Skip to content

Repository navigation

Bump the nuget-minor-patch group with 5 updates - #469

Merged
Oasis35 merged 1 commit into
env/stagingfrom
dependabot/nuget/src/back/env/staging/nuget-minor-patch-2d979c0c7f
Nov 2, 2026
Merged

Bump the nuget-minor-patch group with 5 updates#469
Oasis35 merged 1 commit into
env/stagingfrom
dependabot/nuget/src/back/env/staging/nuget-minor-patch-2d979c0c7f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 1, 2026

Copy link
Copy Markdown
Contributor

Updated WolverineFx.EntityFrameworkCore from 6.57.0 to 6.60.0.

Release notes

Sourced from WolverineFx.EntityFrameworkCore's releases.

6.60.0

What's Changed

Full Changelog: JasperFx/wolverine@V6.59.1...V6.60.0

6.59.1

This is a patch release with two fixes. Upgrading is a package bump only: there is no schema change and no API change.

SQL Server: the inbox and outbox seek on their indexes again

  • GH-5292 (#​5294): Several of the SQL Server message store's per-envelope statements were scanning the whole envelope table. That cost grows with the size of the inbox and outbox, and those statements run once per message. The cause was how two kinds of value were bound as parameters.
    • Envelope ids went out as sql_variant. The statements that mark envelopes as handled, reassign them, delete them and move them to the dead letter queue all filter on the envelope id. Weasel's generic command builder has no mapping for Guid, so it bound each id as DbType.Object, which SqlClient sends as sql_variant. SQL Server then had to compare CONVERT_IMPLICIT(sql_variant, [id]) on every row, which rules out a seek on the uniqueidentifier primary key. Ids are now bound as uniqueidentifier, so each statement is a primary key seek.
    • Envelope addresses went out as nvarchar. received_at on the inbox and destination on the outbox are varchar(250) columns, but statements that filter on them bound the address as nvarchar. Under a SQL collation such as SQL_Latin1_General_CP1_CI_AS, the default on Azure SQL, that converts the column and defeats the index. The statements affected are the per-envelope updates and deletes, inbox recovery's page load, outbox loads by destination, the scheduled message updates and the duplicate check. They now bind the address as varchar.
    • DateTime parameters kept only the date. The same generic mapping typed DateTime as DbType.Date. The message store now lets SqlClient type both values itself.
    • The new test checks SQL Server's plan cache after running each of these statements. It requires that no plan contains sql_variant and that no plan converts an indexed envelope column. The full SqlServerTests suite passes (721 tests, 2 skipped).
    • PostgreSQL, MySQL, SQLite and Oracle bind exactly as they did before.
    • The underlying Weasel mappings are tracked as JasperFx/weasel#​758 (Guid as sql_variant) and JasperFx/weasel#​759 (DateTime as date). Wolverine works around both on its own, so this release doesn't wait for a Weasel release.

The run command no longer blocks a thread pool thread

  • JasperFx 2.96.2 (JasperFx/jasperfx#​1093, fixes JasperFx/jasperfx#​1092): Wolverine now depends on JasperFx 2.96.2. Before this release, the run command waited for shutdown by blocking a thread pool thread for the whole life of the application. That matters when a container's CPU limit is below one core. ProcessorCount is then 1, so the thread pool's minimum is one thread, and the run command held it. After that, every burst of work had to wait for the pool to add a thread, about 500 ms each time. The reporter saw a 200 ms Task.Delay loop wake up as much as about 950 ms late on Azure Container Apps.
    • The run command now awaits shutdown instead of blocking. It still listens for the same three signals: ApplicationStopping, Ctrl+C, and the assembly load context unloading.
    • When the host is already started (the AutoStartHost / WebApplicationFactory path), RunJasperFxCommands() used to block the calling thread. It now returns a task that completes when the host shuts down.
    • This applies to every application started with RunJasperFxCommands() or RunWolverineCommands(), whatever its persistence or transport.

Full Changelog: JasperFx/wolverine@V6.59.0...V6.59.1

6.59.0

New

  • GH-5288 (#​5289): Scheduled message management now knows about sagas. ScheduledMessageSummary.SagaId reports the saga id carried by each scheduled envelope. The new ScheduledMessageQuery.SagaId limits QueryAsync and CancelAsync to one saga's scheduled messages, such as its pending timeouts.
    • There is no schema change. The filter reads every scheduled message that matches the rest of the query and pages the saga's messages in memory, so PageSize and TotalCount stay exact. On a large scheduled backlog, narrow the query with MessageType or an execution-time window as well.
    • A CancelAsync with a SagaId that matches nothing cancels nothing.
    • Supported by PostgreSQL, SQL Server, MySQL, SQLite, Oracle, RavenDB and CosmosDB. RavenDB and CosmosDB now treat PageSize <= 0 as "read every match", as the RDBMS stores already did.
  • #​5287: WolverineFx.AI's AddLlmCallouts() now works under TypeLoadMode.Static when the application's pre-generated code was written without it. A library can ship its own static codegen and a host can add LLM callouts on top. In Static mode, callouts run on a pre-built handler that needs no generated code. Every other mode is unchanged.
    • New LlmCalloutOptions.ConfigureChain(Action<HandlerChain>) customizes the callout chain in any mode. IHandlerPolicy doesn't reach the pre-built handler.
    • DeduplicateCallouts is refused at startup in Static mode, because deduplication is woven into generated code.

