chore(deps): update ⬆️ dagger to v0.21.3

[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
dagger/dagger	minor	v0.20.6 → v0.21.3	v0.21.4

---

Release Notes

dagger/dagger (dagger/dagger)

v0.21.3

Compare Source

Fixed

• Fix regression in 1password secret provider support @​marcosnils + @​sipsma in #​13283

What to do next?

• Read the documentation
• Join our Discord server
• Follow us on Twitter

v0.21.2

Compare Source

Fixed

• Fix dagger release publishing to bust cache of operations that involve external state by @​tiborvass + @​sipsma in #​13279
  The previous v0.21.1 release hit a long-standing bug in our version module tooling where certain operations did not bust cache based on changes in external state. We hit this for the first time because v0.21.0 and our infrastructure have had significant improvements in cache re-use.

What to do next?

• Read the documentation
• Join our Discord server
• Follow us on Twitter

v0.21.1

Compare Source

Added

• Add native GraphQL interfaces and unified object IDs in DagQL by @​vito in #​12041
  Dagger now exposes objects through the standard Node interface and ID scalar, enabling APIs to accept generic Dagger objects while preserving SDK compatibility through legacy FooID and loadFooFromID views for older clients.

Fixed

• Python SDK: fix unhandled module registration cases and bugs by removing the AST-based module analyzer and returning to runtime introspection by @​eunomie in #​13251
• Fix Go module generation to avoid unnecessary dependency churn in generated go.mod and go.sum files by @​sipsma in #​13244
• Fix registry authentication so withRegistryAuth credentials are not incorrectly skipped and authenticated publishes keep working after anonymous pulls to the same registry by @​marcosnils + @​sipsma in #​13255 #​13256
• Fix published image layer structure so withDirectory and withFile operations preserve expected layer boundaries instead of being squashed into a few large layers by @​sipsma in #​13242
• Fix Dockerfile RUN --mount=type=bind conversion when the bind source selector points to a regular file, improving compatibility with file and directory bind mounts by @​sipsma in #​13273
• Fix module source cache dependency retention, including ephemeral missing shared result errors after cache persistence or engine restarts by @​sipsma in #​13243
• Fix a bug where some cache entries did not have their size calculated during background and shutdown pruning by @​sipsma in #​13225
• Fix repeated op:// 1Password secret reads by caching resolved 1Password secret values during a run, avoiding provider rate limits when the same secret is mounted or read multiple times by @​matipan in #​13249
• Fix Windows Changeset exports so RemovePaths entries cannot remove files outside the selected export root through backslash or absolute-path interpretation by @​marcosnils in #​13222
• Fix dagger --x-release for tagged releases so semver refs download release artifacts instead of looking in the main-build artifact namespace, and prevent local runner override environment from leaking into the re-executed CLI by @​grouville in #​13259

What to do next?

• Read the documentation
• Join our Discord server
• Follow us on Twitter

v0.21.0

Compare Source

Added

• Automatically expose a check for each generate function by @​eunomie in #​12923
  Each generated check has the same name as its generate function, so dagger check can report whether generated files are out of date.
  Use dagger check --no-generate to list or run only functions explicitly marked as checks, without the generated ones.
  Toolchains can set ignoreChecks to skip creating checks for specific generate functions.
• Add workspace lockfiles for selected lookups such as container.from and Git refs by @​shykes + @​alexcb + @​grouville + @​tiborvass + @​eunomie in #​12046 #​13094
  Locking is opt-in with --lock live, --lock pinned, or --lock frozen: live mode resolves and records live values, pinned mode prefers recorded pins while resolving the rest live, and frozen mode only resolves from .dagger/lock.
  Use dagger lock update to refresh entries already recorded in .dagger/lock; it now creates the file when missing.
  This also fixes remote Git tree cache keys so cache reuse follows the actual checkout inputs.
• Add an interactive tests view to the TUI, plus compact test summaries for pretty, plain, logs, dots, and report progress modes by @​vito in #​13073
• Add experimental --x-release=<ref> and DAGGER_X_RELEASE=<ref> support for running a command against an unreleased Dagger build from a GitHub ref, fixing #​12996 by @​tiborvass in #​13156
• Add a configurable Kubernetes Service to the Helm chart by @​pierreyves-lebrun + @​grouville in #​11993
• Add EngineCacheEntry.dagqlCall and EngineCacheEntry.recordTypes so cache entries expose the producing DagQL call and all represented storage record types for inspection and GC filtering by @​sipsma in #​13207
• Show the Dagger Cloud trace URL when using the logs frontend by @​marcosnils in #​13105
• Dang SDK: add support for local types that shadow Dagger core types, early return, self-calls, order-independent declarations, and stricter nullability/type checking by @​vito in #​13184

