Skip to content

Bump the nuget group with 4 updates - #260

Merged
KaliCZ merged 1 commit into
mainfrom
dependabot/nuget/backend/src/Kalandra.Api/nuget-0608bf77d7
Aug 4, 2026
Merged

Bump the nuget group with 4 updates#260
KaliCZ merged 1 commit into
mainfrom
dependabot/nuget/backend/src/Kalandra.Api/nuget-0608bf77d7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 4, 2026

Copy link
Copy Markdown
Contributor

Updated Marten from 9.20.1 to 9.22.3.

Release notes

Sourced from Marten's releases.

9.22.3

What's Changed

Full Changelog: JasperFx/marten@V9.22.1...V9.22.3

9.22.1

Security release. Upgrade is recommended for anyone using sharded tenancy together with Events.UseTenantPartitionedEvents.

A tenant id was interpolated into a double-quoted PostgreSQL identifier without doubling an embedded double quote, so a tenant id containing one could terminate the identifier and execute additional SQL statements. This is a different class from the two advisories previously published on this repository, both of which were the single-quoted string-literal class; neither of those fixes addressed this.

You are affected only if you use sharded tenancy, have UseTenantPartitionedEvents enabled, and your application passes attacker-influenced input as a tenant id. Note that the reachable surface includes ordinary session resolution, not just administrative provisioning calls — GetTenantAsync / FindOrCreateDatabase auto-provision an unknown tenant. Applications using tenant ids from a trusted fixed set are not exploitable.

Affected versions: 9.4.0 through 9.22.0.

Full details, including remediation guidance for existing data, are in the security advisory: GHSA-3vp4-34pf-2rcw

What changed

  • PerTenantEventSequences.QuotedSequenceName escapes embedded quotes, matching quote_ident/%I so the name still resolves to the same object the quick-append function finds. Covers the create, drop, schema-apply and cleanup paths.
  • BulkEventAppender no longer builds an unquoted sequence name from a suffix read back out of the tenants table. This also fixes a functional bug: PreserveSourceSequence bulk imports previously failed with 42601 for hyphenated and GUID tenant ids under sharded tenancy.
  • ShardedTenancy validates tenant ids destined for DDL, closing a long-standing asymmetry with the DefaultTenancy provisioning path. It is a narrow denylist rather than the existing identifier allowlist, so hyphenated and GUID tenant ids keep working.

Dependency

Requires Weasel.Postgresql 9.21.1, which escapes partition bound values (JasperFx/weasel#​416). Both halves are needed; the dependency is pulled in automatically.

Credit to Barak Srour (Apiiro) for the report.

9.22.0

The partitioning feature is new, but otherwise this was all about CritterWatch improvements for a huge installation

What's Changed

Full Changelog: JasperFx/marten@V9.21.0...V9.22.0

9.21.0

Highlights

A small, low-risk release: two bug fixes reported against 9.20.x, a LINQ ordering fix, a Newtonsoft serialization fix, and a new health-check overload for Wolverine-managed daemon distribution.

[!NOTE]
There is a change to the mt_quick_append_events PostgreSQL function in this release, and applying it is NOT mandatory or required.

You do not need to patch your database, schedule a migration, or coordinate a deployment window to take 9.21.0. The client-side half of the #​5062 fix ships in the assembly, so upgrading the NuGet package alone is sufficient — 9.21.0 is correct against the function version you already have deployed.

Under the default AutoCreate.CreateOrUpdate the function is simply refreshed the next time Marten ensures event storage exists (a CREATE OR REPLACE FUNCTION, no lock on your event data). If you run AutoCreate.None with db-patch / db-apply, your next patch will contain one extra CREATE OR REPLACE FUNCTION … mt_quick_append_events statement — apply it whenever it suits your normal cadence. See the migration guide for details.

Bug Fixes

mt_quick_append_events returned {NULL} for an empty event array (#​5062, #​5088)

array_length('{}', 1) is NULL in PostgreSQL rather than 0, so calling the bulk append function with no events returned a bigint[] whose single element was NULL. Npgsql could not read that into long[], and the resulting InvalidCastException was thrown from the batch's post-processing loop — where it displaced whatever exception had actually made the append fail. Callers were left with an unrelated, non-retryable error instead of the real one; for the reporter that dead-lettered Wolverine messages which would otherwise have been retried.

