What dapr/dapr shipped
Written by FoxPlug from the repository's own releases; not affiliated with Dapr. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/dapr/dapr; Dapr did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Service invocation no longer forwards spoofed caller identity headers to the target app, closing a security gap where a caller could set dapr-caller-app-id, dapr-caller-namespace and dapr-callee-app-id itself. Pull request #10683
- The Scheduler now checks the actor type a reminder targets against the caller identity, so an app can no longer create reminders against another app's internal workflow actors. Pull request #10682
- Service invocation access control now treats percent-encoded slash, backslash and dot consistently with the target app, closing a bypass where a denied operation could still be reached. Pull request #10684
- With clustered workflow deployment enabled, another app in the same namespace can no longer forge workflow and activity task results through the reserved executor actor. Pull request #10685
- The app HTTP middleware pipeline no longer shares a single root handler between requests, fixing responses that could carry a concurrent request's result. Pull request #10677
- Activity executions no longer stay pending when a workflow instance ID is reused while a previous run's activity is still in flight on the same sidecar. Pull request #10671
- Sidecars with hot reload no longer log subscription INFO lines every 60 seconds for subscriptions scoped to other apps. Pull request #10696
- The workflow executor actor no longer panics with a WaitGroup reuse error when it is deactivated during an in-flight call. Pull request #10681
- Dapr 1.18.7 fixes a sidecar crash when a workflow executor actor was deactivated during a call, data races in shutdown and deactivation paths, and an actor that stopped accepting calls after a reentrant call. Release
- Data races in the sidecar's scheduler job stream, hot reload and actor placement connections were fixed, including concurrent CloseSend on scheduler disconnects. Pull request #10674
Why it matters
This week is mostly about security and stability: several fixes close ways one app could spoof another's identity, reach denied operations, or forge workflow results, and those fixes are backported across the supported release lines. Alongside them, a batch of race and lifecycle bugs found during chaos testing are fixed, including a sidecar crash on workflow executor deactivation and pending activities when instance IDs are reused. Users on 1.17, 1.18 and 1.19 should pick up the matching patch releases.
Changelog entry
- Service invocation no longer forwards caller-supplied dapr-caller-app-id, dapr-caller-namespace and dapr-callee-app-id values to the target app. Pull request #10683
- Scheduler validates the target actor type of reminder requests against the caller's identity. Pull request #10682
- Service invocation access control handles percent-encoded slash, backslash and dot the same way as the target application. Pull request #10684
- Clustered workflow deployments reject workflow and activity task results sent through the reserved executor actor by another app. Pull request #10685
- HTTP app requests each get their own middleware pipeline handler instead of sharing one root handler. Pull request #10677
- Activity executions no longer remain pending when a workflow instance ID is reused while a prior activity is in flight. Pull request #10671
- Sidecars with hot reload stop logging subscriptions scoped to other apps every 60 seconds. Pull request #10696
- Workflow executor actor no longer panics when deactivated during an in-flight call. Pull request #10681
- Data races in sidecar shutdown, actor and workflow deactivation, input bindings and pub/sub are fixed. Pull request #10678
- Data races in the sidecar's scheduler job stream, hot reload and actor placement connections are fixed. Pull request #10674
- Integration suite added for workflow Select, covering racing events, timers, activities, retry chains and child workflows. Pull request #10668
- Dapr 1.17.15 fixes Azure Event Hubs checkpointing messages regardless of whether the application processed them. Release
Security and stability updates are out: spoofed caller identity headers, a service invocation access control bypass, and forged workflow task results through the reserved executor actor are fixed. Also fixed: a sidecar crash on workflow executor deactivation, reused instance IDs
This week's releases focus on security and stability across the supported versions. Security fixes stop service invocation from delivering spoofed caller identity headers, close an access control bypass using percent-encoded path characters, prevent the Scheduler from accepting actor reminders targeting another app's internal workflow actors, and block another app from forging workflow task results through the reserved executor actor. Stability fixes cover a sidecar crash when a workflow executor actor is deactivated during a call, activities left pending when workflow instance IDs are reused, subscription log noise every 60 seconds for subscriptions scoped to other apps, shared middleware handlers across concurrent HTTP app requests, and data races in shutdown, deactivation, input binding
