RATATOSKRATATOSK
Sign in

Dapr

v1.19.0Orchestration & Management
Oct 22, 2026

ACTION 1CHECK 15OTHER 83

A feature-rich, behavior-changing release adds workflow, storage, messaging, observability, and scheduler-based placement capabilities, alongside performance and correctness improvements. Operators should account for changed defaults, upgrade and rollback compatibility, deployment constraints, and security-related behavior changes.

Action needed (1)

  • breakingMetrics server HTTP method handling

    The metrics server now responds to POST, PUT, PATCH, and DELETE requests with 405 and Allow: GET, HEAD.

Check if affected (15)

  • breakingSidecar version requirement before activation

    Applies if you turn it on before every sidecar runs 1.19 or later.

    Activation now requires every sidecar to run version 1.19 or later.

  • breakingHelm chart scheduler and actor settings

    Applies if global.scheduler.enabled, global.actors.enabled, and global.actors.serviceName are set.

    The chart requires global.scheduler.enabled, global.actors.enabled, and global.actors.serviceName=placement to be set before it renders.

  • breakingCustom RBAC before upgrade

    Applies if you use custom RBAC.

    Custom RBAC must be added before upgrading to 1.19.

  • breakingScheduler placement upgrade sequence

    Applies if you upgrade the control plane before every sidecar runs 1.19 or later or do not restart your applications afterward.

    The global.scheduler.placement.enabled setting requires sidecars to be upgraded to 1.19 or later before the control plane, followed by application restarts.

  • breakingSentry rollback target

    Applies if you roll back from 1.19 directly to 1.17.6 or earlier.

    Rollback from 1.19 directly to 1.17.6 or earlier is unsupported; 1.18.x is the stated safe rollback target.

  • breakingWorkflowAccessPolicy downgrade compatibility

    Applies if you use requires with WorkflowAccessPolicy.

    Downgrades must account for requires rules in WorkflowAccessPolicy, because a 1.18 control plane and sidecar do not recognize that field and apply the rules without the gate.

  • breakingWorkflowAccessPolicy requires field handling

    Applies if the 1.19 WorkflowAccessPolicy CRD is not applied and you use requires.

    Until the 1.19 WorkflowAccessPolicy CRD is applied, the API server drops the requires field and applies rules containing it without that gate.

    requires

  • breakingScheduler pod RBAC

    Applies if you deploy the Scheduler.

    The chart adds a dapr-scheduler-pods Role and RoleBinding in the Dapr namespace, granting the Scheduler get, list, and watch access to pods.

  • breakingReduced etcd compaction retention default

    Applies if you do not set either --etcd-compaction-retention or dapr_scheduler.etcdCompactionRetention.

    The default retention changes from 1000000 to 10000 for both --etcd-compaction-retention and dapr_scheduler.etcdCompactionRetention.

  • breakingActor timer ownership check

    Applies if you use a timer operation on a sidecar that does not own the actor.

    A timer operation now fails when sent to a sidecar that does not own the actor.

    timer operation

  • breakingAMQP TLS setting validation

    Applies if you set caCert, clientCert, or clientKey on a plain amqp:// URL.

    The component rejects caCert, clientCert, and clientKey TLS settings when they are used with a plain amqp:// URL during initialization.

  • breakingService invocation method validation

    Applies if you use a service invocation method containing %2F, %5C, %2E, or a literal \.

    Service invocation methods containing %2F, %5C, %2E in any letter case, or a literal \, now fail before the access control check.

  • breakingInternal actor type rejection

    Applies if you invoke actors through gRPC InvokeActor or HTTP /v1.0/actors/{type}/{id}/method/{method} using dapr.internal.* actor types.

    gRPC InvokeActor and HTTP /v1.0/actors/{type}/{id}/method/{method} now reject all dapr.internal.* actor types.

  • breakingGetConfiguration annotation scope

    Applies if you use GetConfiguration with a dapr.io/config annotation on one of the calling app's pods.

    GetConfiguration now returns only the configuration named in the dapr.io/config annotation on one of the calling app's pods. Without that matching annotation, it returns PermissionDenied.

  • breakingTimezone validation for @every schedules

    Applies if you use an @every schedule with a timezone.

    Schedules such as CRON_TZ=Europe/Rome @every 1h now fail at parse time with timezone is not supported for @every schedules.

    schedule

All 83 other recorded changessecurity fixes 1 · additions 45 · value changes 22 · fixes 9 · defaults 3 · constraints 2 · removals 1

security fixes (1)

  • Five security fixes. Four of them, for service invocation, the Scheduler and workflows, also shipped in 1.18.6. The fifth makes the Operator enforce app scopes and configuration assignment, and it also shipped in 1.18.9 and 1.17.18. Four of the five change behavior.

additions (45)

