langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-21 03:55:25 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

My dify self-hosted server suddenly became unavailable. #21162

New Issue
Closed
opened 2026-02-21 20:11:14 -05:00 by yindo · 4 comments
yindo commented 2026-02-21 20:11:14 -05:00
Owner
Copy Link
Copy Source

Originally created by @RajanZhan on GitHub (Dec 18, 2025).

Self Checks

  • I have read the Contributing Guide and Language Policy.
  • This is only for bug report, if you would like to ask a question, please head to Discussions.
  • I have searched for existing issues search for existing issues, including closed ones.
  • I confirm that I am using English to submit this report, otherwise it will be closed.
  • 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：）
  • Please do not modify this template :) and fill in all the required fields.

Dify version

v1.9.0

Cloud or Self Hosted

Self Hosted (Docker)

Steps to reproduce

A few days ago, the server reported a security issue, which triggered related security actions.

✔️ Expected Behavior

The Dify web interface is accessible and all functions are working properly.

❌ Actual Behavior

The Dify web interface is inaccessible, related services are unavailable, and the Dify web container is reporting an error, as follows:
2025-12-19T01:57:51: PM2 log: Launching in no daemon mode
2025-12-19T01:57:51: PM2 log: [PM2] Starting /app/web/server.js in cluster_mode (2 instances)
2025-12-19T01:57:51: PM2 log: App [dify-web:0] starting in -cluster mode-
2025-12-19T01:57:51: PM2 log: App [dify-web:0] online
2025-12-19T01:57:51: PM2 log: App [dify-web:1] starting in -cluster mode-
2025-12-19T01:57:51: PM2 log: App [dify-web:1] online
2025-12-19T01:57:51: PM2 log: [PM2] Done.
2025-12-19T01:57:51: PM2 log: ┌────┬─────────────┬─────────────┬─────────┬─────────┬──────────┬────────┬──────┬───────────┬──────────┬──────────┬──────────┬──────────┐
│ id │ name │ namespace │ version │ mode │ pid │ uptime │ ↺ │ status │ cpu │ mem │ user │ watching │
├────┼─────────────┼─────────────┼─────────┼─────────┼──────────┼────────┼──────┼───────────┼──────────┼──────────┼──────────┼──────────┤
│ 0 │ dify-web │ default │ 1.9.0 │ cluster │ 23 │ 0s │ 0 │ online │ 0% │ 55.1mb │ │ disabled │
│ 1 │ dify-web │ default │ 1.9.0 │ cluster │ 30 │ 0s │ 0 │ online │ 0% │ 53.7mb │ │ disabled │
└────┴─────────────┴─────────────┴─────────┴─────────┴──────────┴────────┴──────┴───────────┴──────────┴──────────┴──────────┴──────────┘
2025-12-19T01:57:51: PM2 log: [--no-daemon] Continue to stream logs
2025-12-19T01:57:51: PM2 log: [--no-daemon] Exit on target PM2 exit pid=7
01:57:52 0|dify-web | You have triggered an unhandledRejection, you may have forgotten to catch a Promise rejection:
01:57:52 0|dify-web | TypeError: (0 , utils.getNodeDebugType) is not a function
01:57:52 0|dify-web | at Server. (/app/web/node_modules/.pnpm/next@15.5.0@babel+core@7.28.3_react-dom@19.1.1_react@19.1.1__react@19.1.1_sass@1.92.1/node_modules/next/dist/server/lib/start-server.js:278:63)
01:57:52 0|dify-web | at Server.emit (node:events:531:35)
01:57:52 0|dify-web | at Server. (/pnpm/global/5/.pnpm/@pm2+io@6.1.0/node_modules/@pm2/io/build/main/metrics/httpMetrics.js:153:37)
01:57:52 0|dify-web | at emitListeningNT (node:net:1983:10)
01:57:52 0|dify-web | at process.processTicksAndRejections (node:internal/process/task_queues:89:21)
01:57:52 1|dify-web | You have triggered an unhandledRejection, you may have forgotten to catch a Promise rejection:
01:57:52 1|dify-web | TypeError: (0 , utils.getNodeDebugType) is not a function
01:57:52 1|dify-web | at Server. (/app/web/node_modules/.pnpm/next@15.5.0@babel+core@7.28.3_react-dom@19.1.1_react@19.1.1__react@19.1.1_sass@1.92.1/node_modules/next/dist/server/lib/start-server.js:278:63)
01:57:52 1|dify-web | at Server.emit (node:events:531:35)
01:57:52 1|dify-web | at Server. (/pnpm/global/5/.pnpm/@pm2+io@6.1.0/node_modules/@pm2/io/build/main/metrics/httpMetrics.js:153:37)
01:57:52 1|dify-web | at emitListeningNT (node:net:1983:10)
01:57:52 1|dify-web | at process.processTicksAndRejections (node:internal/process/task_queues:89:21)