Week of September 28, 2026
What shipped
- Dapr Runtime v1.19.0-rc.1 released as the first release candidate for the 1.19 version. Release
- Workflow creation no longer reruns the entire workflow if the create request is retried after the workflow has already started execution. Pull request #10595
- Fixed pubsub tracestate and baggage propagation in both HTTP and gRPC delivery paths so CloudEvent metadata is preserved end-to-end. Pull request #10385
- Fixed duplicate traceparent headers in gRPC metadata for service invocation by avoiding duplicate append of W3C trace context. Pull request #10596
- Added gRPC keepalive to the sidecar's connection to the placement leader to prevent silent network partition issues. Pull request #10572
- Fixed sidecars incorrectly falling back to placement when the scheduler was still initializing on cold start. Pull request #10570
- Fixed scheduler crashing and rebuilding when a cron job is deleted or overwritten as it fires by bumping go-etcd-cron. Pull request #10560
- Fixed component hotreload resolving secrets twice, which caused parse errors on Kubernetes when secrets were already decoded. Pull request #10526
- Updated dependencies to address CVE security issues. Pull request #10599
- Dapr Runtime v1.18.5-rc.1 released as the first release candidate for the 1.18.5 patch version. Release
Why it matters
The 1.19.0-rc.1 release candidate includes significant stability improvements across workflows, pubsub tracing, scheduler placement, and cron job handling. Multiple fixes address production issues found through chaos testing and integration tests, particularly around workflow reruns, trace context propagation, and silent network partition handling. These changes aim to reduce deployment issues in scheduler and placement service scenarios.
Changelog entry
- Workflow: don't re-run a workflow when its create is retried Pull request #10595
- Fix pubsub tracestate and baggage propagation for HTTP and gRPC delivery Pull request #10385
- Fix: avoid duplicate traceparent in SpanContextToGRPCMetadata Pull request #10596
- Fix actors keepalive on the scheduler placement leader connection Pull request #10572
- Fix sidecars falling back to placement on scheduler cold start Pull request #10570
- Scheduler: fix self restart when a firing job is deleted or overwritten Pull request #10560
- Fix hotreload: resolve a component's secrets exactly once on update Pull request #10526
- Workflow: admit activity completions by what history proves Pull request #10578
- Workflow: retry a completion that arrives before its scheduling is durable Pull request #10581
- Update dependencies for CVE Pull request #10599
Dapr v1.19.0-rc.1 is out. Fixes for workflow creation retries, pubsub tracestate propagation, gRPC keepalive on placement leader connections, and scheduler cron job handling.
Dapr Runtime v1.19.0-rc.1 is now available. This release includes critical stability improvements: workflow creation no longer reruns on retries, pubsub now correctly propagates tracestate and baggage in both HTTP and gRPC, gRPC keepalive prevents silent connection drops to placement leader, and scheduler cron jobs handle deletion/overwrite without crashing. These fixes address production scenarios found through chaos testing.
Week of September 21, 2026
What shipped
- Placement authority detection cutover and rollback logic enables Scheduler to handle placement operations, allowing gradual migration from Placement to Scheduler. Pull request #10416
- Fixed duplicate Prometheus metric samples that appeared after sidecar runtime hot reload, which previously caused metric gathering errors. Pull request #10537
- Fixed nil pointer error when upgrading from v1.18 to v1.19 using helm upgrade --reuse-values. Pull request #10559
- Restricted file permissions on sentry's trust bundle Secret from 0644 to 0440 for tighter security. Pull request #10534
- Updated durabletask-go dependency with detached workflow function name change from ScheduleNewWorkflow to ScheduleNewDetachedWorkflow. Pull request #10544
- Added scheduler placement performance tests to daily nightly runs alongside regular placement tests. Pull request #10539
- Added comprehensive unit test coverage for dead-letter publish paths in both HTTP and gRPC subscription postmen. Pull request #10525
- Improved integration test output readability by reducing terminal spam from 25,444 lines to focus on actual failures. Pull request #10350
- Fixed Go module vulnerabilities in the v1.18 release branch. Pull request #10551
Why it matters
This week addresses critical issues in metrics collection, Helm upgrades, and security permissions that affect operators running Dapr in production. The Placement to Scheduler migration continues advancing with authority detection logic. Integration testing improvements help contributors debug failures faster.
