Dagster 1.13.19 - Sensor Dry Run Permission Guard

Dagster 1.13.19 shipped on 21 August 2026 as a stable patch on the 1.13 core line, with libraries at 0.29.19. The change that matters for operators is in the sensor dry run apply path. The UI action “Apply requests & commit tick result” could launch runs even when creating or deleting dynamic partitions failed because the caller lacked permission.

The full release notes and downloads are on the GitHub release page.

This tag has two items. No scheduler rewrite, no new execution APIs, no migration notes. One item is an authorization bug on a write path that looks like a preview. The other is a table control for people who debug automation conditions in the UI.

Dagster sensors can mutate a dynamic partition set and emit run requests in the same tick. Dynamic partitions exist so keys can appear at runtime from a source that is not known at definition time. The partition set is the catalog. The run is the work.

The dry run UI is how operators test that tick without treating it as a live sensor cycle. The action named in this release is “Apply requests & commit tick result”. That action is supposed to take the evaluated tick and commit it. Partition create or delete first. Run launches after.

The bug was a partial commit. If create or delete of dynamic partitions failed because the user did not have permission, the apply path still launched runs. The catalog write was rejected. The run launcher proceeded.

That split is a control plane problem. If a caller cannot write the catalog, the runtime should not start work that claims those keys exist. A user who can dry run a sensor but cannot create or delete dynamic partitions could still cause runs to start. That is a permission bypass on the run launch side, even when the partition write was refused.

Runs can also start for partition keys that never landed in the partition set. Asset pages, backfills, and status queries that join on partition keys then disagree with the run list.

The delete case is worse for cleanup sensors. A tick that wants to drop stale keys and then run a cleanup job could fail the delete and still fire the job. The job then operates on keys the catalog still lists as live.

The notes locate the bug on that UI action, not on daemon tick processing. If your sensors never create or delete dynamic partitions, the trigger is absent. If you never use “Apply requests & commit tick result”, the notes do not claim a daemon fix. If anyone in the org does use that apply button against dynamic partitions, especially on a shared webserver where roles are not all admin, treat 1.13.19 as required.

The notes do not name the permission class or the UI route. After this tag, a failed partition mutation due to insufficient permissions should stop the apply from launching runs. If your runbook still says dry run then apply as a privileged step, keep the runbook, but stop treating a failed partition write as a no-op for the run launcher.

The same tag adds an expand or collapse all toggle on the automation condition evaluation table.

Declarative automation in Dagster evaluates nested conditions: freshness, cron, work already in progress, upstream dependencies, and user defined predicates. The evaluation table is how you see why an asset did or did not request a materialization on a given tick. Nested rows get large once condition trees stack AND and OR nodes.

Before this patch you opened rows one at a time. That is slow when a skipped tick has a deep tree and you need the whole picture, or when you want the top level only. Expand all and collapse all are table controls. They do not change evaluation semantics, tick storage, or the condition language.

If you never open that table, skip this item. If you debug skipped automations in the UI, it cuts clicks. The notes do not mention keyboard bindings, persisted table state, or API changes around this control.

1.13.19 is a stable release, not a candidate, beta, or alpha. The notes list no breaking changes, no deprecations, no config key renames, and no database migrations. Read the GitHub release page before you upgrade. It is short.

The dual version line is unchanged. Core is 1.13.19. Libraries are 0.29.19. Integration packages still track a 0.29 train against a 1.13 core.

There is no claim in the notes about sensor evaluation in the daemon, about run queue behavior, or about auth on other mutations. Do not read this tag as a general RBAC audit. It is a fix for one apply action when partition create or delete fails on permissions.

If you run Dagster as a headless orchestrator and never use the web UI, the permission fix still matters if anything in your stack calls the same apply path. The table toggle does not.

Library packages published with this tag are 0.29.19.