Changed

• Migrate caching to DagQL and remove the BuildKit solver backend, making DagQL responsible for cache lookups, persistence, and pruning by @​sipsma in #​11856
• Improve engine performance and memory use by reducing bbolt/containerd metadata overhead, lazily creating containerd operation leases, reusing pooled CNI namespaces for default execs, and batching long withDirectory chains instead of materializing them quadratically by @​sipsma in #​13117 #​13123 #​13144 #​13124
• Deduplicate equivalent in-flight DagQL calls across clients in the same session and fall back to same-session secret/socket attachables when the original client binding is gone by @​sipsma in #​13118

Fixed

• Fix enum argument defaults so they appear correctly in schema output and CLI help by @​kpenfound in #​13068
• Fix module loading and type generation failures caused by stale handle-form module IDs and nested client session races, replacing session ... not found failures with the intended behavior or original error by @​sipsma in #​13108 #​13119
• Fix bound service failures so dependent execs and container-backed services see the service exit as the cause while interactive terminals stay open by @​vito in #​13099
• Fix remote Git checkout behavior so cached trees can be reused after cache pruning by @​sipsma in #​13141
• Fix Changeset merge cleanup flakiness by disabling Git auto-maintenance in Dagger's temporary merge repositories by @​sipsma in #​13121
• Fix WithSecretVariable so later calls override earlier values, fixing #​13147 by @​matipan in #​13159
• Fix user-default secret and env handling so empty plaintext secrets resolve correctly, .env values are not double-expanded through namespaces, and plaintext Secret defaults are scrubbed in console output; fixes #​12855 and closes #​12014 by @​sipsma + @​marcosnils + @​tiborvass in #​13163 #​13160 #​13177
• Fix telemetry and replay output so dagger check log telemetry is not dropped, Python module logs are not duplicated, and dagger trace honors frontend flags by @​vito + @​sipsma in #​13114 #​13153
• Fix dagger generate --scale-out returning unusable remote Changeset objects by always running generation locally; dagger check --scale-out remains supported by @​eunomie in #​13190
• Fix toolchain customizations so they propagate when toolchain functions are called through another module function by @​suprjinx in #​13176
• Dang SDK: fix panics, initialization-race typechecking failures, and ID argument handling by @​tiborvass + @​vito in #​13098 #​13103 #​13150
• Java SDK: fix version updates so mvn versions:set no longer performs unnecessary dependency/plugin resolution, preventing Maven Central 429 failures; fixes #​13174 by @​dagger-codex[bot] + @​tiborvass in #​13198
• Python SDK: fix static module analysis regressions from the AST analyzer cutover, including inherited functions, aliased decorators and fields, @staticmethod, type aliases, constants/defaults, Annotated, Optional, Union, and relative imports; fixes #​13097 and #​13089 by @​eunomie in #​13095
• Python SDK: fix more AST analyzer cases for TypeAlias inside X | None, quoted and aliased annotations, and absolute self-package imports by @​marcosnils + @​grouville + @​eunomie in #​13149 #​13162 #​13171
• Python SDK: exclude the broken yarl 1.24.1 release from the dependency range by @​tiborvass in #​13189
• Rust SDK: fix list-of-object fields so generated clients load each object by ID instead of returning an incorrect single wrapped selection by @​wingyplus in #​13000

What to do next?

