v1.13.3
版本发布时间: 2024-05-21 21:16:29
dapr/dapr最新发布版本:v1.14.0-rc.7(2024-07-29 22:54:59)
Dapr 1.13.3
This update includes bug fixes:
- App API token forwarded from caller to receiving app
- Upgrade Go version to 1.21.9
- Placement server fails to disseminate placement tables
- Restore dapr_http_server_response_count HTTP metric
App API token forwarded from caller to receiving app
Problem
The caller sidecar is appending the local app API token to the egress request, thereby leaking the API token protecting the local app to the foreign sidecar.
Impact
Receiving app can have access to the calling app's API token and make unauthorized calls directly to the originating app - in case it is listening on 0.0.0.0 or an accessible IP address.
Root cause
A pull request accidentally added this change.
Solution
Fixed the issue and added integration tests to verify and avoid future regressions.
Upgrade Go version to 1.21.9
Problem
Go version 1.21.8 or older are impacted by CVE-2023-45288.
Impact
See https://nvd.nist.gov/vuln/detail/CVE-2023-45288
Root cause
See https://nvd.nist.gov/vuln/detail/CVE-2023-45288
Solution
Update Go version used to build Dapr.
Placement server fails to disseminate placement tables
Problem
In case of an error during dissemination of placement table to a sidecar instance, the dissemination to the remaining instances do not complete. See https://github.com/dapr/dapr/issues/7031
Impact
Sidecars can run with an old copy of the dissemination table and cannot invoke the correct Dapr sidecar for a given actor instance.
Root cause
During shutdown, all publish calls to the application where being cancelled.
Solution
Check the return value of performTableDissemination for errors.
Restore dapr_http_server_response_count HTTP metric
Problem
An existing metrics was removed without deprecation notice, affecting users that relied on it. See https://github.com/dapr/dapr/issues/7642
Impact
Users did not have this specific metric available anymore, potentially impacting their alerts and monitoring.
Root cause
Metric removed without deprecation notice.
Solution
Added the metric back.
1、 daprd_darwin_amd64.tar.gz 50.34MB
2、 daprd_darwin_amd64.tar.gz.sha256 92B
3、 daprd_darwin_arm64.tar.gz 45.57MB
4、 daprd_darwin_arm64.tar.gz.sha256 92B
5、 daprd_linux_amd64-stablecomponents.tar.gz 30.45MB
6、 daprd_linux_amd64-stablecomponents.tar.gz.sha256 108B
7、 daprd_linux_amd64.tar.gz 48.21MB
8、 daprd_linux_amd64.tar.gz.sha256 91B
9、 daprd_linux_arm-stablecomponents.tar.gz 28.52MB
10、 daprd_linux_arm-stablecomponents.tar.gz.sha256 106B
11、 daprd_linux_arm.tar.gz 41.25MB
12、 daprd_linux_arm.tar.gz.sha256 89B
13、 daprd_linux_arm64-stablecomponents.tar.gz 27.72MB
14、 daprd_linux_arm64-stablecomponents.tar.gz.sha256 108B
15、 daprd_linux_arm64.tar.gz 41.1MB
16、 daprd_linux_arm64.tar.gz.sha256 91B
17、 daprd_windows_amd64.zip 44.47MB
18、 daprd_windows_amd64.zip.sha256 90B
19、 grafana-actor-dashboard.json 20.55KB
20、 grafana-actor-dashboard.json.sha256 95B
21、 grafana-sidecar-dashboard.json 62.37KB
22、 grafana-sidecar-dashboard.json.sha256 97B
23、 grafana-system-services-dashboard.json 30.93KB
24、 grafana-system-services-dashboard.json.sha256 105B
25、 injector_darwin_amd64.tar.gz 12.55MB
26、 injector_darwin_amd64.tar.gz.sha256 95B
27、 injector_darwin_arm64.tar.gz 11.88MB
28、 injector_darwin_arm64.tar.gz.sha256 95B
29、 injector_linux_amd64.tar.gz 11.92MB
30、 injector_linux_amd64.tar.gz.sha256 94B
31、 injector_linux_arm.tar.gz 11.06MB
32、 injector_linux_arm.tar.gz.sha256 92B
33、 injector_linux_arm64.tar.gz 10.68MB
34、 injector_linux_arm64.tar.gz.sha256 94B
35、 injector_windows_amd64.zip 11.87MB
36、 injector_windows_amd64.zip.sha256 93B
37、 operator_darwin_amd64.tar.gz 13.18MB
38、 operator_darwin_amd64.tar.gz.sha256 95B
39、 operator_darwin_arm64.tar.gz 12.44MB
40、 operator_darwin_arm64.tar.gz.sha256 95B
41、 operator_linux_amd64.tar.gz 12.53MB
42、 operator_linux_amd64.tar.gz.sha256 94B
43、 operator_linux_arm.tar.gz 11.67MB
44、 operator_linux_arm.tar.gz.sha256 92B
45、 operator_linux_arm64.tar.gz 11.22MB
46、 operator_linux_arm64.tar.gz.sha256 94B
47、 operator_windows_amd64.zip 12.47MB
48、 operator_windows_amd64.zip.sha256 93B
49、 placement_darwin_amd64.tar.gz 11.73MB
50、 placement_darwin_amd64.tar.gz.sha256 96B
51、 placement_darwin_arm64.tar.gz 11.06MB
52、 placement_darwin_arm64.tar.gz.sha256 96B
53、 placement_linux_amd64.tar.gz 11.16MB
54、 placement_linux_amd64.tar.gz.sha256 95B
55、 placement_linux_arm.tar.gz 10.41MB
56、 placement_linux_arm.tar.gz.sha256 93B
57、 placement_linux_arm64.tar.gz 10MB
58、 placement_linux_arm64.tar.gz.sha256 95B
59、 placement_windows_amd64.zip 11.11MB
60、 placement_windows_amd64.zip.sha256 94B
61、 sentry_darwin_amd64.tar.gz 13.04MB
62、 sentry_darwin_amd64.tar.gz.sha256 93B
63、 sentry_darwin_arm64.tar.gz 12.35MB
64、 sentry_darwin_arm64.tar.gz.sha256 93B
65、 sentry_linux_amd64.tar.gz 12.38MB
66、 sentry_linux_amd64.tar.gz.sha256 92B
67、 sentry_linux_arm.tar.gz 11.48MB
68、 sentry_linux_arm.tar.gz.sha256 90B
69、 sentry_linux_arm64.tar.gz 11.1MB
70、 sentry_linux_arm64.tar.gz.sha256 92B
71、 sentry_windows_amd64.zip 12.33MB
72、 sentry_windows_amd64.zip.sha256 91B