Fixes

  • GH-5286 (#​5290): A send that IHost.StopAsync() cancels mid-flight is no longer logged as a send failure. Azure Service Bus hands the runtime's cancellation token to the SDK, so an orderly shutdown used to produce two Error lines for a batch that was never lost. A durable agent now logs it at Information, because the envelopes stay in the outbox and are recovered on restart. A non-durable agent logs it at Warning, because those messages were not sent. A shutdown cancellation no longer counts toward the circuit breaker or the sending failure policies. A cancellation while the application is still running, or any other exception during shutdown, is still logged at Error.

6.58.0

New

  • GH-5279 (#​5280, #​5282): New opt-in Durability.UseTransactionScopedDurabilityPassLock for PostgreSQL. The serverless durability pass takes a transaction-scoped advisory lock (pg_try_advisory_xact_lock) instead of a session lock. This makes the pass lock safe behind a transaction-mode pooler such as PgBouncer or Supabase's pooler, where a session lock can leak onto a pooled connection or be held by two passes at once. #​5282 hardens it:

    • the lock connection stays out of an ambient TransactionScope
    • an idle_in_transaction_session_timeout can no longer drop the lock in the middle of a pass
    • a lock transaction that ends before the pass does is reported, and its pooled connection is discarded
    • a session unlock that fails is logged as a warning

    Wolverine also logs a one-time warning when the store doesn't support the setting, or when extension steps such as Marten's projection catch-up run under the open lock transaction. That open transaction can stall Marten's gap detection, which is tracked in JasperFx/marten#​5791. See the serverless guide.

Fixes

  • GH-5276 (#​5277, thanks @​3nth): The HTTP transport's batch endpoint now answers 503 when a durable local queue cannot write the batch to its inbox. Before, it answered 200 while the messages were dropped, so a durable outbox deleted messages that were never stored on either side. The sender now keeps the batch and retries it.
  • GH-5278 (#​5281): A durable TCP listener now answers ProcessingFailure instead of Received when its inbox could not store a batch. The sender keeps the batch and retries it, and a late duplicate is deduplicated by id. gRPC listeners can't be durable, so they aren't affected. A guard test now pins that.
  • #​5275 (thanks @​lahma): With Durability.EnableInboxPartitioning, PostgreSQL's durable inbox now refuses a redelivery whose identity was already handled. Before, the kept Handled row sat in a different partition and didn't collide, so the redelivery was handled a second time. This completes the stable-id deduplication from 6.57.0 for partitioned inboxes.

Commits viewable in compare view.

Updated WolverineFx.Http from 6.57.0 to 6.60.0.

Release notes

Sourced from WolverineFx.Http's releases.

6.60.0

What's Changed

Full Changelog: JasperFx/wolverine@V6.59.1...V6.60.0

6.59.1

This is a patch release with two fixes. Upgrading is a package bump only: there is no schema change and no API change.

SQL Server: the inbox and outbox seek on their indexes again

  • GH-5292 (#​5294): Several of the SQL Server message store's per-envelope statements were scanning the whole envelope table. That cost grows with the size of the inbox and outbox, and those statements run once per message. The cause was how two kinds of value were bound as parameters.
    • Envelope ids went out as sql_variant. The statements that mark envelopes as handled, reassign them, delete them and move them to the dead letter queue all filter on the envelope id. Weasel's generic command builder has no mapping for Guid, so it bound each id as DbType.Object, which SqlClient sends as sql_variant. SQL Server then had to compare CONVERT_IMPLICIT(sql_variant, [id]) on every row, which rules out a seek on the uniqueidentifier primary key. Ids are now bound as uniqueidentifier, so each statement is a primary key seek.
    • Envelope addresses went out as nvarchar. received_at on the inbox and destination on the outbox are varchar(250) columns, but statements that filter on them bound the address as nvarchar. Under a SQL collation such as SQL_Latin1_General_CP1_CI_AS, the default on Azure SQL, that converts the column and defeats the index. The statements affected are the per-envelope updates and deletes, inbox recovery's page load, outbox loads by destination, the scheduled message updates and the duplicate check. They now bind the address as varchar.
    • DateTime parameters kept only the date. The same generic mapping typed DateTime as DbType.Date. The message store now lets SqlClient type both values itself.
    • The new test checks SQL Server's plan cache after running each of these statements. It requires that no plan contains sql_variant and that no plan converts an indexed envelope column. The full SqlServerTests suite passes (721 tests, 2 skipped).
    • PostgreSQL, MySQL, SQLite and Oracle bind exactly as they did before.
    • The underlying Weasel mappings are tracked as JasperFx/weasel#​758 (Guid as sql_variant) and JasperFx/weasel#​759 (DateTime as date). Wolverine works around both on its own, so this release doesn't wait for a Weasel release.

