A maintenance release with an operator-relevant correctness fix. The remaining note concerns SPIFFE SVID authentication context passed to operation calls.
Source ↗Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
Project: DaprClear ×
A maintenance release with operator-facing correctness fixes, runtime behavior changes, a new configuration flag, and cron parser updates backed by a dependency change. It contains no security advisories or explicitly described vulnerabilities.
Source ↗This release contains a security-related build toolchain update and an input-binding startup fix. The probe timeout is configurable for applications with slow startup.
Action needed (1)
securityThe
Gotoolchain version, updated to1.26. 5 The
Goversion used to build Dapr is updated from1.to26. 4 1.across the runtime, build tooling, and container images.26. 5
A maintenance release that corrects runtime, workflow, actor, metrics, component, and sidecar defects. It adds Kafka configuration and health-check capabilities and includes two security-related dependency upgrades.
Action needed (3)
securitymedium
github.updated for CVE-2025-69725com/go-chi/chi/v5 github.is updated to v5.2.4, which resolves CVE-2025-69725.com/go-chi/chi/v5 securitymedium
go.andmongodb. org/mongo-driver github.updatescom/dapr/components-contrib go.is updated to v1.17.7, and themongodb. org/mongo-driver github.dependency is bumped to v1.18.3. The change carries advisory CVE-2026-2303.com/dapr/components-contrib breakingConflict errors for workflow instance IDs
Create requests for workflow instance IDs are rejected with a conflict error that names the blocking child workflow.
Dapr v1.16.17 fixes Scheduler handling for actor reminder and job names and actor IDs that were accepted at the API edge but rejected by stricter DNS-1123 validation. It also corrects the related validation error and actor metadata handling, with no operator action required beyond upgrading.
Source ↗Dapr v1.18.1 is a bug-fix release covering workflow timer cleanup, sidecar shutdown and restart behavior, ContinueAsNew completion handling, operator resynchronization, and Helm CRD schema alignment. No security advisories or security flaws are identified.
This release corrects a resiliency retry defect in pubsub publish operations. Configured status-code matching is honored when publish errors carry gRPC status codes.
Source ↗This release contains operator-relevant defect corrections for Sentry certificate signing interoperability and Helm-based downgrade handling. The fixes cover certificate template and signing request compatibility, plus chart support for downgrade-related storage sizing.
Source ↗This release contains a correctness fix for Sentry startup when using Ed25519 or RSA issuer keys. It also includes a dependency version update associated with that fix.
Source ↗A substantial operator-facing release adds workflow and MCP capabilities alongside control-plane, API, component, and lifecycle changes. It also includes security fixes, dependency and default updates, and compatibility constraints that affect upgrade planning and configuration review.
Action needed (8)
securitymediumThe
golang.dependency update fororg/x/image GO-2026-4962golang.is updated to v0.39.0 fororg/x/image GO-2026-4962.securityThe
durabletask-goandpgxdependency updatesdurabletask-gois updated to v0.12.1, andpgxis updated as part of the vulnerability fixes.breakingThe
WorkflowsRemoteActivityReminderdefault, enabledWorkflowsRemoteActivityReminderis enabled by default. Cross-app workflow activity results are delivered through Scheduler reminders unless the setting is changed.breakingThe
HotReloaddefault, enabledHotReloadis enabled by default for Components, Subscriptions,MCPServers, Configurations,HTTPEndpoints, Resiliencies, andWorkflowAccessPolicies.breakingSidecar probe defaults
Sidecar probe defaults now give liveness more time before a kubelet restart, at about 230 seconds, while readiness responds more quickly.
breakingThe
HotReloaddefault, enabled in v1.18HotReloadis enabled by default in v1.18.breakingLiveness and readiness probe defaults
The default liveness probe is widened, and the readiness probe default is tightened.
breakingChanged sidecar probe defaults
Sidecar probe defaults now set liveness to be more lenient, at about 230 seconds before a kubelet restart, and readiness to be tighter, at about 3 seconds for the control plane and 5 seconds for
daprd.
Check if affected (6)
securityService invocation path traversal ACL bypass fix
Applies if you use service invocation.
