News
What happened
The release of Dapr 1.18 brings significant advancements in workflow security with the introduction of Verifiable Execution. This new feature set addresses the growing need for trust and integrity in distributed systems, particularly as organizations increasingly rely on AI agents and autonomous workflows.
Dapr 1.18 introduces Verifiable Execution capabilities, including Workflow History Signing, Workflow History Propagation, and Workflow Attestation. These features provide cryptographic assurances about execution history and provenance, enabling organizations to verify and trust their workflows. This is particularly crucial for industries that require compliance and security, ensuring that execution histories remain tamper-proof and verifiable.
Release at a glance
Key facts from the announcement.
Version
1.18
Product
Dapr
Released
June 2026
Platform
Cloud Native
PRIVACY STACK
Extend Privacy Beyond DNS
Controlling your DNS queries is one layer of network privacy. Your email metadata — who you talk to, when, how often — is equally exposed with standard providers. Proton Mail applies end-to-end encryption to the layer most people ignore.
Try Proton Mail →This is an affiliate link. If you purchase, I earn a commission at no extra cost to you.
Changes at a glance
What's new
Dapr 1.18 introduces Verifiable Execution features that enhance the integrity of workflows. Key additions include Workflow History Signing for tamper-evident execution histories, Workflow History Propagation for tracking execution lineage, and Workflow Attestation for cryptographically verifying execution context.
Breaking changes
No breaking changes were reported in the source material.
Analysis
In detail
Dapr 1.18 introduces three key features aimed at enhancing the security and integrity of workflows: Workflow History Signing, which generates cryptographic signatures over workflow history records to create tamper-evident execution histories; Workflow History Propagation, which allows execution lineage to travel with requests, providing context about where execution originated and the sequence of events; and Workflow Attestation, which enables workflows to receive cryptographically verifiable execution context, ensuring that decisions are based on verified provenance.
These features are built on the foundation of SPIFFE-based workload identity, which Dapr has long utilized for secure service-to-service communication. By tying workflow attestation and execution provenance to the identities of participating workloads, Dapr establishes a chain of trust that spans orchestrators, activities, services, AI agents, and external systems. This is particularly beneficial for regulated industries, where maintaining a clear and verifiable execution history is critical.
The introduction of these capabilities marks a significant shift in how organizations can manage and verify their workflows, especially in environments where compliance and security are paramount. As AI agents and autonomous workflows become more prevalent, the need for such robust verification mechanisms will only grow.
Key takeaways
The most important facts from this update.
Why it matters
The introduction of Verifiable Execution in Dapr 1.18 addresses critical security and compliance needs for organizations using distributed systems. By ensuring that execution histories are tamper-proof and verifiable, it enhances trust in workflows and AI agents.
Homelab impact
Homelab operators utilizing Dapr for workflow management will benefit from the enhanced security features introduced in version 1.18. The ability to verify execution history and provenance is particularly relevant for those managing sensitive data or operating in regulated environments.
Upgrading to Dapr 1.18 may require adjustments to existing workflows to leverage the new capabilities effectively. Operators should consider how these features can be integrated into their current setups to improve trust and compliance in their automated processes.
What to do next
Practical steps for operators running self-hosted stacks.
This article summarises reporting from CNCF Blog. Visit the original post for release notes, changelogs, and full technical documentation.