The run command no longer blocks a thread pool thread

  • JasperFx 2.96.2 (JasperFx/jasperfx#​1093, fixes JasperFx/jasperfx#​1092): Wolverine now depends on JasperFx 2.96.2. Before this release, the run command waited for shutdown by blocking a thread pool thread for the whole life of the application. That matters when a container's CPU limit is below one core. ProcessorCount is then 1, so the thread pool's minimum is one thread, and the run command held it. After that, every burst of work had to wait for the pool to add a thread, about 500 ms each time. The reporter saw a 200 ms Task.Delay loop wake up as much as about 950 ms late on Azure Container Apps.
    • The run command now awaits shutdown instead of blocking. It still listens for the same three signals: ApplicationStopping, Ctrl+C, and the assembly load context unloading.
    • When the host is already started (the AutoStartHost / WebApplicationFactory path), RunJasperFxCommands() used to block the calling thread. It now returns a task that completes when the host shuts down.
    • This applies to every application started with RunJasperFxCommands() or RunWolverineCommands(), whatever its persistence or transport.

Full Changelog: JasperFx/wolverine@V6.59.0...V6.59.1

6.59.0

New

  • GH-5288 (#​5289): Scheduled message management now knows about sagas. ScheduledMessageSummary.SagaId reports the saga id carried by each scheduled envelope. The new ScheduledMessageQuery.SagaId limits QueryAsync and CancelAsync to one saga's scheduled messages, such as its pending timeouts.
    • There is no schema change. The filter reads every scheduled message that matches the rest of the query and pages the saga's messages in memory, so PageSize and TotalCount stay exact. On a large scheduled backlog, narrow the query with MessageType or an execution-time window as well.
    • A CancelAsync with a SagaId that matches nothing cancels nothing.
    • Supported by PostgreSQL, SQL Server, MySQL, SQLite, Oracle, RavenDB and CosmosDB. RavenDB and CosmosDB now treat PageSize <= 0 as "read every match", as the RDBMS stores already did.
  • #​5287: WolverineFx.AI's AddLlmCallouts() now works under TypeLoadMode.Static when the application's pre-generated code was written without it. A library can ship its own static codegen and a host can add LLM callouts on top. In Static mode, callouts run on a pre-built handler that needs no generated code. Every other mode is unchanged.
    • New LlmCalloutOptions.ConfigureChain(Action<HandlerChain>) customizes the callout chain in any mode. IHandlerPolicy doesn't reach the pre-built handler.
    • DeduplicateCallouts is refused at startup in Static mode, because deduplication is woven into generated code.

Fixes

  • GH-5286 (#​5290): A send that IHost.StopAsync() cancels mid-flight is no longer logged as a send failure. Azure Service Bus hands the runtime's cancellation token to the SDK, so an orderly shutdown used to produce two Error lines for a batch that was never lost. A durable agent now logs it at Information, because the envelopes stay in the outbox and are recovered on restart. A non-durable agent logs it at Warning, because those messages were not sent. A shutdown cancellation no longer counts toward the circuit breaker or the sending failure policies. A cancellation while the application is still running, or any other exception during shutdown, is still logged at Error.

6.58.0

New

  • GH-5279 (#​5280, #​5282): New opt-in Durability.UseTransactionScopedDurabilityPassLock for PostgreSQL. The serverless durability pass takes a transaction-scoped advisory lock (pg_try_advisory_xact_lock) instead of a session lock. This makes the pass lock safe behind a transaction-mode pooler such as PgBouncer or Supabase's pooler, where a session lock can leak onto a pooled connection or be held by two passes at once. #​5282 hardens it:

    • the lock connection stays out of an ambient TransactionScope
    • an idle_in_transaction_session_timeout can no longer drop the lock in the middle of a pass
    • a lock transaction that ends before the pass does is reported, and its pooled connection is discarded
    • a session unlock that fails is logged as a warning

    Wolverine also logs a one-time warning when the store doesn't support the setting, or when extension steps such as Marten's projection catch-up run under the open lock transaction. That open transaction can stall Marten's gap detection, which is tracked in JasperFx/marten#​5791. See the serverless guide.