Originally created by @RajanZhan on GitHub (Dec 18, 2025). ### Self Checks - [x] I have read the [Contributing Guide](https://github.com/langgenius/dify/blob/main/CONTRIBUTING.md) and [Language Policy](https://github.com/langgenius/dify/issues/1542). - [x] This is only for bug report, if you would like to ask a question, please head to [Discussions](https://github.com/langgenius/dify/discussions/categories/general). - [x] I have searched for existing issues [search for existing issues](https://github.com/langgenius/dify/issues), including closed ones. - [x] I confirm that I am using English to submit this report, otherwise it will be closed. - [x] 【中文用户 & Non English User】请使用英语提交，否则会被关闭 ：） - [x] Please do not modify this template :) and fill in all the required fields. ### Dify version v1.9.0 ### Cloud or Self Hosted Self Hosted (Docker) ### Steps to reproduce A few days ago, the server reported a security issue, which triggered related security actions. ### ✔️ Expected Behavior The Dify web interface is accessible and all functions are working properly. ### ❌ Actual Behavior The Dify web interface is inaccessible, related services are unavailable, and the Dify web container is reporting an error, as follows: 2025-12-19T01:57:51: PM2 log: Launching in no daemon mode 2025-12-19T01:57:51: PM2 log: [PM2] Starting /app/web/server.js in cluster_mode (2 instances) 2025-12-19T01:57:51: PM2 log: App [dify-web:0] starting in -cluster mode- 2025-12-19T01:57:51: PM2 log: App [dify-web:0] online 2025-12-19T01:57:51: PM2 log: App [dify-web:1] starting in -cluster mode- 2025-12-19T01:57:51: PM2 log: App [dify-web:1] online 2025-12-19T01:57:51: PM2 log: [PM2] Done. 2025-12-19T01:57:51: PM2 log: ┌────┬─────────────┬─────────────┬─────────┬─────────┬──────────┬────────┬──────┬───────────┬──────────┬──────────┬──────────┬──────────┐ │ id │ name │ namespace │ version │ mode │ pid │ uptime │ ↺ │ status │ cpu │ mem │ user │ watching │ ├────┼─────────────┼─────────────┼─────────┼─────────┼──────────┼────────┼──────┼───────────┼──────────┼──────────┼──────────┼──────────┤ │ 0 │ dify-web │ default │ 1.9.0 │ cluster │ 23 │ 0s │ 0 │ online │ 0% │ 55.1mb │ │ disabled │ │ 1 │ dify-web │ default │ 1.9.0 │ cluster │ 30 │ 0s │ 0 │ online │ 0% │ 53.7mb │ │ disabled │ └────┴─────────────┴─────────────┴─────────┴─────────┴──────────┴────────┴──────┴───────────┴──────────┴──────────┴──────────┴──────────┘ 2025-12-19T01:57:51: PM2 log: [--no-daemon] Continue to stream logs 2025-12-19T01:57:51: PM2 log: [--no-daemon] Exit on target PM2 exit pid=7 01:57:52 0|dify-web | You have triggered an unhandledRejection, you may have forgotten to catch a Promise rejection: 01:57:52 0|dify-web | TypeError: (0 , _utils.getNodeDebugType) is not a function 01:57:52 0|dify-web | at Server.<anonymous> (/app/web/node_modules/.pnpm/next@15.5.0_@babel+core@7.28.3_react-dom@19.1.1_react@19.1.1__react@19.1.1_sass@1.92.1/node_modules/next/dist/server/lib/start-server.js:278:63) 01:57:52 0|dify-web | at Server.emit (node:events:531:35) 01:57:52 0|dify-web | at Server.<anonymous> (/pnpm/global/5/.pnpm/@pm2+io@6.1.0/node_modules/@pm2/io/build/main/metrics/httpMetrics.js:153:37) 01:57:52 0|dify-web | at emitListeningNT (node:net:1983:10) 01:57:52 0|dify-web | at process.processTicksAndRejections (node:internal/process/task_queues:89:21) 01:57:52 1|dify-web | You have triggered an unhandledRejection, you may have forgotten to catch a Promise rejection: 01:57:52 1|dify-web | TypeError: (0 , _utils.getNodeDebugType) is not a function 01:57:52 1|dify-web | at Server.<anonymous> (/app/web/node_modules/.pnpm/next@15.5.0_@babel+core@7.28.3_react-dom@19.1.1_react@19.1.1__react@19.1.1_sass@1.92.1/node_modules/next/dist/server/lib/start-server.js:278:63) 01:57:52 1|dify-web | at Server.emit (node:events:531:35) 01:57:52 1|dify-web | at Server.<anonymous> (/pnpm/global/5/.pnpm/@pm2+io@6.1.0/node_modules/@pm2/io/build/main/metrics/httpMetrics.js:153:37) 01:57:52 1|dify-web | at emitListeningNT (node:net:1983:10) 01:57:52 1|dify-web | at process.processTicksAndRejections (node:internal/process/task_queues:89:21)
yindo added the 🐞 bug label 2026-02-21 20:11:14 -05:00
yindo closed this issue 2026-02-21 20:11:14 -05:00
yindo commented 2026-02-21 20:11:14 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 18, 2025):

Your error is caused by a mismatch or corruption in the Next.js dependencies inside your Docker container. Dify v1.9.0 uses a vulnerable version of Next.js (≤15.5.6) that was patched in later releases due to a critical security issue (CVE-2025-66478). The error message shows Next.js 15.5.0 is running, but the project expects ~15.5.9, which means your dependencies are out of sync or corrupted, likely after the security incident and related actions.

