Bump WolverineFx from 6.23.1 to 6.24.5

[dependabot]

Updated WolverineFx from 6.23.1 to 6.24.5.

Release notes

Sourced from WolverineFx's releases.

6.24.5

Note: 6.24.4 shipped on NuGet without a GitHub release, so these notes cover everything since V6.24.3.

Highlights

Multi-database projection & subscription assignment got a major reliability pass. For sharded event stores, Wolverine assigns the agents for projections and subscriptions in groups by database — so connection pools scale with the number of databases rather than nodes × databases:

• A blue/green rollout carrying a projection version bump no longer assigns the new version's agents to nodes that cannot build them — previously the new version could never start anywhere for the whole rollout (#​3792, thanks @​erdtsieck). A split database now costs exactly one owner per version.
• Database affinity is now a property of the database across agent families (#​3785): a shard database's durability agent follows that database's projection agents onto the same node, so the database attracts one node's connection pool instead of two. Measured on a 512-database production cluster, 73% of databases were split across two nodes, wasting ~425 connection slots. Expect a one-time wave of durability-agent reassignments on first deploy as an existing cluster converges.
• The settled assignment state is now pinned as a fixed point — re-evaluating a converged cluster moves nothing — and a new deterministic simulation drives the real leader evaluation through the exact deploy shape of GH-3753: slow agent starts and a blue/green capability split at once.

Durable outbox to SNS/SQS FIFO destinations is fixed (#​3793): EnvelopeSerializer never round-tripped Envelope.DeduplicationId, so any envelope recovered from durable storage after an outage was re-sent without MessageDeduplicationId and rejected deterministically by a FIFO destination without content-based deduplication — retrying forever or dead-lettering. Also fixed alongside it: the circuit-resume ping could never reach a FIFO destination (a latched sender could never unlatch), and SNS sent MessageDeduplicationId to standard topics, which AWS rejects. The same fix is merged to the 5.x maintenance branch and will ship in the next 5.40.x release for .NET 8 users.

Balanced-mode host shutdown no longer hangs (#​3781): stopping a node while agent commands were queued could pay a full agent-batch reply window per queued command — measured at 17+ minutes. Now ~2 minutes on the same reproduction.

Azure Service Bus conventional routing sanitizes entity names (#​3786): a handler for an array message type (e.g. Handle(Foo[])) produced an illegal ASB entity name that broke broker startup for the whole assembly, and the real reason was lost. Names are sanitized and failures now carry the offending name.

What's Changed

• Never adopt a test-runner assembly as the application assembly (GH-3776) by @​jeremydmiller in Never adopt a test-runner assembly as the application assembly (GH-3776) JasperFx/wolverine#3777
• CI/testing sweep: compliance assertion scoping, Marten segmentation, dispose leaks by @​jeremydmiller in CI/testing sweep: compliance assertion scoping, Marten segmentation, dispose leaks JasperFx/wolverine#3775
• GH-3779: a dev-scale reproduction of slow agent starts, and the first flaky-tag burn-down (GH-3763) by @​jeremydmiller in GH-3779: a dev-scale reproduction of slow agent starts, and the first flaky-tag burn-down (GH-3763) JasperFx/wolverine#3780
• Stop Balanced-mode host shutdown paying a full agent reply window (GH-3781) by @​jeremydmiller in Stop Balanced-mode host shutdown paying a full agent reply window (GH-3781) JasperFx/wolverine#3782
• Wait for the ASB emulator's management api, and pin the image by @​jeremydmiller in Wait for the ASB emulator's management api, and pin the image JasperFx/wolverine#3783
• Restore 32 Azure Service Bus tests, re-tag 11 that are genuinely broken (GH-3763, GH-3786) by @​jeremydmiller in Restore 32 Azure Service Bus tests, re-tag 11 that are genuinely broken (GH-3763, GH-3786) JasperFx/wolverine#3784
• Report what every CI job spends of its retry budget (GH-3787) by @​jeremydmiller in Report what every CI job spends of its retry budget (GH-3787) JasperFx/wolverine#3788
• Sanitize Azure Service Bus entity names, and stop losing the reason (GH-3786) by @​jeremydmiller in Sanitize Azure Service Bus entity names, and stop losing the reason (GH-3786) JasperFx/wolverine#3789
• Point the AWS tests at LocalStack, and fix the SQS name limit they were hiding (GH-3763) by @​jeremydmiller in Point the AWS tests at LocalStack, and fix the SQS name limit they were hiding (GH-3763) JasperFx/wolverine#3791
• Restore the Kafka tests the Flaky tag was hiding (GH-3763) by @​jeremydmiller in Restore the Kafka tests the Flaky tag was hiding (GH-3763) JasperFx/wolverine#3794
• Stop the RabbitMQ tests colliding on shared broker names (GH-3763) by @​jeremydmiller in Stop the RabbitMQ tests colliding on shared broker names (GH-3763) JasperFx/wolverine#3795
• Restore 55 Pulsar tests and skip only the four behaviours that are missing (GH-3763) by @​jeremydmiller in Restore 55 Pulsar tests and skip only the four behaviours that are missing (GH-3763) JasperFx/wolverine#3798
• Fix DistributeByGroupAffinity assigning a bumped projection version to nodes that cannot build it by @​erdtsieck in Fix DistributeByGroupAffinity assigning a bumped projection version to nodes that cannot build it JasperFx/wolverine#3792
• Round-trip Envelope.DeduplicationId, and let a ping reach a FIFO destination (GH-3793) by @​jeremydmiller in Round-trip Envelope.DeduplicationId, and let a ping reach a FIFO destination (GH-3793) JasperFx/wolverine#3801
• Pin the group-affinity invariants GH-3792 relies on, and simulate a version bump with slow starts by @​jeremydmiller in Pin the group-affinity invariants GH-3792 relies on, and simulate a version bump with slow starts JasperFx/wolverine#3804
• Make database affinity a property of the database across agent families (GH-3785) by @​jeremydmiller in Make database affinity a property of the database across agent families (GH-3785) JasperFx/wolverine#3805
• RavenDb and CosmosDb dead-letter readers survive an unreadable body (GH-3773)
• Completion continuations honor the executor's metrics-silent tracker (GH-3774)