Fixed on three fronts:

  • The function now COALESCEs the array length, so an empty append means what it says: zero events appended, final version unchanged.
  • The append operation no longer reads the returned array when the batch carries no events — this is what makes the fix effective without any database change.
  • The one code path in Marten that could reach the function with empty arrays (ProjectionUpdateBatch.WaitForCompletion, for an Append side effect that ended up with no events) no longer issues the call.

OrderBy against a dictionary indexer dropped the key (#​5063, #​5073)

OrderBy(x => x.SomeDictionary["key"]) generated SQL that ignored the indexer key, so the ordering was wrong (or arbitrary) rather than failing loudly.

Lazy LINQ sequences serialized as objects under Newtonsoft (#​5076, #​5080)

A document property holding a deferred-execution sequence (Select(...), Where(...) without a materializing call) was written by Newtonsoft as an iterator object rather than a JSON array, so it would not round-trip. These are now written as plain arrays.

IMessageBatch is called concurrently (#​5065, #​5085)

Not a behavior change, but a documentation fix worth flagging if you implement IMessageBatch yourself: the async daemon raises projection side effects from multiple threads at once (measured at up to 8 concurrent publishers across 10 threads for a single-stream projection catching up). The interface previously said nothing about this. An implementation that appends to an unsynchronized collection will silently drop messages — the same hazard, in a real outbox, that showed up here as a "flaky" test.

New

Provider-aware databaseFilter for the high-water health check (#​5061, #​5089)

AddMartenHighWaterHealthCheck's databaseFilter is captured at registration time, so it cannot resolve services — which makes it unable to express "the databases this node currently owns" when ownership is runtime state. That is precisely the case under Wolverine-managed daemon distribution, where agents are assigned per (database, tenant) and rebalanced over a node's lifetime.

There is now an overload whose filter receives the IServiceProvider and is re-evaluated on every probe:

Services.AddHealthChecks().AddMartenHighWaterHealthCheck(
    (services, database) => services.GetRequiredService<IWolverineRuntime>()
        .Agents.AllLocallyOwnedDatabaseIds()
        .Any(id => id.Name.EqualsIgnoreCase(database.Identifier)),
    staleThreshold: TimeSpan.FromSeconds(30),
    includeExternallyManaged: true);
 ... (truncated)

## 9.20.2

## What's Changed
* Fix NgramIndex to match NgramSearch's unaccent-aware mt_grams_vector expression by @​dat-honguyen in https://github.com/JasperFx/marten/pull/5060

## New Contributors
* @​dat-honguyen made their first contribution in https://github.com/JasperFx/marten/pull/5060

**Full Changelog**: https://github.com/JasperFx/marten/compare/V9.20.1...V9.20.2

Commits viewable in [compare view](https://github.com/JasperFx/marten/compare/V9.20.1...V9.22.3).
</details>

Updated [ModelContextProtocol](https://github.com/modelcontextprotocol/csharp-sdk) from 2.0.0-rc.2 to 2.0.0.

<details>
<summary>Release notes</summary>

_Sourced from [ModelContextProtocol's releases](https://github.com/modelcontextprotocol/csharp-sdk/releases)._

## 2.0.0

**Version 2.0.0 brings the C# SDK into stable alignment with the MCP 2026-07-28 specification.**

This major release introduces discovery-first negotiation, multi-round-trip requests, stateless-by-default HTTP, caching hints, standardized headers, stronger OAuth and token-cache safety, and dedicated MCP Apps and Tasks extension packages, with down-level interoperability for peers negotiating 2025-11-25 and earlier. Review the migration guidance below.

## Breaking Changes

Refer to the [C# SDK Versioning](https://csharp.sdk.modelcontextprotocol.io/versioning.html) documentation for details on versioning and breaking-change policies.