To fix this and restore your server:

  1. Upgrade to Dify v1.10.1-fix.1 or later, which includes the patched Next.js version and addresses the security vulnerability.
  2. Remove your existing node_modules and pnpm-lock.yaml in the web directory.
  3. Rebuild your Docker image from scratch to ensure a clean environment and correct dependencies.
  4. If you suspect your container was compromised (unexpected processes running), redeploy from a clean, patched image and review your environment for unauthorized activity.

This approach is recommended by both maintainers and users for similar issues and is necessary to resolve both the startup error and the underlying security risk
details
patch PR
security disclosure.

If you build from source, also check your next.config.js for any required transpilePackages settings and rebuild after making changes.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Dec 18, 2025): <!-- Answer --> Your error is caused by a mismatch or corruption in the Next.js dependencies inside your Docker container. Dify v1.9.0 uses a vulnerable version of Next.js (≤15.5.6) that was patched in later releases due to a critical security issue (CVE-2025-66478). The error message shows Next.js 15.5.0 is running, but the project expects ~15.5.9, which means your dependencies are out of sync or corrupted, likely after the security incident and related actions. To fix this and restore your server: 1. Upgrade to Dify v1.10.1-fix.1 or later, which includes the patched Next.js version and addresses the security vulnerability. 2. Remove your existing node_modules and pnpm-lock.yaml in the web directory. 3. Rebuild your Docker image from scratch to ensure a clean environment and correct dependencies. 4. If you suspect your container was compromised (unexpected processes running), redeploy from a clean, patched image and review your environment for unauthorized activity. This approach is recommended by both maintainers and users for similar issues and is necessary to resolve both the startup error and the underlying security risk [details](https://github.com/langgenius/dify/issues/29265#issuecomment-3625150798) [patch PR](https://github.com/langgenius/dify/pull/29105) [security disclosure](https://github.com/langgenius/dify/issues/29233). If you build from source, also check your next.config.js for any required transpilePackages settings and rebuild after making changes. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=Your%20error%20is%20caused%20by%20a%20mismatch%20or%20corruption%20in%20the%20Next.js%20dependencies%20inside%20your%20Docker%20container.%20Dify%20v1.9.0%20uses%20a%20vulnerable%20version%20of%20Next.js%20%28%E2%89%A415.5.6%29%20that%20was%20patched%20in%20later%20releases%20due%20to%20a%20critical%20security%20issue%20%28CVE-2025-66478%29.%20The%20error%20message%20shows%20Next.js%2015.5.0%20is%20running%2C%20but%20the%20project%20expects%20~15.5.9%2C%20which%20means%20your%20dependencies%20are%20out%20of%20sync%20or%20corrupted%2C%20likely%20after%20the%20security%20incident%20and%20related%20actions.%0A%0ATo%20fix%20this%20and%20restore%20your%20server%3A%0A%0A1.%20Upgrade%20to%20Dify%20v1.10.1-fix.1%20or%20later%2C%20which%20includes%20the%20patched%20Next.js%20version%20and%20addresses%20the%20security%20vulnerability.%20%20%0A2.%20Remove%20your%20existing%20node_modules%20and%20pnpm-lock.yaml%20in%20the%20web%20directory.%0A3.%20Rebuild%20your%20Docker%20image%20from%20scratch%20to%20ensure%20a%20clean%20environment%20and%20correct%20dependencies.%0A4.%20If%20you%20suspect%20your%20container%20was%20compromised%20%28unexpected%20processes%20running%29%2C%20redeploy%20from%20a%20clean%2C%20patched%20image%20and%20review%20your%20environment%20for%20unauthorized%20activity.%0A%0AThis%20approach%20is%20recommended%20by%20both%20maintainers%20and%20users%20for%20similar%20issues%20and%20is%20necessary%20to%20resolve%20both%20the%20startup%20error%20and%20the%20underlying%20security%20risk%20%20%0A%5Bdetails%5D%28https%3A//github.com/langgenius/dify/issues/29265%23issuecomment-3625150798%29%20%20%0A%5Bpatch%20PR%5D%28https%3A//github.com/langgenius/dify/pull/29105%29%20%20%0A%5Bsecurity%20disclosure%5D%28https%3A//github.com/langgenius/dify/issues/29233%29.%0A%0AIf%20you%20build%20from%20source%2C%20also%20check%20your%20next.config.js%20for%20any%20required%20transpilePackages%20settings%20and%20rebuild%20after%20making%20changes.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/29911)
yindo commented 2026-02-21 20:11:14 -05:00
Author
Owner
Copy Link
Copy Source

@RajanZhan commented on GitHub (Dec 18, 2025):

Your error is caused by a mismatch or corruption in the Next.js dependencies inside your Docker container. Dify v1.9.0 uses a vulnerable version of Next.js (≤15.5.6) that was patched in later releases due to a critical security issue (CVE-2025-66478). The error message shows Next.js 15.5.0 is running, but the project expects ~15.5.9, which means your dependencies are out of sync or corrupted, likely after the security incident and related actions.