Full Changelog: JasperFx/wolverine@V6.24.3...V6.24.5

6.24.3

What's Changed

• Re-point the GH-3740 tests at the better guarantee JasperFx 2.37.0 gives us by @​jeremydmiller in Re-point the GH-3740 tests at the better guarantee JasperFx 2.37.0 gives us JasperFx/wolverine#3755
• Bump Marten to 9.22.2 and Weasel to 9.23.0 by @​jeremydmiller in Bump Marten to 9.22.2 and Weasel to 9.23.0 JasperFx/wolverine#3756
• Reassignments run in the source node's lane and batch by AgentStartBatchSize (GH-3749, GH-3748) by @​jeremydmiller in Reassignments run in the source node's lane and batch by AgentStartBatchSize (GH-3749, GH-3748) JasperFx/wolverine#3757
• Kafka retry-tier listeners inherit native DLQ enablement; DLQ tests get isolated topics by @​jeremydmiller in Kafka retry-tier listeners inherit native DLQ enablement; DLQ tests get isolated topics JasperFx/wolverine#3760
• System traffic no longer counts as application message metrics (CritterWatch GH-907) by @​jeremydmiller in System traffic no longer counts as application message metrics (CritterWatch GH-907) JasperFx/wolverine#3759
• Bobcat-supervised CI test runs: parallel workers, per-lane databases, honest retries by @​jeremydmiller in Bobcat-supervised CI test runs: parallel workers, per-lane databases, honest retries JasperFx/wolverine#3758
• Agent commands wait on observed progress, not the clock (GH-3748, GH-3750) by @​jeremydmiller in Agent commands wait on observed progress, not the clock (GH-3748, GH-3750) JasperFx/wolverine#3768
• fix(mqtt): wait for broker ack before completing durable sends by @​dmitrynovik in fix(mqtt): wait for broker ack before completing durable sends JasperFx/wolverine#3745
• Save the scraped domain-event envelopes before committing the tenant transaction (GH-3744) by @​jeremydmiller in Save the scraped domain-event envelopes before committing the tenant transaction (GH-3744) JasperFx/wolverine#3754
• Durable receiver settles unacked deliveries when the inbox database is unavailable (GH-3767) by @​jeremydmiller in Durable receiver settles unacked deliveries when the inbox database is unavailable (GH-3767) JasperFx/wolverine#3770
• Parameterless OrInner() no longer discards its inner-exception match (GH-3766) by @​jeremydmiller in Parameterless OrInner<T>() no longer discards its inner-exception match (GH-3766) JasperFx/wolverine#3769
• Bump to 6.24.3 by @​jeremydmiller in Bump to 6.24.3 JasperFx/wolverine#3772

New Contributors

• @​dmitrynovik made their first contribution in fix(mqtt): wait for broker ack before completing durable sends JasperFx/wolverine#3745

