Skip to content

chore: upstream/mainからの変更を取り込み (Dify 1.9.1)#15

Merged
shogo-sonoda merged 10 commits intodevfrom
update-code
Oct 24, 2025
Merged

chore: upstream/mainからの変更を取り込み (Dify 1.9.1)#15
shogo-sonoda merged 10 commits intodevfrom
update-code

Conversation

@shogo-sonoda
Copy link
Copy Markdown

No description provided.

tmokmss and others added 10 commits August 8, 2025 11:30
*Issue #, if available:*
n/a

*Description of changes:*

Upgrade Dify to 1.7.1.

For some reason, Celery stopped working after update due to the below
error:

> 2025-08-08 01:24:13,366.366 CRITICAL [MainThread] [worker.py:207] -
Unrecoverable error: ValueError('\nA rediss:// URL must have parameter
ssl_cert_reqs and this must be set to CERT_REQUIRED, CERT_OPTIONAL, or
CERT_NONE\n')

I found that Celery result backend is switched from Postgres to Redis:

```
In 1.4.3:
---------- .> transport: rediss://:**@master.redacted.apne1.cache.amazonaws.com:6379/1
---------- .> results: postgresql://postgres:**@difyonawsstack-redacted.cluster-cdxwnm5dehdj.ap-northeast-1.rds.amazonaws.com:5432/main

In 1.7.1
---------- .> transport: rediss://:**@master.redacted.apne1.cache.amazonaws.com:6379/1
---------- .> results: rediss://:**@master.redacted.apne1.cache.amazonaws.com:6379/1
```

But could not found any relevant upstream changes:


https://github.com/langgenius/dify/blob/084dcd1a504796043308f5fa4077f26d9e61e948/api/extensions/ext_celery.py#L44-L46

https://github.com/langgenius/dify/blob/084dcd1a504796043308f5fa4077f26d9e61e948/api/configs/middleware/__init__.py#L250-L257

Celery does not have changed the relevant logic either:

https://github.com/celery/celery/blob/6dcecbe52da8717c015203f5e0f6b8d684b6ccc9/celery/backends/redis.py#L267-L286

At least, adding ssl_cert_reqs parameter resolved the issue and it seems
it is working without problem. We'll monitor if this breaks anything.

By submitting this pull request, I confirm that you can use, modify,
copy, and redistribute this contribution, under the terms of your
choice.
Potential fix for
[https://github.com/aws-samples/dify-self-hosted-on-aws/security/code-scanning/2](https://github.com/aws-samples/dify-self-hosted-on-aws/security/code-scanning/2)

To fix the problem, explicitly set the `permissions` block in the
workflow to restrict the `GITHUB_TOKEN` to the minimum required
privileges. Since the workflow only checks out code and runs build/test
commands, it only needs read access to repository contents. The best way
to do this is to add `permissions: contents: read` at the top level of
the workflow (just after the `name` key and before `on:`), so it applies
to all jobs. No changes to the jobs or steps are required.

---


_Suggested fixes powered by Copilot Autofix. Review carefully before
merging._

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Potential fix for
[https://github.com/aws-samples/dify-self-hosted-on-aws/security/code-scanning/1](https://github.com/aws-samples/dify-self-hosted-on-aws/security/code-scanning/1)

To fix the problem, we should add a `permissions` block to the workflow
or to the specific job that requires it. Since only the `update` job is
present, and it performs a commit to the repository, it needs `contents:
write` permission. The best way to fix this is to add a `permissions`
block under the `update` job, specifying only the permissions required
(`contents: write`). This change should be made in
`.github/workflows/update_snaphost.yml`, immediately under the `runs-on:
ubuntu-latest` line (line 11), before the `steps` block. No additional
imports or definitions are needed.