• Read the documentation
• Join our Discord server
• Follow us on Twitter

v0.20.8

Compare Source

v0.20.8 - 2026-05-06

Fixed

• Python SDK: fix v0.20.7 regressions where valid Python modules could fail to load correctly, especially when using patterns such as import aliases, inherited functions, relative imports, or module-level type aliases, by @​tiborvass in aa1721d (reverts commit bcb2193 backported from #​11803)
• Dang SDK: parallel initialization no longer panics or reports spurious typechecking errors by @​tiborvass in 53f1ae3 (backported from #​13098) and @​vito in ae5fc75 (backported from #​13103)

What to do next?

• Read the documentation
• Join our Discord server
• Follow us on Twitter

v0.20.7

Compare Source

v0.20.7 - 2026-04-30

Fixed

• Fix rare engine hangs when short-lived container processes leave runc run or runc exec stuck by @​sipsma in d2fd6b4 (backported from #​13078)
• Fix toolchain customization defaults so changing a default invalidates cached omitted-argument calls and returns the new value by @​shykes in dbab536 (backported from #​13047)
• Fix remote modules that install a toolchain from another repo so +defaultPath file inputs resolve from the module selected by -m, not from the toolchain repo or the caller's local workspace by @​tiborvass in 1c105d4
• Fix modules that install a toolchain so module code can call installed toolchain constructors and types from generated SDK bindings again by @​eunomie in d348571 (backported from #​12991)
• Fix dagger mcp so MCP clients and agents can use functions from the current workspace module again, instead of only generic or core tools by @​shykes in 104a5ec (backported from #​13030)
• Fix Docker-backed engines in cgroup subgroup environments by ensuring the engine image includes the init binary it needs to start correctly by @​marcosnils in 7a5f6e6 (backported from #​12999)
• Fix nested Dagger commands so explicit local NO_COLOR settings are preserved after telemetry initialization, avoiding unexpected ANSI color codes in parseable logs by @​sipsma in 3dbb010 (backported from #​13076)
• Fix LLM tool calls for providers such as AWS Bedrock by giving undocumented module functions a fallback tool description instead of an empty one by @​shykes in 4d49e17 (backported from #​12857)
• Fix git credential errors so failed credential helper output includes stderr, making authentication failures easier to diagnose by @​marcosnils in 588ce15 (backported from #​13048)
• Fix dagger functions and dagger call --help so constructor plumbing no longer appears as a confusing extra with function by @​eunomie in c50f40a (backported from #​13012)
• Dang SDK: fix built-in sdk: "dang" modules so calls to Go or TypeScript dependency modules complete instead of timing out while loading the dependency runtime by @​shykes in 4dba920 (backported from #​12975)
• Elixir SDK: fix dagger generate elixir-sdk so users can regenerate Elixir bindings from the current engine introspection schema by @​wingyplus in 983d5b0 (backported from #​12890)
• Python SDK: fix calls so they no longer stall for several seconds with repeated OpenTelemetry metrics exporter warnings when unsupported metrics are emitted by @​eunomie in d7a2709 (backported from #​13013)
• Python SDK: fix redundant image pulls in new modules by aligning the generated Python version requirement with the default runtime image for better cache-hit performance by @​eunomie in ede18a0 (backported from #​13027)
• Python SDK: fix terminal cleanup so dagger.connection() restores the cursor and stops the spinner with default logging settings by @​shykes in 12e1238 (backported from #​12835)
• Python SDK: fix module discovery so introspection no longer imports user modules by @​eunomie in 8d5362b (backported from #​11803)

Contributors

Special thanks to our external contributor this release!

• @​wingyplus

What to do next?

• Read the documentation
• Join our Discord server
• Follow us on Twitter

---

Configuration

📅 Schedule: (in timezone America/Los_Angeles)

• Branch creation
  • "after 4pm on thursday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.