Full Changelog: JasperFx/wolverine@V6.24.2...V6.24.3

6.24.2

What's Changed

• Fix the chronic CISqlServer red: give the DLQ expiration suite its own schema by @​jeremydmiller in Fix the chronic CISqlServer red: give the DLQ expiration suite its own schema JasperFx/wolverine#3743
• Stop one bad property getter from killing the whole capabilities snapshot (GH-3740) by @​jeremydmiller in Stop one bad property getter from killing the whole capabilities snapshot (GH-3740) JasperFx/wolverine#3741
• Fix InvalidCastException starting a NATS listener with a dead-letter subject (GH-3739) by @​jeremydmiller in Fix InvalidCastException starting a NATS listener with a dead-letter subject (GH-3739) JasperFx/wolverine#3742

Full Changelog: JasperFx/wolverine@V6.24.1...V6.24.2

6.24.1

Patch release. Four reported issues, all with reproductions from production clusters.

Fixes

#​3701 — wolverine_node_records grows without bound (#​3734)

A reporting cluster reached 36,135,221 rows / 16 GB in five days on a diagnostic table nothing on the hot path reads. Three distinct defects:

• INodeAgentPersistence.DeleteOldNodeRecordsAsync was implemented for every relational store and never invoked outside tests.
• The pruning that did run bounds the table by age only (NodeEventRecordExpirationTime, 5 days), which is no ceiling at all at high write rates — every one of those 36M rows was inside the window.
• That age sweep's hourly throttle was dead. Its backing field was never assigned (the CS0649 suppression on it said so), so a full-table delete went out on every recovery cycle — every 5 seconds by default.

New Durability.NodeRecordRetention (default 10,000 rows) and Durability.NodeRecordPruningPeriod (default hourly). MultiTenantedMessageStore now delegates the trim to the main store instead of inheriting a no-op default, and Sqlite, MySQL and Oracle gained implementations they had also been missing.

#​3697 — no supported force-catch-up under Wolverine-managed event subscription distribution (#​3735)

Wolverine already implemented the coordinator-driven catch-up path, but only exposed it as a TrackActivity() stage. Adds the standalone entry point on IHost and IServiceProvider, plus <T> ancillary-store variants:

await host.PauseThenCatchUpOnMartenDaemonActivityAsync();
await host.PauseThenCatchUpOnMartenDaemonActivityAsync(CatchUpMode.AndDoNothing);
await host.PauseThenCatchUpOnMartenDaemonActivityAsync<IMyStore>();

It never calls IProjectionDaemon.CatchUpAsync — doing so under a live coordinator is what produces the ProgressionProgressOutOfOrderException and pk_mt_event_progression duplicate-key errors suites have been retrying around. Resuming the agents that already own the shards means there is only ever one writer.

#​3733 — a comma in an agent Uri voided a whole batch confirmation (#​3736)

AgentsStarted, StartAgents, AgentsStopped and StopAgents joined their Uri[] on a comma, which RFC 3986 permits unescaped in a path segment. Agent URIs embed tenant ids and projection names, so one comma shattered an agent into fragments — and because the read side built the array in a single projection, the resulting throw took out the confirmation for the entire batch. Newline is the delimiter now, and entries are parsed individually so a bad one names itself.

The comma remains the default on the wire for payloads that do not contain one, so rolling upgrades keep working in both directions.

#​3706 — RabbitMQ acks were cumulative (#​3737)

Every ack went out as BasicAckAsync(tag, multiple: true), acknowledging every lower delivery tag on the channel. That is only correct when completions happen in delivery order, and they do not with ConsumerDispatchConcurrency > 1 — acking one message silently acknowledged deliveries whose handlers were still running, and a crash at that moment lost them.

Acks are now per message. Two dead-letter paths that relied on the cumulative sweep settle themselves, most importantly the un-mappable-message branch in WorkerQueueMessageConsumer, which dead-lettered and returned without touching the delivery at all. This unblocks the planned native-ack parallel endpoint mode.

Also included

• #​3730 — compliance coverage for a pause and node loss landing on in-flight assignments (GH-3698)
• #​3732 — seed the departed node's inbox rows as already owned (GH-3729)

6.24.0

Two data-loss fixes — but for unusual usages

This release closes two bugs that silently destroyed data rather than failing loudly. Both are worth reading before you skip the rest of these notes.

Durable inbox rows were orphaned when a circuit breaker tripped (#​3680). DurableReceiver checked its latched flag before calling MarkReceived. The latched path still persists each envelope to the inbox as a safety net — but on an envelope that never went through MarkReceived, Status is the enum default (Outgoing) and Destination is null. Both are filter columns for inbox recovery, so the rows were written in a state no recovery sweep on any node could ever see. The null Listener also skipped the nack back to the broker, and the broker's redelivery after restart hit DuplicateIncomingEnvelopeException — which acks and drops. Net result: genuine message loss under a durable inbox any time a circuit breaker trip latched the receiver mid-flight. Measured on the circuit-breaker suite, 9 of 1,200 messages were lost per run.

