Impact Score: 5/10
Dify: v1.11.4
Source available — automated, not human-reviewed
Component: dify · Channel: stable. Automated analysis, not a compatibility certification. How this works.
Analysis updated: 2026-11-01.
⚡ Executive Summary (TL;DR)
Dify 1.11.4. Source highlight: Dify now requires Node.js 24.13.0 to pick up the upstream fix for the AsyncLocalStorage/async_hooks DoS CVE that can crash apps with deeply nested input. **All self-hosted deployments should upgrade Node.js**. Thanks to @hyoban in #30945.
Who Does This Impact? (Role-Based Analysis)
💻 Software Engineers & Devs
Check the source notes against the package and APIs you use before upgrading.
📊 Product & Engineering Leads
Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.
⚙️ DevOps & Security
Verify the target version, runtime requirements and rollback procedure in the official documentation.
🔧 Bug Fixes & Patches (6)
- **Redirect After Login**: We’ve sorted out the login redirects to bring you back to your intended destination smoothly after logging in. Shoutout to @hyoban for this fix in #30985.
- **Missing ID and Message ID**: Missing the essentials? Not anymore! We’ve patched the missing `id` and `message_id` issue, thanks to @fatelei in #31008.
- **Destructuring Undefined Properties**: Ever run into that annoying error where you can't destructure `name` from `value` because it's undefined? That’s been crushed too, all thanks to @fatelei in #30991.
- fix: redirect after login
- fix: fix missing id and message_id
- fix: fix Cannot destructure property 'name' of 'value' as it is undef…
📄 View Raw Release Notes (Original Developer Log)
## 🔒 Security
Dify now requires Node.js 24.13.0 to pick up the upstream fix for the AsyncLocalStorage/async_hooks DoS CVE that can crash apps with deeply nested input. **All self-hosted deployments should upgrade Node.js**. Thanks to @hyoban in #30945.
Related: #30935.
## 🛠️ Bug Fixes
- **Redirect After Login**: We’ve sorted out the login redirects to bring you back to your intended destination smoothly after logging in. Shoutout to @hyoban for this fix in #30985.
- **Missing ID and Message ID**: Missing the essentials? Not anymore! We’ve patched the missing `id` and `message_id` issue, thanks to @fatelei in #31008.
- **Destructuring Undefined Properties**: Ever run into that annoying error where you can't destructure `name` from `value` because it's undefined? That’s been crushed too, all thanks to @fatelei in #30991.
---
## Upgrade Guide
### Docker Compose Deployments
1. Back up your customized docker-compose YAML file (optional)
```bash
cd docker
cp docker-compose.yaml docker-compose.yaml.$(date +%s).bak
```
2. Get the latest code from the main branch
```bash
git checkout main
git pull origin main
```
3. Stop the service. Please execute in the docker directory
```bash
docker compose down
```
4. Back up data
```bash
tar -cvf volumes-$(date +%s).tgz volumes
```
5. Upgrade services
```bash
docker compose up -d
```
> [!NOTE]
>
> If you encounter errors like below
>
> ```bash
> 2025/11/26 11:37:57 /app/internal/db/pg/pg.go:30
> [error] failed to initialize database, got error failed to connect to `host=db_postgres user=postgres database=dify_plugin`: hostname resolving error (lookup db_postgres on 127.0.0.11:53: server misbehaving)
>
> 2025/11/26 11:37:57 /app/internal/db/pg/pg.go:34
> [error] failed to initialize database, got error failed to connect to `host=db_postgres user=postgres database=postgres`: hostname > resolving error (lookup db_postgres on 127.0.0.11:53: server misbehaving)
> 2025/11/26 11:37:57 init.go:99: [PANIC]failed to init dify plugin db: failed to connect to `host=db_postgres user=postgres database=postgres`: hostname resolving error (lookup db_postgres on 127.0.0.11:53: server misbehaving)
> panic: [PANIC]failed to init dify plugin db: failed to connect to `host=db_postgres user=postgres database=postgres`: hostname resolving error (lookup db_postgres on 127.0.0.11:53: server misbehaving)
> ```
> Please use the following command instead. For details, please read this https://github.com/langgenius/dify/issues/28706
> ```bash
> docker compose --profile postgresql up -d
> ```
### Source Code Deployments
1. Stop the API server, Worker, and Web frontend Server.
2. Get the latest code from the release branch:
```bash
git checkout 1.11.4
```
3. Update Python dependencies:
```bash
cd api
uv sync
```
4. Then, let's run the migration script:
```bash
uv run flask db upgrade
```
5. Finally, run the API server, Worker, and Web frontend Server again.
---
## What's Changed
- fix: redirect after login by @hyoban in https://github.com/langgenius/dify/pull/30985
- fix: fix missing id and message_id by @fatelei in https://github.com/langgenius/dify/pull/31008
- build: require node 24.13.0 by @hyoban in https://github.com/langgenius/dify/pull/30945
- chore: bump version to 1.11.4 by @laipz8200 in https://github.com/langgenius/dify/pull/30961
- fix: fix Cannot destructure property 'name' of 'value' as it is undef… by @hyoban in https://github.com/langgenius/dify/pull/30991
**Full Changelog**: https://github.com/langgenius/dify/compare/1.11.3...1.11.4