To fix this and restore your server:

  1. Upgrade to Dify v1.10.1-fix.1 or later, which includes the patched Next.js version and addresses the security vulnerability.
  2. Remove your existing node_modules and pnpm-lock.yaml in the web directory.
  3. Rebuild your Docker image from scratch to ensure a clean environment and correct dependencies.
  4. If you suspect your container was compromised (unexpected processes running), redeploy from a clean, patched image and review your environment for unauthorized activity.

This approach is recommended by both maintainers and users for similar issues and is necessary to resolve both the startup error and the underlying security risk details patch PR security disclosure.

If you build from source, also check your next.config.js for any required transpilePackages settings and rebuild after making changes.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

My current container version already contains some project data and is running in a production environment. What is the best way to upgrade with minimal cost, while preserving all current project data?

@RajanZhan commented on GitHub (Dec 18, 2025): > Your error is caused by a mismatch or corruption in the Next.js dependencies inside your Docker container. Dify v1.9.0 uses a vulnerable version of Next.js (≤15.5.6) that was patched in later releases due to a critical security issue (CVE-2025-66478). The error message shows Next.js 15.5.0 is running, but the project expects ~15.5.9, which means your dependencies are out of sync or corrupted, likely after the security incident and related actions. > > To fix this and restore your server: > > 1. Upgrade to Dify v1.10.1-fix.1 or later, which includes the patched Next.js version and addresses the security vulnerability. > 2. Remove your existing node_modules and pnpm-lock.yaml in the web directory. > 3. Rebuild your Docker image from scratch to ensure a clean environment and correct dependencies. > 4. If you suspect your container was compromised (unexpected processes running), redeploy from a clean, patched image and review your environment for unauthorized activity. > > This approach is recommended by both maintainers and users for similar issues and is necessary to resolve both the startup error and the underlying security risk [details](https://github.com/langgenius/dify/issues/29265#issuecomment-3625150798) [patch PR](https://github.com/langgenius/dify/pull/29105) [security disclosure](https://github.com/langgenius/dify/issues/29233). > > If you build from source, also check your next.config.js for any required transpilePackages settings and rebuild after making changes. > > _To reply, just mention [@dosu](https://go.dosu.dev/dosubot)._ > > How did I do? [Good](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=other) > > [![Chat with Dosu](https://camo.githubusercontent.com/7c571478962a6b8a5d47cac74b6824c75e4f6731bba52377e6007f9150462923/68747470733a2f2f646f73752e6465762f646f73752d636861742d62616467652e737667)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github) [![Open in Cursor](https://camo.githubusercontent.com/bdf7dbded65ee585887f47e5fd6fa099ea0933088b4b03d02e83b4def50154d4/68747470733a2f2f646f73752e6465762f646f73752d696e2d637572736f722e737667)](https://cursor.com/link/prompt?text=Your%20error%20is%20caused%20by%20a%20mismatch%20or%20corruption%20in%20the%20Next.js%20dependencies%20inside%20your%20Docker%20container.%20Dify%20v1.9.0%20uses%20a%20vulnerable%20version%20of%20Next.js%20%28%E2%89%A415.5.6%29%20that%20was%20patched%20in%20later%20releases%20due%20to%20a%20critical%20security%20issue%20%28CVE-2025-66478%29.%20The%20error%20message%20shows%20Next.js%2015.5.0%20is%20running%2C%20but%20the%20project%20expects%20~15.5.9%2C%20which%20means%20your%20dependencies%20are%20out%20of%20sync%20or%20corrupted%2C%20likely%20after%20the%20security%20incident%20and%20related%20actions.%0A%0ATo%20fix%20this%20and%20restore%20your%20server%3A%0A%0A1.%20Upgrade%20to%20Dify%20v1.10.1-fix.1%20or%20later%2C%20which%20includes%20the%20patched%20Next.js%20version%20and%20addresses%20the%20security%20vulnerability.%20%20%0A2.%20Remove%20your%20existing%20node_modules%20and%20pnpm-lock.yaml%20in%20the%20web%20directory.%0A3.%20Rebuild%20your%20Docker%20image%20from%20scratch%20to%20ensure%20a%20clean%20environment%20and%20correct%20dependencies.%0A4.%20If%20you%20suspect%20your%20container%20was%20compromised%20%28unexpected%20processes%20running%29%2C%20redeploy%20from%20a%20clean%2C%20patched%20image%20and%20review%20your%20environment%20for%20unauthorized%20activity.%0A%0AThis%20approach%20is%20recommended%20by%20both%20maintainers%20and%20users%20for%20similar%20issues%20and%20is%20necessary%20to%20resolve%20both%20the%20startup%20error%20and%20the%20underlying%20security%20risk%20%20%0A%5Bdetails%5D%28https%3A//github.com/langgenius/dify/issues/29265%23issuecomment-3625150798%29%20%20%0A%5Bpatch%20PR%5D%28https%3A//github.com/langgenius/dify/pull/29105%29%20%20%0A%5Bsecurity%20disclosure%5D%28https%3A//github.com/langgenius/dify/issues/29233%29.%0A%0AIf%20you%20build%20from%20source%2C%20also%20check%20your%20next.config.js%20for%20any%20required%20transpilePackages%20settings%20and%20rebuild%20after%20making%20changes.) [![Join Discord](https://camo.githubusercontent.com/7d2066700925db1e370d956834f9ea0e5bc92cecbe84963fbd2a363e45091b4e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6a6f696e2d3538363546323f6c6f676f3d646973636f7264266c6f676f436f6c6f723d7768697465266c6162656c3d)](https://go.dosu.dev/discord-bot) [![Share on X](https://camo.githubusercontent.com/a8bd7f3fcf3f5e3bd124eee9ae50ae2ac17b40971726665ac2121d48f9aee155/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f582d73686172652d626c61636b)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/29911) My current container version already contains some project data and is running in a production environment. What is the best way to upgrade with minimal cost, while preserving all current project data?
yindo commented 2026-02-21 20:11:14 -05:00
Author
Owner
Copy Link
Copy Source