Fixes

  • GH-5276 (#​5277, thanks @​3nth): The HTTP transport's batch endpoint now answers 503 when a durable local queue cannot write the batch to its inbox. Before, it answered 200 while the messages were dropped, so a durable outbox deleted messages that were never stored on either side. The sender now keeps the batch and retries it.
  • GH-5278 (#​5281): A durable TCP listener now answers ProcessingFailure instead of Received when its inbox could not store a batch. The sender keeps the batch and retries it, and a late duplicate is deduplicated by id. gRPC listeners can't be durable, so they aren't affected. A guard test now pins that.
  • #​5275 (thanks @​lahma): With Durability.EnableInboxPartitioning, PostgreSQL's durable inbox now refuses a redelivery whose identity was already handled. Before, the kept Handled row sat in a different partition and didn't collide, so the redelivery was handled a second time. This completes the stable-id deduplication from 6.57.0 for partitioned inboxes.

Commits viewable in compare view.

Updated WolverineFx.Http.FluentValidation from 6.57.0 to 6.60.0.

Release notes

Sourced from WolverineFx.Http.FluentValidation's releases.

6.60.0

What's Changed

Full Changelog: JasperFx/wolverine@V6.59.1...V6.60.0

6.59.1

This is a patch release with two fixes. Upgrading is a package bump only: there is no schema change and no API change.

SQL Server: the inbox and outbox seek on their indexes again

  • GH-5292 (#​5294): Several of the SQL Server message store's per-envelope statements were scanning the whole envelope table. That cost grows with the size of the inbox and outbox, and those statements run once per message. The cause was how two kinds of value were bound as parameters.
    • Envelope ids went out as sql_variant. The statements that mark envelopes as handled, reassign them, delete them and move them to the dead letter queue all filter on the envelope id. Weasel's generic command builder has no mapping for Guid, so it bound each id as DbType.Object, which SqlClient sends as sql_variant. SQL Server then had to compare CONVERT_IMPLICIT(sql_variant, [id]) on every row, which rules out a seek on the uniqueidentifier primary key. Ids are now bound as uniqueidentifier, so each statement is a primary key seek.
    • Envelope addresses went out as nvarchar. received_at on the inbox and destination on the outbox are varchar(250) columns, but statements that filter on them bound the address as nvarchar. Under a SQL collation such as SQL_Latin1_General_CP1_CI_AS, the default on Azure SQL, that converts the column and defeats the index. The statements affected are the per-envelope updates and deletes, inbox recovery's page load, outbox loads by destination, the scheduled message updates and the duplicate check. They now bind the address as varchar.
    • DateTime parameters kept only the date. The same generic mapping typed DateTime as DbType.Date. The message store now lets SqlClient type both values itself.
    • The new test checks SQL Server's plan cache after running each of these statements. It requires that no plan contains sql_variant and that no plan converts an indexed envelope column. The full SqlServerTests suite passes (721 tests, 2 skipped).
    • PostgreSQL, MySQL, SQLite and Oracle bind exactly as they did before.
    • The underlying Weasel mappings are tracked as JasperFx/weasel#​758 (Guid as sql_variant) and JasperFx/weasel#​759 (DateTime as date). Wolverine works around both on its own, so this release doesn't wait for a Weasel release.

The run command no longer blocks a thread pool thread

  • JasperFx 2.96.2 (JasperFx/jasperfx#​1093, fixes JasperFx/jasperfx#​1092): Wolverine now depends on JasperFx 2.96.2. Before this release, the run command waited for shutdown by blocking a thread pool thread for the whole life of the application. That matters when a container's CPU limit is below one core. ProcessorCount is then 1, so the thread pool's minimum is one thread, and the run command held it. After that, every burst of work had to wait for the pool to add a thread, about 500 ms each time. The reporter saw a 200 ms Task.Delay loop wake up as much as about 950 ms late on Azure Container Apps.
    • The run command now awaits shutdown instead of blocking. It still listens for the same three signals: ApplicationStopping, Ctrl+C, and the assembly load context unloading.
    • When the host is already started (the AutoStartHost / WebApplicationFactory path), RunJasperFxCommands() used to block the calling thread. It now returns a task that completes when the host shuts down.
    • This applies to every application started with RunJasperFxCommands() or RunWolverineCommands(), whatever its persistence or transport.

