LoginSign Up
← Back to all sparks
D

Dapr

DEVOPS
Velocity6.3

Portable event-driven runtime for building distributed applications

dapr.io ↗

Nine days after 1.19 GA, Dapr patches 11 security flaws across three release lines.

distributed runtimeworkflowssecurityaccess controlmcp
◆Current state
Dapr 1.19.1, 1.18.10 and 1.17.19 landed together on Oct 31 with the same 11 security fixes. They cover access control bypasses in service invocation, an API token check bypass, Scheduler reminders delivered to the wrong app, unauthenticated metadata writes on the public port, and forged outbox messages. 1.19 itself reached GA on Oct 22 with up to 40% more workflow throughput, cross-app workflow control and a Dapr MCP server.
◆Where it's heading
The 1.19 feature push is now followed by a hardening pass on trust between apps, sidecars and control plane services. Several fixes tighten boundaries inside a namespace, which matters more as cross-app workflows make those boundaries central. Older lines are still patched in parallel, and the percent-encoding fix extends one first shipped in 1.17.16 and 1.18.6.
◆Prediction
Expect further 1.19.x patches, since this batch completes an earlier incomplete fix and more of the same class may surface. The entries give no timing for 1.20.

◆Recent moves

  1. 9d ago

    Dapr 1.17.19: 11 security fixes for the 1.17 line

    1.17.19 is a security-only release with the same 11 fixes, showing the 1.17 line still receives full patches. It also completes the percent-encoding access control fix first shipped in 1.17.16.

    View source ↗
  2. 9d ago

    Dapr 1.18.10: security batch, unrecoverable workflow fix

    1.18.10 carries the same 11 security fixes and the Placement leak fix to the 1.18 line. It also fixes workflows that became permanently unrecoverable after a save with a timer in the inbox.

    View source ↗
  3. 9d ago

    Dapr 1.19.1: 11 security fixes, Placement connection leak closed

    The first 1.19 patch is mostly security: 11 fixes to app-to-app and control plane trust, plus a sidecar connection leak during Placement outages and SQLite `database is locked` failures. It turns the release's cross-app story toward hardening within nine days of GA.

    View source ↗
  4. 18d ago

    Dapr 1.19: cross-app workflows, MCP server, faster runtime

    ⚡ SPARK

    After seven candidates, 1.19 GA lands the workflow focus of this cycle: up to 40% more throughput, cross-app workflow control under access policies, and detached workflows. It also opens new ground with alpha storage, search and vector building blocks and an MCP server.

    View source ↗
  5. 19d ago

    Dapr 1.19.0-rc.7: final candidate, two backports

    The seventh and final candidate adds two backports: Operator scope enforcement and a lighter path for wake-ups on completed workflows.

    View source ↗
  6. 19d ago

    Dapr 1.17.18: Operator scope-leak fix backported

    1.17.18 carries the Operator scoping fix to the 1.17 line, which returned other apps' HTTPEndpoints with secrets resolved to plaintext.

    View source ↗