What dapr/dapr shipped

This week: scheduler no longer stalls on concurrency gates and resolves triggers with unknown result statuses, placement ignores out-of-phase acks, staged workflow ops now report when they are staged, and the remote gRPC pool is keyed by address, namespace and app ID.

Changes this week in Dapr: the scheduler releases all concurrency gates before draining pending triggers and now resolves a trigger when a sidecar returns an unknown result status. Placement ignores acks that do not belong to the current phase, which fixes a disseminator stuck in the unlock phase. Workflow staged operations return at once when no workflow worker is connected and tell the caller the operation was staged. The remote gRPC connection pool is keyed by address, namespace and app ID. The MCP client falls back to the startup JWT SVID when Sentry cannot mint on demand, and brotli is bumped to v1.2.7.

Dapr 1.17.19, 1.18.10 and 1.19.1 are out. This week's fixes cover service invocation ACL handling, gRPC header limits, forged outbox messages, encrypted state errors, OIDC host validation, the public HTTP port and scheduler job deletion. Upgrade to pick them up.

Dapr 1.17.19, 1.18.10 and 1.19.1 are released. This week's work closes a set of security gaps: service invocation access control could be bypassed with percent-encoded characters and path parameters, CallLocal could skip ACL HTTP verb rules when metadata was empty, the internal outbox topic accepted forged messages, malformed encrypted state values could panic the sidecar, OIDC discovery did not reject forwarded hosts with userinfo, the public HTTP port accepted unauthenticated metadata writes, and scheduler prefix deletes could reach other apps' jobs. The releases also fix connection leaks while Placement is unreachable, SQLite writes failing with database is locked after a cancelled read, and permanently unrecoverable workflows. Upgrade to the latest patch on your release line.

Patch releases for 1.16, 1.17 and 1.18 include a security fix for the operator returning resources scoped to other apps. Also this week: timed-out actor calls return DeadlineExceeded, completed workflows ack duplicate wake-ups, and the sidecar no longer leaks connections when the

This week Dapr shipped patch releases on the 1.16, 1.17 and 1.18 lines with a security fix for the operator disclosing resources and secrets scoped to other apps; the operator now checks resource scopes against the caller's app ID. On the runtime side, a timed-out actor invocation over gRPC now returns DeadlineExceeded, a settled completed workflow acknowledges duplicate wake-ups instead of firing them at the finished instance, and the sidecar stops leaking a connection each second while no Scheduler host is reachable. The scheduler's pod RBAC is now limited to its own namespace, and the 1.19 line moved through release candidates toward 1.19.0 with its release notes in place.

Release candidate 1.19.0-rc.4 is out. This week: daprd binds its internal gRPC port before outbound connections, the scheduler keeps 10,000 etcd revisions instead of 1,000,000, workflow duplicate results no longer re-arm completed workflows, and pubsub registers streaming subscri

Release candidate 1.19.0-rc.4 is out. This week's fixes mostly target failure modes that appear under load. daprd now binds its internal gRPC port before any outbound connection, so the default 50002 port cannot be taken as an ephemeral source port and break both binds. The scheduler's embedded etcd keeps 10,000 revisions instead of 1,000,000, so it no longer retains the payloads of a million writes, and the scheduler exits when it cannot bind its port rather than looping. Workflows no longer re-arm a completed instance for a duplicate result and reload state on an empty inbox only when the cache is stale. Pubsub registers a streaming subscriber before acknowledging it, and hot reloaded subscriptions are listed only once subscribed. Sentry's pod cache is now scoped to injected pods.

Security and stability updates are out: spoofed caller identity headers, a service invocation access control bypass, and forged workflow task results through the reserved executor actor are fixed. Also fixed: a sidecar crash on workflow executor deactivation, reused instance IDs

This week's releases focus on security and stability across the supported versions. Security fixes stop service invocation from delivering spoofed caller identity headers, close an access control bypass using percent-encoded path characters, prevent the Scheduler from accepting actor reminders targeting another app's internal workflow actors, and block another app from forging workflow task results through the reserved executor actor. Stability fixes cover a sidecar crash when a workflow executor actor is deactivated during a call, activities left pending when workflow instance IDs are reused, subscription log noise every 60 seconds for subscriptions scoped to other apps, shared middleware handlers across concurrent HTTP app requests, and data races in shutdown, deactivation, input binding

Dapr v1.19.0-rc.1 is out. Fixes for workflow creation retries, pubsub tracestate propagation, gRPC keepalive on placement leader connections, and scheduler cron job handling.

Dapr Runtime v1.19.0-rc.1 is now available. This release includes critical stability improvements: workflow creation no longer reruns on retries, pubsub now correctly propagates tracestate and baggage in both HTTP and gRPC, gRPC keepalive prevents silent connection drops to placement leader, and scheduler cron jobs handle deletion/overwrite without crashing. These fixes address production scenarios found through chaos testing.

This week's updates: fixed duplicate Prometheus metrics after hot reload, resolved v1.18→v1.19 Helm upgrade failures, tightened trust bundle permissions, and advanced Scheduler placement integration.

Dapr this week shipped improvements across stability, operations, and migration: fixed duplicate Prometheus metrics appearing after sidecar restarts, resolved Helm upgrade failures when moving from v1.18 to v1.19, enhanced security by restricting trust bundle file permissions, and continued the Placement to Scheduler migration with authority detection logic. Integration test improvements also make debugging faster for contributors.

Workflows now run across multiple modes together in CI, fixing six actor bugs. Daprd gets actor placement from Scheduler. State tested across daprd upgrades.

This week's Dapr release work focused on Scheduler integration and workflow reliability. Daprd can now receive actor placement from the Scheduler service, enabling migration paths away from Placement. The workflow test matrix now combines clustered, fastpath, and signing modes, surfacing and fixing six previously hidden actor bugs. Workflows are tested across daprd version upgrades to ensure history, reminders, and state survive transitions. These improvements strengthen the foundation for production workloads.