RATATOSKRATATOSK
로그인

Dapr

v1.19.0Orchestration & Management
2026년 10월 22일

ACTION 1CHECK 15OTHER 83

기능 확장과 성능 및 정확성 개선이 포함된 릴리스지만, 동작과 기본값도 바뀝니다. 기본값 변경, 호환성 조건, 배포 제약, 보안 관련 수정이 있어 운영자는 업그레이드 전에 환경별 영향을 검토해야 합니다.

조치 필요 (1)

  • breakingmetrics server의 지원하지 않는 메서드 응답 변경

    metrics server가 이제 POST, PUT, PATCH, DELETE 요청에 405와 Allow: GET, HEAD를 반환합니다.

영향 확인 (15)

  • breakingsidecar 버전 업그레이드 선행 조건

    모든 sidecar가 1.19 이상을 실행하기 전에 활성화하면 적용됩니다.

    활성화하기 전에 모든 sidecar를 1.19 이상으로 업그레이드해야 합니다.

  • breaking배치 차트 렌더링 조건 변경

    global.scheduler.enabled, global.actors.enabled, global.actors.serviceName을 설정한 경우 적용됩니다.

    차트는 global.scheduler.enabled, global.actors.enabled, global.actors.serviceName=placement가 설정되어야 렌더링됩니다.

  • breaking사용자 지정 RBAC 권한 추가 조건

    사용자 지정 RBAC를 사용하는 경우 적용됩니다.

    사용자 지정 RBAC를 쓰는 환경에서는 1.19로 업그레이드하기 전에 권한을 추가해야 합니다.

  • breakingglobal.scheduler.placement.enabled 업그레이드 순서 변경

    모든 sidecar가 1.19 이상을 실행하기 전에 컨트롤 플레인을 업그레이드하거나, 그 뒤에 애플리케이션을 다시 시작하지 않으면 적용됩니다.

    컨트롤 플레인을 업그레이드하기 전에 모든 sidecar를 1.19 이상으로 올리고, 업그레이드가 끝난 뒤 애플리케이션을 다시 시작해야 합니다.

  • breakingSentry 롤백 대상 제한

    1.19에서 1.17.6 이하로 직접 롤백하는 경우 적용됩니다.

    1.19에서 1.17.6 이하로 직접 되돌리는 경로는 안전하지 않습니다. 안전한 롤백 대상은 1.18.x입니다.

  • breakingWorkflowAccessPolicy 다운그레이드 호환성 변경

    WorkflowAccessPolicy에서 requires를 사용하는 경우 적용됩니다.

    1.18 컨트롤 플레인과 sidecar는 해당 필드를 인식하지 못하므로 게이트 없이 규칙을 적용합니다. 다운그레이드하기 전에 해당 규칙을 제거하거나 범위를 좁혀야 합니다.

  • breakingWorkflowAccessPolicy CRD 적용 전 requires 처리

    1.19 WorkflowAccessPolicy CRD를 적용하지 않은 상태에서 requires를 사용하는 경우 적용됩니다.

    1.19 WorkflowAccessPolicy CRD를 적용하기 전에는 API 서버가 새 requires 필드를 삭제하므로, requires로 작성한 규칙이 해당 게이트 없이 적용됩니다.

    requires

  • breakingScheduler의 Pod 조회 권한 추가

    Scheduler를 배포하는 경우 적용됩니다.

    차트가 Dapr 네임스페이스에 dapr-scheduler-pods Role과 RoleBinding을 추가합니다. 이 권한으로 Scheduler가 pods에 대해 get, list, watch를 수행합니다.

  • breakingetcd 압축 보존 기본값 변경

    --etcd-compaction-retention이나 dapr_scheduler.etcdCompactionRetention 중 어느 것도 설정하지 않은 경우 적용됩니다.

    플래그 --etcd-compaction-retention과 Helm 값 dapr_scheduler.etcdCompactionRetention의 기본 보존값이 1000000에서 10000으로 낮아집니다.

