Dapr
v1.17.17Orchestration & ManagementOct 21, 2026
A security and correctness maintenance release refreshes expired Entra ID credentials for Redis connections. It also updates Go so `crypto/x509` rejects certificate chains that pass through compromised keys.
Action needed (1)
security
Go 1.certificate-chain validation26. 10 Dapr is built with
Go 1., whose26. 10 crypto/x509package rejects certificate chains that pass through compromised keys.
All 1 other recorded changesfixes 1
fixes (1)
- The component fetches a current token every time it opens a Redis connection, so connections opened after the first token expires authenticate with a valid one.
Add Dapr to your stack
A weekly email arrives when a release needs action. Like the security patches in this release.