A security fix addresses a path traversal ACL bypass in service invocation.
breakingThe
MCPServerResourceandWorkflowAccessPolicyfeature gates, removedApplies if you configure the
MCPServerResourceorWorkflowAccessPolicyfeature gates.The
MCPServerResourceandWorkflowAccessPolicyfeature gates are removed.breakingThe
SentryEd25519 workload identity key rollback constraintApplicability is not stated in the release notes.
Dapr 1.18 introduces Ed25519 workload identity keys, and
Sentrypersists the Ed25519-keyed CA in thedapr-trust-bundlesecret. Direct rollback from 1.18 to 1.17.6 or earlier is not supported.- + 3 more on the release page
Plan ahead (1)
deprecatedThe
ScheduleJobAlpha1alpha RPCs, deprecatedApplies if you use
ScheduleJobAlpha1.The alpha RPCs, including
ScheduleJobAlpha1, are deprecated in this release but remain fully functional.
This release corrects a workflow retention purge failure for Azure Cosmos DB when the customStatus row is absent. Affected workflows recover automatically after upgrading to v1.17.9, with no manual scheduler intervention required.
A maintenance release corrects a workflow retentioner defect and constrains forwarded-host handling during Sentry OIDC discovery. The discovery change affects deployments that use Sentry OIDC.
Check if affected (1)
securityConstrained
X-Forwarded-Hostuse during Sentry OIDC discoveryApplies if you use Sentry OIDC.
handleDiscoveryhonorsX-Forwarded-Hostonly when--oidc-allowed-hostsis configured and the allowed-hosts middleware has validated it against the operator's allowlist. Without an allowlist, the issuer andjwks_uricome fromr., and the header is ignored.Host
Dapr v1.17.7 is a corrective release focused on workflow, scheduler, actor, networking, and pub/sub reliability defects. It also adds workflow payload metrics, changes scheduler defaults, adds a scheduler flag, and updates github..
Check if affected (1)
breakingThe actor
drainOngoingCallTimeoutconstraintApplies if an application supplies an actor
drainOngoingCallTimeoutthat meets or exceeds the daprd-side placement dissemination timeout, which defaults to 30 seconds.The actor
drainOngoingCallTimeoutconstraint is corrected for values that meet or exceed the daprd-side placement dissemination timeout, which defaults to 30 seconds. This fix ships in Dapr v1.17.7.
This release corrects a pub/sub graceful-shutdown defect in Dapr. Messages arriving during subscription shutdown are held instead of rejected, so the broker can redeliver them rather than diverting them to dead-letter queues.
Source ↗This is a security-focused maintenance release. It corrects a service-invocation ACL mismatch caused by path normalization and updates Go to v1. for CVE coverage.
Action needed (2)
securityNormalized service-invocation ACL and outbound dispatch paths
The normalized path form is used for both the ACL check and outbound dispatch, removing the mismatch in service invocation.
securityThe
Godependency, updated tov1.25. 9 The
Godependency is updated tov1.to address CVEs affecting the 1.24 line.25. 9
This release contains a security fix for service-invocation access-control policy handling. It aligns method-path normalization for ACL checks and outbound dispatch, which concerns operators using these policies.
Action needed (1)
securityService-invocation ACL path normalization
In Dapr v1.17.5, the normalized method path is used for both the service-invocation ACL check and outbound dispatch, eliminating the mismatch that caused the bypass.
A security-focused release fixes a service-invocation ACL bypass caused by inconsistent path normalization. It also rejects dangerous method-path characters, removes the purell dependency from ACL path handling, and applies additional path cleaning in constructRequest.
Action needed (3)
securityConsistent service-invocation method path normalization
Method paths are normalized at the service invocation edge for HTTP and gRPC public API calls, gRPC internal calls, and proxied calls. The normalized form is used for both the ACL check and outbound dispatch.
securityStricter method path validation
Normalization uses
path.to resolveClean .segments and duplicate slashes. Method paths containing. / #,?, null bytes, or control characters are rejected.securityThe
purelldependency, removed from the ACL pathThe
purelldependency has been removed from ACL path handling.
