LoginSign Up
← Back to all sparks
D

Dapr

DEVOPS
Velocity5.0

Portable event-driven runtime for building distributed applications

dapr.io ↗

Dapr is shipping fixes across three release branches at once, most of them in workflows.

distributed-systemsworkflowskubernetesactorsreliability
◆Current state
Dapr maintains 1.16, 1.17 and 1.18 concurrently, and the current window is entirely bug fixes backported across all three. The 1.18.3 release carries fifteen of them; the older branches receive the subset that applies. Workflow durability dominates — stalled workflows left unrecoverable after the last worker disconnected, terminate events silently dropped when batched, orphaned activity-result reminders retrying forever, and continue_as_new iterations sharing one unbounded trace.
◆Where it's heading
The failure reports are notably specific about who was affected and under what configuration, and several describe components that looked healthy while silently doing nothing — input bindings that never activated because a warmup probe had a hardcoded three-second budget, an Azure credential chain that stopped at SPIFFE instead of falling back. That class of bug is what a maturing distributed runtime finds once the obvious crashes are gone. Release candidates are published openly before each patch, so the same fixes appear several times in the feed.
◆Prediction
Expect continued patch releases across all three branches, with workflow recovery paths the likeliest source given how many of this window's fixes cluster there.

◆Recent moves

  1. 4d ago

    Azure credential chain no longer halts at SPIFFE (1.16 backport)

    Backports to the 1.16 branch the fix for Azure component authentication stopping at the SPIFFE credential instead of falling through to managed identity or the Azure CLI. Anyone on 1.16.0 or later with azureClientId and azureTenantId but no secret was unable to authenticate despite a working credential being available.

    View source ↗
  2. 4d ago

    Stalled workflow recovery fixed (1.17 backport)

    Brings the stalled-workflow recovery fix to the 1.17 branch alongside the SPIFFE credential fixes. Stalling exists so a workflow survives its workers leaving, so a stall that could not resume defeated the mechanism's purpose during exactly the rolling upgrades it was built for.

    View source ↗
  3. 4d ago

    Fifteen fixes across actors, scheduler, placement and workflows

    The substantive release of this window, collecting fifteen fixes: actor state stores now hot reload, a single sidecar disconnecting mid-dissemination no longer drops every sidecar in the namespace from Placement, several scheduler crashes and hangs are resolved, and a cluster of workflow bugs around terminate, continue_as_new tracing and orphaned reminders is cleared.

    View source ↗
  4. 8d ago

    Release candidate for 1.18.3

    A release candidate carrying five backported pull requests that ship in 1.18.3 four days later. Pre-release packaging of work counted in the final release.

    View source ↗
  5. 12d ago

    Go 1.26.5 rebuild; input binding probe timeout made configurable

    Rebuilds on Go 1.26.5 after govulncheck flagged standard library and toolchain vulnerabilities in 1.26.4, and makes the input-binding subscription probe timeout configurable. The probe's hardcoded three-second budget left slow-starting applications with bindings that initialized cleanly but never delivered an event.

    View source ↗
  6. 12d ago

    Input binding probe timeout fix (1.16 backport)

    Backports the input-binding probe fix to 1.16. On the HTTP channel a failed probe also aborted every remaining binding on that sidecar, leaving only a warning in the log; on gRPC it failed silently.

    View source ↗