Skip to content

Bump Marten and 4 others#85

Merged
andregoepel merged 1 commit into
mainfrom
dependabot/nuget/nuget-minor-patch-49cb85693e
Jul 12, 2026
Merged

Bump Marten and 4 others#85
andregoepel merged 1 commit into
mainfrom
dependabot/nuget/nuget-minor-patch-49cb85693e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pinned Marten at 9.14.1.

Release notes

Sourced from Marten's releases.

9.14.1

Marten 9.14.1 is a patch release focused on a substantial round of LINQ query-translation improvements, plus event-store partitioning, high-water, and AoT fixes, and refreshed Weasel/JasperFx dependencies.

LINQ query translation

This release significantly expands what the LINQ provider can push down to PostgreSQL instead of falling back to slower strategies or throwing:

  • Collection Any(predicate) filters now translate to JSONPath and OR-of-containment strategies, and the old explode/ctid fallback has been replaced by a correlated EXISTS strategy. All() shapes and duplicated array fields moved onto the same EXISTS strategy. The net effect is correct, index-friendlier SQL for nested-collection predicates.
  • Indexing into complex child collections inside Where() clauses is now supported (e.g. x.Children[0].Name == "...").
  • Aggregates over collections — Sum/Min/Max/Average — can now be used inside Where() clauses.
  • Regex.IsMatch() is translated in Where() clauses.
  • IComparable.CompareTo() now works for non-string comparables such as Guid (#​4920), alongside broader CompareTo() coverage, string IsOneOf via the ?| operator, and CollectionIsEmpty via ICollectionAware.
  • GinIndexJsonDataMember() was added for member-scoped expression GIN indexes.

#​4916 — subclass queries now use duplicated fields and the base id

Querying a document subclass and filtering on a Duplicate()'d field or the base-class id previously emitted a JSONB filter (CAST(d.data ->> 'FarmId' as uuid)) instead of the real column, missing the duplicated column and the primary-key index:

o.Schema.For<Animal>().AddSubClass<Cow>().Duplicate(x => x.FarmId);

Query<Cow>().Where(x => x.FarmId == id)  // now: d.farm_id = :p0     (was: CAST(d.data ->> 'FarmId' ...))
Query<Cow>().Where(x => x.Id == id)      // now: d.id = :p0          (was: CAST(d.data ->> 'Id' ...))

A subclass shares its parent's table, so the parent's column-backed members (duplicated fields, the id, the soft-delete flag) are now inherited by the subclass's query member resolution. Querying the parent type was already correct and is unchanged.

Event store, partitioning & daemon

  • #​4924 — hyphenated / GUID tenant ids under UseTenantPartitionedEvents. Registering a tenant whose partition suffix contains a - (so every GUID tenant id) made ApplyAllConfiguredChangesToDatabaseAsync() throw 42601 because the per-tenant CREATE SEQUENCE / DROP SEQUENCE DDL emitted the identifier unquoted. The schema-apply statements are now quoted (matching the quick-append function and the imperative provisioning path), so hyphenated tenants migrate cleanly. Quote — not sanitize — so the append function can still resolve the sequence by its raw suffix.
  • #​4915 — projection coordinator shutdown. The projection coordinator now drains on disposal, and via the Weasel 9.16.3 bump the advisory-lock ObjectDisposedException path latches-and-rethrows so a HotCold cold node's leadership loop terminates instead of re-polling a disposed data source during shutdown.
  • #​4913 — high-water scan under partitioning (JasperFx 2.26.0). Under UseTenantPartitionedEvents the store-global high-water agent was continuously running select max(seq_id) from mt_events, an unfiltered scan that fans out across every tenant partition on every poll. That store-global mark is not used to advance tenant projections (they advance per-tenant), so the recurring scan is now skipped under partitioning; tenant high water is driven by the per-tenant coordinator and poll timer.
  • jasperfx#​502 (#​4922) — GetProjectionStatusesAsync now resolves the correct named database.

AoT / trimming

  • #​4917 — corrected AoT annotations in the event graph.
  • The AddEventType / QueryRawEventDataOnly generic-constraint tightening was reversed, and event-mapping construction now routes through the cached GenericFactoryCache while preserving the trimming root (#​4930).

Dependencies

  • Weasel 9.16.3 (#​4932) — advisory-lock disposed-pool fix (marten#​4915).
  • JasperFx 2.26.0 — the #​4913 high-water fix, plus 2.25.0's ShardState.DatabaseIdentifier (jasperfx#​501).

Closed issues

#​4913, #​4915, #​4916, #​4917, #​4924, and jasperfx#​502.

9.14.0

Marten 9.14.0 is the recommended upgrade for all 9.x users. It combines the LINQ SQL-injection security fix (first shipped in 9.13.0) with the fix for the projection-coordinator shutdown race in #​4874 and the accompanying dependency updates.