Full Changelog: JasperFx/wolverine@V6.59.0...V6.59.1

6.59.0

New

  • GH-5288 (#​5289): Scheduled message management now knows about sagas. ScheduledMessageSummary.SagaId reports the saga id carried by each scheduled envelope. The new ScheduledMessageQuery.SagaId limits QueryAsync and CancelAsync to one saga's scheduled messages, such as its pending timeouts.
    • There is no schema change. The filter reads every scheduled message that matches the rest of the query and pages the saga's messages in memory, so PageSize and TotalCount stay exact. On a large scheduled backlog, narrow the query with MessageType or an execution-time window as well.
    • A CancelAsync with a SagaId that matches nothing cancels nothing.
    • Supported by PostgreSQL, SQL Server, MySQL, SQLite, Oracle, RavenDB and CosmosDB. RavenDB and CosmosDB now treat PageSize <= 0 as "read every match", as the RDBMS stores already did.
  • #​5287: WolverineFx.AI's AddLlmCallouts() now works under TypeLoadMode.Static when the application's pre-generated code was written without it. A library can ship its own static codegen and a host can add LLM callouts on top. In Static mode, callouts run on a pre-built handler that needs no generated code. Every other mode is unchanged.
    • New LlmCalloutOptions.ConfigureChain(Action<HandlerChain>) customizes the callout chain in any mode. IHandlerPolicy doesn't reach the pre-built handler.
    • DeduplicateCallouts is refused at startup in Static mode, because deduplication is woven into generated code.

Fixes

  • GH-5286 (#​5290): A send that IHost.StopAsync() cancels mid-flight is no longer logged as a send failure. Azure Service Bus hands the runtime's cancellation token to the SDK, so an orderly shutdown used to produce two Error lines for a batch that was never lost. A durable agent now logs it at Information, because the envelopes stay in the outbox and are recovered on restart. A non-durable agent logs it at Warning, because those messages were not sent. A shutdown cancellation no longer counts toward the circuit breaker or the sending failure policies. A cancellation while the application is still running, or any other exception during shutdown, is still logged at Error.

6.58.0

New

  • GH-5279 (#​5280, #​5282): New opt-in Durability.UseTransactionScopedDurabilityPassLock for PostgreSQL. The serverless durability pass takes a transaction-scoped advisory lock (pg_try_advisory_xact_lock) instead of a session lock. This makes the pass lock safe behind a transaction-mode pooler such as PgBouncer or Supabase's pooler, where a session lock can leak onto a pooled connection or be held by two passes at once. #​5282 hardens it:

    • the lock connection stays out of an ambient TransactionScope
    • an idle_in_transaction_session_timeout can no longer drop the lock in the middle of a pass
    • a lock transaction that ends before the pass does is reported, and its pooled connection is discarded
    • a session unlock that fails is logged as a warning

    Wolverine also logs a one-time warning when the store doesn't support the setting, or when extension steps such as Marten's projection catch-up run under the open lock transaction. That open transaction can stall Marten's gap detection, which is tracked in JasperFx/marten#​5791. See the serverless guide.

Fixes

  • GH-5276 (#​5277, thanks @​3nth): The HTTP transport's batch endpoint now answers 503 when a durable local queue cannot write the batch to its inbox. Before, it answered 200 while the messages were dropped, so a durable outbox deleted messages that were never stored on either side. The sender now keeps the batch and retries it.
  • GH-5278 (#​5281): A durable TCP listener now answers ProcessingFailure instead of Received when its inbox could not store a batch. The sender keeps the batch and retries it, and a late duplicate is deduplicated by id. gRPC listeners can't be durable, so they aren't affected. A guard test now pins that.
  • #​5275 (thanks @​lahma): With Durability.EnableInboxPartitioning, PostgreSQL's durable inbox now refuses a redelivery whose identity was already handled. Before, the kept Handled row sat in a different partition and didn't collide, so the redelivery was handled a second time. This completes the stable-id deduplication from 6.57.0 for partitioned inboxes.

Commits viewable in compare view.

Updated WolverineFx.Postgresql from 6.57.0 to 6.60.0.

Release notes

Sourced from WolverineFx.Postgresql's releases.

6.60.0

What's Changed

Full Changelog: JasperFx/wolverine@V6.59.1...V6.60.0

6.59.1

This is a patch release with two fixes. Upgrading is a package bump only: there is no schema change and no API change.

SQL Server: the inbox and outbox seek on their indexes again

  • GH-5292 (#​5294): Several of the SQL Server message store's per-envelope statements were scanning the whole envelope table. That cost grows with the size of the inbox and outbox, and those statements run once per message. The cause was how two kinds of value were bound as parameters.
    • Envelope ids went out as sql_variant. The statements that mark envelopes as handled, reassign them, delete them and move them to the dead letter queue all filter on the envelope id. Weasel's generic command builder has no mapping for Guid, so it bound each id as DbType.Object, which SqlClient sends as sql_variant. SQL Server then had to compare CONVERT_IMPLICIT(sql_variant, [id]) on every row, which rules out a seek on the uniqueidentifier primary key. Ids are now bound as uniqueidentifier, so each statement is a primary key seek.
    • Envelope addresses went out as nvarchar. received_at on the inbox and destination on the outbox are varchar(250) columns, but statements that filter on them bound the address as nvarchar. Under a SQL collation such as SQL_Latin1_General_CP1_CI_AS, the default on Azure SQL, that converts the column and defeats the index. The statements affected are the per-envelope updates and deletes, inbox recovery's page load, outbox loads by destination, the scheduled message updates and the duplicate check. They now bind the address as varchar.
    • DateTime parameters kept only the date. The same generic mapping typed DateTime as DbType.Date. The message store now lets SqlClient type both values itself.
    • The new test checks SQL Server's plan cache after running each of these statements. It requires that no plan contains sql_variant and that no plan converts an indexed envelope column. The full SqlServerTests suite passes (721 tests, 2 skipped).
    • PostgreSQL, MySQL, SQLite and Oracle bind exactly as they did before.
    • The underlying Weasel mappings are tracked as JasperFx/weasel#​758 (Guid as sql_variant) and JasperFx/weasel#​759 (DateTime as date). Wolverine works around both on its own, so this release doesn't wait for a Weasel release.

