Bump the nuget-minor-patch group with 9 updates - #172
Open
dependabot[bot] wants to merge 2 commits into
Open
Conversation
Bumps AndreGoepel.Core from 1.0.0 to 1.0.1 Bumps AndreGoepel.Marten.Identity.Blazor from 1.8.0 to 1.9.0 Bumps Marten from 9.19.0 to 9.22.2 Bumps Npgsql from 9.0.4 to 9.0.5 Bumps Quartz.Extensions.Hosting from 3.18.2 to 3.19.1 Bumps Quartz.Serialization.SystemTextJson from 3.18.2 to 3.19.1 Bumps Radzen.Blazor from 11.1.7 to 11.2.0 Bumps WolverineFx.Marten from 6.22.0 to 6.24.2 Bumps WolverineFx.RuntimeCompilation from 6.22.0 to 6.24.2 --- updated-dependencies: - dependency-name: AndreGoepel.Core dependency-version: 1.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: AndreGoepel.Marten.Identity.Blazor dependency-version: 1.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Marten dependency-version: 9.22.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Npgsql dependency-version: 9.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Quartz.Extensions.Hosting dependency-version: 3.19.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Quartz.Serialization.SystemTextJson dependency-version: 3.19.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Radzen.Blazor dependency-version: 11.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: WolverineFx.Marten dependency-version: 6.24.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: WolverineFx.RuntimeCompilation dependency-version: 6.24.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
.NET
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated AndreGoepel.Core from 1.0.0 to 1.0.1.
Release notes
Sourced from AndreGoepel.Core's releases.
1.0.1
What's Changed
New Contributors
Full Changelog: andregoepel/core@v1.0.0...v1.0.1
Commits viewable in compare view.
Updated AndreGoepel.Marten.Identity.Blazor from 1.8.0 to 1.9.0.
Release notes
Sourced from AndreGoepel.Marten.Identity.Blazor's releases.
1.9.0
What's Changed
Full Changelog: andregoepel/marten-identity@v1.8.1...v1.9.0
1.8.1
What's Changed
Full Changelog: andregoepel/marten-identity@v1.8.0...v1.8.1
Commits viewable in compare view.
Updated Marten from 9.19.0 to 9.22.2.
Release notes
Sourced from Marten's releases.
9.22.1
Security release. Upgrade is recommended for anyone using sharded tenancy together with
Events.UseTenantPartitionedEvents.A tenant id was interpolated into a double-quoted PostgreSQL identifier without doubling an embedded double quote, so a tenant id containing one could terminate the identifier and execute additional SQL statements. This is a different class from the two advisories previously published on this repository, both of which were the single-quoted string-literal class; neither of those fixes addressed this.
You are affected only if you use sharded tenancy, have
UseTenantPartitionedEventsenabled, and your application passes attacker-influenced input as a tenant id. Note that the reachable surface includes ordinary session resolution, not just administrative provisioning calls —GetTenantAsync/FindOrCreateDatabaseauto-provision an unknown tenant. Applications using tenant ids from a trusted fixed set are not exploitable.Affected versions: 9.4.0 through 9.22.0.
Full details, including remediation guidance for existing data, are in the security advisory: GHSA-3vp4-34pf-2rcw
What changed
PerTenantEventSequences.QuotedSequenceNameescapes embedded quotes, matchingquote_ident/%Iso the name still resolves to the same object the quick-append function finds. Covers the create, drop, schema-apply and cleanup paths.BulkEventAppenderno longer builds an unquoted sequence name from a suffix read back out of the tenants table. This also fixes a functional bug:PreserveSourceSequencebulk imports previously failed with42601for hyphenated and GUID tenant ids under sharded tenancy.ShardedTenancyvalidates tenant ids destined for DDL, closing a long-standing asymmetry with theDefaultTenancyprovisioning path. It is a narrow denylist rather than the existing identifier allowlist, so hyphenated and GUID tenant ids keep working.Dependency
Requires Weasel.Postgresql 9.21.1, which escapes partition bound values (JasperFx/weasel#416). Both halves are needed; the dependency is pulled in automatically.
