langgenius/dify
Build Agentic workflows, RAG pipelines, with rich AI model and tool support on one collaborative workspace. Deploy on cloud, VPC, or self-hosted, so teams move from prototype to production without rebuilding the stack.
How dify is put together
Dify is an open-source LLM application development platform structured as a multi-language monorepo. The backend is a Python 3.12 Flask API (api/) using Celery for async tasks, SQLAlchemy/PostgreSQL for persistence, and Redis for caching/queues, exposing console, service (v1), webapp, MCP, and trigger HTTP surfaces; it integrates a large pluggable set of vector databases and LLM tracing backends via uv workspace plugins. The frontend is a Next.js/React web app (web/) managed with pnpm and Vite tooling. Additional components include a TypeScript CLI (difyctl), a Go-based agent sandbox runtime (dify-agent-runtime), and a Python agent library (dify-agent). Data flows from the web/CLI clients through the Flask controllers into services, model providers, vector stores, and async Celery workers.
Languages
Frameworks
Datastores
Infrastructure
Major components
api (Flask backend)
Core Python backend serving console, service (v1), webapp, MCP, and trigger HTTP APIs plus the application factory and extensions.
web (Next.js frontend)
React/Next.js single-page web UI for building and operating LLM apps, linted via Vite/oxlint/eslint tooling.
cli (difyctl)
TypeScript command-line client that talks to the Dify API over the /openapi/v1 contract using oRPC.
dify-agent-runtime
Go sandbox runtime using landlock and SQLite to execute agent code in an isolated environment.
dify-agent
Python agent library and stub server built on pydantic-ai for agent orchestration.
VDB provider plugins
uv workspace plugins under providers/vdb/* each registering a vector-store backend via dify.vector_backends entry points.
Trace provider plugins
uv workspace plugins under providers/trace/* integrating LLM observability backends (Langfuse, Langsmith, Opik, etc.).
Celery async workers
Background task processing (indexing, retention, data migration) using Celery with gevent workers.
Shipped the 1.17.0 release with new agent skill controls, credit-usage tracking, and a wave of UI and permission fixes.
3 weeksWeek of 2026-08-24
Week of 2026-08-24latest
Shipped the 1.17.0 release with new agent skill controls, credit-usage tracking, and a wave of UI and permission fixes.
Week of 2026-08-17
A busy 171-commit week centered on a UI component library refactor, new unified tracing, and continued endpoint permission hardening.
Week of 2026-08-10
Focused on security hardening of API endpoints, safer error handling, and continued migration of tests to real database models.
Over the past three weeks, Dify has been in a heavy hardening and polish phase, culminating in the 1.17.0 release. The dominant themes are a large security push (locking down API endpoints with proper permission checks), a sweeping test-infrastructure overhaul (moving tests onto real database models), and continued build-out of the new Agent v2 experience and its skills system. Recent work shifted toward user-facing refinement — UI fixes, performance tuning, and unified tracing.
Week by week
2026-08-24Shipped the 1.17.0 release with new agent skill controls, credit-usage tracking, and a wave of UI and permission fixes.latest6 changes
Chore
Released version 1.17.0
Cut the official 1.17.0 version bump, packaging the recent round of features and fixes.
Feature
Credit usage tracking
Added the ability to track how AI credits are consumed across different contexts.
Feature
Agent skill enable switch
Introduced a feature toggle so skills can be turned on or off, alongside hiding the add-library-skill option in the agent UI.
Fix
Locked down MCP server refresh endpoint
Enforced proper edit-permission checks so only authorized users can refresh an MCP server.
Refactor
Smarter agent polling
Tuned polling intervals and added exponential backoff to prevent a storm of repeated agent requests.
Fix
Read-only protection in build mode
Prevented agent resources from being edited while in build mode, showing a not-allowed cursor in the prompt editor.
2026-08-17A busy 171-commit week centered on a UI component library refactor, new unified tracing, and continued endpoint permission hardening.6 changes
Feature
Provider-neutral unified tracing
Added a single tracing system that works across different observability providers instead of being tied to one.
Feature
Enterprise Home Snapshot
Shipped new runtime endpoints and an agent adapter for an enterprise home-screen snapshot feature.
Fix
Enforced permissions on model and data-source endpoints
Added admin and role-based access checks to several previously under-protected settings endpoints.
Refactor
Streamlined the UI component library
Simplified dialogs, popovers, sliders, and other shared UI building blocks for more consistent behavior.
Chore
Migrated many test suites to real database models
Moved numerous test areas onto SQLite with real ORM models for more realistic, reliable testing.
Fix
Prevented dropped workflow events
Fixed an issue where workflow-started events could be lost, improving reliability of workflow tracking.
2026-08-10Focused on security hardening of API endpoints, safer error handling, and continued migration of tests to real database models.6 changes
Fix
Protected sensitive API operations
Added access checks to workspace credentials, agent sandbox reads, OAuth client deletion, and RAG draft variables.
Feature
Silent OAuth authorization option
Enabled apps to auto-authorize trusted OAuth flows without prompting the user each time.
Feature
Agent run limits
Expanded and enforced limits on how many times an agent can run, with clearer error messaging.
Fix
Safer error handling
Replaced overly broad exception catching with targeted handling and preserved original error traces.
Fix
Audio and file handling fixes
Added support for m4a audio in speech recognition and preserved file preview content types.
Chore
Continued database-backed test migration
Moved more controller, RAG, and identity test suites onto real ORM models.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required