1. **Default to stateless HTTP and discovery-first negotiation #​1610**
   * `HttpServerTransportOptions.Stateless` now defaults to `true`. Stateless servers do not create transport sessions, expose the standalone SSE `GET`/`DELETE` endpoints, or support unsolicited server-to-client requests.
   * Set `Stateless = false` when an existing server requires legacy stateful behavior. Stateful-only options now produce `MCP9006` warnings and apply only to down-level initialize-handshake connections.
   * Clients probe `server/discover` first and automatically fall back to the legacy `initialize` handshake for down-level servers.
2. **Deprecate Roots, Sampling, and Logging APIs #​1651**
   * The stable Roots, Sampling, and Logging API surfaces now produce `MCP9005` warnings because these features are deprecated by the 2026-07-28 specification.
   * Existing down-level connections can continue using these APIs. Suppress `MCP9005` temporarily if continued use is required while planning migration.
3. **Move Tasks into `ModelContextProtocol.Extensions.Tasks` #​1693**
   * The v1.4.x Tasks implementation is replaced by a dedicated extension package and has no API or wire compatibility with the earlier experimental implementation.
   * Add a reference to `ModelContextProtocol.Extensions.Tasks`, import its namespace, register Tasks with `WithTasks(...)`, and replace Core `RequestMethods.Tasks*` constants with `TasksProtocol` members.
4. **Strengthen OAuth callback and issuer validation #​1605**
   * `AuthorizationRedirectDelegate` and `ClientOAuthOptions.AuthorizationRedirectDelegate` now produce `MCP9007` warnings. Migrate to `ClientOAuthOptions.AuthorizationCallbackHandler` so callbacks can return the authorization code, state, and issuer.
   * OAuth authorization now rejects issuer mismatches required by RFC 9207 and RFC 8414. Correct inconsistent authorization-server metadata rather than bypassing validation.
5. **Emit non-object structured tool results directly #​1568**
   * Tools with `UseStructuredContent = true` and a non-object return type now emit the raw value and matching schema, such as `structuredContent: 72`, instead of wrapping it as `{ "result": 72 }`.
   * Update clients to read the value according to the advertised output schema rather than assuming a `result` property.
6. **Require `Tool.inputSchema` during deserialization #​1600**
   * Deserializing a `Tool` payload without `inputSchema` now throws `JsonException` instead of silently defaulting the schema.
   * Custom servers, proxies, and test fixtures that produce tool JSON must include `inputSchema`; an empty `{}` is sufficient.
7. **Require explicit PKCE S256 support in OAuth metadata #​1700**
   * OAuth authorization now fails when authorization-server metadata does not advertise `S256` in `code_challenge_methods_supported`.
   * Update the authorization server metadata to declare PKCE S256 support.
8. **Send `application_type` during dynamic client registration #​1613**
   * Dynamic client registration requests now include an inferred `application_type`.
   * Authorization servers that validate the request shape must accept this standard field; set `DynamicClientRegistrationOptions.ApplicationType` explicitly when the inferred value is not appropriate.
9. **Propagate underlying SSE connection exceptions #​1432**
   * Explicit SSE connections now surface the underlying `HttpRequestException`, `TimeoutException`, or genuine I/O exception instead of always wrapping failures in `IOException`.
   * Update connection error handling that depends on the old `IOException("Failed to connect transport.")` wrapper. In AutoDetect mode, inspect the outer `HttpRequestException` and its inner SSE failure.
10. **Fail OAuth step-up when a challenge makes no progress #​1591**
    * A repeated `insufficient_scope` challenge that introduces no new scopes now throws `McpException` instead of retrying indefinitely.
    * Handle the exception as an authorization failure and ensure repeated challenges add scopes when another step-up attempt is expected.

## What's Changed

* Add `InheritEnvironmentVariables` to `StdioClientTransportOptions` #​1563 by @​halter73
* Stop logging stdio transport environment variables #​1538 by @​halter73 (co-authored by @​Copilot)
* Implement SEP-2243 HTTP header standardization #​1553 by @​mikekistler (co-authored by @​tarekgh @​Copilot)
* Append `offline_access` to authorization scope when advertised (SEP-2207) #​1479 by @​stephentoub (co-authored by @​Copilot)
* Deprecate `McpErrorCode.ResourceNotFound` per SEP-2164 #​1558 by @​jayaraman-venkatesan
* Add APIs for pre-populating the `McpClient` tool cache #​1590 by @​tarekgh
* Add `ScopeSelectorDelegate` to OAuth options #​1596 by @​halllo
* Validate the authenticated user on Streamable HTTP session deletion #​1604 by @​halter73
 ... (truncated)

Commits viewable in [compare view](https://github.com/modelcontextprotocol/csharp-sdk/compare/v2.0.0-rc.2...v2.0.0).
</details>

Updated ModelContextProtocol.AspNetCore from 2.0.0-rc.2 to 2.0.0.

