This release corrects a pub/sub graceful-shutdown defect in Dapr. Messages arriving during subscription shutdown are held instead of rejected, so the broker can redeliver them rather than diverting them to dead-letter queues.
Source ↗Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
This is a security-focused maintenance release. It corrects a service-invocation ACL mismatch caused by path normalization and updates Go to v1. for CVE coverage.
Action needed (2)
securityNormalized service-invocation ACL and outbound dispatch paths
The normalized path form is used for both the ACL check and outbound dispatch, removing the mismatch in service invocation.
securityThe
Godependency, updated tov1.25. 9 The
Godependency is updated tov1.to address CVEs affecting the 1.24 line.25. 9
This release contains a security fix for service-invocation access-control policy handling. It aligns method-path normalization for ACL checks and outbound dispatch, which concerns operators using these policies.
Action needed (1)
securityService-invocation ACL path normalization
In Dapr v1.17.5, the normalized method path is used for both the service-invocation ACL check and outbound dispatch, eliminating the mismatch that caused the bypass.
A security-focused release fixes a service-invocation ACL bypass caused by inconsistent path normalization. It also rejects dangerous method-path characters, removes the purell dependency from ACL path handling, and applies additional path cleaning in constructRequest.
Action needed (3)
securityConsistent service-invocation method path normalization
Method paths are normalized at the service invocation edge for HTTP and gRPC public API calls, gRPC internal calls, and proxied calls. The normalized form is used for both the ACL check and outbound dispatch.
securityStricter method path validation
Normalization uses
path.to resolveClean .segments and duplicate slashes. Method paths containing. / #,?, null bytes, or control characters are rejected.securityThe
purelldependency, removed from the ACL pathThe
purelldependency has been removed from ACL path handling.
Dapr v1.16.13 includes a security-relevant Go dependency update and correctness fixes. The release also changes scheduler reliability and Pulsar pub/sub processing behavior.
Action needed (1)
securityThe
Goversion updateThe
Goversion is updated from1.to25. 8 1.in v1.16.13.25. 9
Check if affected (1)
breaking
processModeinitialization validationApplies if you configure
processMode.Invalid
processModevalues are rejected at initialization time.
This release contains operator-relevant correctness fixes across messaging, workflows, HTTP proxying, placement, and scheduling. It also updates the Go toolchain across the repository and its Docker images.
Action needed (1)
securityThe Go toolchain, updated to 1.25.9
The Go toolchain was upgraded from 1.25.8 to 1.25.9 across all modules and Docker images in the repository.