Skip to content

v1.10.0

Latest
Latest

Choose a tag to compare

View all tags
@ks-temporal ks-temporal released this 03 Nov 01:49
v1.10.0
eace324
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

💥 Breaking Changes

  • temporal nexus operation describe --output json moves operation fields under info, matching temporal activity describe. The response now has a top-level runId, an info object holding the existing fields, and a top-level input plus either result or failure. Anything parsing the JSON will find execution fields one level down, at .info.operationId instead of .operationId and so on. --raw output also gains the info wrapper. (#1225)
  • temporal worker deployment describe-version --output json leaves out unset times. routingChangedTime, currentSinceTime, rampingSinceTime and drainageInfo (including its lastChangedTime and lastCheckedTime) used to hold 1970-01-01T00:00:00Z or zero-value times when unset; they are now omitted. Scripts that read these fields should treat a missing field as unset. The output also gains status and lastModifierIdentity. (#1223)

Highlights

This release moves the embedded dev server to OSS Server v1.32.2 and fixes reported vulnerabilities in the CLI's dependencies. Users upgrading from v1.9.1 should read the breaking changes above.

Added

  • Standalone Nexus Operations are on by default in the dev server. The CLI sets nexusoperation.enableStandalone=true, which Server v1.32.2 leaves off by default, so every start-dev user now runs this feature. To turn it off, start the dev server with --dynamic-config-value nexusoperation.enableStandalone=false. (#1221)
  • Priority and fairness are visible from the CLI. temporal workflow describe and temporal activity describe show the priority key, fairness key and fairness weight when set. temporal task-queue describe --report-priority-stats breaks Workflow and Activity Task Queue statistics down by priority key across all build IDs, and temporal task-queue config get shows fairness key weight overrides. (#1217)
  • Worker Deployment Versions can be managed with compute configuration (Experimental). The new temporal worker deployment version command group can create, describe and delete a Version. Its compute-config subcommands attach, update, describe or remove the compute provider that runs the Version's workers, with AWS Lambda (#1235) and Modal (#1240) supported.

Changed

  • temporal server start-dev now runs OSS Server v1.32.2, and the bundled Web UI moves to v2.56.1.
  • The bundled Web UI stays on the v2.56.x line, because UI Server v2.57.0 and later require go.temporal.io/api v1.64, which OSS Server v1.32.x is not compatible with.
  • The bundled Nexus SDK moves to v0.7.0 (github.com/nexus-rpc/sdk-go), ahead of the v0.6.0 that Server v1.32.2 ships with. Serializer errors are now passed through instead of being replaced, so in the dev server, malformed input to a system Nexus Operation returns the underlying decode error rather than BAD_REQUEST "invalid input". (#1181)
  • temporal worker deployment describe-version text output shows Status and LastModifierIdentity, and no longer shows a never-set time as "a long while ago". (#1223)
  • The CLI is built with Go 1.26.10, and the published Docker image is built on Alpine 3.24.3. (#1250, #1251)

Fixed

Dependency updates fix the following reported vulnerabilities. govulncheck ./... reports no reachable vulnerabilities on this release.

Dependency Version Fixes
Go standard library 1.26.10 CVE-2026-111943, CVE-2026-94448, CVE-2026-97030, CVE-2026-56866, CVE-2026-97031, CVE-2026-94440, CVE-2026-78667, CVE-2026-94439, CVE-2026-56857
golang.org/x/net v0.62.0 CVE-2026-78659, CVE-2026-78660, CVE-2026-78669, CVE-2026-78663, CVE-2026-97032, CVE-2026-78661, CVE-2026-97045
go.opentelemetry.io/otel (sdk, otlptrace, otlptracegrpc) v1.45.0 CVE-2026-81870
github.com/labstack/echo/v4 v4.16.1 CVE-2026-118264 (critical); CVE-2026-118260, CVE-2026-118261, CVE-2026-118262, CVE-2026-118650 (high); 5 medium
github.com/gomarkdown/markdown v0.0.0-20260724235538-61af6e1e6971 CVE-2026-102941 (high)
github.com/go-jose/go-jose/v4 v4.1.6 CVE-2026-116587 (#1247)

UI Server v2.56.1 still requires a gomarkdown version affected by CVE-2026-102941, so the CLI pins gomarkdown to the fixed version until UI Server picks it up.

⚠️ Risks

  • Standalone Nexus Operations are on by default in the dev server. The CLI sets nexusoperation.enableStandalone=true, which Server v1.32.2 leaves off by default, so every start-dev user now runs this server feature. To turn it off, start the dev server with --dynamic-config-value nexusoperation.enableStandalone=false. (#1221)
  • Modal compute configuration depends on server-side support that hasn't shipped. The server change it relies on is still open, and the commands were tested manually only against a test cell with Modal enabled. Against a server without it, the commands return an error for the unsupported options. (#1240)
  • AWS Lambda compute configuration isn't covered by CI. Its functional tests are skipped because they need AWS Lambda and assume-role fixtures, so these commands are covered by unit tests only. (#1235)
  • The dev server runs with some dependencies newer than Server v1.32.2 was tested with. The API (go.temporal.io/api v1.63.5) and gRPC versions match the server. Others are ahead of it, including nexus-rpc v0.7.0 (see Changed), OpenTelemetry v1.45.0 and its gRPC/HTTP instrumentation v0.70.0, and golang.org/x/net v0.62.0. The OpenTelemetry instrumentation only takes effect when tracing is configured.
  • Some reported vulnerabilities have no fix yet. echo CVE-2026-118651 and CVE-2026-118653 have no upstream release. golang.org/x/crypto/openpgp (GO-2026-5932) is unmaintained and has no tagged fix, but govulncheck finds it isn't called.

What's Changed

  • Remove redundant CHASM and standalone activity config by @fretz12 in #1222
  • Enable standalone nexus operations in devserver, and support delete by @S15 in #1221
  • 💥 Includes input/output for nexus op describe JSON by @S15 in #1225
  • Bump cliext go directive to 1.26.8 to match root module by @ks-temporal in #1212
  • chore(deps): bump docker/setup-qemu-action from 4.2.0 to 4.3.0 in the github-actions group by @dependabot[bot] in #1216
  • chore(deps): bump github.com/nexus-rpc/sdk-go from 0.6.0 to 0.7.0 by @dependabot[bot] in #1181
  • chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by @dependabot[bot] in #1182
  • ci: disable cloud API key tests by @ks-temporal in #1242
  • Surface priority and fairness details in CLI output by @moody-temporal in #1217
  • 💥 Show all important fields and omit unset times in worker deployment describe-version by @moody-temporal in #1223
  • Adds compute-config commands under worker deployment version, with provider sub-commands by @mani-j9 in #1235
  • Add compute-config modal-function create and update commands by @harish-narayanappa-10 in #1240
  • VLN-1871: remediate go-jose-below-4.1.6 by @milescrabill in #1247
  • Bump dev server to OSS v1.32.2 and fix reported CVEs by @ks-temporal in #1250
  • Bump Alpine base image to 3.24.3 by @ks-temporal in #1251

New Contributors

Full Changelog: v1.9.1...v1.10.0

Contributors

milescrabill, S15, and 6 other contributors
Assets 11
Loading