_Suggested fixes powered by Copilot Autofix. Review carefully before
merging._

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Bumps and
[brace-expansion](https://github.com/juliangruber/brace-expansion).
These dependencies needed to be updated together.
Updates `brace-expansion` from 1.1.11 to 1.1.11
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/juliangruber/brace-expansion/compare/1.1.11...1.1.11">compare
view</a></li>
</ul>
</details>
<br />

Updates `brace-expansion` from 2.0.1 to 2.0.2
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/juliangruber/brace-expansion/compare/1.1.11...1.1.11">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/aws-samples/dify-self-hosted-on-aws/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…samples#89) (aws-samples#90)

*Issue aws-samples#89 

*Description of changes: Add `bedrock:GetInferenceProfile` Policy to API
service role


By submitting this pull request, I confirm that you can use, modify,
copy, and redistribute this contribution, under the terms of your
choice.
Updated links and descriptions for deployment resources in Japanese.
@github-actions
Copy link
Copy Markdown

📋 CDK Diff Results

Click to expand diff results
[Warning at /DifyOnAwsStack] You are exposing ALB to the Internet without TLS encryption. It is recommended to set useCloudFront: true or domainName property. [ack: Dify:albWithoutEncryption]
start: Building DifyOnAwsUsEast1Stack Template
success: Built DifyOnAwsUsEast1Stack Template
start: Publishing DifyOnAwsUsEast1Stack Template (058264089195-us-east-1)
success: Published DifyOnAwsUsEast1Stack Template (058264089195-us-east-1)
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)

Stack DifyOnAwsUsEast1Stack
There were no differences

start: Building DifyOnAwsStack Template
success: Built DifyOnAwsStack Template
start: Publishing DifyOnAwsStack Template (058264089195-us-west-2)
success: Published DifyOnAwsStack Template (058264089195-us-west-2)
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)

Stack DifyOnAwsStack
IAM Statement Changes
┌───┬──────────┬────────┬───────────────────────────────────────┬─────────────────────────────────┬───────────┐
│   │ Resource │ Effect │ Action                                │ Principal                       │ Condition │
├───┼──────────┼────────┼───────────────────────────────────────┼─────────────────────────────────┼───────────┤
│ + │ *        │ Allow  │ bedrock:GetInferenceProfile           │ AWS:${ApiService/Task/TaskRole} │           │
│   │          │        │ bedrock:InvokeModel                   │                                 │           │
│   │          │        │ bedrock:InvokeModelWithResponseStream │                                 │           │
│   │          │        │ bedrock:ListFoundationModels          │                                 │           │
│   │          │        │ bedrock:Rerank                        │                                 │           │
│   │          │        │ bedrock:Retrieve                      │                                 │           │
│   │          │        │ bedrock:RetrieveAndGenerate           │                                 │           │
│   │          │        │ logs:CreateLogStream                  │                                 │           │
│   │          │        │ logs:DescribeLogGroups                │                                 │           │
│   │          │        │ logs:DescribeLogStreams               │                                 │           │
│   │          │        │ logs:PutLogEvents                     │                                 │           │
│   │          │        │ ssmmessages:CreateControlChannel      │                                 │           │
│   │          │        │ ssmmessages:CreateDataChannel         │                                 │           │
│   │          │        │ ssmmessages:OpenControlChannel        │                                 │           │
│   │          │        │ ssmmessages:OpenDataChannel           │                                 │           │
│ - │ *        │ Allow  │ bedrock:InvokeModel                   │ AWS:${ApiService/Task/TaskRole} │           │
│   │          │        │ bedrock:InvokeModelWithResponseStream │                                 │           │
│   │          │        │ bedrock:ListFoundationModels          │                                 │           │
│   │          │        │ bedrock:Rerank                        │                                 │           │
│   │          │        │ bedrock:Retrieve                      │                                 │           │
│   │          │        │ bedrock:RetrieveAndGenerate           │                                 │           │
│   │          │        │ logs:CreateLogStream                  │                                 │           │
│   │          │        │ logs:DescribeLogGroups                │                                 │           │
│   │          │        │ logs:DescribeLogStreams               │                                 │           │
│   │          │        │ logs:PutLogEvents                     │                                 │           │
│   │          │        │ ssmmessages:CreateControlChannel      │                                 │           │
│   │          │        │ ssmmessages:CreateDataChannel         │                                 │           │
│   │          │        │ ssmmessages:OpenControlChannel        │                                 │           │
│   │          │        │ ssmmessages:OpenDataChannel           │                                 │           │
└───┴──────────┴────────┴───────────────────────────────────────┴─────────────────────────────────┴───────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)

