LoginSign Up
← Back to all sparks
D

Dapr

DEVOPS
Velocity5.0

Portable event-driven runtime for building distributed applications

dapr.io ↗

Dapr patches three release lines at once and writes root-cause notes for each fix.

distributed-runtimeactorsworkflowsbackport-disciplinemcpcve-patching
◆Current state
Dapr maintains 1.16, 1.17 and 1.18 concurrently, cutting patches on all three within days of each other and running a numbered release-candidate sequence on the active line. The release notes are unusually rigorous — each fix gets problem, impact, root cause and solution sections. The most recent round fixed input bindings that never activated when an application was slow to answer the subscription discovery probe, which previously had a hardcoded three-second budget, and moved builds to Go 1.26.5 for standard library vulnerabilities.
◆Where it's heading
The current fix pattern points at applications and clusters under stress: probe timeouts too tight for JVM warmup, actor timer callbacks blocking other actors, sidecars restarting on unrelated configuration changes, workflow instance ID reuse while child workflows are still running. This is the work of a runtime being pushed by production deployments rather than one adding surface. The 1.18 line has also picked up MCP server support, visible only through registration retry and credential reload fixes.
◆Prediction
Given the rc sequence in flight, a 1.18.3 release is imminent; the MCP server path is the newest component and the most likely source of the next round of fixes.

◆Recent moves

  1. 2d ago

    Go 1.26.5 rebuild and input binding probe timeout fix

    Two changes with clear operational impact: a Go toolchain bump for reported standard library vulnerabilities, and the binding subscription probe fix that had left slow-starting applications with bindings that never activated despite appearing healthy in the metadata endpoint.

    View source ↗
  2. 2d ago

    Binding probe fix backported to the 1.16 line

    The same probe timeout fix delivered to 1.16 two minutes before the 1.17 release. The simultaneous cut across lines is how Dapr handles a bug that silently disables a component rather than failing loudly.

    View source ↗
  3. 5d ago

    1.18.3 first release candidate

    A candidate carrying eleven backports — scheduler shutdown draining, HTTP job delivery without a data field, an MCP server registration retry and a pubsub panic on non-string trace fields. Staging for a patch release rather than a release itself.

    View source ↗
  4. 18d ago

    Actor, workflow and component reload fixes across the 1.18 line

    A dense patch release addressing exactly the failure modes that show up under load: a slow actor timer callback delaying every other actor, sidecars restarting on unrelated Configuration changes, SPIFFE SVID propagation, and reminders failing to register when names contained characters like pipe or at-sign. MCP servers with secret-referenced credentials had been reloading every sixty seconds.

    View source ↗
  5. 22d ago

    Fourth 1.18.2 candidate: workflow metrics and reminder recovery

    Two backported fixes staged for 1.18.2. Part of the numbered candidate sequence rather than a distinct release.

    View source ↗
  6. 22d ago

    Third 1.18.2 candidate: actor timers and dependency bumps

    Staging for 1.18.2, including the bounded pool for concurrent in-memory timer callbacks and the go-chi and mongo-driver CVE bumps that the final release describes in full.

    View source ↗