Beyond the LINQ updates, this made the new Per-Tenant Event Partitioning much more robust as we're testing that in conjunction with a JasperFx client for ludicrous scalability.

🔒 Security — SQL injection in the LINQ provider (GHSA-rfx3-98h7-v3xp)

Several LINQ / tenant-management code paths interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted literal without escaping or parameterization. A value containing a single quote could break out of the literal and inject SQL. The primary vector — a Dictionary<,> indexer key in a Where filter (a common "filter by attribute name" / EAV pattern) — was reported privately with an executed proof-of-concept and enabled filter / multi-tenant authorization bypass and blind data exfiltration.

Fixed sinks (#​4911):

  • DictionaryItemMember — dictionary indexer key, e.g. Where(x => x.Attributes[key] == v)
  • DictionaryContainsKeyFilter — Dictionary.ContainsKey(key) (Newtonsoft serializer + the Enum branch, which bypass System.Text.Json's quote escaping)
  • SelectParser — a constant string projected through Select(x => new { L = runtimeString })
  • DeleteAllForTenant — tenant id reaching per-tenant projection teardown (now parameterized)
  • DatabaseScopedTenantPartitions — tenant id inlined into partition DDL
  • EventLoader — per-tenant partition-pruning literal (defense-in-depth)

Each sink now escapes embedded single quotes or binds the value as a parameter; regression tests lock down every vector, and a follow-up LINQ-wide audit cleared the rest of the query hot path (full-text search, string-method translations, comparisons, IsOneOf/Contains/subset operators, and patching paths). Affected versions: 7.0.0 – 9.12.0. Also patched in 8.37.4 (8.x line) and 9.13.0.

Reported responsibly by @​svenclaesson — thank you. See advisory GHSA-rfx3-98h7-v3xp (CVE pending assignment).

🛠️ Reliability — projection-coordinator shutdown drain race (#​4874)

On host shutdown, the native HotCold projection coordinator could abort with ObjectDisposedException: 'Npgsql.PoolingDataSource' — the coordinator's leadership poll issued an OpenAsync against an already-disposed data source while tenancy was tearing down. This is the "case B" ordering storm reported against #​4874 (distinct from the async-tenancy foundation laid in #​4907, which did not resolve it).

The fix ships through the dependency updates below, with a Marten-side regression test (Bug_4874_coordinator_drain_ordering, #​4912):

  • JasperFx 2.24.1 (jasperfx#​499/#​500) — ProjectionCoordinatorBase terminates the leadership loop on a disposed data source / wrapped cancellation instead of re-polling.
  • Weasel 9.16.2 (weasel#​349/#​350) — AdvisoryLock guards against a disposed NpgsqlDataSource during shutdown (short-circuits while disposing and treats a disposed-pool ObjectDisposedException as a non-acquire rather than propagating).

⬆️ Dependency updates

  • JasperFx 2.24.0 → 2.24.1
  • Weasel 9.16.1 → 9.16.2
  • Weasel.EntityFrameworkCore 9.2.1 → 9.16.2 (released from its prior version hold now that the Weasel line is published)

Full changelog since 9.13.0

  • #​4911 — SQL injection fix in the LINQ provider (carried into this release)
  • #​4912 — regression test for the #​4874 case-B coordinator-drain ordering storm
  • JasperFx 2.24.1 / Weasel 9.16.2 / EFCore 9.16.2 bump (#​4874 shutdown-race fix)

9.13.0

Security release. Fixes SQL injection in the LINQ provider via unescaped string literals (#​4911).

Several LINQ / tenant-management code paths interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted literal without escaping or parameterization; a value containing a single quote could break out and inject SQL. The primary vector — a Dictionary<,> indexer key in a Where filter — was reported privately with an executed proof-of-concept (filter / multi-tenant authorization bypass, blind exfiltration).

Fixed sinks:

  • DictionaryItemMember — dictionary indexer key
  • DictionaryContainsKeyFilter — ContainsKey key (Newtonsoft serializer + Enum branch)
  • SelectParser — constant string projected via Select(...)
  • DeleteAllForTenant — tenant id in per-tenant projection teardown (now parameterized)
  • DatabaseScopedTenantPartitions — tenant id in partition DDL
  • EventLoader — per-tenant partition-pruning literal (defense-in-depth)

All 9.x users should upgrade. The 8.x line is fixed in 8.37.4. See advisory GHSA-rfx3-98h7-v3xp.

Commits viewable in compare view.

Pinned OpenTelemetry.Instrumentation.Runtime at 1.16.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.Runtime's releases.

1.16.0

1.16.0-rc.1

  • NuGet: OpenTelemetry.Instrumentation.Process v1.16.0-rc.1

    • Updated semantic conventions to
      v1.42.0.
      (#​4602)

      • Breaking Change: The process.cpu.time metric attribute process.cpu.state
        was renamed to cpu.mode.
      • Added the process.uptime metric.
      • Added the process.windows.handle.count metric (Windows only).
      • Added the process.unix.file_descriptor.count metric (Linux only).

