1.13.3-fix2

4-1-unocss

build/feat/saas-quota-v4

feat/remove-unused-is-deleted-from-conversation

codex-add-podman-compose-dev-scripts

fix-partnerstack-cookie-sync

hotfix/1.13.3-fix1

3-31-vite-task-cache

test/add-test-case-for-prompt-editor

build/feat/saas-quota

build/feat/saas-quota-v2

deploy/agent-dev

yanli/fix-iter-log

review-myscale-sqli

codex/force-node24-for-actions

ci/docker-build-narrowing

chore/dependabot-alert-to-bot

verify-email-reset-flow

3-26-cache-lint-for-autofix

gh-readonly-queue/main/pr-34120-2cbcf9518e40104286a3034f3c3c688cd4ff9fbf

gh-readonly-queue/main/pr-34123-1c72b8d9db03b93b3fc7f86bc522e53806f5a8f0

gh-readonly-queue/main/pr-33960-38285aa1ac6de98614456f49b4d834fe503f4e58

p383

yanli/phase3-code-scope

test/workflow-app

codex/migrate-old-toast-calls-and-update-translations

hotfix/1.13.2-fix2

focal-quokka

codex/fix-issue-33422-in-repository

hotfix/1.13.2-fix1

copilot/refactor-test-config-leak-fix

build/release-1.13.2

fix-kpa-issue

build/release-1.13.1-rc.3

3-18-dev-with-http2

build/release-1.13.1-rc.2

3-16-revert-changes

3-16-add-csp

build/release-1.13.1-rc.1

feat/source-for-plugin-tasks

3-16-next-lib

revert-33484-dependabot/pip/api/python-packages-2eba66ec58

move-trigger-nodes

copilot/refactor-test-config-leak-detection

fix/enterprise-api-error-handling

release/e-1.12.1

fix/vinext-deps

yanli/docx-image-render

copilot/analyze-dify-code

deploy/clean-task-trace

copilot/sub-pr-33044

3-6-type-check

feat/model-provider-refactor

copilot/refactor-unnecessary-cast-call

build/export-app-messages

1.12.1-otel-ee

hotfix/1.13.0-fix.4

update-checker

test/ui-primitive-wrapper-tests-pr

hotfix/1.13.0-fix.3

refactor/base-comp

deploy/memory-usage

hotfix/1.13.0-fix.2

hotfix/1.13.0-fix.1

build/sandbox-clean-job-260302-1

build/sandbox-clean-job

fix/otel-upgrade-e-1.12.1

build/optimize-workflow-run-cleanup

move-core-prompt-runtime

hotfix/1.12.1-fix.6

copilot/remove-pm2-from-docker

move-token-buffer-memory

32589-main-repo

fix/access-mode-sso-verified

refactor/remove-workspace-mutate-from-context

2-11-fix-lint

feat/plugins-marketplace-ssr-prefetch-loading

build/message-clean-performance-log

refactor/template-transform-node

hotfix/1.12.1-fix.5

2-9-stable-test-2

pre-align-hitl-frontend

fix/preserve-UNC-paths-in-conversation-opner

hotfix/1.12.1-fix.4

hotfix/1.12.1-fix.3

feat/add-update-all-plugin-button

refactor/share

hotfix/1.12.1-fix.2

test/inprove-quality

feat/add_templates

hotfix/1.12.1-fix.1

fix/ee-1511-set-default-provider-user-id-bug

copilot/fix-pnpm-test

hotfix/1.12.1-fix.0

feat/vibe-wf

fix/fix-test

fix/console_ns_import

release/1.12.1

fix/workflow-sync-draft

refactor/ssr-prefetch-zustand-removal

1-24-kubb-generate

refactor/migrate-react-window-to-tanstack-virtual

fix/input-ime-onpressenter

1-30-fix-failed-test

feat/structured-output-with-sandbox

yanli/init-ty

hotfix/1.11.4-fix.4

fix/trigger-plugin-output

fix/parallel-generation-render

refactor/configuration

yanli/add-opaque-body

build/billing-refactor-test-2026012701

refactor/debug-and-preview-store

refactor/tools-workflow

build/debug-billing-refactor

build/billing-service

build-billing-service

feat/add-agentation

refactor/app-components

build/collaboration

copilot/sub-pr-31424

refactor/local-storage

refactor/skill-bundler

hotfix/1.11.4-fix.3

build/archive-workflow-run

feat/pull-a-variable

hotfix/1.11.4-fix.2

copilot/sub-pr-30849

hotfix/1.11.4-fix.1

1-21-test-window-is-not-defined

revert-30727-feat/model-total-credits

copilot/sub-pr-31283

zhsama/multi-turn-popup

