Dify

> [!WARNING] > Self-hosted deployments using the bundled Weaviate must complete a manual, staged upgrade before starting 1.17.1. The bundled Weaviate server moves from 1.27.0 to 1.39.2 — 12 minor versions — and skipping minors is unsupported. Pulling and restarting can silently and permanently break vector search. See Upgrade Guide below. Fresh deployments, external Weaviate, and other vector stores are unaffected.

New Features

Dataset-Scoped Knowledge Base API Keys

• Knowledge base service-API keys were scoped to the whole workspace: one key could read and write every knowledge base in the tenant, so giving an integration access to a single knowledge base meant giving it access to all of them. Keys can now be bound to specific knowledge bases from the knowledge base's API access panel, with a workspace / this-knowledge-base scope selector at creation time. A bound key returns 403 for any other dataset — both documents and retrieval — and for endpoints that carry no dataset ID, such as list-all. Existing keys are unbound and keep their workspace-wide behavior, so nothing changes when you upgrade. (#37569)

Keyboard Movement for Workflow Nodes and Comments

• The workflow canvas required a mouse to reposition anything. Nodes, multi-node selections, comment markers, and draft comments can now be moved with the arrow keys — hold Shift for larger steps — including Note, Iteration, and Loop nodes. Continuous movement is committed on key release or blur, so it produces one undo entry rather than one per keypress, and read-only mode, container boundaries, and collaboration updates are all still respected. (#41967)

Marketplace Creator Profiles and Homepage Redesign

• Plugin authors now have public profile pages at /marketplace/creator/, listing their creations with a publisher sidebar, reachable from a new Creator Center entry in the sidebar help menu. The marketplace homepage was rebuilt around a hero, a banner carousel, sticky search, catalog tabs, and tag/language filters, with a stacked-and-swipeable mobile layout. Bundles are no longer mixed into plugin categories. (#41538)

Configurable Markdown Form Field Name Length

• The Markdown form field-name limit was hard-coded at 128 characters, with no way to accommodate longer generated field names. It is now configurable through MARKDOWN_FORM_FIELD_NAME_MAX_LENGTH (Docker) or NEXT_PUBLIC_MARKDOWN_FORM_FIELD_NAME_MAX_LENGTH (direct Web deployments), defaulting to the previous 128. Character validation and prototype-pollution protections are unchanged. (#41697)

---

Bug Fixes

Knowledge Base

This release fixes a cluster of extraction bugs that changed document content without reporting an error. Re-import affected documents after upgrading; indexed text is not retroactively repaired.

• CSV cells were passed through pandas type inference before indexing. Leading-zero codes became floats (00123 → 123.0), empty cells became the literal string nan, and cells containing NA or NULL became missing values. The extractor now reads everything as text and disables missing-value inference; an explicit csv_args still overrides this for callers that want typed parsing. (#41922)
• Notion table rows lost or gained columns. Each rich-text segment inside a cell was emitted as its own Markdown column, so any cell with mixed formatting — bold, links, mentions — produced extra columns and corrupted the table, while an empty cell was skipped entirely and shifted the rest of the row left. Cells are now emitted one-per-column with their segments concatenated. (#41993)
• Notion database properties were truncated at the first formatting change. rich_text and title properties read only their first segment, so a title of Hello world with world in bold was indexed as just Hello . All segments are now joined. (#42050)
• `.xls` cells containing double quotes corrupted the row. The extractor