# Dapr v1.19.1

> Orchestration & Management · 2026-10-31

A security-focused maintenance release tightens access control and isolation, fixes denial-of-service and crash paths, and changes enforcement on public endpoints and gRPC metadata limits. It also includes routine dependency and connection-handling fixes.

## Action needed
- **[security]** Local-app restriction for the internal gRPC proxy
  - On the internal port, the gRPC proxy serves only calls addressed to the local app and returns `PermissionDenied` for other targets.
- **[security]** `id_prefix_match` for actor reminder IDs
  - The Scheduler now terminates the key prefix for job targets with the delimiter, so `id_prefix_match` applies only to actor reminder IDs as documented.
- **[security]** `Sentry` allowed-host validation
  - `Sentry` now accepts only a host with an optional numeric port, without user info, path, query, or fragment. The host, or host and port, must be in the allowed hosts list; otherwise `Sentry` returns `403`.
- **[security]** No-store caching for `Sentry` discovery documents
  - A discovery document built from the request host is now sent with `Cache-Control: no-store`.
- **[security]** gRPC request-header limit from `--read-buffer-size`
  - The gRPC API server and internal gRPC server limit request headers to the configured `--read-buffer-size` value, with a minimum of 64 KiB. The `dapr.io/read-buffer-size` setting is also covered.
- **[security]** Constant-time API token comparison
  - HTTP and gRPC API token checks now use constant-time comparison.

## Check if affected
- **[security · medium]** GHSA-59m6-82qm-vqgj API token path matching
  - Applies if you configure `DAPR_API_TOKEN`.
  - GHSA-59m6-82qm-vqgj fixes API token checks for percent-encoded health check paths by comparing the escaped path matched by the router. A configured `DAPR_API_TOKEN` is now required for those paths.
- **[security]** HTTP service invocation access control
  - Applies if you use HTTP apps.
  - HTTP service invocation access control now matches policies against the decoded, lowercased method used by the application route.
- **[security]** `WatchJobs` access to internal actor types
  - Applies if you use `WatchJobs`.
  - The Scheduler rejects a `WatchJobs` stream with `PermissionDenied` when it declares or limits concurrency for an internal actor type such as `dapr.internal.*` that belongs to another app or namespace.
- **[security]** Public-port removal of `PUT /v1.0/metadata/{key}`
  - Applies if you use `PUT /v1.0/metadata/{key}`.
  - `PUT /v1.0/metadata/{key}` on the public port now returns `404`. The endpoint is available on the Dapr HTTP API port instead.
- **[security]** `primaryEncryptionKey` decryption panic
  - Applies if you configure `primaryEncryptionKey`.
  - A stored `primaryEncryptionKey` value no longer causes Dapr to panic during decryption.
- **[security]** Transactional outbox marker-key and message validation
  - Applies if you use the transactional outbox.
  - The transactional outbox now accepts only the outbox marker keys it creates, such as `outbox-<uuid>`. A message without `datacontenttype` no longer causes Dapr to panic.

## Other recorded changes
- 3 (defect_corrected 2, value_changed 1)

[Full analysis](https://ratatosk.io/en/releases/dapr/v1.19.1)

[Original release notes](https://github.com/dapr/dapr/releases/tag/v1.19.1)