AI-analyzed release notes for CNCF graduated and incubating projects.
This release contains a security-related build toolchain update and an input-binding startup fix. The probe timeout is configurable for applications with slow startup.
Action needed (1)
securityThe Go toolchain version, updated to 1.
The Go version used to build Dapr is updated from 1. to 1. across the runtime, build tooling, and container images.
A maintenance release that corrects runtime, workflow, actor, metrics, component, and sidecar defects. It adds Kafka configuration and health-check capabilities and includes two security-related dependency upgrades.
Action needed (3)
securitymediumgithub. updated for CVE-2025-69725
github. is updated to v5.2.4, which resolves CVE-2025-69725.
securitymediumgo. and github. updates
go. is updated to v1.17.7, and the github. dependency is bumped to v1.18.3. The change carries advisory CVE-2026-2303.
breakingConflict errors for workflow instance IDs
Create requests for workflow instance IDs are rejected with a conflict error that names the blocking child workflow.
A substantial operator-facing release adds workflow and MCP capabilities alongside control-plane, API, component, and lifecycle changes. It also includes security fixes, dependency and default updates, and compatibility constraints that affect upgrade planning and configuration review.
Action needed (8)
securitymediumThe golang. dependency update for GO-2026-4962
golang. is updated to v0.39.0 for GO-2026-4962.
securityThe durabletask-go and pgx dependency updates
durabletask-go is updated to v0.12.1, and pgx is updated as part of the vulnerability fixes.
breakingThe WorkflowsRemoteActivityReminder default, enabled
WorkflowsRemoteActivityReminder is enabled by default. Cross-app workflow activity results are delivered through Scheduler reminders unless the setting is changed.
breakingThe HotReload default, enabled
HotReload is enabled by default for Components, Subscriptions, MCPServers, Configurations, HTTPEndpoints, Resiliencies, and WorkflowAccessPolicies.
breakingSidecar probe defaults
Sidecar probe defaults now give liveness more time before a kubelet restart, at about 230 seconds, while readiness responds more quickly.
breakingThe HotReload default, enabled in v1.18
HotReload is enabled by default in v1.18.
breakingLiveness and readiness probe defaults
The default liveness probe is widened, and the readiness probe default is tightened.
breakingChanged sidecar probe defaults
Sidecar probe defaults now set liveness to be more lenient, at about 230 seconds before a kubelet restart, and readiness to be tighter, at about 3 seconds for the control plane and 5 seconds for daprd.
Check if affected (6)
securityService invocation path traversal ACL bypass fix
Applies if you use service invocation.
A security fix addresses a path traversal ACL bypass in service invocation.
breakingThe MCPServerResource and WorkflowAccessPolicy feature gates, removed
Applies if you configure the MCPServerResource or WorkflowAccessPolicy feature gates.
The MCPServerResource and WorkflowAccessPolicy feature gates are removed.
breakingThe Sentry Ed25519 workload identity key rollback constraint
Applicability is not stated in the release notes.
Dapr 1.18 introduces Ed25519 workload identity keys, and Sentry persists the Ed25519-keyed CA in the dapr-trust-bundle secret. Direct rollback from 1.18 to 1.17.6 or earlier is not supported.
Plan ahead (1)
deprecatedThe ScheduleJobAlpha1 alpha RPCs, deprecated
Applies if you use ScheduleJobAlpha1.
The alpha RPCs, including ScheduleJobAlpha1, are deprecated in this release but remain fully functional.
A maintenance release corrects a workflow retentioner defect and constrains forwarded-host handling during Sentry OIDC discovery. The discovery change affects deployments that use Sentry OIDC.
Check if affected (1)
securityConstrained X-Forwarded-Host use during Sentry OIDC discovery
Applies if you use Sentry OIDC.
handleDiscovery honors X-Forwarded-Host only when --oidc-allowed-hosts is configured and the allowed-hosts middleware has validated it against the operator's allowlist. Without an allowlist, the issuer and jwks_uri come from r., and the header is ignored.