Changelog entry
- Placement authority detection: cutover and rollback for Scheduler-based placement Pull request #10416
- Fixed duplicate Prometheus metric samples after sidecar runtime hot reload Pull request #10537
- Fixed nil pointer error when upgrading from v1.18 with helm upgrade --reuse-values Pull request #10559
- Restricted sentry trust bundle Secret file permissions to 0440 Pull request #10534
- Updated durabletask-go with detached workflow function name changes Pull request #10544
- Added scheduler placement performance testing to daily nightly runs Pull request #10539
- Added dead-letter publish path unit tests for subscription postmen Pull request #10525
- Improved integration test output readability Pull request #10350
This week's updates: fixed duplicate Prometheus metrics after hot reload, resolved v1.18→v1.19 Helm upgrade failures, tightened trust bundle permissions, and advanced Scheduler placement integration.
Dapr this week shipped improvements across stability, operations, and migration: fixed duplicate Prometheus metrics appearing after sidecar restarts, resolved Helm upgrade failures when moving from v1.18 to v1.19, enhanced security by restricting trust bundle file permissions, and continued the Placement to Scheduler migration with authority detection logic. Integration test improvements also make debugging faster for contributors.
Week of September 14, 2026
What shipped
- Daprd now receives actor placement from the Scheduler service instead of only from Placement, including the placement stream transport, dissemination handling, and runtime wiring. Pull request #10440
- Workflow test suite now runs as a combined matrix of clustered, fastpath, and signing modes together, exposing bugs that single-mode legs could not reach. Pull request #10491
- Fixed six workflow actor bugs including turn commit failures, lost results, and abandoned commits that only appeared when multiple modes ran together. Pull request #10490
- Workflow state is now tested across daprd upgrades to verify that history rows, run-activity reminders, and timer reminders survive version transitions. Pull request #10505
- Workflow activity actor IDs maintain their three-part format across releases from 1.15 through 1.18 and into master to ensure compatibility. Pull request #10504
- Added new Grafana dashboards for Workflow and Scheduler subsystems and extended coverage in the actor dashboard and system services. Pull request #10496
- Integration test harness now supports workflow history signing mode that composes with clustered and fastpath modes for comprehensive coverage. Pull request #10489
- Integration tests for actors, workflows, and placement now run against both Placement and Scheduler Placement authorities via a new scheduler-placement mode. Pull request #10492
- Fixed version-skew integration suite for release-1.18 by patching the bindings metadata component build tag configuration. Pull request #10506
Why it matters
The Scheduler service can now serve actor placement alongside Placement, and workflows are tested more thoroughly across version boundaries and with multiple execution modes combined. These changes ensure operators can migrate to Scheduler-based placement and that workflow state survives daprd upgrades without losing activity or timer state.
Changelog entry
- Daprd now accepts actor placement from Scheduler service via placement stream transport with dissemination handling and placement-leader connector Pull request #10440
- Workflow integration test matrix now runs all combinations of clustered, fastpath, and signing modes Pull request #10491
- Fixed six workflow actor bugs: turn commit failures, lost results, abandoned commits, and result handling issues Pull request #10490
- Added cross-version daprd upgrade tests for in-flight workflows to verify history and reminder persistence Pull request #10505
- Maintained three-part workflow activity actor ID format across releases 1.15-1.18 and master Pull request #10504
- Added Grafana dashboards for Workflow and Scheduler subsystems; extended actor and system services dashboards Pull request #10496
- Added workflow history signing mode to integration test harness composable with other execution modes Pull request #10489
- New scheduler-placement mode in integration tests runs actor, workflow, and placement suites against both Placement and Scheduler Placement Pull request #10492
Workflows now run across multiple modes together in CI, fixing six actor bugs. Daprd gets actor placement from Scheduler. State tested across daprd upgrades.
This week's Dapr release work focused on Scheduler integration and workflow reliability. Daprd can now receive actor placement from the Scheduler service, enabling migration paths away from Placement. The workflow test matrix now combines clustered, fastpath, and signing modes, surfacing and fixing six previously hidden actor bugs. Workflows are tested across daprd version upgrades to ensure history, reminders, and state survive transitions. These improvements strengthen the foundation for production workloads.