@dosubot[bot] commented on GitHub (Dec 18, 2025):

To upgrade Dify in production and preserve all your project data, follow these steps:

  1. Back up everything: Save your database, all Docker volumes (like ./volumes/db/data, ./volumes/app/storage, and any vector DB volumes), your .env file, and optionally your docker-compose.yaml. This ensures you can recover if anything goes wrong.
  2. Stop all running containers: 
    docker compose down
  3. Update code and images:
    • Pull the latest code and switch to the target release (v1.10.1-fix.1 or later).
    • Pull the latest Docker images: 
      docker compose pull
    • Replace your docker-compose.yaml with the new version and migrate any customizations (ports, volumes, Nginx config, etc.) to the new file.
  4. Sync your .env file:
    Compare your .env with the new .env.example and update/add any new variables required by the new version.
  5. Start the new containers: 
    docker compose up -d
  6. Run database and plugin migrations:
    Enter the API container and run: 
    docker compose exec api uv run flask db upgrade
docker compose exec api uv run flask extract-plugins --workers=20
docker compose exec api uv run flask install-plugins --workers=2
docker compose exec api uv run flask migrate-data-for-plugin
  7. Adjust permissions (if needed):
    From v1.10.1, the API container runs as a non-root user (UID 1001). On the host, run: 
    sudo chown -R 1001:1001 ./volumes/app/storage
  8. Restart all services: 
    docker compose down
docker compose up -d
  9. Verify the upgrade:
    Log in to Dify, check plugins, tools, models, workflows, and data. Monitor logs for errors.

You can reuse your existing Docker volumes as long as they are correctly mounted and preserved during the upgrade. Double-check volume paths and permissions. There is no auto-upgrade script; the process is manual and requires the steps above. If you have customizations or use a non-standard database backend, review compatibility and transfer any changes as needed, always backing up before starting and ensuring all migration steps are run to avoid data loss or missing features. For extra safety, you can mark volumes as external in your Compose file to prevent accidental deletion during docker compose down details and references.

This process is designed to minimize downtime and maintain all your current project data while addressing the security vulnerability and dependency issues.