This is a security-focused maintenance release. It corrects a service-invocation ACL mismatch caused by path normalization and updates Go to v1. for CVE coverage.
Action needed (2)
securityNormalized service-invocation ACL and outbound dispatch paths
The normalized path form is used for both the ACL check and outbound dispatch, removing the mismatch in service invocation.
securityThe Go dependency, updated to v1.
The Go dependency is updated to v1. to address CVEs affecting the 1.24 line.
This release contains a security fix for service-invocation access-control policy handling. It aligns method-path normalization for ACL checks and outbound dispatch, which concerns operators using these policies.
Action needed (1)
securityService-invocation ACL path normalization
In Dapr v1.17.5, the normalized method path is used for both the service-invocation ACL check and outbound dispatch, eliminating the mismatch that caused the bypass.
A security-focused release fixes a service-invocation ACL bypass caused by inconsistent path normalization. It also rejects dangerous method-path characters, removes the purell dependency from ACL path handling, and applies additional path cleaning in constructRequest.
Action needed (3)
securityConsistent service-invocation method path normalization
Method paths are normalized at the service invocation edge for HTTP and gRPC public API calls, gRPC internal calls, and proxied calls. The normalized form is used for both the ACL check and outbound dispatch.
securityStricter method path validation
Normalization uses path. to resolve . segments and duplicate slashes. Method paths containing #, ?, null bytes, or control characters are rejected.
securityThe purell dependency, removed from the ACL path
The purell dependency has been removed from ACL path handling.
Dapr v1.16.13 includes a security-relevant Go dependency update and correctness fixes. The release also changes scheduler reliability and Pulsar pub/sub processing behavior.
Action needed (1)
securityThe Go version update
The Go version is updated from 1. to 1. in v1.16.13.
Check if affected (1)
breakingprocessMode initialization validation
Applies if you configure processMode.
Invalid processMode values are rejected at initialization time.
This release contains operator-relevant correctness fixes across messaging, workflows, HTTP proxying, placement, and scheduling. It also updates the Go toolchain across the repository and its Docker images.
Action needed (1)
securityThe Go toolchain, updated to 1.25.9
The Go toolchain was upgraded from 1.25.8 to 1.25.9 across all modules and Docker images in the repository.
A maintenance release with a security-relevant gRPC dependency upgrade, Pulsar Avro and JSON schema handling corrections, and a Scheduler cluster recovery fix. It also adds raw payload topic metadata and updates Avro payload conversion and CloudEvents schema registration.
Action needed (1)
securitycriticalThe google. dependency and CVE-2026-33186 resolution
The affected google. dependency is upgraded to a version that resolves CVE-2026-33186. The fix ships in this release.
Check if affected (2)
breakingRejected rawPayload=true publishing to CloudEvents-wrapped topics
Applies if rawPayload is set for a CloudEvents-wrapped topic.
Publishing with rawPayload=true to a CloudEvents-wrapped topic is rejected with a clear error. The constraint ships in this release.
breakingStructural validation for . topics
Applies if you configure ..
Topics configured with . compile a goavro codec at initialization and validate payloads with NativeFromTextual at publish time. Invalid schemas fail fast at startup, and the validation change ships in this release.
Dapr v1.17.3 is a maintenance release with two dependency upgrades that resolve reported CVEs. It also includes correctness fixes for actor and service responses, placement dissemination, reconnect behavior, Scheduler participation, metrics, and Windows sidecar startup.
Action needed (2)
securitycriticalThe google. dependency, updated for CVE-2026-33186
The google. dependency is upgraded in this release to resolve CVE-2026-33186.
securitymediumThe golang. dependency, updated for CVE-2026-33809
This release upgrades golang. from v0.25.0 to v0.38.0, resolving CVE-2026-33809.
This release updates the Go toolchain and corrects Scheduler and container defects. The recorded Scheduler and Windows fixes require only an upgrade, with no operator configuration changes stated.
Action needed (1)
securityThe Go version, updated to 1.25.8
Dapr v1.16.11 updates the Go toolchain from 1.25.7 to 1.25.8.