zhsama/panel-var-popup

12-19-demo-for-app-store

refactor/migrate-app-detail-to-tanstack-query

build/clear-message

feat/credential-sync-fix-ee

feat/llm-first-token-timeout

zhsama/assemble-var-input

release/e-1.11.2

feature/task-quadrant-view

zhsama/llm-warning-ui

build/clear-workflow-run

zhsama/agent-at-nodes

build/1.11.4

release/e-1.6.0-fix.1

release/e-0.15.8-fix.1

1-14-remove-web-app-access-token

refactor/plugins-detail

fix/reset-dev

feat/llm-support-tools

feat/knowledge-summary-index

fix/preact-security-vulnerability

copilot/fix-clear-query-params-test

refactor/query-params-nuqs

chore/upgrade-pnpm-10.28.0

8c92-update-api-core

detached

chore/i18n-sync-20260107-104636

chore/i18n-sync-20260107-102654

feat/grouping-branching

feat/agent-node-v2

hotfix/1.11.2-fix.3

feat/llm-node-support-tools

refactor/remove-axios-dependency

refactor/web-service-hooks

fix/pwa-plugin-migration

chore/refactor-text-generation

hotfix/1.11.2-fix.2

release/e-1.11.1

release/e-1.9.2

release/e-1.8.2

hotfix/1.11.2-hotfix-1

refactor/chat-messages-service-api

fix/knowledge-retrieval-node-affected-by-past-version

fix/esbuild-dependabot-145

chore/automated-i18n-updates-02e0fadef78f0c888b79e7a52ae6714ac73effdc

chore/automated-i18n-updates-eb73f9a9b9fc9eee6be786d2bf5f41fc77e240c4

hotfix/1.11.1-2

refactor-text-generate-item

feat/end-user-oauth

feat/add-qdrant-to-tidb-migration

codex/run-pnpm-lint-fix-and-commit-changes

feat/document-test

feat/e2e-testing

deploy/trigger-dev

hotfix/1.11.1-1

e-260

refactor/use-log-react-query

feat/fallback-interface-for-unauthorized-datasource-node

hotfix/1.10.1-fix.4

refactor/app/components/app/text-generate/item/index.tsx-and-add-test

release/e-1.6.0

hotfix/1.10.1-fix.3

hotfix/1.10.1-fix.2

feat/tracking-1203

deploy/end-user-oauth

hotfix/1.10.1-fix.1

refactor/marketplace-react-query

feat/detect-cognitive-complexity

fix/codeowners

fix/httpx_timeout_parameters

feat/end-user-auth-dummy-apis

chore/re-point-doc-urls

fix/share-markdown-xss

feat/data-tracking

feat/memory-orchestration-be

build/trigger-billing

chore/remove-docker-legacy-dir

copilot/reverse-engineer-dify-application

feat/amplitude

feat/trigger-saas

mysql-adapt

test/build-diff-edition

feat/no-root-image

feat/trigger

feat/ga-tracking

feat/collaboration

mysql-adaptation

feat/sqlalchemy-type-annotations

build/trigger-1

build/self-tenant-queue

mcp-conditional-capability

fix/mcp-capability

hotfix/1.9.2-fix.3

hotfix/1.9.2-fix.2

feat/iteration-node

hotfix/1.9.2-fix.1

hotfix/1.9.1-fix.1

e1ca7a9bdb0443b9f027b6de16

fix/login-status

feat/gtag-1016

test/monaco-editor-and-remix-icon-upgrade

copilot/fix-ce7a9189-f70c-4ea9-81ba-3f49303104d6

feat/memory-orchestration-be-dev-env

build/trigger

feat/add-knowledge-pipeline-template-command

chore/workflow-performance

copilot/fix-fc039c44-aa24-4844-82b2-e9ac237a13e9

test/log-refactor

chore/ssrf-config

feat/pinecone-vdb

copilot/fix-d8c5989d-5a30-418f-8dc4-099cf1f37218

deploy/rag-dev

hotfix/1.9.0-fix.2

pinecone

fix/document-query

feat/trigger_backup

feat/playwright-integration

feat/trigger_merging

feat/chunk-deduplication

feat/crendential-policy-default-check

feat/credential-policy

release/e-1.8.1

fix/template-list

feat/end_user

feat/trigger-fe

revert-25628-refactor-24421-app-datasets-part1

fix/plugin-tag-fallback

fix/unselect-credential

feat/limit-conv-var-desc-length

feat/rag-pipeline-service-api

fix/empty-plugin-list

feat/plugin-readme

feat/plugin-readme-fe

feat/container-node-extract-mapping

bug1

fix/model-credential

