This release includes 1 breaking change for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
+14 more
Affected surfaces
Summary
AI summaryDefault DAG type changed from chain to graph; set type: chain or explicit depends to preserve ordering.
Full changelog
This is one of the largest Dagu releases so far. It turns workflows from a collection of commands into reusable, packageable automation units: steps can now be plain commands, built-in actions, or versioned Dagu actions with their own inputs, outputs, artifacts, and toolchain.
Highlights:
- Action schema v2 adds the new
run,action,with, andoutputsstyle for clearer workflow definitions while keeping existing workflows supported. See also workflow outputs. - Remote Dagu Actions and Official Dagu Actions make reusable workflow packages possible. Actions can be referenced by version, resolve their own workspace, expose typed outputs, and run as sub-DAGs. DuckDB is provided as the official duckdb@v1 Dagu Action, not as a built-in action.
- DAG-level tools let workflows declare required CLIs and runtimes directly in YAML. Tool installation is powered by Aqua, so workers can prepare the right tools at runtime instead of baking everything into images.
- New built-in actions cover common workflow glue: file operations, artifact publishing and stream capture, data conversion and picking, waits, Git checkout, DAG enqueue, and structured output writing.
- Operations features now include Dagu-managed secrets, notification channels and rules, incident connections and routing, the Dagu MCP server, and configurable webhook payload limits.
- Execution behavior and reliability were tightened with
graphas the default DAG type, better auto-retry notification behavior, deferred failure handlers during retries, richer Slack context for the agent, and no hard LLM request timeout for agent steps.
For example, the new Official Dagu Actions node-script@v1 and python-script@v1 let a workflow run small Node.js and Python glue steps without baking those runtimes into every worker image:
steps:
- id: prepare_release
action: node-script@v1
with:
input:
version: "2.7.1"
script: |
return {
tag: `v${input.version}`,
channel: input.version.includes("-") ? "preview" : "stable"
}
- id: summarize
action: python-script@v1
with:
input:
tag: "${prepare_release.outputs.result.tag}"
channel: "${prepare_release.outputs.result.channel}"
script: |
return {
"message": f"release {input['tag']} is ready for {input['channel']}"
}
depends:
- prepare_release
- id: print
run: echo "${summarize.outputs.result.message}"
depends:
- summarize
The default DAG type is now graph. Existing workflows that omitted type and relied on implicit sequential execution should set type: chain, or add explicit depends, to preserve the previous ordering.
Added
- feat: add action schema v2 (#2122) @yottahmd
- feat: make webhook payload size configurable (#2148) @yottahmd
- feat: add DAG-level aqua tools (#2150) @yottahmd
- feat: add file operation actions (#2151) @yottahmd
- feat: add simplified secret management (#2153) @yottahmd
- feat: simplify secret scopes (#2155) @yottahmd
- feat: add DuckDB SQL actions (#2156) @yottahmd
- feat: add wait action (#2157) @yottahmd
- feat: add Dagu MCP server (#2158) @yottahmd
- feat: add artifact actions (#2159) @yottahmd
- feat: add data convert and pick actions (#2160) @yottahmd
- feat: add git checkout action (#2161) @yottahmd
- feat: add dag enqueue action (#2163) @yottahmd
- feat: add artifact output stream syntax (#2164) @yottahmd
- feat: add remote action executor (#2167) @yottahmd
- feat: add notification channels and rules (#2169) @yottahmd
- feat: add incident connections and routing (#2170) @yottahmd
Changed
- chore(deps): bump github.com/slack-go/slack from 0.19.0 to 0.23.1 in the go-security group across 1 directory (#2152) @dependabot
- Make graph the default DAG type (#2168) @yottahmd
- refactor: remove core DuckDB executor (#2172) @yottahmd
Fixed
- fix: include recent Slack notifications in agent context (#2147) @yottahmd
- fix: remove agent step LLM request timeout (#2154) @yottahmd
- fix: suppress pending auto-retry notifications (#2162) @yottahmd
- fix: defer failure handler during auto retry (#2165) @yottahmd
- fix: default empty DAG type to graph (#2171) @yottahmd
Contributors
Thanks to our contributors for this release:
| Contribution | Contributor |
| --- | --- |
| feat: customizable webhook payload size (#2146) | @bagemt (report) |
| chore(deps): bump github.com/slack-go/slack from 0.19.0 to 0.23.1 in the go-security group across 1 directory (#2152) | @dependabot |
| feat: Native DuckDB Connector or Embedded Analytical Store (#2149) | @vit76 (request) |
Acknowledgements
Special thanks to the aquaproj project and aqua. Dagu v2.7.0’s new DAG-level tools feature uses aqua internally to install pinned CLI tools reproducibly.
Full Changelog: https://github.com/dagucloud/dagu/compare/v2.6.10...v2.7.1
Breaking Changes
- Default DAG type changed to "graph"; workflows without a `type` field now behave differently. Existing workflows should set `type: chain` or add explicit `depends:` to retain previous ordering.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About dagu
A local-first workflow engine built the way it should be: declarative, file-based, self-contained, air-gapped ready. One binary that scales from laptop to distributed cluster. Your Workflow Operator handles creating and debugging workflows.
Beta — feedback welcome: [email protected]