  • breakingactor 소유 sidecar 외부의 timer operation 처리

    actor를 소유하지 않은 sidecar에서 timer operation을 사용하는 경우 적용됩니다.

    actor를 소유하지 않은 sidecar에서 [timer operation](https://v1-19.docs.dapr.io/developing-applications/building-blocks/actors/actors-timers-reminders/)을 실행하면 이제 실패합니다.

    timer operation

  • breaking일반 AMQP URL의 TLS 설정 검증

    일반 amqp:// URL에 caCert, clientCert, clientKey 중 하나를 설정한 경우 적용됩니다.

    일반 amqp:// URL에 설정한 TLS 설정인 caCert, clientCert, clientKey를 컴포넌트 초기화 시 거부합니다.

  • breaking서비스 호출 메서드의 금지 문자 처리

    서비스 호출 메서드에 %2F, %5C, %2E, 리터럴 \\ 중 하나가 포함된 경우 적용됩니다.

    %2F, %5C, %2E가 포함되거나 리터럴 \\를 포함한 메서드는 접근 제어 검사 전에 실패합니다.

  • breaking내부 actor 유형 호출 제한

    gRPC InvokeActor 또는 HTTP /v1.0/actors/{type}/{id}/method/{method}로 dapr.internal.* actor 유형을 호출하는 경우 적용됩니다.

    gRPC InvokeActor와 HTTP /v1.0/actors/{type}/{id}/method/{method}가 모든 dapr.internal.* actor 유형을 거부합니다.

  • breakingGetConfiguration 구성 범위 제한

    호출 앱의 Pod 중 하나에 dapr.io/config 주석을 지정하고 GetConfiguration을 사용하는 경우 적용됩니다.

    GetConfiguration은 호출 앱의 Pod 중 하나에 있는 dapr.io/config 주석에 지정된 구성만 반환합니다. 해당 주석이 없으면 PermissionDenied를 반환합니다.

  • breaking시간대가 포함된 @every 일정 제한

    시간대와 함께 @every 일정을 사용하는 경우 적용됩니다.

    시간대를 포함한 @every 일정은 파싱 시 실패하며, timezone is not supported for @every schedules 오류를 반환합니다.

    schedule

그 외 기록된 변경 83건 전체security fixes 1 · additions 45 · value changes 22 · fixes 9 · defaults 3 · constraints 2 · removals 1

security fixes (1)

  • Five security fixes. Four of them, for service invocation, the Scheduler and workflows, also shipped in 1.18.6. The fifth makes the Operator enforce app scopes and configuration assignment, and it also shipped in 1.18.9 and 1.17.18. Four of the five change behavior.

additions (45)

