Skip to content

v2.11.0

Latest
Latest

Choose a tag to compare

View all tags
@yohamta0 yohamta0 released this 26 Jul 12:12
v2.11.0
2669d96
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release adds controller DAGs, a new DAG type where an LLM decides what runs next instead of you wiring the path in advance, tightens the CORS defaults (breaking for cross-origin setups), and fixes a long list of bugs across retries, distributed logs, scheduling, and handler outputs.

Highlights

Controller DAGs (#2435)

With type: controller, steps stop being a plan and become a catalog of actions. A tasks list declares the goals, an llm block picks the model, and the controller chooses one action per turn, observes the result, and marks tasks complete until every goal is settled.

type: controller

llm:
  provider: anthropic
  model: claude-sonnet-4-20250514

steps:
  - name: run_tests
    description: Run the test suite.
    run: make test
  - name: fix_flaky
    description: Quarantine the known flaky test.
    run: ./scripts/quarantine.sh
  - id: sign_off
    name: sign_off
    action: human.task
    with:
      prompt: Tests are green. Ship it?

tasks:
  - name: tests_green
    description: Finished when run_tests succeeded on its most recent run.
  - name: approved
    description: Finished when a person answered sign_off with approved=true.

Human tasks (#2396, #2399)

The human.task action pauses a run for an acknowledgement or typed operator input, validated against a JSON Schema form, with REST API and Web UI surfaces for answering pending tasks.

Cloud secret providers (#2402, #2403, #2404, #2438)

AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Alibaba Cloud KMS join the secret provider set. Profiles and secrets are now managed from one place in the UI (#2416), and LLM provider and model fields accept value references (#2433).

Authentication and access control

Proxy header authentication (#2397) lets an upstream identity-aware proxy authenticate users, with trusted-proxy validation and Helm chart support. OIDC claims can map to workspace grants (#2395), and every DAG run now records the actor that triggered it (#2423).

Breaking change: CORS defaults are secure by default (#2387)

cors_allowed_origins / DAGU_CORS_ALLOWED_ORIGINS changed meaning:

Before Now
Unset or empty Every origin allowed, without credentials Cross-origin browser access disabled
Exact origins Only those origins, credentials enabled Unchanged
* in the list Treated the same as unset Allows every origin without credentials, and logs a security warning (louder when auth.mode: none)

If a separate front end or another host calls the Dagu API from a browser, list its origin explicitly before upgrading. Same-origin usage, including the bundled Web UI and any CLI or server-side client, is unaffected.

Other hardening in this release: DAG resolution is constrained to configured directories (#2424), Windows process tree termination no longer swallows errors (#2440), API key requests skip bcrypt on the hot path (#2394), Git Sync is limited to DAG files (#2413), and dependencies flagged by security scans were bumped (#2430, #2427, #2431).

Notable fixes

  • Synchronous start API no longer times out on runs over a few minutes (#2386)
  • Distributed run logs stream while the run is still active (#2409)
  • Step and run retries inside child DAGs started via dag.run now target the persisted child run (#2419)
  • Scheduled runs resolve the workspace base config again, fixing unknown-action failures and silently wrong env (#2422)
  • stdout.outputs on handler_on steps is published to the DAG run outputs (#2439), and onInit / onWait handlers appear on run status surfaces (#2441)
  • Parameter declaration order is preserved in the Start DAG UI (#2421)
  • Relative working_dir resolves against the file the DAG was written in (#2447)
  • Cached DAG load errors are re-checked instead of being served forever (#2442)
  • Output of a step attempt that follows an earlier one is flushed (#2446)
  • Controller no longer overrides parameters a step already decided (#2445)
  • Workers reconnect to the coordinator after a heartbeat timeout (#2408), and failed queued dispatches are finalized (#2437)
  • Succeeded parallel child runs are reused rather than re-executed (#2415)

Also added

Git worktree actions (#2391), dynamic template references (#2414), sub-workflows declaring the outputs their caller sees (#2444), a fallback pull policy (#2401), and Telegram topicId for forum group notifications (#2405).

