Dapr

v1.18.2Orchestration & Management

Jul 21, 2026Copy link

Dapr v1.18.2 is a bugfix rollup addressing workflow state management, actor concurrency, and component initialization, with two medium-severity CVE dependency bumps (go-chi and MongoDB driver) that are drop-in updates. Two breaking changes affect workflow metrics labeling and instance ID reuse error handling.

• securitygo-chi HTTP routing library CVE-2025-69725 fixed

  CVE-2025-69725 in go-chi/chi is fixed by updating the dependency from v5.2.2 to v5.2.4 in v1.18.2. This is a drop-in update with no behavior changes.

• securityMongoDB driver CVE-2026-2303 fixed

  CVE-2026-2303 in the MongoDB Go driver is fixed by pinning go.mongodb.org/mongo-driver to v1.17.7 (from v1.14.0) in components-contrib v1.18.3, which ships with v1.18.2. This applies to deployments using the MongoDB state store and is a drop-in update with no behavior changes.

• breakingWorkflow execution metric labels changed

  The dapr_runtime_workflow_execution_count metric label now correctly distinguishes terminated workflows (status=terminated) from failed ones (status=failed), rather than reporting both as failed. Queries and alerts that depend on the prior label semantics must be updated.

• breakingWorkflow instance ID reuse conflict detection enforced

  When creating a workflow instance with an ID that is already in use by a running child workflow, the request is now rejected immediately with a conflict error instead of hanging indefinitely. Applies to deployments reusing instance IDs with running child workflows.

• enhancementActor reminder and job naming validation relaxed

  Reminder names, job names, and actor identifiers may now contain any character except forward slash (/), backslash (\), hash (#), question mark (?), control characters (including NUL), and the exact path sequences . and .. This relaxes prior naming restrictions and applies when using scheduler-backed actor reminders.