Credit to Barak Srour (Apiiro) for the report.
9.22.0
The partitioning feature is new, but otherwise this was all about CritterWatch improvements for a huge installation
What's Changed
Full Changelog: JasperFx/marten@V9.21.0...V9.22.0
9.21.0
Highlights
A small, low-risk release: two bug fixes reported against 9.20.x, a LINQ ordering fix, a Newtonsoft serialization fix, and a new health-check overload for Wolverine-managed daemon distribution.
Bug Fixes
mt_quick_append_eventsreturned{NULL}for an empty event array (#5062, #5088)array_length('{}', 1)isNULLin PostgreSQL rather than0, so calling the bulk append function with no events returned abigint[]whose single element wasNULL. Npgsql could not read that intolong[], and the resultingInvalidCastExceptionwas thrown from the batch's post-processing loop — where it displaced whatever exception had actually made the append fail. Callers were left with an unrelated, non-retryable error instead of the real one; for the reporter that dead-lettered Wolverine messages which would otherwise have been retried.Fixed on three fronts:
COALESCEs the array length, so an empty append means what it says: zero events appended, final version unchanged.ProjectionUpdateBatch.WaitForCompletion, for anAppendside effect that ended up with no events) no longer issues the call.OrderByagainst a dictionary indexer dropped the key (#5063, #5073)OrderBy(x => x.SomeDictionary["key"])generated SQL that ignored the indexer key, so the ordering was wrong (or arbitrary) rather than failing loudly.Lazy LINQ sequences serialized as objects under Newtonsoft (#5076, #5080)
A document property holding a deferred-execution sequence (
Select(...),Where(...)without a materializing call) was written by Newtonsoft as an iterator object rather than a JSON array, so it would not round-trip. These are now written as plain arrays.IMessageBatchis called concurrently (#5065, #5085)Not a behavior change, but a documentation fix worth flagging if you implement
IMessageBatchyourself: the async daemon raises projection side effects from multiple threads at once (measured at up to 8 concurrent publishers across 10 threads for a single-stream projection catching up). The interface previously said nothing about this. An implementation that appends to an unsynchronized collection will silently drop messages — the same hazard, in a real outbox, that showed up here as a "flaky" test.New
Provider-aware
databaseFilterfor the high-water health check (#5061, #5089)AddMartenHighWaterHealthCheck'sdatabaseFilteris captured at registration time, so it cannot resolve services — which makes it unable to express "the databases this node currently owns" when ownership is runtime state. That is precisely the case under Wolverine-managed daemon distribution, where agents are assigned per (database, tenant) and rebalanced over a node's lifetime.There is now an overload whose filter receives the
IServiceProviderand is re-evaluated on every probe:It never calls
IProjectionDaemon.CatchUpAsync— doing so under a live coordinator is what produces theProgressionProgressOutOfOrderExceptionandpk_mt_event_progressionduplicate-key errors suites have been retrying around. Resuming the agents that already own the shards means there is only ever one writer.#3733 — a comma in an agent Uri voided a whole batch confirmation (#3736)
AgentsStarted,StartAgents,AgentsStoppedandStopAgentsjoined theirUri[]on a comma, which RFC 3986 permits unescaped in a path segment. Agent URIs embed tenant ids and projection names, so one comma shattered an agent into fragments — and because the read side built the array in a single projection, the resulting throw took out the confirmation for the entire batch. Newline is the delimiter now, and entries are parsed individually so a bad one names itself.The comma remains the default on the wire for payloads that do not contain one, so rolling upgrades keep working in both directions.
