Dapr Installer-Bundle v1.18.4-d3e.1

Dapr 1.18.4-d3e.1

D3E patch release based on upstream Dapr v1.18.4 and the previous D3E release v1.18.3-d3e.4. All D3E enterprise patches are carried forward. Upstream v1.18.4 keeps its components-contrib dependency at v1.18.4, so the D3E components-contrib fork stays on v1.18.4-d3e.1. The kit fork stays on v0.18.3-d3e.1, so the logging features delivered in v1.18.3-d3e.4 are unchanged.

This release matters for two reasons. Upstream v1.18.4 is a workflow reliability release, and it fixes seventeen workflow faults. This release also clears every reachable vulnerability on this line, and it adds one D3E dependency bump for a newly published gRPC advisory.

Upstream Fixes (Dapr 1.18.4)

This release merges upstream Dapr v1.18.4. Seventeen of its eighteen fixes are workflow fixes. The upstream notes, included at docs/release_notes/v1.18.4.md, give the full problem, impact, and root cause for each.

• Workflows stranded in PENDING — three separate faults left a new instance permanently PENDING, with no reminder registered and no error surfaced to monitoring. The triggers were a Scheduler replica shutdown, a start reminder that fired before the creation commit, and a placement rebalance during a Scheduler outage. A routine rolling upgrade was enough to hit the first one.
• Workflows stuck RUNNING or deadlocked — a child workflow created after ContinueAsNew could collide with a still-running child instance ID and deadlock the parent forever. A lost first execution after ContinueAsNew, and a turn answered with the previous turn's result, both left instances stuck RUNNING under WorkflowsClusteredDeployment. Child completions also reached the parent before the child committed its own state.
• History signing false positives — workflows wrongly failed as tampered after a stale completion, a transient state store fault, or a rejected child workflow creation. Force purge failed for every workflow when history signing was enabled. A child workflow that continued as new could not report its completion.
• Force purge — force purge left the workflow actor serving and writing its stale in-memory state.
• Other workflow fixes — terminate was silently dropped when it arrived in the same batch as other events. Schedule and status waits failed with a stalled-actor error while a workflow was stalled. NewGuid and other SDK-derived deterministic values repeated after ContinueAsNew. A hot-reloaded workflow access policy appeared in metadata before it was enforced.
• Pub/sub and bindings — pluggable pub/sub components delivered messages to the application one at a time instead of concurrently. Output binding invocations over gRPC forwarded binary trace metadata to components.

Security posture

Upstream v1.18.4 bumps golang.org/x/crypto to v0.56.0, go.etcd.io/etcd to v3.5.33, and github.com/valyala/fasthttp to v1.70.0. This release adds one D3E bump of google.golang.org/grpc to v1.82.2. Together they clear six advisories.

A govulncheck scan of ./cmd/... with -tags=allcomponents reports no reachable vulnerabilities for this release. The same scan of v1.18.3-d3e.4 reports four reachable vulnerabilities, plus one in an imported package.

Advisory	Component and issue	Was	Now	Status before
GO-2026-6355	golang.org/x/crypto/ssh — denial of service on a deadlocked established channel	v0.55.0	v0.56.0	Reachable through the SFTP output binding
GO-2026-6354	golang.org/x/crypto/ssh — denial of service on a deadlocked undecided channel	v0.55.0	v0.56.0	Reachable through the SFTP output binding
GO-2026-6114	go.etcd.io/etcd/server/v3 — Watch API authorization bypass	v3.5.30	v3.5.33	Reachable
GO-2026-6107	go.etcd.io/etcd/client/pkg/v3 — unbounded TLS handshake goroutines	v3.5.30	v3.5.33	Reachable
GO-2026-4950	github.com/valyala/fasthttp — authorization bypass via double-encoded paths	v1.53.0	v1.70.0	Imported package
CVE-2026-84445	google.golang.org/grpc — denial of service in xDS servers	v1.82.1	v1.82.2	Reported by trivy

CVE-2026-84445 was published after upstream v1.18.4, so this bump is a D3E change. Upstream Dapr stays on grpc v1.82.1. The fix is available on the 1.82 line as v1.82.2, so it does not force the 1.83 upgrade that this line cannot take. otelgrpc stays at v0.60.0 and etcd stays at v3.5.33.

Upstream also moves golang.org/x/net to v0.58.0 and github.com/dapr/durabletask-go to v0.12.5. The D3E dependency bumps from v1.18.3-d3e.2 and v1.18.3-d3e.3 stay, because they remain ahead of upstream: golang.org/x/image stays at v0.45.0 and github.com/rabbitmq/amqp091-go stays at v1.14.0.

Not included in this release

Four advisories remain in required modules. govulncheck reports that no D3E code path calls any of them, so they are unreachable. They are unchanged from v1.18.3-d3e.4.

Advisory	Component and issue	Present	Fixed in
GO-2026-5932	golang.org/x/crypto/openpgp — unmaintained and unsafe by design	v0.56.0	No fix available
GO-2026-5774, GO-2026-5775, GO-2026-5777	github.com/go-chi/chi/v5 — IP spoofing in middleware.RealIP	v5.2.4	v5.3.0

One image-scanner advisory also carries forward. A trivy scan of this release will still report it:

Advisory	Component	Present	Fixed in
CVE-2026-84304	google.golang.org/grpc	v1.82.2	v1.83.1

The fix for CVE-2026-84304 does not build on this line. The v1.82.2 bump does not clear it, because that fix landed only on the 1.83 line. The dependency chain of v1.83.1 forces otelgrpc v0.61.0, which removed the interceptor API that etcd 3.5.x still calls. The etcd bump to v3.5.33 does not change this, because the constraint is the 3.5 line itself. See the v1.17.13-d3e.3 release notes on release-1.17 for the full analysis. The bump needs either etcd 3.6 or an upstream resolution, and upstream Dapr stays on grpc v1.82.1 on every branch. The advisory is acknowledged with a scoped .trivyignore entry that expires 2026-12-01, so scans stay green on a tracked decision without permanent suppression.

Enterprise Patches

All D3E enterprise patches are carried forward unchanged. Two D3E changes ship beyond the upstream merge:

• The diagrid-dapr-injector Helm chart is published as version 1.0.3, which aligns it with the 1.16 and 1.17 lines (#479).
• google.golang.org/grpc is bumped to v1.82.2 to clear CVE-2026-84445. This is a dependency-only change.

There are no other D3E-specific runtime or Helm chart changes in this release.