  • the workflow block of the metrics settings in Configuration now takes its own latencyDistributionBuckets, with a latencyDistributionUnits such as 1s.
  • The repository also ships Grafana dashboards for workflows and for the Scheduler in [grafana/]
  • A [worker](https://v1-19.docs.dapr.io/developing-applications/building-blocks/workflow/workflow-stateful-client/) can now advertise the WORKER_CAPABILITY_STATEFUL_HISTORY capability on its work-item stream.
  • the sidecar now sends a health ping every 30 seconds to a worker that advertises the WORKER_CAPABILITY_HEALTH_PING capability
  • The new [WorkflowsFastPath](https://v1-19.docs.dapr.io/developing-applications/building-blocks/workflow/workflow-fast-path/) [preview feature](https://v1-19.docs.dapr.io/operations/support/support-preview-features/) is off by default.
  • A workflow client can now run its operations on a workflow that [another app in the same namespace](https://v1-19.docs.dapr.io/developing-applications/building-blocks/workflow/workflow-multi-app/) owns
  • The workflow request protos have a new optional app_id field, and the HTTP endpoints accept an appID query parameter.
  • A [WorkflowAccessPolicy](https://v1-19.docs.dapr.io/operations/security/workflow-access-policy/) rule can now have a requires block.
  • A workflow can now start a [detached workflow](https://v1-19.docs.dapr.io/developing-applications/building-blocks/workflow/workflow-detached/).
  • With this feature on, the [Scheduler](https://v1-19.docs.dapr.io/concepts/dapr-services/scheduler/) places actors itself
  • set this Helm value
  • dapr_scheduler_placement_leader and dapr_scheduler_placement_streams_connected show the leader and the connected sidecars, and dapr_scheduler_placement_incapable_sidecars counts sidecars older than 1.19.
  • New flags: daprd --actors-placement-startup-timeout
  • use [dapr init --scheduler-placement](https://v1-19.docs.dapr.io/reference/cli/dapr-init/)
  • A new [building block](https://v1-19.docs.dapr.io/developing-applications/building-blocks/binarystore/) stores files through one API
  • HTTP: /v1.0-alpha1/binarystore/{name}/{fileName}.
  • gRPC: SetBinaryFileAlpha1 streams a file in, GetBinaryFileAlpha1 streams it out, and DeleteBinaryFileAlpha1 deletes it.
  • SDK support in 1.19: .NET (via Dapr.BinaryStore) and JavaScript (@dapr/dapr).
  • A new [building block](https://v1-19.docs.dapr.io/developing-applications/building-blocks/search/) lets an application store, retrieve and query documents
  • Components: search.meilisearch, and search.in-memory for tests.
  • SDK support in 1.19: .NET (via [Dapr.Search](https://www.nuget.org/packages/Dapr.Search)) and JavaScript (@dapr/dapr).
  • A new [building block](https://v1-19.docs.dapr.io/developing-applications/building-blocks/vector/) provides a means to store, retrieve and run similarity queries
  • Components: vector.meilisearch, and vector.in-memory for tests.
  • SDK support in 1.19: .NET (via [Dapr.Vector](https://www.nuget.org/packages/Dapr.Vector)) and JavaScript (@dapr/dapr).
  • gRPC: [ListActorTimers and GetActorTimer](https://v1-19.docs.dapr.io/reference/api/actors_api/).
  • HTTP: GET /v1.0/actors/{actorType}/{actorId}/timers and GET /v1.0/actors/{actorType}/{actorId}/timers/{name}.
  • HTTP: GET /v1.0/actors/{actorType}/{actorId}/reminders, to match the gRPC ListActorReminders API.
  • daprd now sends a Dapr-Actor-Activation-Id header
  • producerTransactionsEnabled: every publish, single or bulk, runs in a Kafka transaction
  • consumerIsolationLevel: "read_committed": a subscription reads only committed records.
  • consumerTransactionsEnabled: each delivery runs inside a transaction
  • Two new metadata options, [exchangeDeclareMode and queueDeclareMode]
  • The [AMQP 1.0 component](https://v1-19.docs.dapr.io/reference/components-reference/supported-pubsub/setup-amqp/) now also registers as pubsub.amqp.
  • Subscriptions can set subscriptionName, durable, shared and selector
  • New component settings: containerID, durableMessages and applicationPropertiesFromMetadata.
  • A [Conversation API](https://v1-19.docs.dapr.io/reference/api/conversation_api/) request can now cap how many tokens a call generates. Set max_tokens on the request, or maxTokens in the component metadata as a default.
  • Set useResponsesAPI: "true" in the [OpenAI component](https://v1-19.docs.dapr.io/reference/components-reference/supported-conversation/openai/) metadata
  • --log-outputs: a comma-separated list of log destinations (stdout, stderr, or a file path).
  • --log-file-max-size, --log-file-max-backups, --log-file-max-age and --log-file-compression: rotation for file destinations.
  • --log-timestamp-format: a Go time layout for the log timestamp.
  • Dapr 1.19 updates two CRDs: Configuration (new workflow latency-bucket fields in the metrics settings) and WorkflowAccessPolicy (the new [requires](https://v1-19.docs.dapr.io/operations/security/workflow-access-policy/) field).
  • The opt-in Helm value global.scheduler.placement.enabled (default false) makes the [Scheduler service](https://v1-19.docs.dapr.io/concepts/dapr-services/scheduler/) serve actor placement, instead of the standalone [Placement service](https://v1-19.docs.dapr.io/concepts/dapr-services/placement/).
  • the new [maxConcurrentHandlers](https://v1-19.docs.dapr.io/reference/components-reference/supported-pubsub/setup-azure-eventhubs/) option (default 100) limits the batches per partition that wait for a checkpoint.
  • **Dapr MCP server (alpha).**
  • run dapr init --scheduler-placement.

value changes (22)