The run command no longer blocks a thread pool thread

  • JasperFx 2.96.2 (JasperFx/jasperfx#​1093, fixes JasperFx/jasperfx#​1092): Wolverine now depends on JasperFx 2.96.2. Before this release, the run command waited for shutdown by blocking a thread pool thread for the whole life of the application. That matters when a container's CPU limit is below one core. ProcessorCount is then 1, so the thread pool's minimum is one thread, and the run command held it. After that, every burst of work had to wait for the pool to add a thread, about 500 ms each time. The reporter saw a 200 ms Task.Delay loop wake up as much as about 950 ms late on Azure Container Apps.
    • The run command now awaits shutdown instead of blocking. It still listens for the same three signals: ApplicationStopping, Ctrl+C, and the assembly load context unloading.
    • When the host is already started (the AutoStartHost / WebApplicationFactory path), RunJasperFxCommands() used to block the calling thread. It now returns a task that completes when the host shuts down.
    • This applies to every application started with RunJasperFxCommands() or RunWolverineCommands(), whatever its persistence or transport.

Full Changelog: JasperFx/wolverine@V6.59.0...V6.59.1

6.59.0

New

  • GH-5288 (#​5289): Scheduled message management now knows about sagas. ScheduledMessageSummary.SagaId reports the saga id carried by each scheduled envelope. The new ScheduledMessageQuery.SagaId limits QueryAsync and CancelAsync to one saga's scheduled messages, such as its pending timeouts.
    • There is no schema change. The filter reads every scheduled message that matches the rest of the query and pages the saga's messages in memory, so PageSize and TotalCount stay exact. On a large scheduled backlog, narrow the query with MessageType or an execution-time window as well.
    • A CancelAsync with a SagaId that matches nothing cancels nothing.
    • Supported by PostgreSQL, SQL Server, MySQL, SQLite, Oracle, RavenDB and CosmosDB. RavenDB and CosmosDB now treat PageSize <= 0 as "read every match", as the RDBMS stores already did.
  • #​5287: WolverineFx.AI's AddLlmCallouts() now works under TypeLoadMode.Static when the application's pre-generated code was written without it. A library can ship its own static codegen and a host can add LLM callouts on top. In Static mode, callouts run on a pre-built handler that needs no generated code. Every other mode is unchanged.
    • New LlmCalloutOptions.ConfigureChain(Action<HandlerChain>) customizes the callout chain in any mode. IHandlerPolicy doesn't reach the pre-built handler.
    • DeduplicateCallouts is refused at startup in Static mode, because deduplication is woven into generated code.

Fixes

  • GH-5286 (#​5290): A send that IHost.StopAsync() cancels mid-flight is no longer logged as a send failure. Azure Service Bus hands the runtime's cancellation token to the SDK, so an orderly shutdown used to produce two Error lines for a batch that was never lost. A durable agent now logs it at Information, because the envelopes stay in the outbox and are recovered on restart. A non-durable agent logs it at Warning, because those messages were not sent. A shutdown cancellation no longer counts toward the circuit breaker or the sending failure policies. A cancellation while the application is still running, or any other exception during shutdown, is still logged at Error.

6.58.0

New

  • GH-5279 (#​5280, #​5282): New opt-in Durability.UseTransactionScopedDurabilityPassLock for PostgreSQL. The serverless durability pass takes a transaction-scoped advisory lock (pg_try_advisory_xact_lock) instead of a session lock. This makes the pass lock safe behind a transaction-mode pooler such as PgBouncer or Supabase's pooler, where a session lock can leak onto a pooled connection or be held by two passes at once. #​5282 hardens it:

    • the lock connection stays out of an ambient TransactionScope
    • an idle_in_transaction_session_timeout can no longer drop the lock in the middle of a pass
    • a lock transaction that ends before the pass does is reported, and its pooled connection is discarded
    • a session unlock that fails is logged as a warning

    Wolverine also logs a one-time warning when the store doesn't support the setting, or when extension steps such as Marten's projection catch-up run under the open lock transaction. That open transaction can stall Marten's gap detection, which is tracked in JasperFx/marten#​5791. See the serverless guide.