feat/big-var-value-show-fe

build/1.7.2-fix.2

release/e-1.7.2

build/boolean-type

feat/oauth-provider-fe

build/0.7.2-fix.1

feat/model-credentials

feat/model-auth

feat/rag-2-preview

release/e-1.7.1

fix/hotfix-tool-provider-deadlock

feat/knowledge-pipeline-access-control

config-tool-file-size

13604-when-using-redis-cluster-for-caching-add-global_prefix-to-all-keys-cached-by-redis

feat/model-credentils

build/oauth

feat/oauth

feat/human-input

build/plugin-auto-upgrade

test/performance

feat/tool-plugin-oauth

feat/tool-oauth

temp-feat-owner-transfer-enterprise-frontend

release/e-3.0.2

feat/plugin-auto-upgrade-fe

chore/offline-the-sys-files

feat/rag-pipeline

feat/r2

release/e-3.2.0

wtw/rag-pipeline

feat/add-retrival-field-in-dataset

feat/webapp-verified-sso-main

fix/app-not-published-error

feat/webapp-verified-sso-260

v141-hotfix

fix/20326-tool-invoke-error-instance-account

fix/19933-account-object-has-no-attribute-_current_tenant-when-workflow-uses-workflow-as-tool-node

hotfix/0519

fix/e-legacy-clean-up

fix/admin-permission

fix/e-admin-permission

feat/model-memory

feat/webapp-auth-api

1.0.0-fix

revert-17133-fix/i16990-text-to-language-settings

e-0156

hotfix/translation-fix

fix/slider-style-error

e-0154

release/0.15.6-alpha-1

cohere/cleanup-free-tenants-logs

chore/auto-dify

fix/rag-infinity-spaces-loop

fix/dataset-admin

fix/expose-debugging-port

fix/tool-info

fix/aws-s3-r2-compatible

feat/knowledge-metabase

fix/fail-branch-stream-output-error

release/0.15.3-fix1

feat/14009-feature-request-support-for-retrieving-historical-conversations-without-from-enduser-id

feat/upgrade-unstructured-version-10.2

feat/classnames-sort

feat/upgrade-unstructured-version

fix/version-check

fix/handle-agent-none-value

fix/agent-params-pasring

fix/agent-parallel

feat/knowledge-dark-mode

feat/custom-tool-input

release/0.15.2-fix1

0.15.1-admin-apis

feat/support-docx-image-view

feat/agent-stream-output

feat/workflow-node-dark-mode

fix/switch-strategy-clean-param

fix/chore-fix

opik-monitoring

provider-gpustack

feat/mecab-japanese-keywords

feat/retry-single-step-debug

revert-12086-feat/parent-child-retrieval

fix/remove-the-retry-index-field

fix/11839

feat/node-execution-retry

feat/support-extractor-tools-update-wip

feat/update-tidb-batchget-endpoint

fix/iteration-thread-pool-error

feat/support-multi-token-count

feat/parent-child-retrieval-api

fix/app-icon-is-missing

feat/support-extractor-tools-update

test/disable_site

build/add-dependabot

feat/support-extractor-tools

fix/docx-extract-image-ssrf

fix/redis-slow-in-gevent

fix/9772-internal-server-error-when-custom-disclaimer-longer-than-64-characters

alert-autofix-89

build/eslint-react-refresh-plugin

build/switch-to-pnpm

revert-9424-feat/update-dataset-clean-rule

fix/external-knowledge-retrieval-issues

feat/login-type-coontrol

feat/external-knowledge-api

feat/rag-external-knowledge-with-api

feat/external-knowledge

fix/notion-table-extract

fix/tooltip

feat/workflow-add-block-shortcut

feat/update-docs

fix/note-node-zoom-issue

fix/model-runtime-quato-issue

fix/db-lock-timeout

feat/new-tooltip

feat/web-app-sso

chore/optimize-app-workflow-deletion-slow-sql

fix/trace_app_config_app_id_idx

fix/extra-table-tracing-app-config

feat/update-beat-job-time-to-env

fix/index-estimate-error

chore/enterprise-license-status

fix/remove-tsne_position

feat/2p

feat/aws-iam-auth-check

feat/add-flashrank

feat/support-milvus-2.4

feat/add-resource-from-tools

bai

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: langgenius/dify#11943