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other

Chat with Dosu Open in Cursor Join Discord Share on X

@dosubot[bot] commented on GitHub (Dec 18, 2025): <!-- Answer --> To upgrade Dify in production and preserve all your project data, follow these steps: 1. **Back up everything**: Save your database, all Docker volumes (like `./volumes/db/data`, `./volumes/app/storage`, and any vector DB volumes), your `.env` file, and optionally your `docker-compose.yaml`. This ensures you can recover if anything goes wrong. 2. **Stop all running containers**: ``` docker compose down ``` 3. **Update code and images**: - Pull the latest code and switch to the target release (v1.10.1-fix.1 or later). - Pull the latest Docker images: ``` docker compose pull ``` - Replace your `docker-compose.yaml` with the new version and migrate any customizations (ports, volumes, Nginx config, etc.) to the new file. 4. **Sync your `.env` file**: Compare your `.env` with the new `.env.example` and update/add any new variables required by the new version. 5. **Start the new containers**: ``` docker compose up -d ``` 6. **Run database and plugin migrations**: Enter the API container and run: ``` docker compose exec api uv run flask db upgrade docker compose exec api uv run flask extract-plugins --workers=20 docker compose exec api uv run flask install-plugins --workers=2 docker compose exec api uv run flask migrate-data-for-plugin ``` 7. **Adjust permissions** (if needed): From v1.10.1, the API container runs as a non-root user (UID 1001). On the host, run: ``` sudo chown -R 1001:1001 ./volumes/app/storage ``` 8. **Restart all services**: ``` docker compose down docker compose up -d ``` 9. **Verify the upgrade**: Log in to Dify, check plugins, tools, models, workflows, and data. Monitor logs for errors. You can reuse your existing Docker volumes as long as they are correctly mounted and preserved during the upgrade. Double-check volume paths and permissions. There is no auto-upgrade script; the process is manual and requires the steps above. If you have customizations or use a non-standard database backend, review compatibility and transfer any changes as needed, always backing up before starting and ensuring all migration steps are run to avoid data loss or missing features. For extra safety, you can mark volumes as `external` in your Compose file to prevent accidental deletion during `docker compose down` [details and references](https://github.com/langgenius/dify/discussions/29865#discussioncomment-15286877). This process is designed to minimize downtime and maintain all your current project data while addressing the security vulnerability and dependency issues. <!-- Dosu Comment Footer --> *To reply, just mention [@dosu](https://go.dosu.dev/dosubot).* --- <sup>How did I do? [Good](https://app.dosu.dev/response-feedback/639d4960-2d60-497c-9abb-27f490301cda?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/639d4960-2d60-497c-9abb-27f490301cda?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/639d4960-2d60-497c-9abb-27f490301cda?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/639d4960-2d60-497c-9abb-27f490301cda?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/639d4960-2d60-497c-9abb-27f490301cda?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/639d4960-2d60-497c-9abb-27f490301cda?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/639d4960-2d60-497c-9abb-27f490301cda?feedback_type=other)</sup> [![Chat with Dosu](https://dosu.dev/dosu-chat-badge.svg)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github)&nbsp;[![Open in Cursor](https://dosu.dev/dosu-in-cursor.svg)](https://cursor.com/link/prompt?text=To%20upgrade%20Dify%20in%20production%20and%20preserve%20all%20your%20project%20data%2C%20follow%20these%20steps%3A%0A%0A1.%20%2A%2ABack%20up%20everything%2A%2A%3A%20Save%20your%20database%2C%20all%20Docker%20volumes%20%28like%20%60./volumes/db/data%60%2C%20%60./volumes/app/storage%60%2C%20and%20any%20vector%20DB%20volumes%29%2C%20your%20%60.env%60%20file%2C%20and%20optionally%20your%20%60docker-compose.yaml%60.%20This%20ensures%20you%20can%20recover%20if%20anything%20goes%20wrong.%20%20%0A2.%20%2A%2AStop%20all%20running%20containers%2A%2A%3A%20%20%0A%20%20%20%60%60%60%0A%20%20%20docker%20compose%20down%0A%20%20%20%60%60%60%0A3.%20%2A%2AUpdate%20code%20and%20images%2A%2A%3A%20%20%0A%20%20%20-%20Pull%20the%20latest%20code%20and%20switch%20to%20the%20target%20release%20%28v1.10.1-fix.1%20or%20later%29.%0A%20%20%20-%20Pull%20the%20latest%20Docker%20images%3A%20%20%0A%20%20%20%20%20%60%60%60%0A%20%20%20%20%20docker%20compose%20pull%0A%20%20%20%20%20%60%60%60%0A%20%20%20-%20Replace%20your%20%60docker-compose.yaml%60%20with%20the%20new%20version%20and%20migrate%20any%20customizations%20%28ports%2C%20volumes%2C%20Nginx%20config%2C%20etc.%29%20to%20the%20new%20file.%0A4.%20%2A%2ASync%20your%20%60.env%60%20file%2A%2A%3A%20%20%0A%20%20%20Compare%20your%20%60.env%60%20with%20the%20new%20%60.env.example%60%20and%20update/add%20any%20new%20variables%20required%20by%20the%20new%20version.%0A5.%20%2A%2AStart%20the%20new%20containers%2A%2A%3A%20%20%0A%20%20%20%60%60%60%0A%20%20%20docker%20compose%20up%20-d%0A%20%20%20%60%60%60%0A6.%20%2A%2ARun%20database%20and%20plugin%20migrations%2A%2A%3A%20%20%0A%20%20%20Enter%20the%20API%20container%20and%20run%3A%20%20%0A%20%20%20%60%60%60%0A%20%20%20docker%20compose%20exec%20api%20uv%20run%20flask%20db%20upgrade%0A%20%20%20docker%20compose%20exec%20api%20uv%20run%20flask%20extract-plugins%20--workers%3D20%0A%20%20%20docker%20compose%20exec%20api%20uv%20run%20flask%20install-plugins%20--workers%3D2%0A%20%20%20docker%20compose%20exec%20api%20uv%20run%20flask%20migrate-data-for-plugin%0A%20%20%20%60%60%60%0A7.%20%2A%2AAdjust%20permissions%2A%2A%20%28if%20needed%29%3A%20%20%0A%20%20%20From%20v1.10.1%2C%20the%20API%20container%20runs%20as%20a%20non-root%20user%20%28UID%201001%29.%20On%20the%20host%2C%20run%3A%20%20%0A%20%20%20%60%60%60%0A%20%20%20sudo%20chown%20-R%201001%3A1001%20./volumes/app/storage%0A%20%20%20%60%60%60%0A8.%20%2A%2ARestart%20all%20services%2A%2A%3A%20%20%0A%20%20%20%60%60%60%0A%20%20%20docker%20compose%20down%0A%20%20%20docker%20compose%20up%20-d%0A%20%20%20%60%60%60%0A9.%20%2A%2AVerify%20the%20upgrade%2A%2A%3A%20%20%0A%20%20%20Log%20in%20to%20Dify%2C%20check%20plugins%2C%20tools%2C%20models%2C%20workflows%2C%20and%20data.%20Monitor%20logs%20for%20errors.%0A%0AYou%20can%20reuse%20your%20existing%20Docker%20volumes%20as%20long%20as%20they%20are%20correctly%20mounted%20and%20preserved%20during%20the%20upgrade.%20Double-check%20volume%20paths%20and%20permissions.%20There%20is%20no%20auto-upgrade%20script%3B%20the%20process%20is%20manual%20and%20requires%20the%20steps%20above.%20If%20you%20have%20customizations%20or%20use%20a%20non-standard%20database%20backend%2C%20review%20compatibility%20and%20transfer%20any%20changes%20as%20needed%2C%20always%20backing%20up%20before%20starting%20and%20ensuring%20all%20migration%20steps%20are%20run%20to%20avoid%20data%20loss%20or%20missing%20features.%20For%20extra%20safety%2C%20you%20can%20mark%20volumes%20as%20%60external%60%20in%20your%20Compose%20file%20to%20prevent%20accidental%20deletion%20during%20%60docker%20compose%20down%60%20%5Bdetails%20and%20references%5D%28https%3A//github.com/langgenius/dify/discussions/29865%23discussioncomment-15286877%29.%0A%0AThis%20process%20is%20designed%20to%20minimize%20downtime%20and%20maintain%20all%20your%20current%20project%20data%20while%20addressing%20the%20security%20vulnerability%20and%20dependency%20issues.)&nbsp;[![Join Discord](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&label=)](https://go.dosu.dev/discord-bot)&nbsp;[![Share on X](https://img.shields.io/badge/X-share-black)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/29911)
yindo commented 2026-02-21 20:11:14 -05:00
Author
Owner
Copy Link
Copy Source

