dagu

v2.10.6 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 15d Automation & Workflows

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agentic-workflow cron data-pipeline devops durable-execution durable-workflows

+14 more

human-in-the-loop job-scheduler mcp-server multiplayer-agent on-premise private-runners self-hosted self-service selfservice-portal task-automation task-scheduler workflow-engine workflow-orchestration workflow-scheduler

Affected surfaces

auth

ReleasePort's take

Moderate signal

editorial:auto 12d

Built‑in authentication now supports token TTLs up to 8760 hours (365 days) and rejects larger values at startup.

Why it matters: Token TTLs are capped at 8760 h (365 days); configurations exceeding this limit will cause startup failures, affecting deployments relying on longer‑lived tokens.

Summary

AI summary

Built-in authentication now correctly handles long‑lived tokens up to 365 days, fixing premature session expiry.

Changes in this release

Type	Severity	Summary	CVE
Breaking	High	Built-in authentication token TTLs are now limited to 8760h (365 days); larger values are rejected at startup. Built-in authentication token TTLs are now limited to 8760h (365 days); larger values are rejected at startup. Source: llm_adapter@2026-07-15 Confidence: low	—
Bugfix	Medium	Built-in authentication now correctly handles long-lived tokens up to 8760h (365 days). Built-in authentication now correctly handles long-lived tokens up to 8760h (365 days). Source: llm_adapter@2026-07-15 Confidence: low	—

Full changelog

v2.10.6 (2026-07-11)

Built-in authentication now works correctly with long-lived tokens. Previously, token TTLs of around 25 days or longer could exceed the browser timer limit, causing the frontend to clear an otherwise valid session immediately after login. Subsequent API requests would then fail with 401 Unauthorized.

Token expiration is now scheduled in browser-safe intervals while using the token's actual expiry time as the source of truth. Configurations such as 2160h (90 days) now work as expected.

[!IMPORTANT]
Built-in authentication token TTLs are now limited to 8760h (365 days). Larger values are rejected during startup validation and must be reduced before upgrading.

Fixed

fix: support long builtin auth token TTLs (#2379) @yohamta0

| Contribution | Contributor |
| --- | --- |
| bug: builtin auth TTL bug | tsfxpro @ Discord (report) |

Breaking Changes

Built-in authentication token TTLs are limited to 8760h (365 days); values larger than this are rejected at startup and must be reduced before upgrading.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track dagu

Get notified when new releases ship.

About dagu

A local-first workflow engine built the way it should be: declarative, file-based, self-contained, air-gapped ready. One binary that scales from laptop to distributed cluster. Your Workflow Operator handles creating and debugging workflows.

All releases →