Dropping one tenant from a shared partition bucket destroyed its co-tenants' data (#​3686). Found alongside #​3683. Tenant bucketing — registering several small tenants against one partition suffix so they share a physical partition — is documented and exposed through PartitionPerTenant(p => p.AllowPartitionSharing = true), and it did not work on either engine. It had no test coverage, because the doc sample demonstrating it is compile-only and never executed.

Global partitioning

Part of the GlobalPartitioning epic (#​3482).

• Global partitioning topologies for PostgreSQL and SQL Server queues (#​3468, #​3469)
• End-to-end sharded-processing suites for Azure Service Bus, GCP Pub/Sub, NATS, Redis Streams and Pulsar (#​3467). The scenario is lifted into Wolverine.ComplianceTests.Partitioning.ShardedProcessing, so a new transport costs one small test class
• Native-mode design comparison and per-transport native alternatives documented (#​3481)

The new suites immediately found two real bugs:

• NATS global partitioning had never worked at all. The topology forces EndpointMode.Durable on every slot, and a NatsEndpoint only supports Durable when JetStream-backed — so every UseShardedNatsSubjects() call threw at configuration time. The topology now enables JetStream on its own endpoints and declares a work-queue stream per shard, without which the listener died at startup on stream not found
• Pulsar named its companion local queues off the full topic path, producing queues like global-persistent://public/default/orders1. They now use the topic's short name, matching every other transport

Multi-tenancy and persistence

• EF Core tenant partition back-fill (#​3496). Routine migration deltas deliberately leave Weasel-managed partitions alone, so a table joining an existing managed set — a newly deployed service, or a newly mapped ITenanted entity — had no partition for any tenant registered before that table existed. IConjoinedTenantPartitions<T>.MigrateTenantPartitionsAsync() reconciles every partitioned table against the full registered tenant set, with per-table TenantPartitionResult reporting
• Conjoined tenant partition bucketing actually works now, on both PostgreSQL and SQL Server (#​3683, and see #​3686 above)
• Exclusive listener inbox recovery is now covered for RavenDb (#​3595) and CosmosDb (#​3596)

Transports

• RabbitMQ: deliveries are settled against the channel they arrived on (#​3687). Acking a delivery on a torn-down channel threw a NullReferenceException
• NATS: auto-provisioned JetStream durable consumers are filtered to their own subject (#​3676). FilterSubject was only assigned when ConsumerName was empty, so every durable consumer on a stream received every message. The fix needs a FilterSubjects multi-filter — a single filter cannot cover both {subject} and {subject}.scheduled, and a work-queue stream discards an uncovered control message
• MQTT: the v5 authentication method name is configurable (#​3588). It was hardcoded to "OAUTH2-JWT". Azure Event Grid's custom JWT authentication requires CUSTOM-JWT, so those brokers could not be reached through Wolverine's authentication support at all. You could already set the method by hand through MqttClientOptionsBuilder.WithAuthentication(), but that gave up Wolverine's token refresh loop — the whole reason to use MqttJwtAuthenticationOptions. You no longer have to choose
• The HTTP transport can send to a destination nobody pre-registered (#​3681, reported as ProductSupport#​34). WolverineHttpTransportClient used the endpoint's OutboundUri purely as an IHttpClientFactory client name, then posted to that client's BaseAddress — so operator commands sent back over the HTTP transport failed with An invalid request URI was provided

Performance

• RabbitMQ consumer dispatch concurrency is now per-endpoint (#​3492). The client default of 1 was the bottleneck. Simulated handler, 2,000 msg/s offered load, 30s measured window:

  ConsumerDispatchConcurrency	Throughput	Transit p50
  1 (client default)	163.7/s	— (nothing from the measured window was consumed before the run ended)
  5	828/s	22,871.9 ms
  20	1,999.1/s	1.486 ms (p95 2.54, p99 3.22)

  The 5.1x and 12.2x multiples understate it — at 1 and 5 the listener never catches up at all.

• Amazon SQS batches message deletions and chunks outgoing batches on the 256KB request size limit (#​3493)

• Azure Service Bus session listeners are no longer quadratic — the n² session loops are now n. MaxConcurrentCalls is surfaced, and a batched defer settles the original message (#​3494)

HTTP and gRPC

... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nuget/​wolverinefx@​6.23.1 ⏵ 6.24.5

View full report

[dependabot]

Superseded by #43.