  • the workflow block of the metrics settings in Configuration now takes its own latencyDistributionBuckets, with a latencyDistributionUnits such as 1s.
  • The repository also ships Grafana dashboards for workflows and for the Scheduler in [grafana/]
  • A [worker](https://v1-19.docs.dapr.io/developing-applications/building-blocks/workflow/workflow-stateful-client/) can now advertise the WORKER_CAPABILITY_STATEFUL_HISTORY capability on its work-item stream.
  • the sidecar now sends a health ping every 30 seconds to a worker that advertises the WORKER_CAPABILITY_HEALTH_PING capability
  • The new [WorkflowsFastPath](https://v1-19.docs.dapr.io/developing-applications/building-blocks/workflow/workflow-fast-path/) [preview feature](https://v1-19.docs.dapr.io/operations/support/support-preview-features/) is off by default.
  • A workflow client can now run its operations on a workflow that [another app in the same namespace](https://v1-19.docs.dapr.io/developing-applications/building-blocks/workflow/workflow-multi-app/) owns
  • The workflow request protos have a new optional app_id field, and the HTTP endpoints accept an appID query parameter.
  • A [WorkflowAccessPolicy](https://v1-19.docs.dapr.io/operations/security/workflow-access-policy/) rule can now have a requires block.
  • A workflow can now start a [detached workflow](https://v1-19.docs.dapr.io/developing-applications/building-blocks/workflow/workflow-detached/).
  • With this feature on, the [Scheduler](https://v1-19.docs.dapr.io/concepts/dapr-services/scheduler/) places actors itself
  • set this Helm value
  • dapr_scheduler_placement_leader and dapr_scheduler_placement_streams_connected show the leader and the connected sidecars, and dapr_scheduler_placement_incapable_sidecars counts sidecars older than 1.19.
  • New flags: daprd --actors-placement-startup-timeout
  • use [dapr init --scheduler-placement](https://v1-19.docs.dapr.io/reference/cli/dapr-init/)
  • A new [building block](https://v1-19.docs.dapr.io/developing-applications/building-blocks/binarystore/) stores files through one API
  • HTTP: /v1.0-alpha1/binarystore/{name}/{fileName}.
  • gRPC: SetBinaryFileAlpha1 streams a file in, GetBinaryFileAlpha1 streams it out, and DeleteBinaryFileAlpha1 deletes it.
  • SDK support in 1.19: .NET (via Dapr.BinaryStore) and JavaScript (@dapr/dapr).
  • A new [building block](https://v1-19.docs.dapr.io/developing-applications/building-blocks/search/) lets an application store, retrieve and query documents
  • Components: search.meilisearch, and search.in-memory for tests.
  • SDK support in 1.19: .NET (via [Dapr.Search](https://www.nuget.org/packages/Dapr.Search)) and JavaScript (@dapr/dapr).
  • A new [building block](https://v1-19.docs.dapr.io/developing-applications/building-blocks/vector/) provides a means to store, retrieve and run similarity queries
  • Components: vector.meilisearch, and vector.in-memory for tests.
  • SDK support in 1.19: .NET (via [Dapr.Vector](https://www.nuget.org/packages/Dapr.Vector)) and JavaScript (@dapr/dapr).
  • gRPC: [ListActorTimers and GetActorTimer](https://v1-19.docs.dapr.io/reference/api/actors_api/).
  • HTTP: GET /v1.0/actors/{actorType}/{actorId}/timers and GET /v1.0/actors/{actorType}/{actorId}/timers/{name}.
  • HTTP: GET /v1.0/actors/{actorType}/{actorId}/reminders, to match the gRPC ListActorReminders API.
  • daprd now sends a Dapr-Actor-Activation-Id header
  • producerTransactionsEnabled: every publish, single or bulk, runs in a Kafka transaction
  • consumerIsolationLevel: "read_committed": a subscription reads only committed records.
  • consumerTransactionsEnabled: each delivery runs inside a transaction
  • Two new metadata options, [exchangeDeclareMode and queueDeclareMode]
  • The [AMQP 1.0 component](https://v1-19.docs.dapr.io/reference/components-reference/supported-pubsub/setup-amqp/) now also registers as pubsub.amqp.
  • Subscriptions can set subscriptionName, durable, shared and selector
  • New component settings: containerID, durableMessages and applicationPropertiesFromMetadata.
  • A [Conversation API](https://v1-19.docs.dapr.io/reference/api/conversation_api/) request can now cap how many tokens a call generates. Set max_tokens on the request, or maxTokens in the component metadata as a default.
  • Set useResponsesAPI: "true" in the [OpenAI component](https://v1-19.docs.dapr.io/reference/components-reference/supported-conversation/openai/) metadata
  • --log-outputs: a comma-separated list of log destinations (stdout, stderr, or a file path).
  • --log-file-max-size, --log-file-max-backups, --log-file-max-age and --log-file-compression: rotation for file destinations.
  • --log-timestamp-format: a Go time layout for the log timestamp.
  • Dapr 1.19 updates two CRDs: Configuration (new workflow latency-bucket fields in the metrics settings) and WorkflowAccessPolicy (the new [requires](https://v1-19.docs.dapr.io/operations/security/workflow-access-policy/) field).
  • The opt-in Helm value global.scheduler.placement.enabled (default false) makes the [Scheduler service](https://v1-19.docs.dapr.io/concepts/dapr-services/scheduler/) serve actor placement, instead of the standalone [Placement service](https://v1-19.docs.dapr.io/concepts/dapr-services/placement/).
  • the new [maxConcurrentHandlers](https://v1-19.docs.dapr.io/reference/components-reference/supported-pubsub/setup-azure-eventhubs/) option (default 100) limits the batches per partition that wait for a checkpoint.
  • **Dapr MCP server (alpha).**
  • run dapr init --scheduler-placement.