@fatelei commented on GitHub (Dec 18, 2025):

Your error is caused by a mismatch or corruption in the Next.js dependencies inside your Docker container. Dify v1.9.0 uses a vulnerable version of Next.js (≤15.5.6) that was patched in later releases due to a critical security issue (CVE-2025-66478). The error message shows Next.js 15.5.0 is running, but the project expects ~15.5.9, which means your dependencies are out of sync or corrupted, likely after the security incident and related actions.
To fix this and restore your server:

  1. Upgrade to Dify v1.10.1-fix.1 or later, which includes the patched Next.js version and addresses the security vulnerability.
  2. Remove your existing node_modules and pnpm-lock.yaml in the web directory.
  3. Rebuild your Docker image from scratch to ensure a clean environment and correct dependencies.
  4. If you suspect your container was compromised (unexpected processes running), redeploy from a clean, patched image and review your environment for unauthorized activity.

This approach is recommended by both maintainers and users for similar issues and is necessary to resolve both the startup error and the underlying security risk details patch PR security disclosure.
If you build from source, also check your next.config.js for any required transpilePackages settings and rebuild after making changes.
To reply, just mention @dosu.
How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other
Chat with Dosu Open in Cursor Join Discord Share on X

My current container version already contains some project data and is running in a production environment. What is the best way to upgrade with minimal cost, while preserving all current project data?

try:

