Releases — RATATOSK

Daprv1.17.0Orchestration & ManagementFeb 27, 2026

ACTION 9CHECK 3PLAN 2OTHER 151View full analysis

A broad feature release adds workflow, component, API, authentication, tracing, configuration, CLI, and observability capabilities, alongside defect fixes and dependency updates. It also deprecates the alpha Bulk PubSub APIs and alpha application callback and includes security fixes.

Action needed (9)

securityGo cryptography dependency updates
The x/(net/sync/crypto) dependencies are bumped, and dvsekhvalnov/jose2go is pinned.
securityGo vulnerability fix
A vulnerability in Go is fixed.
securityRoot-only UID check
The UID check now checks only the root UID.
securityHTTP path matching and invocation auto-registration
HTTP path matching is fixed to address a cardinality leak, and invocation auto-registration is supported.
securityThe golang.org/x/crypto dependency, updated
The golang.org/x/crypto dependency is bumped.
securityThe github.com/docker/docker dependency, updated
The github.com/docker/docker dependency is bumped.
securitySecurity fixes
Security fixes ship in the release.
securityThe github.com/coreos/go-oidc/v3 dependency, updated
The github.com/coreos/go-oidc/v3 dependency is bumped.
securityNATS vulnerability fix
A vulnerability in NATS is fixed.

Check if affected (3)

securityPlacement authorization for Dapr actor types
Applies if you use Placement.
Placement authorization for Dapr actor types is updated.
securityCloudflare worker vulnerability fix
Applies if you use the Cloudflare worker.
A vulnerability affecting the Cloudflare worker is fixed.
breakingScheduler resources removed from the Helm chart
Applies if you use the Helm chart.
The Helm chart now completely removes scheduler resources instead of scaling them to zero.

Plan ahead (2)

deprecatedAlpha Bulk PubSub APIs and app callback deprecation
Applies if you use /v1.0-alpha1/publish/bulk/<pubsub-name>/<topic>, BulkPublishEventAlpha1, or OnBulkTopicEventAlpha1.
The alpha Bulk PubSub APIs are deprecated in favor of the stable Bulk PubSub APIs. This includes the alpha endpoint /v1.0-alpha1/publish/bulk/<pubsub-name>/<topic>, BulkPublishEventAlpha1, and the OnBulkTopicEventAlpha1 app callback; the stable forms are /v1.0/publish/bulk/<pubsub-name>/<topic>, BulkPublishEvent, and OnBulkTopicEvent.
deprecatedThe OnBulkTopicEventAlpha1 callback, deprecated
Applies if you use OnBulkTopicEventAlpha1.
Alpha paths remain functional but are deprecated in favor of stable APIs.

Source ↗

Daprv1.16.9Orchestration & ManagementFeb 12, 2026

ACTION 1OTHER 1View full analysis

This release includes a Go toolchain dependency upgrade and a corrected Pulsar PubSub subscription-metadata defect. A regression test verifies that metadata is applied to consumer options.

Action needed (1)

securityhighThe Go toolchain upgrade to 1.24.13
Dapr v1.16.9 upgrades Go to 1.24.13. The upgrade addresses advisories GO-2026-4340 and GO-2026-4341.

Source ↗