# Dapr v1.18.10

> Orchestration & Management · 2026-10-31

A security-focused maintenance release fixes access-control, isolation, denial-of-service, and crash issues. It also introduces breaking restrictions for public metadata writes and oversized gRPC metadata, which affect deployments using those paths or request patterns.

## Action needed
- **[security]** gRPC request-header size limit
  - The gRPC API server and internal gRPC server now limit request headers to `--read-buffer-size` bytes, with a minimum of 64 KiB. The corresponding configuration is `dapr.io/read-buffer-size`.

## Check if affected
- **[security]** HTTP service invocation access-control matching
  - Applies if you run HTTP apps.
  - Service invocation access control for HTTP apps now matches policies against the routed method after decoding percent-encoded characters once and lowercasing it.
- **[security]** `Scheduler` `WatchJobs` authorization for internal actor types
  - Applies if a `WatchJobs` stream declares or sets a concurrency limit on an internal actor type, `dapr.internal.*`, that does not belong to the calling app and namespace.
  - The `Scheduler` rejects a `WatchJobs` stream with `PermissionDenied` when it declares or sets a concurrency limit on an internal actor type, `dapr.internal.*`, that does not belong to the calling app and namespace.
- **[security]** `DAPR_API_TOKEN` protection for encoded health-check paths
  - Applies if you configure `DAPR_API_TOKEN`.
  - The API token middleware compares the same escaped path matched by the router, so a percent-encoded health-check path requires the API token.
- **[security]** Internal-port gRPC proxy target restriction
  - Applies if you use the internal port.
  - On the internal port, the gRPC proxy serves only calls addressed to the local app and returns `PermissionDenied` for other targets.
- **[security]** Public-port `PUT /v1.0/metadata/{key}` removal
  - Applies if you send `PUT /v1.0/metadata/{key}` on the public port.
  - The public port now returns `404` for `PUT /v1.0/metadata/{key}`. Clients use the Dapr HTTP API port for this request instead.
- **[security]** Request-host discovery document caching
  - Applies if a discovery document is built from the request host.
  - The discovery document is built from the validated value. A document built from the request host is now sent with `Cache-Control: no-store`.
- **[security]** `primaryEncryptionKey` error handling
  - Applies if `primaryEncryptionKey` contains values that would otherwise cause a panic.
  - Dapr now returns an error instead of panicking for the affected `primaryEncryptionKey` values: gRPC `Internal` or HTTP `500`, using the existing state store error code.
- **[security]** Transactional outbox marker-key validation
  - Applies if you use the transactional outbox.
  - The transactional outbox subscriber drops messages whose `id` is not an outbox marker key, `outbox-<uuid>`, before reading or deleting state, and logs a warning.
- **[security]** Constant-time `DAPR_API_TOKEN` comparison
  - Applies if you configure `DAPR_API_TOKEN`.
  - The HTTP and gRPC API token checks now use a constant-time comparison.

## Other recorded changes
- 2 (defect_corrected 2)

[Full analysis](https://ratatosk.io/en/releases/dapr/v1.18.10)

[Original release notes](https://github.com/dapr/dapr/releases/tag/v1.18.10)