Updated [Supabase.Storage](https://github.com/supabase-community/storage-csharp) from 2.5.0 to 2.7.0.

<details>
<summary>Release notes</summary>

_Sourced from [Supabase.Storage's releases](https://github.com/supabase-community/storage-csharp/releases)._

## 2.7.0

## [2.7.0](https://github.com/supabase-community/storage-csharp/compare/v2.6.0...v2.7.0) (2026-08-04)


### Features

* classify oversized-upload 413s ([#​56](https://github.com/supabase-community/storage-csharp/issues/56)) ([724f46d](https://github.com/supabase-community/storage-csharp/commit/724f46d925a75c0f268d272cca06fc6f19af5b01))
* put cache nonce as parameter on some route ([#​53](https://github.com/supabase-community/storage-csharp/issues/53)) ([ed7a9c2](https://github.com/supabase-community/storage-csharp/commit/ed7a9c2c6d26432c8aa16ede437076ed86a0e59c))


### Bug Fixes

* treat an empty TransformOptions as no transform, not a render request ([#​55](https://github.com/supabase-community/storage-csharp/issues/55)) ([9ae3581](https://github.com/supabase-community/storage-csharp/commit/9ae35812ea252c54410554429e0d0d1f8289f9a8))

## 2.6.0

## [2.6.0](https://github.com/supabase-community/storage-csharp/compare/v2.5.0...v2.6.0) (2026-07-29)


### Features

* add cancelation token on download method ([#​49](https://github.com/supabase-community/storage-csharp/issues/49)) ([82af2b8](https://github.com/supabase-community/storage-csharp/commit/82af2b8fbcf44684b6bd618493c3bb80c798513f))
* implement purge cache issue ([#​50](https://github.com/supabase-community/storage-csharp/issues/50)) ([41ee1f8](https://github.com/supabase-community/storage-csharp/commit/41ee1f86a39e921b781886fe6c44b3c567d711fc))


### Bug Fixes

* clear trailing '?' on CreateSignedUrl ([#​51](https://github.com/supabase-community/storage-csharp/issues/51)) ([7ca4723](https://github.com/supabase-community/storage-csharp/commit/7ca4723fe4a192b1470818793d369568850c5393))
* non-JSON Storage error now throws SupabaseStorageException ([#​46](https://github.com/supabase-community/storage-csharp/issues/46)) ([1c54194](https://github.com/supabase-community/storage-csharp/commit/1c5419443a914b7c2b3643a2441c0a3ca6282e97))

Commits viewable in [compare view](https://github.com/supabase-community/storage-csharp/compare/v2.5.0...v2.7.0).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions


</details>

@dependabot
Bump the nuget group with 4 updates
38e7098 
Bumps Marten from 9.20.1 to 9.22.3
Bumps ModelContextProtocol from 2.0.0-rc.2 to 2.0.0
Bumps ModelContextProtocol.AspNetCore from 2.0.0-rc.2 to 2.0.0
Bumps Supabase.Storage from 2.5.0 to 2.7.0

---
updated-dependencies:
- dependency-name: Marten
  dependency-version: 9.22.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
- dependency-name: ModelContextProtocol
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: ModelContextProtocol.AspNetCore
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget
- dependency-name: Supabase.Storage
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Aug 4, 2026
@dependabot
dependabot Bot requested a review from KaliCZ as a code owner August 4, 2026 13:37
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Aug 4, 2026
@KaliCZ
KaliCZ merged commit d486061 into main Aug 4, 2026
7 checks passed
@KaliCZ
KaliCZ deleted the dependabot/nuget/backend/src/Kalandra.Api/nuget-0608bf77d7 branch August 4, 2026 14:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@KaliCZ KaliCZ KaliCZ approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@KaliCZ