#3706 — RabbitMQ acks were cumulative (#3737)
Every ack went out as
BasicAckAsync(tag, multiple: true), acknowledging every lower delivery tag on the channel. That is only correct when completions happen in delivery order, and they do not withConsumerDispatchConcurrency > 1— acking one message silently acknowledged deliveries whose handlers were still running, and a crash at that moment lost them.Acks are now per message. Two dead-letter paths that relied on the cumulative sweep settle themselves, most importantly the un-mappable-message branch in
WorkerQueueMessageConsumer, which dead-lettered and returned without touching the delivery at all. This unblocks the planned native-ack parallel endpoint mode.Also included
6.24.0
Two data-loss fixes — but for unusual usages
This release closes two bugs that silently destroyed data rather than failing loudly. Both are worth reading before you skip the rest of these notes.
Durable inbox rows were orphaned when a circuit breaker tripped (#3680).
DurableReceiverchecked its latched flag before callingMarkReceived. The latched path still persists each envelope to the inbox as a safety net — but on an envelope that never went throughMarkReceived,Statusis the enum default (Outgoing) andDestinationis null. Both are filter columns for inbox recovery, so the rows were written in a state no recovery sweep on any node could ever see. The nullListeneralso skipped the nack back to the broker, and the broker's redelivery after restart hitDuplicateIncomingEnvelopeException— which acks and drops. Net result: genuine message loss under a durable inbox any time a circuit breaker trip latched the receiver mid-flight. Measured on the circuit-breaker suite, 9 of 1,200 messages were lost per run.Dropping one tenant from a shared partition bucket destroyed its co-tenants' data (#3686). Found alongside #3683. Tenant bucketing — registering several small tenants against one partition suffix so they share a physical partition — is documented and exposed through
PartitionPerTenant(p => p.AllowPartitionSharing = true), and it did not work on either engine. It had no test coverage, because the doc sample demonstrating it is compile-only and never executed.Global partitioning
Part of the GlobalPartitioning epic (#3482).
Wolverine.ComplianceTests.Partitioning.ShardedProcessing, so a new transport costs one small test classThe new suites immediately found two real bugs:
EndpointMode.Durableon every slot, and aNatsEndpointonly supportsDurablewhen JetStream-backed — so everyUseShardedNatsSubjects()call threw at configuration time. The topology now enables JetStream on its own endpoints and declares a work-queue stream per shard, without which the listener died at startup onstream not foundglobal-persistent://public/default/orders1. They now use the topic's short name, matching every other transportMulti-tenancy and persistence
ITenantedentity — had no partition for any tenant registered before that table existed.IConjoinedTenantPartitions<T>.MigrateTenantPartitionsAsync()reconciles every partitioned table against the full registered tenant set, with per-tableTenantPartitionResultreportingTransports
NullReferenceExceptionFilterSubjectwas only assigned whenConsumerNamewas empty, so every durable consumer on a stream received every message. The fix needs aFilterSubjectsmulti-filter — a single filter cannot cover both{subject}and{subject}.scheduled, and a work-queue stream discards an uncovered control message"OAUTH2-JWT". Azure Event Grid's custom JWT authentication requiresCUSTOM-JWT, so those brokers could not be reached through Wolverine's authentication support at all. You could already set the method by hand throughMqttClientOptionsBuilder.WithAuthentication(), but that gave up Wolverine's token refresh loop — the whole reason to useMqttJwtAuthenticationOptions. You no longer have to chooseWolverineHttpTransportClientused the endpoint'sOutboundUripurely as anIHttpClientFactoryclient name, then posted to that client'sBaseAddress— so operator commands sent back over the HTTP transport failed withAn invalid request URI was providedPerformance
RabbitMQ consumer dispatch concurrency is now per-endpoint (#3492). The client default of 1 was the bottleneck. Simulated handler, 2,000 msg/s offered load, 30s measured window:
ConsumerDispatchConcurrencyThe 5.1x and 12.2x multiples understate it — at 1 and 5 the listener never catches up at all.
Amazon SQS batches message deletions and chunks outgoing batches on the 256KB request size limit (#3493)
Azure Service Bus session listeners are no longer quadratic — the n² session loops are now n.