Fixes

  • GH-5276 (#​5277, thanks @​3nth): The HTTP transport's batch endpoint now answers 503 when a durable local queue cannot write the batch to its inbox. Before, it answered 200 while the messages were dropped, so a durable outbox deleted messages that were never stored on either side. The sender now keeps the batch and retries it.
  • GH-5278 (#​5281): A durable TCP listener now answers ProcessingFailure instead of Received when its inbox could not store a batch. The sender keeps the batch and retries it, and a late duplicate is deduplicated by id. gRPC listeners can't be durable, so they aren't affected. A guard test now pins that.
  • #​5275 (thanks @​lahma): With Durability.EnableInboxPartitioning, PostgreSQL's durable inbox now refuses a redelivery whose identity was already handled. Before, the kept Handled row sat in a different partition and didn't collide, so the redelivery was handled a second time. This completes the stable-id deduplication from 6.57.0 for partitioned inboxes.

Commits viewable in compare view.

Updated WolverineFx.RuntimeCompilation from 6.57.0 to 6.60.0.

Release notes

Sourced from WolverineFx.RuntimeCompilation's releases.

6.60.0

What's Changed

Full Changelog: JasperFx/wolverine@V6.59.1...V6.60.0

6.59.1

This is a patch release with two fixes. Upgrading is a package bump only: there is no schema change and no API change.

SQL Server: the inbox and outbox seek on their indexes again

  • GH-5292 (#​5294): Several of the SQL Server message store's per-envelope statements were scanning the whole envelope table. That cost grows with the size of the inbox and outbox, and those statements run once per message. The cause was how two kinds of value were bound as parameters.
    • Envelope ids went out as sql_variant. The statements that mark envelopes as handled, reassign them, delete them and move them to the dead letter queue all filter on the envelope id. Weasel's generic command builder has no mapping for Guid, so it bound each id as DbType.Object, which SqlClient sends as sql_variant. SQL Server then had to compare CONVERT_IMPLICIT(sql_variant, [id]) on every row, which rules out a seek on the uniqueidentifier primary key. Ids are now bound as uniqueidentifier, so each statement is a primary key seek.
    • Envelope addresses went out as nvarchar. received_at on the inbox and destination on the outbox are varchar(250) columns, but statements that filter on them bound the address as nvarchar. Under a SQL collation such as SQL_Latin1_General_CP1_CI_AS, the default on Azure SQL, that converts the column and defeats the index. The statements affected are the per-envelope updates and deletes, inbox recovery's page load, outbox loads by destination, the scheduled message updates and the duplicate check. They now bind the address as varchar.
    • DateTime parameters kept only the date. The same generic mapping typed DateTime as DbType.Date. The message store now lets SqlClient type both values itself.
    • The new test checks SQL Server's plan cache after running each of these statements. It requires that no plan contains sql_variant and that no plan converts an indexed envelope column. The full SqlServerTests suite passes (721 tests, 2 skipped).
    • PostgreSQL, MySQL, SQLite and Oracle bind exactly as they did before.
    • The underlying Weasel mappings are tracked as JasperFx/weasel#​758 (Guid as sql_variant) and JasperFx/weasel#​759 (DateTime as date). Wolverine works around both on its own, so this release doesn't wait for a Weasel release.

The run command no longer blocks a thread pool thread

  • JasperFx 2.96.2 (JasperFx/jasperfx#​1093, fixes JasperFx/jasperfx#​1092): Wolverine now depends on JasperFx 2.96.2. Before this release, the run command waited for shutdown by blocking a thread pool thread for the whole life of the application. That matters when a container's CPU limit is below one core. ProcessorCount is then 1, so the thread pool's minimum is one thread, and the run command held it. After that, every burst of work had to wait for the pool to add a thread, about 500 ms each time. The reporter saw a 200 ms Task.Delay loop wake up as much as about 950 ms late on Azure Container Apps.
    • The run command now awaits shutdown instead of blocking. It still listens for the same three signals: ApplicationStopping, Ctrl+C, and the assembly load context unloading.
    • When the host is already started (the AutoStartHost / WebApplicationFactory path), RunJasperFxCommands() used to block the calling thread. It now returns a task that completes when the host shuts down.
    • This applies to every application started with RunJasperFxCommands() or RunWolverineCommands(), whatever its persistence or transport.

