发布日期: 2026-03-06
版本号: v1.16.10

Dapr 1.16.10 更新包含多个错误修复、安全修复以及 Go 版本升级。主要修复内容包括：针对 Pulsar PubSub 组件，在发布消息前验证 JSON 消息是否符合 Avro 模式，以防止下游反序列化失败；将 Go 版本从 1.24.13 升级至 1.25.7，以解决已知漏洞；更新 OpenTelemetry SDK 至 v1.40.0 以修复一个可能允许任意代码执行的安全问题；将 golangci-lint 更新至 v2.10.1 以支持 Go 1.25 代码的静态检查；此外，还修复了 WASM 绑定和中间件组件在非 WASM 架构上无法注册的问题，该问题由文件名意外匹配 Go 构建约束引起。

更新内容 （中文）

Dapr 1.16.10

此更新包含错误修复、安全修复以及 Go 版本升级：

Pulsar PubSub：发布前根据 Avro 架构验证 JSON 消息

问题

使用带有 Avro 架构的 Pulsar PubSub 组件时，无效的 JSON 消息在未验证的情况下被发布到主题。这可能导致下游消费者反序列化消息失败，引起静默数据损坏或消费者崩溃。

影响

向 Avro 类型的 Pulsar 主题发布格式错误或与架构不兼容消息的应用程序不会收到任何错误反馈，导致难以诊断的下游处理故障。

根本原因

Pulsar PubSub 组件在发布前未根据配置的 Avro 架构验证 JSON 负载。此外，Avro 编解码器在每次发布调用时都被重新编译，而不是在初始化时缓存。

解决方案

  • 使用 linkedin/goavro 添加 Avro 架构验证，在发布前根据主题的 Avro 架构验证 JSON 消息。
  • 在组件初始化时缓存编译后的 Avro 编解码器以提高性能。
  • 添加了全面的测试覆盖，以处理 Avro 边缘情况，包括可空字段、嵌套记录、数组、映射、枚举和联合类型。

Go 版本更新至 1.25.7

问题

Dapr 1.16.x 是使用 Go 1.24.13 构建的。Go 1.25.7 包含针对 go 命令和 crypto/tls 包的安全修复，以及编译器和 crypto/x509 包的错误修复。

影响

运行使用 Go 1.24.x 构建的 Dapr 的用户可能暴露于已在 Go 1.25.7 中修补的已知漏洞。

解决方案

将 Go 版本从 1.24.13 更新至 1.25.7。

OpenTelemetry SDK 更新至 v1.40.0

问题

Dapr 使用的 OpenTelemetry Go SDK v1.35.0 受漏洞 GO-2026-4394（通过 PATH 劫持进行任意代码执行）影响。

影响

该漏洞可能允许攻击者在可以控制 PATH 的环境中执行任意代码。

解决方案

将 go.opentelemetry.io/otel/sdk 及相关 OpenTelemetry 包从 v1.35.0 更新至 v1.40.0。

golangci-lint 更新至 v2.10.1

问题

golangci-lint v1.64.6 是使用 Go 1.24 构建的，无法对 Go 1.25 代码进行 lint 检查。

影响

CI lint 检查将在使用 Go 1.25.7 时失败。

解决方案

从 golangci-lint v1.64.6 迁移至 v2.10.1（支持 Go 1.25）。将 .golangci.yml 更新为 v2 配置格式。

WASM 绑定和中间件组件在非 WASM 架构上注册失败

问题

升级到 Dapr v1.16.0 后，使用 WASM 输出绑定或 WASM HTTP 中间件组件的应用程序启动时出现以下错误：

FATA[0000] Fatal error from runtime: process component wasm error:
[INIT_COMPONENT_FAILURE]: initialization error occurred for wasm
(bindings.wasm/v1): couldn't find binding wasm (bindings.wasm/v1)

影响

WASM 绑定和 WASM HTTP 中间件组件在所有生产架构（amd64、arm64、arm）上完全不可用，影响 v1.16.0 至 v1.16.9 的所有版本。

根本原因

在 v1.16.0 中，PR #9009 为了命名一致性重命名了组件注册文件：

  • binding_webassembly.go → bindings_wasm.go
  • middleware_http_webassembly.go → middleware_http_wasm.go