  • 1.19 contains behavior changes that can affect an upgrade, mostly in the SDKs.
  • Workflows: throughput is 40% higher in TestWorkflowWithConstantVUs and 32% higher in TestSeriesWorkflowWithMaxVUs.
  • Jobs scheduling: p99 latency is 33% lower (39.5 ms to 26.3 ms), and the test now sustains the full requested 1000 QPS (921 QPS on 1.18.0).
  • Actor reminder registration: p99 latency is 71% lower (148 ms to 43 ms), at 43% more registrations per second.
  • Configuration subscribe: throughput is 67% higher over HTTP and about 2.8x over gRPC.
  • fails with the gRPC AlreadyExists status code when the instance ID belongs to an active (not completed) instance
  • A child workflow that runs as a retry attempt now records the instance ID of the first attempt in the parent's history.
  • expect actor and workflow activity to pause for longer than that while the Schedulers come back up.
  • You can turn the feature on or off without sidecar restarts.
  • actors are deactivated and reactivated on their new hosts once per switch, in either direction.
  • Workload identity certificates now record which images run in the pod.
  • Every [Kubernetes Service](https://v1-19.docs.dapr.io/operations/hosting/kubernetes/) that Dapr creates now sets appProtocol on each port.
  • When rotation is on and no size is set, a file rotates at 100 MB.
  • Every port of every [Service](https://v1-19.docs.dapr.io/operations/hosting/kubernetes/) that Dapr creates now declares appProtocol (http, grpc, tls, https or tcp).
  • When the Scheduler server stops with a runtime error, for example because its embedded store is briefly unavailable, the Scheduler now recreates it in the process.
  • The Scheduler process exits, and Kubernetes restarts it, as in 1.18, so alerts that count Scheduler pod restarts still see this condition.
  • The span name no longer contains the actor ID or the reminder or timer name.
  • When a message carries no W3C trace context (no traceparent and no legacy traceid), the sidecar now starts a new root span for the delivery, and the app receives a traceparent header.
  • pubsub.solace.amqp now answers a handler error with the AMQP modified outcome, so the broker delivers the message again.
  • On a 1.19 runtime, [dapr scheduler list, get and delete](https://v1-19.docs.dapr.io/reference/cli/dapr-scheduler/) show workflow activity jobs as activity/<app-id>/<instance-id>::<task-id>::0.
  • The sidecar sets them from the caller's mTLS identity, and it removes any value that the calling app sets.
  • now fail with no workflow worker is connected for app '<app-id>' instead of actor routing errors such as did not find address for actor

fixes (9)

  • these operations now fail at once with a clear error instead of a 20 second retry and an actor routing error
  • When an actor moves to another host, its in-memory timers on the old host are now deleted.
  • Publishing with ttlInSeconds no longer panics the sidecar
  • a lost connection reconnects with backoff, and a failed link no longer closes the shared connection.
  • Before 1.19 the flags had no effect, and the servers always bound all interfaces.
  • A duration string such as "30s" was ignored, and the [component](https://v1-19.docs.dapr.io/reference/components-reference/supported-pubsub/setup-redis-pubsub/) always used 15 seconds. The configured value now applies.
  • The [setting](https://v1-19.docs.dapr.io/reference/components-reference/supported-configuration-stores/azure-appconfig-configuration-store/) now controls the initial retry delay as documented.
  • Before, the checkpoint could move past a failed batch. Now the component retries a failed batch with the backOff* settings until the handler succeeds.
  • Inbound retries now use the handler's own context. Before 1.19, they used a context that never ended.

defaults (3)

  • The SDKs that support it turn it on by default
  • The [default model](https://v1-19.docs.dapr.io/reference/components-reference/supported-conversation/anthropic/) is now claude-sonnet-4-6, because the previous default model is retired.
  • A consumer group with no stored checkpoint now starts from the earliest retained event, not the latest.

constraints (2)

  • The component also accepts the x-consistent-hash exchange kind
  • Set [vaultAuthMethod: kubernetes](https://v1-19.docs.dapr.io/reference/components-reference/supported-secret-stores/hashicorp-vault/)

removals (1)

  • The [workflow Get API](https://v1-19.docs.dapr.io/reference/api/workflow_api/) no longer copies the failure message into dapr.workflow.output for a workflow in the FAILED state.
Dapr 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗Dapr 릴리스 전체 →