Dapr v1.16.13 includes a security-relevant Go dependency update and correctness fixes. The release also changes scheduler reliability and Pulsar pub/sub processing behavior.
Action needed (1)
securityThe
Goversion updateThe
Goversion is updated from1.to25. 8 1.in v1.16.13.25. 9
Check if affected (1)
breaking
processModeinitialization validationApplies if you configure
processMode.Invalid
processModevalues are rejected at initialization time.
This release contains operator-relevant correctness fixes across messaging, workflows, HTTP proxying, placement, and scheduling. It also updates the Go toolchain across the repository and its Docker images.
Action needed (1)
securityThe Go toolchain, updated to 1.25.9
The Go toolchain was upgraded from 1.25.8 to 1.25.9 across all modules and Docker images in the repository.
A maintenance release with a security-relevant gRPC dependency upgrade, Pulsar Avro and JSON schema handling corrections, and a Scheduler cluster recovery fix. It also adds raw payload topic metadata and updates Avro payload conversion and CloudEvents schema registration.
Action needed (1)
securitycriticalThe
google.dependency and CVE-2026-33186 resolutiongolang. org/grpc The affected
google.dependency is upgraded to a version that resolves CVE-2026-33186. The fix ships in this release.golang. org/grpc
Check if affected (2)
breakingRejected
rawPayload=truepublishing to CloudEvents-wrapped topicsApplies if
rawPayloadis set for a CloudEvents-wrapped topic.Publishing with
rawPayload=trueto a CloudEvents-wrapped topic is rejected with a clear error. The constraint ships in this release.breakingStructural validation for
.topicsjsonschema Applies if you configure
..jsonschema Topics configured with
.compile ajsonschema goavrocodec at initialization and validate payloads withNativeFromTextualat publish time. Invalid schemas fail fast at startup, and the validation change ships in this release.
Dapr v1.17.3 is a maintenance release with two dependency upgrades that resolve reported CVEs. It also includes correctness fixes for actor and service responses, placement dissemination, reconnect behavior, Scheduler participation, metrics, and Windows sidecar startup.
Action needed (2)
securitycriticalThe
google.dependency, updated for CVE-2026-33186golang. org/grpc The
google.dependency is upgraded in this release to resolve CVE-2026-33186.golang. org/grpc securitymediumThe
golang.dependency, updated for CVE-2026-33809org/x/image This release upgrades
golang.from v0.25.0 to v0.38.0, resolving CVE-2026-33809.org/x/image
This release updates the Go toolchain and corrects Scheduler and container defects. The recorded Scheduler and Windows fixes require only an upgrade, with no operator configuration changes stated.
Action needed (1)
securityThe
Goversion, updated to 1.25.8Dapr v1.16.11 updates the
Gotoolchain from 1.25.7 to 1.25.8.
A maintenance release with disclosed Go standard-library security fixes, a Go toolchain upgrade, and a required manual Configuration CRD update. It also adds RavenDB state-store registration and correctness and performance fixes across pub/sub, scheduling, service invocation, workflows, actors, conversation components, state stores, and Sentry.
Action needed (3)
securityhighGo toolchain upgrade to 1.25.8
The Go toolchain was upgraded from 1.24.13 to 1.25.8 across all modules and Docker images in the repository.
securitymedium
GO-2026-4603and escaped meta content URLshtml/templatenow escapes URLs in meta content attribute actions, addressing potential cross-site scripting via crafted URLs.securitylow
GO-2026-4602andos.root boundariesFileInfo os.can no longer escape from aFileInfo Rootto access files outside the intended directory boundary.
Check if affected (2)
securityhigh
GO-2026-4601and IPv6 host literal parsingApplies if you use
net/url.IPv6 host literal parsing in
net/urlwas corrected to prevent unexpected URL routing or SSRF when applications parse user-supplied URLs.breaking
ConfigurationstateRetentionPolicyschemaApplies if you configure
stateRetentionPolicy.The
ConfigurationCRD schema now usestype: stringfor allstateRetentionPolicyfields, matching themetav1.serialization format.Duration
Dapr v1.17.1 is a maintenance release focused on runtime behavior in the operator path. The noted fixes cover workflow cleanup, bulk subscription timing, WASM component registration, and placement dissemination overhead.