Resources
[~] AWS::SSM::Parameter Redis/BrokerUrl RedisBrokerUrlA8582E06
 └─ [~] Value
     └─ [~] .Fn::Join:
         └─ @@ -12,6 +12,6 @@
            [ ]         "PrimaryEndPoint.Address"
            [ ]       ]
            [ ]     },
            [-]     ":6379/1"
            [+]     ":6379/1?ssl_cert_reqs=optional"
            [ ]   ]
            [ ] ]
[~] AWS::IAM::Policy ApiService/Task/TaskRole/DefaultPolicy ApiServiceTaskTaskRoleDefaultPolicy982AD2DC
 └─ [~] PolicyDocument
     └─ [~] .Statement:
         └─ @@ -38,6 +38,7 @@
            [ ] },
            [ ] {
            [ ]   "Action": [
            [+]     "bedrock:GetInferenceProfile",
            [ ]     "bedrock:InvokeModel",
            [ ]     "bedrock:InvokeModelWithResponseStream",
            [ ]     "bedrock:ListFoundationModels",
[~] AWS::ECS::TaskDefinition ApiService/Task ApiServiceTask878B1807 may be replaced
 └─ [~] ContainerDefinitions (may cause replacement)
     └─ @@ -194,7 +194,7 @@
        [ ]   "StartPeriod": 90,
        [ ]   "Timeout": 5
        [ ] },
        [-] "Image": "langgenius/dify-api:1.4.3",
        [+] "Image": "langgenius/dify-api:1.9.1",
        [ ] "LogConfiguration": {
        [ ]   "LogDriver": "awslogs",
        [ ]   "Options": {
        @@ -522,7 +522,7 @@
        [ ]   }
        [ ] ],
        [ ] "Essential": true,
        [-] "Image": "langgenius/dify-api:1.4.3",
        [+] "Image": "langgenius/dify-api:1.9.1",
        [ ] "LogConfiguration": {
        [ ]   "LogDriver": "awslogs",
        [ ]   "Options": {
        @@ -878,7 +878,7 @@
        [ ]   }
        [ ] ],
        [ ] "Essential": true,
        [-] "Image": "langgenius/dify-plugin-daemon:0.1.2-local",
        [+] "Image": "langgenius/dify-plugin-daemon:0.3.1-local",
        [ ] "LogConfiguration": {
        [ ]   "LogDriver": "awslogs",
        [ ]   "Options": {
[~] AWS::ECS::TaskDefinition WebService/Task WebServiceTaskF9926E9D may be replaced
 └─ [~] ContainerDefinitions (may cause replacement)
     └─ @@ -71,7 +71,7 @@
        [ ]   "StartPeriod": 30,
        [ ]   "Timeout": 5
        [ ] },
        [-] "Image": "langgenius/dify-web:1.4.3",
        [+] "Image": "langgenius/dify-web:1.9.1",
        [ ] "LogConfiguration": {
        [ ]   "LogDriver": "awslogs",
        [ ]   "Options": {

Outputs
[-] Output ConsoleListTasksCommand: {"Value":{"Fn::Join":["",["aws ecs list-tasks --region us-west-2 --cluster ",{"Ref":"ClusterEB0386A7"}," --service-name ",{"Fn::GetAtt":["ApiServiceFargateServiceE4EA9E4E","Name"]}," --desired-status RUNNING"]]}}
[~] Output ConsoleConnectToTaskCommand ConsoleConnectToTaskCommand: {"Value":{"Fn::Join":["",["aws ecs execute-command --region us-west-2 --cluster ",{"Ref":"ClusterEB0386A7"}," --container Main --interactive --command \"bash\" --task TASK_ID"]]}} to {"Value":{"Fn::Join":["",["aws ecs execute-command --region us-west-2 --cluster ",{"Ref":"ClusterEB0386A7"}," --container Main --interactive --command \"bash\" --task $(aws ecs list-tasks --region us-west-2 --cluster ",{"Ref":"ClusterEB0386A7"}," --service-name ",{"Fn::GetAtt":["ApiServiceFargateServiceE4EA9E4E","Name"]}," --desired-status RUNNING --query 'taskArns[0]' --output text)"]]}}



✨  Number of stacks with differences: 1


⚠️ Please review the changes above before merging.

@shogo-sonoda shogo-sonoda merged commit adf05d9 into dev Oct 24, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants