The Apache DolphinScheduler August Monthly Report is here! Over the past month, the community continued to move the project forward with new improvements across functionality, performance, stability, and ecosystem development. Let’s take a closer look at the updates that stood out in August. And as always, a huge thank-you to everyone who contributed code, shared feedback, and supported the community. Every contribution helps DolphinScheduler continue to evolve!
📊 August at a Glance
| Metric | Value |
|---|---|
| 🚀 PRs Merged | 23 |
| 👥 Contributors | 10 |
| ➕ Lines Added | +3,702 |
| ➖ Lines Deleted | -1,327 |
| 🔀 Net Lines Changed | +2,375 |
| 📁 Modules Touched | 8 |
| 📝 Documentation Files Touched | 5 |
| 🧪 Test Files Touched | 28 |
🏆 Top Contributors
| Rank | GitHub Username | Primary Contribution Area | PRs | +Lines | -Lines | Overall Score |
|---|---|---|---|---|---|---|
| 🥇 | @ruanwenjun | Tests | 10 | 1602 | 1001 | 88.59 |
| 🥈 | @njnu-seafish | Performance | 3 | 818 | 288 | 29.09 |
| 🥉 | @SEPURI-SAI-KRISHNA | Debugging & Fixes | 2 | 229 | 3 | 18.77 |
| 4. | @kittimzhe | Documentation | 2 | 4 | 4 | 14.02 |
| 5. | @nikhiln64 | Debugging & Fixes | 1 | 344 | 8 | 10.16 |
| 6. | @hellodml | Debugging & Fixes | 1 | 136 | 1 | 9.45 |
| 7. | @zhang-arvin | Debugging & Fixes | 1 | 10 | 3 | 9.04 |
| 8. | @liang-wenjie | Tests | 1 | 542 | 7 | 7.82 |
| 9. | @hiSandog | Tests | 1 | 17 | 1 | 6.06 |
| 10. | @SbloodyS | Architecture & Engineering | 1 | 0 | 11 | 6.01 |
🔄 Code Changes
Breakdown by Category: Features / Performance / Bug Fixes / Architecture
| Category | PRs | Share |
|---|---|---|
| Features | 6 | 26.1% |
| Performance Improvements | 2 | 8.7% |
| Bug Fixes | 9 | 39.1% |
| Architecture Improvements | 6 | 26.1% |
Bug fixes accounted for the largest share of this month’s changes, at 39.1% (9 PRs). Combined with 6 feature PRs and 2 performance improvements, the overall development rhythm was clear: stability first, with a steady stream of new capabilities.
📦 Key Modules
Ranked by the number of PR touches.
| Rank | Module | PR Touches | Lines Added | Lines Deleted | Net Change |
|---|---|---|---|---|---|
| 1. | dolphinscheduler-api |
82 | +2,132 | -1,016 | +1,116 |
| 2. | dolphinscheduler-dao |
25 | +307 | -201 | +106 |
| 3. | docs |
14 | +68 | -48 | +20 |
| 4. | dolphinscheduler-ui |
10 | +74 | -27 | +47 |
| 5. | dolphinscheduler-master |
9 | +374 | -12 | +362 |
| 6. | dolphinscheduler-common |
6 | +64 | -6 | +58 |
| 7. | dolphinscheduler-scheduler-plugin |
6 | +229 | -4 | +225 |
| 8. | dolphinscheduler-task-plugin |
4 | +305 | -2 | +303 |
| 9. | misc |
3 | +149 | -11 | +138 |
What the module breakdown tells us:
- 🏛️ API (15 touches) was the clear focus of this month’s changes, with 15/23 PRs involving the API module. Most of the work centered on strengthening authorization and removing obsolete APIs.
- 🏗️ DAO (7 touches) mainly supported the API changes, including query optimization by excluding large text fields and updates to authorization query logic.
- 🎨 UI (5 touches) saw several touchpoints, but most were relatively small changes (+49 net lines), serving primarily as supporting updates.
- 🔧 Master (4 touches) focused on scheduling stability, including task retries and failure recovery.
🎯 8 Changes Users Will Notice Most
The following updates are ranked by their potential user impact and focus on the changes that matter most in real-world deployments.
1. 🔐 Stronger Permissions and Security — 7 PRs
Representative PR: #18561 — [Fix-18559][API] Align workflow mutations with project write permissions (#18561)
- Author: @ruanwenjun
- Change size: +426 / -128 lines
- PRs in this category this month: 7
Why it matters: Tenant isolation is now stricter, sensitive operations are better protected, and the overall security and compliance posture is stronger. Seven PRs this month focused on strengthening the permission model, covering project write-permission checks, cross-project authorization for sub-workflows, datasource and cluster authorization, Actuator endpoint authentication, user-list data masking, and authorization API optimization. These changes are particularly important for enterprise and multi-tenant deployments.
Key scenarios to verify:
- ✅ When creating, updating, or deleting a workflow, does the system strictly verify project-level write permissions?
- ✅ When referencing a sub-workflow, can the system verify that the user also has permission to access the referenced workflow, preventing unauthorized access across projects?
- ✅ When a task definition references a datasource, does the system verify that the current user has access to that datasource?
- ✅ Do cluster query APIs enforce permission checks consistently?
- ✅ Are user-list responses properly masked, with permissions appropriately restricted?
- ✅ Do sensitive Actuator endpoints require authentication before they can be accessed?
Full list of related PRs:
| PR # | Title | Author | Diff |
|---|---|---|---|
| #18561 | [Fix-18559][API] Align workflow mutations with project write permissions (#18561) | @ruanwenjun | +426/-128 |
| #18597 | [Fix-18596][API] Enforce permission checks for sub-workflow references (#18597) | @ruanwenjun | +450/-0 |
| #18566 | [Fix-18565][API] Validate datasource access for task definitions (#18566) | @ruanwenjun | +342/-17 |
| #18564 | [Improvement-18563][API] Refine datasource authorization list APIs (#18564) | @ruanwenjun | +102/-62 |
| #18583 | [Fix-18582][Authentication] Align actuator endpoint matching (#18583) | @ruanwenjun | +149/-11 |
| #18560 | [Improvement-18558][API] Harden user list access and responses (#18560) | @ruanwenjun | +65/-28 |
| #18590 | [Improvement-18589][API] Align cluster query permissions (#18590) | @ruanwenjun | +59/-20 |
2. 🛡️ Stability and Bug Fixes — 4 PRs
Representative PR: #18573 — [Fix-18570][Master] Detect wrapped CommandDuplicateHandleException in bootstrapError (#18570) (#18573)
- Author: @hellodml
- Change size: +136 / -1 lines
- PRs in this category this month: 4
Why it matters: These fixes address abnormal workflow and task states, directly improving reliability in production. There were 9 bug-fix PRs in total this month, making bug fixing the largest category. The other bug-fix PRs are covered in dedicated sections for permissions, K8s, DataX, and documentation. The four core fixes below focus on issues outside those categories.
Key scenarios to verify:
- ✅ Failed task retries: When recreating a failed task instance, is the runtime state correctly reset to prevent stale state from causing retry failures?
- ✅ Retry timing: Is the retry scheduled based on
endTime + retryIntervalrather thanstartTime? - ✅ Master startup failures: Can
bootstrapErrorcorrectly identify aCommandDuplicateHandleExceptionafter it has been wrapped? - ✅ Log messages: Has the typo in
DataSourceServiceImpllog messages been corrected to avoid confusion during troubleshooting?
Full list of related PRs:
| PR # | Title | Author | Diff |
|---|---|---|---|
| #18573 | [Fix-18570][Master] Detect wrapped CommandDuplicateHandleException in bootstrapError (#18570) (#18573) | @hellodml | +136/-1 |
| #18541 | [Fix-18540][Master] Reset the runtime state when recreating a failed task instance (#18541) | @SEPURI-SAI-KRISHNA | +132/-0 |
| #18539 | [Fix-18538][Master] Schedule task retry at endTime + retryInterval (#18539) | @SEPURI-SAI-KRISHNA | +97/-3 |
| #18581 | [Improvement-18580][api] Fix typo in DataSourceServiceImpl log message (#18581) | @kittimzhe | +1/-1 |
3. ⏰ Scheduling Policies / Missed-Fire Handling — 1 PR
Representative PR: #18464 — [DSIP-18454][Scheduler] Add schedule missed fire policy (#18464)
- Author: @liang-wenjie
- Change size: +542 / -7 lines
- PRs in this category this month: 1
| Policy | Behavior | Best For |
|---|---|---|
| Skip | Skip missed triggers and wait for the next cron trigger | When missed runs should simply be skipped to avoid putting additional load on the system |
| FireOnceNow | Trigger only once immediately and discard the remaining missed runs | When only the most recent missed run needs to be executed |
| FireAll | Execute all missed triggers sequentially according to their original scheduled times | Financial, reconciliation, and other scenarios where every scheduled run must be executed |
Why it matters: This is the biggest new feature of the month. If the Master is down or the scheduling thread is blocked and cron triggers are missed, you can now configure one of three policies to determine how DolphinScheduler handles those missed triggers.
Key scenarios to verify:
- ✅ When creating or editing a schedule, does the UI display the Missed Fire Policy dropdown?
- ✅ Simulate a two-hour Master outage by stopping the Master process and starting it again. Do the different policies behave as expected?
- ✅ Does the database upgrade script (
3.5.0_schema) execute correctly, and does thet_ds_scheduletable contain the newly added field?
4. ⚡ Performance Improvements — 2 PRs
Representative PR: #18444 — [Improvement-18443][API&DAO] Optimize WorkflowInstanceMapper to exclude large text fields from list queries (#18444)
- Author: @njnu-seafish
- Change size: +790 / -268 lines
- PRs in this category this month: 2
Why it matters: Workflow-instance and task-instance list queries no longer fetch large TEXT fields such as global_params and process_instance_json unnecessarily. This can significantly improve list-page response times, database I/O, and memory usage, with particularly noticeable benefits in large-scale deployments.
Key scenarios to verify:
- ✅ Compare workflow-instance list-page response times before and after the optimization, especially with 1,000+ instances.
- ✅ Open an individual workflow instance and verify that large fields such as global parameters are still displayed correctly. The detail API continues to retrieve them.
- ✅ Verify that list-page export, search, and other functions continue to work as expected.
Full list of related PRs:
| PR # | Title | Author | Diff |
|---|---|---|---|
| #18444 | [Improvement-18443][API&DAO] Optimize WorkflowInstanceMapper to exclude large text fields from list queries (#18444) | @njnu-seafish | +790/-268 |
| #18442 | [Improvement-18441][API&DAO] Optimize TaskInstanceMapper to exclude large text fields from list queries (#18442) | @njnu-seafish | +17/-5 |
5. 🔌 Task Types and New Data Sources — 1 PR
Representative PR: #18434 — [Fix-18389][DataX] Read job definition from attached resource file when custom json is empty (#18434)
- Author: @nikhiln64
- Change size: +344 / -8 lines
- PRs in this category this month: 1
Why it matters: Previously, DataX users had to paste JSON content into the custom JSON field in the UI and could not reuse files from the Resource Center. The new behavior allows DolphinScheduler to automatically read the job definition from a resource file when the custom JSON field is empty, bringing the experience in line with how SQL tasks load SQL from resource files.
6. 🧹 API Cleanup and Engineering Improvements — 5 PRs
Representative PR: #18569 — [Improvement-18568][API] Remove obsolete task update-with-upstream API (#18569)
- Author: @ruanwenjun
- Change size: +2 / -507 lines
- PRs in this category this month: 5
Why it matters: This month, the community removed three groups of obsolete APIs covering cluster query-by-code, task update-with-upstream, and dynamic sub-workflow functionality, while also updating incompatible.md.
For users upgrading from an earlier version, this is an important area to review. If your organization has a custom frontend or automation scripts that rely on any of these legacy APIs, make sure to update them before upgrading.
Full list of related PRs:
| PR # | Title | Author | Diff |
|---|---|---|---|
| #18569 | [Improvement-18568][API] Remove obsolete task update-with-upstream API (#18569) | @ruanwenjun | +2/-507 |
| #18557 | [Improvement-18556][API] Remove obsolete dynamic sub-workflow API (#18557) | @ruanwenjun | +2/-138 |
| #18584 | [Chore][API] Remove obsolete cluster query-by-code API (#18584) | @ruanwenjun | +5/-90 |
| #18408 | [Chore][Common] Handle parentless paths in FileUtils (#18408) | @hiSandog | +17/-1 |
| #18599 | [Chore] Remove unused code- #18599 (#18599) | @SbloodyS | +0/-11 |
7. ☸️ K8s and Cloud-Native Deployment — 1 PR
Representative PR: #18574 — [Fix-17883] Fix K8s Alert HTTP test sending failed by using IP for non-StatefulSet pods (#17883) (#18574)
- Author: @zhang-arvin
- Change size: +10 / -3 lines
- PRs in this category this month: 1
Why it matters: For non-StatefulSet Pods in K8s, such as Pods managed by a Deployment, HTTP alert-instance testing could previously fail because the endpoint was resolved using the hostname. The fix switches to IP-based addressing, improving the reliability of alert channels in K8s deployments.
8. 📚 Documentation and Example Improvements — 2 PRs
Representative PR: #18478 — [Doc-18474][Upgrade] Fix zh/en incompatible upgrade docs out of sync (#18478)
- Author: @njnu-seafish
- Change size: +11 / -15 lines
- PRs in this category this month: 2
Why it matters: Broken links in the datasource and configuration documentation were fixed, while the Chinese and English upgrade-incompatibility documentation was brought back into alignment. These updates help reduce confusion and prevent issues caused by outdated or inconsistent documentation.
Full list of related PRs:
| PR # | Title | Author | Diff |
|---|---|---|---|
| #18478 | [Doc-18474][Upgrade] Fix zh/en incompatible upgrade docs out of sync (#18478) | @njnu-seafish | +11/-15 |
| #18578 | [Doc-18579] Fix malformed links in datasource and configuration docs (#18578) | @kittimzhe | +3/-3 |
⚠️ Upgrade and Validation Recommendations
Risk Assessment
Overall Risk Level: 🟠 Medium-High
| Risk Area | Assessment | Details |
|---|---|---|
| Core Module Changes | ⚠️ Yes | The API module was touched by 15/23 PRs; permission-related APIs require particular attention during regression testing |
| Number of Bug Fixes | 9 | A relatively high number of bug fixes; pay close attention to task retry and failure-recovery scenarios |
| Permission/Security Changes | 7 | ⚠️ Significant changes to the permission model require comprehensive authorization testing |
| K8s/Deployment Changes | 1 | ⚠️ Deployment-related logic was changed; Helm/Docker deployments should be verified |
| UI Changes | Yes | ⚠️ Frontend changes require smoke testing of key pages |
| Database Schema | ⚠️ Yes | DSIP-18464 adds new DDL; verify that the upgrade script is executed correctly |
Before You Upgrade
📦 Back up the database: Before upgrading, create a full backup of the DolphinScheduler metadata database using
mysqldumporpg_dump.📋 Check the DDL scripts: Verify that the new scripts under
dolphinscheduler-dao/src/main/resources/sql/upgrade/3.5.0_schema/are included in the upgrade process.📝 Review incompatible changes: Pay particular attention to the four groups of API removals marked this month in
docs/docs/en/guide/upgrade/incompatible.md.🧪 Check custom integrations: If you use OpenAPI, search your codebase to make sure none of these three removed APIs are still being called:
-
cluster/query-by-code(PR #18584) -
task/update-with-upstream(PR #18569) - Dynamic sub-workflow APIs (PR #18557)
-
💾 Back up configuration files: Back up all configuration files under the
conf/directory.
Common Issues and Quick Checks
| Symptom | Possible Cause | What to Check |
|---|---|---|
| A sudden 403 when saving a workflow | PR #18561 introduced stricter permission checks | Verify that the current user has write permission for the target project and that the upstream workflow referenced by the sub-workflow is also within the user's authorized scope |
| A sub-workflow cannot be referenced | PR #18597 added cross-project permission checks | Confirm that the user has the required permissions for the project containing the sub-workflow |
| Binding a datasource returns 403 | PR #18566 added datasource authorization checks | Grant the user access to the corresponding datasource under Datasource Authorization |
| HTTP alert testing fails in a K8s deployment | Logic changed by PR #18574 | Check Pod network policies and verify in the logs whether the connection is being made using a hostname or an IP address |
| Missed-fire behavior is not what you expected after upgrading | DSIP-18464 defaults to the Skip policy | Check the value of missed_fire_policy; switch the policy manually if missed runs need to be executed |
| Task retries trigger immediately instead of respecting the interval | PR #18539 changed the calculation to use endTime
|
Verify that retry time is calculated as task end time + retryInterval, rather than start time |
| Workflow-instance lists load slowly or return errors after upgrading | VO fields no longer match after large-field exclusions | Check whether the frontend version was upgraded at the same time, or roll back temporarily to isolate the changes from #18444/#18442 |
🙏 Thank You to Our Contributors
A huge thank-you to the 10 contributors who contributed code to Apache DolphinScheduler in August 2026:
@ruanwenjun, @njnu-seafish, @SEPURI-SAI-KRISHNA, @kittimzhe, @nikhiln64, @hellodml, @zhang-arvin, @liang-wenjie, @hiSandog, and @SbloodyS
Every PR helps DolphinScheduler continue to evolve in stability, usability, and ecosystem growth. 💪
Top comments (0)