# Dify 1.16.1 — Release & Upgrade Intelligence
- **Product:** Dify (https://dify.ai)
- **Version:** 1.16.1
- **Released:** Jul 28, 2026
- **Impact Score:** 5/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/dify/updates/1.16.1/

## Executive Summary (TL;DR)
Dify 1.16.1. Source highlight: **Tool Multi-Select Input**

## New Features
- Workflow tool nodes now support multi-select dropdown inputs, allowing users to choose multiple values from a predefined list when configuring tool parameters. (#39346)
- You can now click a node_id in workflow run logs or error messages to locate and highlight the corresponding node in the workflow editor canvas. (#38187)
- The block selector panel now features improved keyboard navigation, category previews, and a more intuitive search experience when adding nodes to workflows. (#39212)
- Agent apps can now be exported as DSL YAML directly from the app sidebar menu, making it easy to back up or version-control agent configurations. (#39299)
- Added more observability traces to knowledge/RAG document processing operations, improving visibility into indexing pipelines. (#38959)
- **Agent sandbox network isolation**: `local_sandbox` is moved off the `default` network to dedicated `agent_sandbox_network` + `local_sandbox_proxy_network`. A new `agent_ssrf_proxy` service (Squid) is added.

## Improvements
- The Agent local sandbox now runs behind a dedicated Squid forward proxy with strict ACL rules, preventing the sandbox from reaching internal services directly. Only the `/files/` endpoint on the API and `/agent-stub/` on agent_backend are permitted, both protected with short-lived access tokens. This significantly reduces the blast radius of arbitrary code execution in the agent sandbox. (#39544)
- Communication between the Dify API and the agent backend now uses token-based authentication via `DIFY_AGENT_API_TOKEN` / `AGENT_BACKEND_API_TOKEN`, hardening the internal service boundary. (#39622)
- Switched Jinja2 template rendering to use `SandboxedEnvironment`, preventing template injection attacks in workflow code nodes (#39609)
- Used `re.fullmatch` in email validator to reject trailing newlines, preventing bypass attacks (#39320)
- Validated account status before accepting workspace invitations (#39438)
- **Lightweight recent apps endpoint** — New `GET /console/api/apps/recent` endpoint reduces the home page "Continue Work" section latency by ~69% (3.2× faster), cutting SQL queries from 19+ to 1 projection SELECT and response size by ~50% (#39625)

## Bug Fixes
- Fixed hidden-tab collaboration leader saving stale drafts when the tab is inactive (#38997)
- Fixed unsaved edits being dropped when collaboration never connects (#39579)
- Preserved latest collaboration session after reconnection (#39646)
- Fixed false draft save error during Strict Mode initialization (#39353)
- Show persistent error notification when workflow draft save fails (#39293)
- Wait for workflow worker threads to finish before Celery tasks complete, preventing orphaned executions (#39614)