Added

Changed

  • chore(deps): bump the ui-security group across 1 directory with 4 updates (#2427) @dependabot

Fixed

  • fix: update Go to 1.26.5 (#2384) @yohamta0
  • fix: refresh synchronous DAG response deadline (#2386) @yohamta0
  • fix: secure CORS defaults (#2387) @yohamta0
  • fix: absorb Windows PowerShell cold start in command substitution (#2392) @yohamta0
  • test: scale coordinator dispatch timeout on Windows (#2393) @yohamta0
  • perf: avoid bcrypt on API key requests (#2394) @yohamta0
  • fix: wait for replacement attempt initialization (#2398) @yohamta0
  • fix: stream distributed logs while runs are active (#2409) @yohamta0
  • fix: limit Git Sync to DAGs (#2413) @yohamta0
  • fix: reuse succeeded parallel child runs (#2415) @yohamta0
  • fix: target step retries in persisted child DAG runs (#2419) @yohamta0
  • fix: preserve YAML parameter order in Start DAG UI (#2421) @yohamta0
  • fix: resolve workspace base config for scheduled runs (#2422) @yohamta0
  • fix: constrain DAG resolution to configured directories (#2424) @yohamta0
  • fix: bump dependencies flagged by security scans (#2430) @yohamta0
  • chore(deps): bump github.com/oapi-codegen/oapi-codegen/v2 from 2.5.1 to 2.7.1 in the go-security group across 1 directory (#2431) @dependabot
  • refactor: streamline cloud secret providers (#2434) @yohamta0
  • fix: finalize failed queued dispatches (#2437) @yohamta0
  • fix: publish lifecycle handler outputs to the DAG run outputs (#2439) @yohamta0
  • Security: Windows Process Tree Termination Ignores Errors (#2440) @tomaioo
  • fix: expose onInit and onWait handlers on run status surfaces (#2441) @yohamta0
  • fix: re-check cached DAG load errors instead of serving them forever (#2442) @yohamta0
  • test: avoid Windows fault in scheduler panic recovery (#2443) @yohamta0
  • fix: stop the controller overriding parameters a step already decided (#2445) @yohamta0
  • fix: flush the output of a step attempt that follows an earlier one (#2446) @yohamta0
  • fix: resolve a relative working_dir against the file the DAG was written in (#2447) @yohamta0

Contributors

Thanks to our contributors for this release:

Contribution Contributor
bug: Preserve YAML parameter declaration order in the Start DAG UI (#2420) @VKFloFi (report)
bug: Retrying a step (or the whole run) inside a child DAG started via dag.run silently does nothing (#2411), feat: Show which user triggered a manual DAG run (#2412) @VKdennis (report)
bug: The start-sync api has no response when the dag's execute time more than 3 minutes (#2385) @aigeling (report)
Security issue with HTTP Headers of REST API that allow for remote code execution (#726) @chrishoage (report)
chore(deps): bump the ui-security group across 1 directory with 4 updates (#2427), chore(deps): bump github.com/oapi-codegen/oapi-codegen/v2 from 2.5.1 to 2.7.1 in the go-security group across 1 directory (#2431) @dependabot
feat: add fallback pull policy (#2401), feat: add Telegram topicId for forum group support notification (#2405) @dodyirawan85
feat: add outputBuffering option for step log streaming (#2310) @four-bytes-robby (report)
bug: stdout.outputs declared on a handler_on step is captured but never published to the DAG run outputs (#2428), question: onInit handler is recorded but never displayed — is that intended? (#2429) @oscar6echo (report)
feat: reconnect worker to coordinator after heartbeat timeout (#2408) @pirm-in
Security: Windows Process Tree Termination Ignores Errors (#2440) @tomaioo
bug: scheduled runs drop the workspace base config — unknown-action failures and silently wrong env (#2418) @vk-marcel (report)

New Contributors

Full Changelog: v2.10.7...v2.11.0

Contributors

chrishoage, pirm-in, and 10 other contributors
Assets 15
Loading