cd /path/to/dify_docker

docker compose pull web
docker compose up -d web

only update web docker

@fatelei commented on GitHub (Dec 18, 2025): > > Your error is caused by a mismatch or corruption in the Next.js dependencies inside your Docker container. Dify v1.9.0 uses a vulnerable version of Next.js (≤15.5.6) that was patched in later releases due to a critical security issue (CVE-2025-66478). The error message shows Next.js 15.5.0 is running, but the project expects ~15.5.9, which means your dependencies are out of sync or corrupted, likely after the security incident and related actions. > > To fix this and restore your server: > > > > 1. Upgrade to Dify v1.10.1-fix.1 or later, which includes the patched Next.js version and addresses the security vulnerability. > > 2. Remove your existing node_modules and pnpm-lock.yaml in the web directory. > > 3. Rebuild your Docker image from scratch to ensure a clean environment and correct dependencies. > > 4. If you suspect your container was compromised (unexpected processes running), redeploy from a clean, patched image and review your environment for unauthorized activity. > > > > This approach is recommended by both maintainers and users for similar issues and is necessary to resolve both the startup error and the underlying security risk [details](https://github.com/langgenius/dify/issues/29265#issuecomment-3625150798) [patch PR](https://github.com/langgenius/dify/pull/29105) [security disclosure](https://github.com/langgenius/dify/issues/29233). > > If you build from source, also check your next.config.js for any required transpilePackages settings and rebuild after making changes. > > _To reply, just mention [@dosu](https://go.dosu.dev/dosubot)._ > > How did I do? [Good](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=great_response) | [Irrelevant](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=irrelevant_answer) | [Incorrect](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=incorrect_sources) | [Verbose](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=hallucination) | [Report 🐛](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/06fc83f4-08b6-4d14-b047-47dc8a2da659?feedback_type=other) > > [![Chat with Dosu](https://camo.githubusercontent.com/7c571478962a6b8a5d47cac74b6824c75e4f6731bba52377e6007f9150462923/68747470733a2f2f646f73752e6465762f646f73752d636861742d62616467652e737667)](https://app.dosu.dev/6088a4f4-073a-43f3-b3d4-4f06fb0c05a0/ask?utm_source=github) [![Open in Cursor](https://camo.githubusercontent.com/bdf7dbded65ee585887f47e5fd6fa099ea0933088b4b03d02e83b4def50154d4/68747470733a2f2f646f73752e6465762f646f73752d696e2d637572736f722e737667)](https://cursor.com/link/prompt?text=Your%20error%20is%20caused%20by%20a%20mismatch%20or%20corruption%20in%20the%20Next.js%20dependencies%20inside%20your%20Docker%20container.%20Dify%20v1.9.0%20uses%20a%20vulnerable%20version%20of%20Next.js%20%28%E2%89%A415.5.6%29%20that%20was%20patched%20in%20later%20releases%20due%20to%20a%20critical%20security%20issue%20%28CVE-2025-66478%29.%20The%20error%20message%20shows%20Next.js%2015.5.0%20is%20running%2C%20but%20the%20project%20expects%20~15.5.9%2C%20which%20means%20your%20dependencies%20are%20out%20of%20sync%20or%20corrupted%2C%20likely%20after%20the%20security%20incident%20and%20related%20actions.%0A%0ATo%20fix%20this%20and%20restore%20your%20server%3A%0A%0A1.%20Upgrade%20to%20Dify%20v1.10.1-fix.1%20or%20later%2C%20which%20includes%20the%20patched%20Next.js%20version%20and%20addresses%20the%20security%20vulnerability.%20%20%0A2.%20Remove%20your%20existing%20node_modules%20and%20pnpm-lock.yaml%20in%20the%20web%20directory.%0A3.%20Rebuild%20your%20Docker%20image%20from%20scratch%20to%20ensure%20a%20clean%20environment%20and%20correct%20dependencies.%0A4.%20If%20you%20suspect%20your%20container%20was%20compromised%20%28unexpected%20processes%20running%29%2C%20redeploy%20from%20a%20clean%2C%20patched%20image%20and%20review%20your%20environment%20for%20unauthorized%20activity.%0A%0AThis%20approach%20is%20recommended%20by%20both%20maintainers%20and%20users%20for%20similar%20issues%20and%20is%20necessary%20to%20resolve%20both%20the%20startup%20error%20and%20the%20underlying%20security%20risk%20%20%0A%5Bdetails%5D%28https%3A//github.com/langgenius/dify/issues/29265%23issuecomment-3625150798%29%20%20%0A%5Bpatch%20PR%5D%28https%3A//github.com/langgenius/dify/pull/29105%29%20%20%0A%5Bsecurity%20disclosure%5D%28https%3A//github.com/langgenius/dify/issues/29233%29.%0A%0AIf%20you%20build%20from%20source%2C%20also%20check%20your%20next.config.js%20for%20any%20required%20transpilePackages%20settings%20and%20rebuild%20after%20making%20changes.) [![Join Discord](https://camo.githubusercontent.com/7d2066700925db1e370d956834f9ea0e5bc92cecbe84963fbd2a363e45091b4e/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6a6f696e2d3538363546323f6c6f676f3d646973636f7264266c6f676f436f6c6f723d7768697465266c6162656c3d)](https://go.dosu.dev/discord-bot) [![Share on X](https://camo.githubusercontent.com/a8bd7f3fcf3f5e3bd124eee9ae50ae2ac17b40971726665ac2121d48f9aee155/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f582d73686172652d626c61636b)](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/langgenius/dify/issues/29911) > > My current container version already contains some project data and is running in a production environment. What is the best way to upgrade with minimal cost, while preserving all current project data? try: cd /path/to/dify_docker docker compose pull web docker compose up -d web only update web docker
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label 🐞 bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#21162
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?