Go 会在文件名匹配 *_GOARCH.go 时应用隐式构建约束。由于 wasm 是有效的 GOARCH 值，以 _wasm.go 结尾的文件仅在 GOARCH=wasm 时编译，导致 WASM 组件在 amd64/arm64/arm 平台上永远不会注册。这无意中逆转了 #5486 和 #6439 中专门解决此文件名冲突的修复。

解决方案

将文件重命名回使用 _webassembly 后缀（不匹配任何有效的 GOARCH 值）：

  • bindings_wasm.go → bindings_webassembly.go
  • middleware_http_wasm.go → middleware_http_webassembly.go

更新内容 （原始）

Dapr 1.16.10

This update includes bug fixes, security fixes, and a Go version bump:

Pulsar PubSub: validate JSON messages against Avro schema before publishing

Problem

When using the Pulsar PubSub component with Avro schemas, invalid JSON messages were being published to topics without validation. This could result in downstream consumers failing to deserialize messages, causing silent data corruption or consumer crashes.

Impact

Applications publishing malformed or schema-incompatible messages to Avro-typed Pulsar topics would not receive any error feedback, leading to downstream processing failures that were difficult to diagnose.

Root Cause

The Pulsar PubSub component did not validate JSON payloads against the configured Avro schema before publishing. Additionally, the Avro codec was being recompiled on every publish call instead of being cached at initialization time.

Solution

  • Added Avro schema validation using linkedin/goavro to validate JSON messages against the topic’s Avro schema before publishing.
  • Cached the compiled Avro codec at component initialization time for improved performance.
  • Added comprehensive test coverage for Avro edge cases including nullable fields, nested records, arrays, maps, enums, and union types.

Go version updated to 1.25.7

Problem

Dapr 1.16.x was built with Go 1.24.13. Go 1.25.7 includes security fixes to the go command and crypto/tls package, as well as bug fixes to the compiler and crypto/x509 package.

Impact

Users running Dapr built with Go 1.24.x may be exposed to known vulnerabilities that have been patched in Go 1.25.7.

Solution

Updated the Go version from 1.24.13 to 1.25.7.

OpenTelemetry SDK updated to v1.40.0

Problem

The OpenTelemetry Go SDK v1.35.0 used by Dapr was affected by vulnerability GO-2026-4394 (Arbitrary Code Execution via PATH Hijacking).

Impact

The vulnerability could allow arbitrary code execution in environments where an attacker can control the PATH.

Solution

Updated go.opentelemetry.io/otel/sdk and related OpenTelemetry packages from v1.35.0 to v1.40.0.

golangci-lint updated to v2.10.1

Problem

golangci-lint v1.64.6 was built with Go 1.24 and cannot lint Go 1.25 code.

Impact

CI linting would fail with Go 1.25.7.

Solution

Migrated from golangci-lint v1.64.6 to v2.10.1, which supports Go 1.25. Updated .golangci.yml to v2 configuration format.

WASM binding and middleware components fail to register on non-wasm architectures

Problem

After upgrading to Dapr v1.16.0, applications using the WASM output binding or WASM HTTP middleware component fail to start with the error:

FATA[0000] Fatal error from runtime: process component wasm error:
[INIT_COMPONENT_FAILURE]: initialization error occurred for wasm
(bindings.wasm/v1): couldn't find binding wasm (bindings.wasm/v1)

Impact

WASM binding and WASM HTTP middleware components are completely unavailable on all production architectures (amd64, arm64, arm), affecting all versions from v1.16.0 through v1.16.9.

Root Cause

In v1.16.0, PR #9009 renamed component registration files for naming consistency:

  • binding_webassembly.go → bindings_wasm.go
  • middleware_http_webassembly.go → middleware_http_wasm.go

Go applies an implicit build constraint when a filename matches *_GOARCH.go. Since wasm is a valid GOARCH value, files ending in _wasm.go are only compiled when GOARCH=wasm, causing the WASM components to never be registered on amd64/arm64/arm platforms. This inadvertently reverted fixes from #5486 and #6439 which specifically addressed this exact filename clash.

Solution

Renamed the files back to use the _webassembly suffix which does not match any valid GOARCH value:

  • bindings_wasm.go → bindings_webassembly.go
  • middleware_http_wasm.go → middleware_http_webassembly.go

下载链接