MaxConcurrentCallsis surfaced, and a batched defer settles the original message (#3494)HTTP and gRPC
... (truncated)
6.23.1
Agent distribution
TL;DR: if you pause a projection from CritterWatch on 6.23.0, restarting it appears to do nothing for a full minute. This fixes that.
A paused projection or subscription agent now resumes immediately when you restart it (#3663). On 6.23.0 the restart was accepted, the pause restriction was cleared, and then nothing happened until the pending-assignment ledger's TTL expired — 2 ×
CheckAssignmentPeriod, so 60 seconds with the defaults. Long enough that an operator reasonably concludes the agent is never coming back.The ledger introduced in 6.23.0 (#3622) only counted an assignment as confirmed if a later evaluation saw the agent running and still assigned to the same node. A pause makes those two conditions mutually exclusive: the first evaluation that can observe the delivered assignment is the same one that detaches the agent. The entry was never confirmed, nothing on the stop path cleared it, and the restart's
AssignAgentwas suppressed as a duplicate still in flight. Delivery alone now confirms the entry, which is the only question the ledger was ever asking.Pausing an agent no longer briefly starts it first (#3666).
ApplyRestrictionsAsynckickstarted a health check before persisting the operator's restriction change, so that evaluation ran against the old restrictions and could act against the very intent being applied — for a pause, re-assigning and starting the agent one beat before the merged evaluation stopped it again. Besides the wasted daemon start/stop cycle, this is what armed the stale ledger entry behind #3663.PostgreSQL
Advisory-lock sessions stay invisible to Marten's async-daemon gap detection (#3664). Marten 9.16.1+ will not skip a stale event-sequence gap while any session whose open transaction predates that gap is still alive (marten#4953). A session parked in an open transaction for the life of the process therefore reads as a permanent "possible reserver" and can hold the high-water mark — and every async projection — behind a gap that is genuinely dead.
Wolverine's long-held locks were already shaped correctly: leader election and node coordination hold session-scoped advisory locks on a dedicated connection with no transaction, so they show up as
state='idle'with a NULLxact_start. Those sessions are now also taggedapplication_name = 'wolverine-advisory-lock:<database>', which turns apg_stat_activityinvestigation from guesswork into something you can read at a glance. The constraints are pinned in tests and in the Postgres durability docs, including the trap worth knowing in your own code: never add a keepalive query inside a long-lived open transaction — it bumpsstate_change, makes the session look active, and re-promotes it to candidate reserver.Note for combined Marten + Wolverine deployments: older guidance suggested Postgres's
idle_in_transaction_session_timeoutas a dead-gap backstop. Prefer upgrading Marten and usingSkipStaleGapsDespiteLiveTransactionsAfterinstead.6.23.0
Projection & agent distribution
TL;DR: this prevents Wolverine from going into a panic doing agent assignments and churning crazily hard during Kubernetes rollouts or cluster starts and that's a very good thing
The bulk of this release. A wave of fixes (WO-1..8) to the agent assignment plane that together remove the re-assignment churn and livelock that could leave projection agents flapping or wedged.
AssignAgentfloods (#3622)IEventSubscriptionAgent.Failuresurfaces aShardFailure— category, the failing event's sequence and type, and the root exception type — through health checks and a newIWolverineObserver.AgentPausedhook plus aNodeRecordType.AgentPausedrecord. Failures bound to a specific event (ApplyEvent,EventSerialization,UnknownEventType) or to two processes racing one shard (ProgressionOutOfOrder) are no longer auto-restarted, since they would die on the identical event every time (#3637, #3638)Durability.AgentStartRetryAttempts/AgentStartRetryDelay, instead of idling a fullCheckAssignmentPeriodafter a startup race (#3519)FindAgentUriAsyncoverload (#3647) and a store-awareTryRebuildRegisteredProjectionAsyncoverload (#3618)Bumps JasperFx.Events to 2.36.1, Marten to 9.20.0 and Polecat to 5.7.0.
