🚀 Dapr 1.18 is here — and it's all about Workflows!
This release puts Dapr Workflows front and center, hardening them for security, durability, and scale. Whether you're running long-running business processes, human-in-the-loop approvals, or AI agent orchestration, 1.18 gives your workflows enterprise-grade guarantees out of the box.
Here's what's new for Workflows 👇
📦 Workflow History Context Propagation
Workflows can now pass slices of their history down to children. Child workflows read the upstream history context through a typed API — no more threading state through inputs or reaching into a state store.
🛡️ Workflow History Tamper Detection
Workflow history can now be cryptographically signed and verified on every state load. Each step is signed under the sidecar's mTLS SPIFFE identity and chained to the previous one — so tampering is caught the moment state is read. Protection extends across app boundaries too, with child workflow and activity completion attestation.
🔐 WorkflowAccessPolicy
A new CRD that controls which app IDs can invoke which workflows and activities. A pure allow-list with per-operation rules and glob matching — purpose-built for shared and multi-tenant clusters where unrestricted cross-app calls are a risk.
🎚️ Workflow Concurrency Limits
Cap how many workflows or activities run at once across the entire cluster, with global and per-name limits. The scheduler queues triggers and dispatches them as slots free up — backpressure done right.
🙋 Human-in-the-Loop, Now Observable
Indefinite WaitForExternalEvent waits now materialize a synthetic timer tagged with the awaited event name — so you can finally see what an instance is blocked on. Approval gates and human-in-the-loop patterns just got operable.
🪂 Graceful Stall on Oversized Payloads
Oversized workflow payloads used to tear down the whole stream and cancel every pending workflow. Now they're gracefully stalled in a recoverable state — the rest of the stream keeps running, and no instance is lost.
And beyond Workflows: the Jobs API graduates to Stable ✅, hot-reloading goes GA (on by default) 🔄, native Kubernetes sidecar container support, IPv6/dual-stack host resolution, and pub/sub now drains in-flight messages on graceful shutdown.
💜 Thank you to our contributors and our community! Dapr is built by an incredible community, and 1.18 is no exception. Huge thanks to everyone who contributed code, docs, reviews, and feedback this cycle.
Read the full release notes in the blog post:
blog.dapr.io/posts/2026/06/1…