value changes (22)

  • 1.19 contains behavior changes that can affect an upgrade, mostly in the SDKs.
  • Workflows: throughput is 40% higher in TestWorkflowWithConstantVUs and 32% higher in TestSeriesWorkflowWithMaxVUs.
  • Jobs scheduling: p99 latency is 33% lower (39.5 ms to 26.3 ms), and the test now sustains the full requested 1000 QPS (921 QPS on 1.18.0).
  • Actor reminder registration: p99 latency is 71% lower (148 ms to 43 ms), at 43% more registrations per second.
  • Configuration subscribe: throughput is 67% higher over HTTP and about 2.8x over gRPC.
  • fails with the gRPC AlreadyExists status code when the instance ID belongs to an active (not completed) instance
  • A child workflow that runs as a retry attempt now records the instance ID of the first attempt in the parent's history.
  • expect actor and workflow activity to pause for longer than that while the Schedulers come back up.
  • You can turn the feature on or off without sidecar restarts.
  • actors are deactivated and reactivated on their new hosts once per switch, in either direction.
  • Workload identity certificates now record which images run in the pod.
  • Every [Kubernetes Service](https://v1-19.docs.dapr.io/operations/hosting/kubernetes/) that Dapr creates now sets appProtocol on each port.
  • When rotation is on and no size is set, a file rotates at 100 MB.
  • Every port of every [Service](https://v1-19.docs.dapr.io/operations/hosting/kubernetes/) that Dapr creates now declares appProtocol (http, grpc, tls, https or tcp).
  • When the Scheduler server stops with a runtime error, for example because its embedded store is briefly unavailable, the Scheduler now recreates it in the process.
  • The Scheduler process exits, and Kubernetes restarts it, as in 1.18, so alerts that count Scheduler pod restarts still see this condition.
  • The span name no longer contains the actor ID or the reminder or timer name.
  • When a message carries no W3C trace context (no traceparent and no legacy traceid), the sidecar now starts a new root span for the delivery, and the app receives a traceparent header.
  • pubsub.solace.amqp now answers a handler error with the AMQP modified outcome, so the broker delivers the message again.
  • On a 1.19 runtime, [dapr scheduler list, get and delete](https://v1-19.docs.dapr.io/reference/cli/dapr-scheduler/) show workflow activity jobs as activity/<app-id>/<instance-id>::<task-id>::0.
  • The sidecar sets them from the caller's mTLS identity, and it removes any value that the calling app sets.
  • now fail with no workflow worker is connected for app '<app-id>' instead of actor routing errors such as did not find address for actor

fixes (9)

  • these operations now fail at once with a clear error instead of a 20 second retry and an actor routing error
  • When an actor moves to another host, its in-memory timers on the old host are now deleted.
  • Publishing with ttlInSeconds no longer panics the sidecar
  • a lost connection reconnects with backoff, and a failed link no longer closes the shared connection.
  • Before 1.19 the flags had no effect, and the servers always bound all interfaces.
  • A duration string such as "30s" was ignored, and the [component](https://v1-19.docs.dapr.io/reference/components-reference/supported-pubsub/setup-redis-pubsub/) always used 15 seconds. The configured value now applies.
  • The [setting](https://v1-19.docs.dapr.io/reference/components-reference/supported-configuration-stores/azure-appconfig-configuration-store/) now controls the initial retry delay as documented.
  • Before, the checkpoint could move past a failed batch. Now the component retries a failed batch with the backOff* settings until the handler succeeds.
  • Inbound retries now use the handler's own context. Before 1.19, they used a context that never ended.

defaults (3)

  • The SDKs that support it turn it on by default
  • The [default model](https://v1-19.docs.dapr.io/reference/components-reference/supported-conversation/anthropic/) is now claude-sonnet-4-6, because the previous default model is retired.
  • A consumer group with no stored checkpoint now starts from the earliest retained event, not the latest.

constraints (2)

  • The component also accepts the x-consistent-hash exchange kind
  • Set [vaultAuthMethod: kubernetes](https://v1-19.docs.dapr.io/reference/components-reference/supported-secret-stores/hashicorp-vault/)

removals (1)

  • The [workflow Get API](https://v1-19.docs.dapr.io/reference/api/workflow_api/) no longer copies the failure message into dapr.workflow.output for a workflow in the FAILED state.
Add Dapr to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →
Official release note ↗All Dapr releases →