A maintenance release with disclosed Go standard-library security fixes, a Go toolchain upgrade, and a required manual Configuration CRD update. It also adds RavenDB state-store registration and correctness and performance fixes across pub/sub, scheduling, service invocation, workflows, actors, conversation components, state stores, and Sentry.
Action needed (3)
securityhighGo toolchain upgrade to 1.25.8
The Go toolchain was upgraded from 1.24.13 to 1.25.8 across all modules and Docker images in the repository.
securitymediumGO-2026-4603 and escaped meta content URLs
html/template now escapes URLs in meta content attribute actions, addressing potential cross-site scripting via crafted URLs.
securitylowGO-2026-4602 and os. root boundaries
os. can no longer escape from a Root to access files outside the intended directory boundary.
Check if affected (2)
securityhighGO-2026-4601 and IPv6 host literal parsing
Applies if you use net/url.
IPv6 host literal parsing in net/url was corrected to prevent unexpected URL routing or SSRF when applications parse user-supplied URLs.
breakingConfiguration stateRetentionPolicy schema
Applies if you configure stateRetentionPolicy.
The Configuration CRD schema now uses type: string for all stateRetentionPolicy fields, matching the metav1. serialization format.
This release corrects Avro publishing and WASM component registration defects, improves Avro publishing performance, and updates the Go and OpenTelemetry SDK dependencies. The Go update includes security fixes, while the OpenTelemetry update is presented without a disclosed security issue.
Action needed (1)
securityThe Go 1. update
Go 1. ships security fixes for the go command and crypto/tls package, plus compiler and crypto/x509 bug fixes.
A broad feature release adds workflow, component, API, authentication, tracing, configuration, CLI, and observability capabilities, alongside defect fixes and dependency updates. It also deprecates the alpha Bulk PubSub APIs and alpha application callback and includes security fixes.
Action needed (9)
securityGo cryptography dependency updates
The x/(net/sync/crypto) dependencies are bumped, and dvsekhvalnov/jose2go is pinned.
securityGo vulnerability fix
A vulnerability in Go is fixed.
securityRoot-only UID check
The UID check now checks only the root UID.
securityHTTP path matching and invocation auto-registration
HTTP path matching is fixed to address a cardinality leak, and invocation auto-registration is supported.
securityThe golang. dependency, updated
The golang. dependency is bumped.
securityThe github. dependency, updated
The github. dependency is bumped.
securitySecurity fixes
Security fixes ship in the release.
securityThe github. dependency, updated
The github. dependency is bumped.
securityNATS vulnerability fix
A vulnerability in NATS is fixed.
Check if affected (3)
securityPlacement authorization for Dapr actor types
Applies if you use Placement.
Placement authorization for Dapr actor types is updated.
securityCloudflare worker vulnerability fix
Applies if you use the Cloudflare worker.
A vulnerability affecting the Cloudflare worker is fixed.
breakingScheduler resources removed from the Helm chart
Applies if you use the Helm chart.
The Helm chart now completely removes scheduler resources instead of scaling them to zero.
Plan ahead (2)
deprecatedAlpha Bulk PubSub APIs and app callback deprecation
Applies if you use /v1., BulkPublishEventAlpha1, or OnBulkTopicEventAlpha1.
The alpha Bulk PubSub APIs are deprecated in favor of the stable Bulk PubSub APIs. This includes the alpha endpoint /v1., BulkPublishEventAlpha1, and the OnBulkTopicEventAlpha1 app callback; the stable forms are /v1., BulkPublishEvent, and OnBulkTopicEvent.
deprecatedThe OnBulkTopicEventAlpha1 callback, deprecated
Applies if you use OnBulkTopicEventAlpha1.
Alpha paths remain functional but are deprecated in favor of stable APIs.
This release includes a Go toolchain dependency upgrade and a corrected Pulsar PubSub subscription-metadata defect. A regression test verifies that metadata is applied to consumer options.
Action needed (1)
securityhighThe Go toolchain upgrade to 1.
Dapr v1. upgrades Go to 1.. The upgrade addresses advisories GO-2026-4340 and GO-2026-4341.
