Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Apr 2026Clear ×Project: DaprClear ×

Daprv1.15.14Orchestration & ManagementApr 16, 2026

ACTION 2View full analysis

This is a security-focused maintenance release. It corrects a service-invocation ACL mismatch caused by path normalization and updates Go to v1.25.9 for CVE coverage.

Action needed (2)

securityNormalized service-invocation ACL and outbound dispatch paths
The normalized path form is used for both the ACL check and outbound dispatch, removing the mismatch in service invocation.
securityThe Go dependency, updated to v1.25.9
The Go dependency is updated to v1.25.9 to address CVEs affecting the 1.24 line.

Source ↗

Daprv1.17.5Orchestration & ManagementApr 16, 2026

ACTION 1View full analysis

This release contains a security fix for service-invocation access-control policy handling. It aligns method-path normalization for ACL checks and outbound dispatch, which concerns operators using these policies.

Action needed (1)

securityService-invocation ACL path normalization
In Dapr v1.17.5, the normalized method path is used for both the service-invocation ACL check and outbound dispatch, eliminating the mismatch that caused the bypass.

Source ↗

Daprv1.16.14Orchestration & ManagementApr 16, 2026

ACTION 3OTHER 1View full analysis

A security-focused release fixes a service-invocation ACL bypass caused by inconsistent path normalization. It also rejects dangerous method-path characters, removes the purell dependency from ACL path handling, and applies additional path cleaning in constructRequest.

Action needed (3)

securityConsistent service-invocation method path normalization
Method paths are normalized at the service invocation edge for HTTP and gRPC public API calls, gRPC internal calls, and proxied calls. The normalized form is used for both the ACL check and outbound dispatch.
securityStricter method path validation
Normalization uses path.Clean to resolve ../ segments and duplicate slashes. Method paths containing #, ?, null bytes, or control characters are rejected.
securityThe purell dependency, removed from the ACL path
The purell dependency has been removed from ACL path handling.

Source ↗

Daprv1.16.13Orchestration & ManagementApr 15, 2026

ACTION 1CHECK 1OTHER 5View full analysis

Dapr v1.16.13 includes a security-relevant Go dependency update and correctness fixes. The release also changes scheduler reliability and Pulsar pub/sub processing behavior.

Action needed (1)

securityThe Go version update
The Go version is updated from 1.25.8 to 1.25.9 in v1.16.13.

Check if affected (1)

breakingprocessMode initialization validation
Applies if you configure processMode.
Invalid processMode values are rejected at initialization time.

Source ↗

Daprv1.17.4Orchestration & ManagementApr 10, 2026

ACTION 1OTHER 11View full analysis

This release contains operator-relevant correctness fixes across messaging, workflows, HTTP proxying, placement, and scheduling. It also updates the Go toolchain across the repository and its Docker images.

Action needed (1)

securityThe Go toolchain, updated to 1.25.9
The Go toolchain was upgraded from 1.25.8 to 1.25.9 across all modules and Docker images in the repository.

Source ↗

Browse by month