Dapr v1.18.1 is a bug-fix release covering workflow timer cleanup, sidecar shutdown and restart behavior, ContinueAsNew completion handling, operator resynchronization, and Helm CRD schema alignment. No security advisories or security flaws are identified.
Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
This release corrects a resiliency retry defect in pubsub publish operations. Configured status-code matching is honored when publish errors carry gRPC status codes.
Source ↗This release contains operator-relevant defect corrections for Sentry certificate signing interoperability and Helm-based downgrade handling. The fixes cover certificate template and signing request compatibility, plus chart support for downgrade-related storage sizing.
Source ↗This release contains a correctness fix for Sentry startup when using Ed25519 or RSA issuer keys. It also includes a dependency version update associated with that fix.
Source ↗A substantial operator-facing release adds workflow and MCP capabilities alongside control-plane, API, component, and lifecycle changes. It also includes security fixes, dependency and default updates, and compatibility constraints that affect upgrade planning and configuration review.
Action needed (8)
securitymediumThe
golang.dependency update fororg/x/image GO-2026-4962golang.is updated to v0.39.0 fororg/x/image GO-2026-4962.securityThe
durabletask-goandpgxdependency updatesdurabletask-gois updated to v0.12.1, andpgxis updated as part of the vulnerability fixes.breakingThe
WorkflowsRemoteActivityReminderdefault, enabledWorkflowsRemoteActivityReminderis enabled by default. Cross-app workflow activity results are delivered through Scheduler reminders unless the setting is changed.breakingThe
HotReloaddefault, enabledHotReloadis enabled by default for Components, Subscriptions,MCPServers, Configurations,HTTPEndpoints, Resiliencies, andWorkflowAccessPolicies.breakingSidecar probe defaults
Sidecar probe defaults now give liveness more time before a kubelet restart, at about 230 seconds, while readiness responds more quickly.
breakingThe
HotReloaddefault, enabled in v1.18HotReloadis enabled by default in v1.18.breakingLiveness and readiness probe defaults
The default liveness probe is widened, and the readiness probe default is tightened.
breakingChanged sidecar probe defaults
Sidecar probe defaults now set liveness to be more lenient, at about 230 seconds before a kubelet restart, and readiness to be tighter, at about 3 seconds for the control plane and 5 seconds for
daprd.
Check if affected (6)
securityService invocation path traversal ACL bypass fix
Applies if you use service invocation.
A security fix addresses a path traversal ACL bypass in service invocation.
breakingThe
MCPServerResourceandWorkflowAccessPolicyfeature gates, removedApplies if you configure the
MCPServerResourceorWorkflowAccessPolicyfeature gates.The
MCPServerResourceandWorkflowAccessPolicyfeature gates are removed.breakingThe
SentryEd25519 workload identity key rollback constraintApplicability is not stated in the release notes.
Dapr 1.18 introduces Ed25519 workload identity keys, and
Sentrypersists the Ed25519-keyed CA in thedapr-trust-bundlesecret. Direct rollback from 1.18 to 1.17.6 or earlier is not supported.- + 3 more on the release page
Plan ahead (1)
deprecatedThe
ScheduleJobAlpha1alpha RPCs, deprecatedApplies if you use
ScheduleJobAlpha1.The alpha RPCs, including
ScheduleJobAlpha1, are deprecated in this release but remain fully functional.
This release corrects a workflow retention purge failure for Azure Cosmos DB when the customStatus row is absent. Affected workflows recover automatically after upgrading to v1.17.9, with no manual scheduler intervention required.