Dapr
v1.18.8Orchestration & ManagementOct 21, 2026
A maintenance release focused on correctness, observability, resource cleanup, and a security-relevant Go toolchain update. It does not introduce any newly required operator configuration.
Action needed (1)
security
Go 1.toolchain update26. 10 Dapr is built with
Go 1.. Its26. 10 crypto/x509package rejects certificate chains that pass through compromised keys.
All 5 other recorded changesfixes 5
fixes (5)
- The sidecar acknowledges a duplicate result for a completed workflow without creating a reminder.
- A call cancelled while waiting is marked as abandoned and skipped when the running turn finishes, so each actor runs one turn at a time again.
- The sidecar registers one tracer provider for the life of the process.
- The component fetches a current token every time it opens a Redis connection, so connections opened after the first token expires authenticate with a valid one.
- The sidecar closes the connection when starting the WatchHosts stream fails, so each failed attempt releases its connection before the next one.
Add Dapr to your stack
A weekly email arrives when a release needs action. Like the security patches in this release.