Source ↗This release corrects Avro publishing and WASM component registration defects, improves Avro publishing performance, and updates the Go and OpenTelemetry SDK dependencies. The Go update includes security fixes, while the OpenTelemetry update is presented without a disclosed security issue.
Action needed (1)
securityThe
Go 1.update25. 7 Go 1.ships security fixes for the25. 7 gocommand andcrypto/tlspackage, plus compiler andcrypto/x509bug fixes.
A broad feature release adds workflow, component, API, authentication, tracing, configuration, CLI, and observability capabilities, alongside defect fixes and dependency updates. It also deprecates the alpha Bulk PubSub APIs and alpha application callback and includes security fixes.
Action needed (9)
securityGo cryptography dependency updates
The
x/(net/sync/crypto)dependencies are bumped, anddvsekhvalnov/jose2gois pinned.security
Govulnerability fixA vulnerability in
Gois fixed.securityRoot-only UID check
The UID check now checks only the root UID.
securityHTTP path matching and invocation auto-registration
HTTP path matching is fixed to address a cardinality leak, and invocation auto-registration is supported.
securityThe
golang.dependency, updatedorg/x/crypto The
golang.dependency is bumped.org/x/crypto securityThe
github.dependency, updatedcom/docker/docker The
github.dependency is bumped.com/docker/docker securitySecurity fixes
Security fixes ship in the release.
securityThe
github.dependency, updatedcom/coreos/go-oidc/v3 The
github.dependency is bumped.com/coreos/go-oidc/v3 securityNATS vulnerability fix
A vulnerability in NATS is fixed.
Check if affected (3)
security
Placementauthorization for Dapr actor typesApplies if you use
Placement.Placementauthorization for Dapr actor types is updated.securityCloudflare worker vulnerability fix
Applies if you use the Cloudflare worker.
A vulnerability affecting the Cloudflare worker is fixed.
breakingScheduler resources removed from the Helm chart
Applies if you use the Helm chart.
The Helm chart now completely removes scheduler resources instead of scaling them to zero.
Plan ahead (2)
deprecatedAlpha Bulk PubSub APIs and app callback deprecation
Applies if you use
/v1.,0-alpha1/publish/bulk/<pubsub-name>/<topic> BulkPublishEventAlpha1, orOnBulkTopicEventAlpha1.The alpha Bulk PubSub APIs are deprecated in favor of the stable Bulk PubSub APIs. This includes the alpha endpoint
/v1.,0-alpha1/publish/bulk/<pubsub-name>/<topic> BulkPublishEventAlpha1, and theOnBulkTopicEventAlpha1app callback; the stable forms are/v1.,0/publish/bulk/<pubsub-name>/<topic> BulkPublishEvent, andOnBulkTopicEvent.deprecatedThe
OnBulkTopicEventAlpha1callback, deprecatedApplies if you use
OnBulkTopicEventAlpha1.Alpha paths remain functional but are deprecated in favor of stable APIs.
This release includes a Go toolchain dependency upgrade and a corrected Pulsar PubSub subscription-metadata defect. A regression test verifies that metadata is applied to consumer options.
Action needed (1)
securityhighThe
Gotoolchain upgrade to1.24. 13 Dapr
v1.upgrades16. 9 Goto1.. The upgrade addresses advisories24. 13 GO-2026-4340andGO-2026-4341.
This is a maintenance release with operator-relevant defect corrections. The recorded fixes cover configuration handling and mutex locking, and no security advisory or security-specific flaw is identified.
Source ↗Dapr v1.16.7 contains operator-facing bug fixes. It updates tracing for raw payload publishes, corrects file-based OAuth configuration with oauth2CredentialsFile, and fixes HTTPEndpoint initialization when only a root CA is configured.
Dapr v1.16.6 is a maintenance release focused on operator-visible correctness and runtime behavior. The release also includes a heading without additional change detail.
Source ↗