Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Mar 2026Clear ×Project: DaprClear ×

Daprv1.16.12Orchestration & ManagementMar 30, 2026

ACTION 1CHECK 2OTHER 4View full analysis

A maintenance release with a security-relevant gRPC dependency upgrade, Pulsar Avro and JSON schema handling corrections, and a Scheduler cluster recovery fix. It also adds raw payload topic metadata and updates Avro payload conversion and CloudEvents schema registration.

Action needed (1)

securitycriticalThe google.golang.org/grpc dependency and CVE-2026-33186 resolution
The affected google.golang.org/grpc dependency is upgraded to a version that resolves CVE-2026-33186. The fix ships in this release.

Check if affected (2)

breakingRejected rawPayload=true publishing to CloudEvents-wrapped topics
Applies if rawPayload is set for a CloudEvents-wrapped topic.
Publishing with rawPayload=true to a CloudEvents-wrapped topic is rejected with a clear error. The constraint ships in this release.
breakingStructural validation for .jsonschema topics
Applies if you configure .jsonschema.
Topics configured with .jsonschema compile a goavro codec at initialization and validate payloads with NativeFromTextual at publish time. Invalid schemas fail fast at startup, and the validation change ships in this release.

Source ↗

Daprv1.17.3Orchestration & ManagementMar 26, 2026

ACTION 2OTHER 12View full analysis

Dapr v1.17.3 is a maintenance release with two dependency upgrades that resolve reported CVEs. It also includes correctness fixes for actor and service responses, placement dissemination, reconnect behavior, Scheduler participation, metrics, and Windows sidecar startup.

Action needed (2)

securitycriticalThe google.golang.org/grpc dependency, updated for CVE-2026-33186
The google.golang.org/grpc dependency is upgraded in this release to resolve CVE-2026-33186.
securitymediumThe golang.org/x/image dependency, updated for CVE-2026-33809
This release upgrades golang.org/x/image from v0.25.0 to v0.38.0, resolving CVE-2026-33809.

Source ↗

Daprv1.16.11Orchestration & ManagementMar 26, 2026

ACTION 1OTHER 4View full analysis

This release updates the Go toolchain and corrects Scheduler and container defects. The recorded Scheduler and Windows fixes require only an upgrade, with no operator configuration changes stated.

Action needed (1)

securityThe Go version, updated to 1.25.8
Dapr v1.16.11 updates the Go toolchain from 1.25.7 to 1.25.8.

Source ↗

Daprv1.17.2Orchestration & ManagementMar 19, 2026

ACTION 3CHECK 2OTHER 22View full analysis

A maintenance release with disclosed Go standard-library security fixes, a Go toolchain upgrade, and a required manual Configuration CRD update. It also adds RavenDB state-store registration and correctness and performance fixes across pub/sub, scheduling, service invocation, workflows, actors, conversation components, state stores, and Sentry.

Action needed (3)

securityhighGo toolchain upgrade to 1.25.8
The Go toolchain was upgraded from 1.24.13 to 1.25.8 across all modules and Docker images in the repository.
securitymediumGO-2026-4603 and escaped meta content URLs
html/template now escapes URLs in meta content attribute actions, addressing potential cross-site scripting via crafted URLs.
securitylowGO-2026-4602 and os.FileInfo root boundaries
os.FileInfo can no longer escape from a Root to access files outside the intended directory boundary.

Check if affected (2)

securityhighGO-2026-4601 and IPv6 host literal parsing
Applies if you use net/url.
IPv6 host literal parsing in net/url was corrected to prevent unexpected URL routing or SSRF when applications parse user-supplied URLs.
breakingConfiguration stateRetentionPolicy schema
Applies if you configure stateRetentionPolicy.
The Configuration CRD schema now uses type: string for all stateRetentionPolicy fields, matching the metav1.Duration serialization format.

Source ↗

Daprv1.16.10Orchestration & ManagementMar 6, 2026

ACTION 1OTHER 4View full analysis

This release corrects Avro publishing and WASM component registration defects, improves Avro publishing performance, and updates the Go and OpenTelemetry SDK dependencies. The Go update includes security fixes, while the OpenTelemetry update is presented without a disclosed security issue.

Action needed (1)

securityThe Go 1.25.7 update
Go 1.25.7 ships security fixes for the go command and crypto/tls package, plus compiler and crypto/x509 bug fixes.

Source ↗

Browse by month