HTTP
Content-Typeon an[AcceptsContentType]route returns 415 rather than 404 (#3649)[AsParameters]endpoints no longer advertise a form body, which had been dropping them from route matching entirely (#3630)PublishMessage<T>andSendMessage<T>— now describe the message they read from the body. They had been advertising no request body at all in OpenAPI (#3646)Transports
ListenToPubsubSubscriptionOnNamedBroker(#3631)EnvelopeMapperreads both timestamp header formats (#3645)EnclosedMessageTypesheader is split before the message type is resolved, so interop works across Azure Service Bus, SNS, SQS and the database transports (#3628)Persistence
DbBatch, so the work splits per statement.Other
Contributors
Thank you to everyone who contributed to this release:
... (truncated)
Commits viewable in compare view.
Updated WolverineFx.RuntimeCompilation from 6.22.0 to 6.24.2.
Release notes
Sourced from WolverineFx.RuntimeCompilation's releases.
6.24.2
What's Changed
Full Changelog: JasperFx/wolverine@V6.24.1...V6.24.2
6.24.1
Patch release. Four reported issues, all with reproductions from production clusters.
Fixes
#3701 —
wolverine_node_recordsgrows without bound (#3734)A reporting cluster reached 36,135,221 rows / 16 GB in five days on a diagnostic table nothing on the hot path reads. Three distinct defects:
INodeAgentPersistence.DeleteOldNodeRecordsAsyncwas implemented for every relational store and never invoked outside tests.NodeEventRecordExpirationTime, 5 days), which is no ceiling at all at high write rates — every one of those 36M rows was inside the window.CS0649suppression on it said so), so a full-table delete went out on every recovery cycle — every 5 seconds by default.New
Durability.NodeRecordRetention(default 10,000 rows) andDurability.NodeRecordPruningPeriod(default hourly).MultiTenantedMessageStorenow delegates the trim to the main store instead of inheriting a no-op default, and Sqlite, MySQL and Oracle gained implementations they had also been missing.#3697 — no supported force-catch-up under Wolverine-managed event subscription distribution (#3735)
Wolverine already implemented the coordinator-driven catch-up path, but only exposed it as a
TrackActivity()stage. Adds the standalone entry point onIHostandIServiceProvider, plus<T>ancillary-store variants:It never calls
IProjectionDaemon.CatchUpAsync— doing so under a live coordinator is what produces theProgressionProgressOutOfOrderExceptionandpk_mt_event_progressionduplicate-key errors suites have been retrying around. Resuming the agents that already own the shards means there is only ever one writer.#3733 — a comma in an agent Uri voided a whole batch confirmation (#3736)
AgentsStarted,StartAgents,AgentsStoppedandStopAgentsjoined theirUri[]on a comma, which RFC 3986 permits unescaped in a path segment. Agent URIs embed tenant ids and projection names, so one comma shattered an agent into fragments — and because the read side built the array in a single projection, the resulting throw took out the confirmation for the entire batch. Newline is the delimiter now, and entries are parsed individually so a bad one names itself.The comma remains the default on the wire for payloads that do not contain one, so rolling upgrades keep working in both directions.
#3706 — RabbitMQ acks were cumulative (#3737)
Every ack went out as
BasicAckAsync(tag, multiple: true), acknowledging every lower delivery tag on the channel. That is only correct when completions happen in delivery order, and they do not withConsumerDispatchConcurrency > 1— acking one message silently acknowledged deliveries whose handlers were still running, and a crash at that moment lost them.Acks are now per message. Two dead-letter paths that relied on the cumulative sweep settle themselves, most importantly the un-mappable-message branch in
WorkerQueueMessageConsumer, which dead-lettered and returned without touching the delivery at all. This unblocks the planned native-ack parallel endpoint mode.Also included
6.24.0
Two data-loss fixes — but for unusual usages
This release closes two bugs that silently destroyed data rather than failing loudly. Both are worth reading before you skip the rest of these notes.