Full Changelog: JasperFx/wolverine@V6.59.0...V6.59.1

6.59.0

New

  • GH-5288 (#​5289): Scheduled message management now knows about sagas. ScheduledMessageSummary.SagaId reports the saga id carried by each scheduled envelope. The new ScheduledMessageQuery.SagaId limits QueryAsync and CancelAsync to one saga's scheduled messages, such as its pending timeouts.
    • There is no schema change. The filter reads every scheduled message that matches the rest of the query and pages the saga's messages in memory, so PageSize and TotalCount stay exact. On a large scheduled backlog, narrow the query with MessageType or an execution-time window as well.
    • A CancelAsync with a SagaId that matches nothing cancels nothing.
    • Supported by PostgreSQL, SQL Server, MySQL, SQLite, Oracle, RavenDB and CosmosDB. RavenDB and CosmosDB now treat PageSize <= 0 as "read every match", as the RDBMS stores already did.
  • #​5287: WolverineFx.AI's AddLlmCallouts() now works under TypeLoadMode.Static when the application's pre-generated code was written without it. A library can ship its own static codegen and a host can add LLM callouts on top. In Static mode, callouts run on a pre-built handler that needs no generated code. Every other mode is unchanged.
    • New LlmCalloutOptions.ConfigureChain(Action<HandlerChain>) customizes the callout chain in any mode. IHandlerPolicy doesn't reach the pre-built handler.
    • DeduplicateCallouts is refused at startup in Static mode, because deduplication is woven into generated code.

Fixes

  • GH-5286 (#​5290): A send that IHost.StopAsync() cancels mid-flight is no longer logged as a send failure. Azure Service Bus hands the runtime's cancellation token to the SDK, so an orderly shutdown used to produce two Error lines for a batch that was never lost. A durable agent now logs it at Information, because the envelopes stay in the outbox and are recovered on restart. A non-durable agent logs it at Warning, because those messages were not sent. A shutdown cancellation no longer counts toward the circuit breaker or the sending failure policies. A cancellation while the application is still running, or any other exception during shutdown, is still logged at Error.

6.58.0

New

  • GH-5279 (#​5280, #​5282): New opt-in Durability.UseTransactionScopedDurabilityPassLock for PostgreSQL. The serverless durability pass takes a transaction-scoped advisory lock (pg_try_advisory_xact_lock) instead of a session lock. This makes the pass lock safe behind a transaction-mode pooler such as PgBouncer or Supabase's pooler, where a session lock can leak onto a pooled connection or be held by two passes at once. #​5282 hardens it:

    • the lock connection stays out of an ambient TransactionScope
    • an idle_in_transaction_session_timeout can no longer drop the lock in the middle of a pass
    • a lock transaction that ends before the pass does is reported, and its pooled connection is discarded
    • a session unlock that fails is logged as a warning

    Wolverine also logs a one-time warning when the store doesn't support the setting, or when extension steps such as Marten's projection catch-up run under the open lock transaction. That open transaction can stall Marten's gap detection, which is tracked in JasperFx/marten#​5791. See the serverless guide.

Fixes

  • GH-5276 (#​5277, thanks @​3nth): The HTTP transport's batch endpoint now answers 503 when a durable local queue cannot write the batch to its inbox. Before, it answered 200 while the messages were dropped, so a durable outbox deleted messages that were never stored on either side. The sender now keeps the batch and retries it.
  • GH-5278 (#​5281): A durable TCP listener now answers ProcessingFailure instead of Received when its inbox could not store a batch. The sender keeps the batch and retries it, and a late duplicate is deduplicated by id. gRPC listeners can't be durable, so they aren't affected. A guard test now pins that.
  • #​5275 (thanks @​lahma): With Durability.EnableInboxPartitioning, PostgreSQL's durable inbox now refuses a redelivery whose identity was already handled. Before, the kept Handled row sat in a different partition and didn't collide, so the redelivery was handled a second time. This completes the stable-id deduplication from 6.57.0 for partitioned inboxes.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the nuget-minor-patch group with 5 updates
f51e714 
Bumps WolverineFx.EntityFrameworkCore from 6.57.0 to 6.60.0
Bumps WolverineFx.Http from 6.57.0 to 6.60.0
Bumps WolverineFx.Http.FluentValidation from 6.57.0 to 6.60.0
Bumps WolverineFx.Postgresql from 6.57.0 to 6.60.0
Bumps WolverineFx.RuntimeCompilation from 6.57.0 to 6.60.0

---
updated-dependencies:
- dependency-name: WolverineFx.EntityFrameworkCore
  dependency-version: 6.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: WolverineFx.Http
  dependency-version: 6.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: WolverineFx.Http.FluentValidation
  dependency-version: 6.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: WolverineFx.Postgresql
  dependency-version: 6.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: WolverineFx.RuntimeCompilation
  dependency-version: 6.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Nov 1, 2026
@sonarqubecloud

sonarqubecloud Bot commented Nov 1, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@Oasis35
Oasis35 merged commit d627f22 into env/staging Nov 2, 2026
13 checks passed
@Oasis35
Oasis35 deleted the dependabot/nuget/src/back/env/staging/nuget-minor-patch-2d979c0c7f branch November 2, 2026 08:48
@Oasis35 Oasis35 mentioned this pull request Nov 2, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Oasis35