# Dapr v1.19.0

> Orchestration & Management · 2026-10-22

A feature-rich, behavior-changing release adds workflow, storage, messaging, observability, and scheduler-based placement capabilities, alongside performance and correctness improvements. Operators should account for changed defaults, upgrade and rollback compatibility, deployment constraints, and security-related behavior changes.

## Action needed
- **[breaking]** Metrics server HTTP method handling
  - The metrics server now responds to POST, PUT, PATCH, and DELETE requests with 405 and `Allow: GET, HEAD`.

## Check if affected
- **[breaking]** Sidecar version requirement before activation
  - Applies if you turn it on before every sidecar runs 1.19 or later.
  - Activation now requires every sidecar to run version 1.19 or later.
- **[breaking]** Helm chart scheduler and actor settings
  - Applies if `global.scheduler.enabled`, `global.actors.enabled`, and `global.actors.serviceName` are set.
  - The chart requires `global.scheduler.enabled`, `global.actors.enabled`, and `global.actors.serviceName=placement` to be set before it renders.
- **[breaking]** Custom RBAC before upgrade
  - Applies if you use custom RBAC.
  - Custom RBAC must be added before upgrading to 1.19.
- **[breaking]** Scheduler placement upgrade sequence
  - Applies if you upgrade the control plane before every sidecar runs 1.19 or later or do not restart your applications afterward.
  - The `global.scheduler.placement.enabled` setting requires sidecars to be upgraded to 1.19 or later before the control plane, followed by application restarts.
- **[breaking]** `Sentry` rollback target
  - Applies if you roll back from 1.19 directly to 1.17.6 or earlier.
  - Rollback from 1.19 directly to 1.17.6 or earlier is unsupported; 1.18.x is the stated safe rollback target.
- **[breaking]** `WorkflowAccessPolicy` downgrade compatibility
  - Applies if you use `requires` with `WorkflowAccessPolicy`.
  - Downgrades must account for `requires` rules in `WorkflowAccessPolicy`, because a 1.18 control plane and sidecar do not recognize that field and apply the rules without the gate.
- **[breaking]** `WorkflowAccessPolicy` `requires` field handling
  - Applies if the 1.19 `WorkflowAccessPolicy` CRD is not applied and you use `requires`.
  - Until the 1.19 `WorkflowAccessPolicy` CRD is applied, the API server drops the `requires` field and applies rules containing it without that gate.
- **[breaking]** `Scheduler` pod RBAC
  - Applies if you deploy the `Scheduler`.
  - The chart adds a `dapr-scheduler-pods` Role and RoleBinding in the Dapr namespace, granting the `Scheduler` `get`, `list`, and `watch` access to `pods`.
- **[breaking]** Reduced etcd compaction retention default
  - Applies if you do not set either `--etcd-compaction-retention` or `dapr_scheduler.etcdCompactionRetention`.
  - The default retention changes from `1000000` to `10000` for both `--etcd-compaction-retention` and `dapr_scheduler.etcdCompactionRetention`.
- **[breaking]** Actor timer ownership check
  - Applies if you use a timer operation on a sidecar that does not own the actor.
  - A timer operation now fails when sent to a sidecar that does not own the actor.
- **[breaking]** AMQP TLS setting validation
  - Applies if you set `caCert`, `clientCert`, or `clientKey` on a plain `amqp://` URL.
  - The component rejects `caCert`, `clientCert`, and `clientKey` TLS settings when they are used with a plain `amqp://` URL during initialization.
- **[breaking]** Service invocation method validation
  - Applies if you use a service invocation method containing `%2F`, `%5C`, `%2E`, or a literal `\`.
  - Service invocation methods containing `%2F`, `%5C`, `%2E` in any letter case, or a literal `\`, now fail before the access control check.
- **[breaking]** Internal actor type rejection
  - Applies if you invoke actors through gRPC `InvokeActor` or HTTP `/v1.0/actors/{type}/{id}/method/{method}` using `dapr.internal.*` actor types.
  - gRPC `InvokeActor` and HTTP `/v1.0/actors/{type}/{id}/method/{method}` now reject all `dapr.internal.*` actor types.
- **[breaking]** `GetConfiguration` annotation scope
  - Applies if you use `GetConfiguration` with a `dapr.io/config` annotation on one of the calling app's pods.
  - `GetConfiguration` now returns only the configuration named in the `dapr.io/config` annotation on one of the calling app's pods. Without that matching annotation, it returns `PermissionDenied`.
- **[breaking]** Timezone validation for `@every` schedules
  - Applies if you use an `@every` schedule with a timezone.
  - Schedules such as `CRON_TZ=Europe/Rome @every 1h` now fail at parse time with `timezone is not supported for @every schedules`.

## Other recorded changes
- 83 (added 45, value_changed 23, defect_corrected 9, default_changed 3, constraint_changed 2, removed 1)

[Full analysis](https://ratatosk.io/en/releases/dapr/v1.19.0)

[Original release notes](https://github.com/dapr/dapr/releases/tag/v1.19.0)