Durable inbox rows were orphaned when a circuit breaker tripped (#3680).
DurableReceiverchecked its latched flag before callingMarkReceived. The latched path still persists each envelope to the inbox as a safety net — but on an envelope that never went throughMarkReceived,Statusis the enum default (Outgoing) andDestinationis null. Both are filter columns for inbox recovery, so the rows were written in a state no recovery sweep on any node could ever see. The nullListeneralso skipped the nack back to the broker, and the broker's redelivery after restart hitDuplicateIncomingEnvelopeException— which acks and drops. Net result: genuine message loss under a durable inbox any time a circuit breaker trip latched the receiver mid-flight. Measured on the circuit-breaker suite, 9 of 1,200 messages were lost per run.Dropping one tenant from a shared partition bucket destroyed its co-tenants' data (#3686). Found alongside #3683. Tenant bucketing — registering several small tenants against one partition suffix so they share a physical partition — is documented and exposed through
PartitionPerTenant(p => p.AllowPartitionSharing = true), and it did not work on either engine. It had no test coverage, because the doc sample demonstrating it is compile-only and never executed.Global partitioning
Part of the GlobalPartitioning epic (#3482).
Wolverine.ComplianceTests.Partitioning.ShardedProcessing, so a new transport costs one small test classThe new suites immediately found two real bugs:
EndpointMode.Durableon every slot, and aNatsEndpointonly supportsDurablewhen JetStream-backed — so everyUseShardedNatsSubjects()call threw at configuration time. The topology now enables JetStream on its own endpoints and declares a work-queue stream per shard, without which the listener died at startup onstream not foundglobal-persistent://public/default/orders1. They now use the topic's short name, matching every other transportMulti-tenancy and persistence
ITenantedentity — had no partition for any tenant registered before that table existed.IConjoinedTenantPartitions<T>.MigrateTenantPartitionsAsync()reconciles every partitioned table against the full registered tenant set, with per-tableTenantPartitionResultreportingTransports
NullReferenceExceptionFilterSubjectwas only assigned whenConsumerNamewas empty, so every durable consumer on a stream received every message. The fix needs aFilterSubjectsmulti-filter — a single filter cannot cover both{subject}and{subject}.scheduled, and a work-queue stream discards an uncovered control message"OAUTH2-JWT". Azure Event Grid's custom JWT authentication requiresCUSTOM-JWT, so those brokers could not be reached through Wolverine's authentication support at all. You could already set the method by hand throughMqttClientOptionsBuilder.WithAuthentication(), but that gave up Wolverine's token refresh loop — the whole reason to useMqttJwtAuthenticationOptions. You no longer have to chooseWolverineHttpTransportClientused the endpoint'sOutboundUripurely as anIHttpClientFactoryclient name, then posted to that client'sBaseAddress— so operator commands sent back over the HTTP transport failed withAn invalid request URI was providedPerformance
RabbitMQ consumer dispatch concurrency is now per-endpoint (#3492). The client default of 1 was the bottleneck. Simulated handler, 2,000 msg/s offered load, 30s measured window:
ConsumerDispatchConcurrencyThe 5.1x and 12.2x multiples understate it — at 1 and 5 the listener never catches up at all.
Amazon SQS batches message deletions and chunks outgoing batches on the 256KB request size limit (#3493)
Azure Service Bus session listeners are no longer quadratic — the n² session loops are now n.
MaxConcurrentCallsis surfaced, and a batched defer settles the original message (#3494)HTTP and gRPC
... (truncated)
6.23.1
Agent distribution
TL;DR: if you pause a projection from CritterWatch on 6.23.0, restarting it appears to do nothing for a full minute. This fixes that.
A paused projection or subscription agent now resumes immediately when you restart it (#3663). On 6.23.0 the restart was accepted, the pause restriction was cleared, and then nothing happened until the pending-assignment ledger's TTL expired — 2 ×
CheckAssignmentPeriod, so 60 seconds with the defaults. Long enough that an operator reasonably concludes the agent is never coming back.The ledger introduced in 6.23.0 (#3622) only counted an assignment as confirmed if a later evaluation saw the agent running and still assigned to the same node. A pause makes those two conditions mutually exclusive: the first evaluation that can observe the delivered assignment is the same one that detaches the agent. The entry was never confirmed, nothing on the stop path cleared it, and the restart's
AssignAgentwas suppressed as a duplicate still in flight. Delivery alone now confirms the entry, which is the only question the ledger was ever asking.Pausing an agent no longer briefly starts it first (#3666).
ApplyRestrictionsAsynckickstarted a health check before persisting the operator's restriction change, so that evaluation ran against the old restrictions and could act against the very intent being applied — for a pause, re-assigning and starting the agent one beat before the merged evaluation stopped it again. Besides the wasted daemon start/stop cycle, this is what armed the stale ledger entry behind #3663.PostgreSQL
Advisory-lock sessions stay invisible to Marten's async-daemon gap detection (#3664). Marten 9.16.1+ will not skip a stale event-sequence gap while any session whose open transaction predates that gap is still alive (marten#4953). A session parked in an open transaction for the life of the process therefore reads as a permanent "possible reserver" and can hold the high-water mark — and every async projection — behind a gap that is genuinely dead.
Wolverine's long-held locks were already shaped correctly: leader election and node coordination hold session-scoped advisory locks on a dedicated connection with no transaction, so they show up as
state='idle'with a NULLxact_start. Those sessions are now also taggedapplication_name = 'wolverine-advisory-lock:<database>', which turns apg_stat_activityinvestigation from guesswork into something you can read at a glance. The constraints are pinned in tests and in the Postgres durability docs, including the trap worth knowing in your own code: never add a keepalive query inside a long-lived open transaction — it bumpsstate_change, makes the session look active, and re-promotes it to candidate reserver.Note for combined Marten + Wolverine deployments: older guidance suggested Postgres's
idle_in_transaction_session_timeoutas a dead-gap backstop. Prefer upgrading Marten and usingSkipStaleGapsDespiteLiveTransactionsAfterinstead.6.23.0
Projection & agent distribution
TL;DR: this prevents Wolverine from going into a panic doing agent assignments and churning crazily hard during Kubernetes rollouts or cluster starts and that's a very good thing
The bulk of this release. A wave of fixes (WO-1..8) to the agent assignment plane that together remove the re-assignment churn and livelock that could leave projection agents flapping or wedged.
AssignAgentfloods (#3622)IEventSubscriptionAgent.Failuresurfaces aShardFailure— category, the failing event's sequence and type, and the root exception type — through health checks and a newIWolverineObserver.AgentPausedhook plus aNodeRecordType.AgentPausedrecord. Failures bound to a specific event (ApplyEvent,EventSerialization,UnknownEventType) or to two processes racing one shard (ProgressionOutOfOrder) are no longer auto-restarted, since they would die on the identical event every time (#3637, #3638)Durability.AgentStartRetryAttempts/AgentStartRetryDelay, instead of idling a fullCheckAssignmentPeriodafter a startup race (#3519)FindAgentUriAsyncoverload (#3647) and a store-awareTryRebuildRegisteredProjectionAsyncoverload (#3618)Bumps JasperFx.Events to 2.36.1, Marten to 9.20.0 and Polecat to 5.7.0.
HTTP
Content-Typeon an[AcceptsContentType]route returns 415 rather than 404 (#3649)[AsParameters]endpoints no longer advertise a form body, which had been dropping them from route matching entirely (#3630)PublishMessage<T>andSendMessage<T>— now describe the message they read from the body. They had been advertising no request body at all in OpenAPI (#3646)Transports
ListenToPubsubSubscriptionOnNamedBroker(#3631)Description has been truncated