    • Assemblies are now digitally signed using cosign.
      (#​4637)

    • Updated semantic conventions to
      v1.43.0
      and marked package as release candidate.
      (#​4675)

    See CHANGELOG for details.

1.16.0-beta.1

1.16.0-alpha.1

1.15.2

Commits viewable in compare view.

Pinned Radzen.Blazor at 11.1.3.

Release notes

Sourced from Radzen.Blazor's releases.

11.1.3

11.1.3 - 2026-07-10

Improvements

  • RadzenSpreadsheet culture-aware editing, display and formulas — the spreadsheet now honors the component's inherited Culture (exposed as a new Workbook.Culture property, defaulting to the current culture). It drives cell input parsing (including comma-decimal entry like 10,50 and day-month date handling), edit and display rendering, number formats (separators, month names and AM/PM designators follow the culture while format codes stay canonical), formula entry and display with Excel FormulaLocal semantics (; argument separators and , decimals in comma-decimal cultures), and dialog input for data validation, conditional formats and filters. XLSX and CSV files continue to read and write canonical invariant values regardless of the workbook culture, and malformed formulas now surface as formula errors instead of throwing. Includes new localization demos for Spreadsheet and Document Processing. Note: headless code on non-en-US hosts now parses string values with the host culture — set Workbook.Culture explicitly (e.g. to InvariantCulture) for host-independent processing.
  • RadzenSpreadsheet protected sheets — pasting into unlocked cells of a protected sheet is now allowed. Paste is blocked only when the selection contains a locked cell, and cut & paste can no longer bypass sheet protection. Thanks to @​panoskentros! Fixes #​2609.
  • RadzenChart data labels — each series data label group now carries a data-seriesindex attribute, making it possible to establish a direct link between a series and its labels. Thanks to @​wimsoetens-cmd!

Fixes

  • RadzenChart: the tooltip is no longer clipped at the chart edge and tooltip placement is now RTL-aware.
  • RadzenSlider: the slider now initializes correctly when it starts disabled and is enabled at runtime.

11.1.2

11.1.2 - 2026-07-06

Improvements

  • RadzenSpeechToTextButton — speech recognition now automatically restarts when the browser ends it prematurely (browsers stop the Web Speech API session after a pause in speech), so dictation keeps going until you actually stop it.
  • Further accessibility improvements: decorative icons across components — Accordion, Chip, ColorPicker, DataGrid, DropDownDataGrid, Fieldset, Menu, PanelMenu, Panel, ProfileMenu, SelectBar, Sidebar, Tabs, Upload, HtmlEditor and Spreadsheet — are now hidden from screen readers with aria-hidden.

Fixes

  • RadzenChart: an additional value axis no longer shows category axis labels when its series is hidden (e.g. via a legend click) — the axis keeps its own numeric scale, for both bar and column series. Fixes #​2607.

11.1.1

11.1.1 - 2026-07-06

Improvements

  • RadzenChart axis Width — new property that sets the axis width in pixels. If not specified, the width is calculated automatically; setting a fixed width helps reduce unnecessary spacing when using multiple Y-axes. Thanks to @​wimsoetens-cmd!
  • RadzenQRCode / RadzenBarcode / RadzenChart ToPng — can now return the PNG data directly and accept output size options.
  • RadzenSpreadsheet Excel-style clipboard — pasting a copied range into a larger selection now tiles the copied cells to fill the selection, and paste, cut and autofill transfer the full cell state, matching Excel: formats, quote prefixes and hyperlinks are copied, empty source cells blank their destinations, cut clears the source, entering a value over a formula cell replaces the formula, and undo restores cells exactly as captured.
  • RadzenSpreadsheet column auto-fit — double-clicking a column edge resizes the column to fit its longest cell (capped at 800px).
  • RadzenDropDown / RadzenDropDownDataGrid — new public OpenPopup(), ClosePopup() and TogglePopup() methods.
  • Localization: more built-in strings are now localizable (Pager, DataGrid, DatePicker, HtmlEditor table dialogs, Dialog, Notification, Slider, Steps and more), with updated German, Spanish, French, Italian and Japanese translations.
  • Further accessibility improvements across components — AutoComplete, Alert, BreadCrumb, Carousel, CheckBox, Dialog, DropDown and more — plus unified focus-outline styles for ListBox, Pager, ProfileMenu, SelectBar, SplitButton and Tabs.

Fixes

  • RadzenRequiredValidator: no longer shows the "required" message for a filled RadzenTextBox / RadzenTextArea / RadzenPassword / RadzenMask / RadzenAutoComplete on blur and no longer blocks form submission. Fixes #​2605.
  • RadzenSpreadsheet: XLSX column widths no longer render too narrow in Excel — auto-fitted columns are measured against the rendered text using Excel's font metrics, account for East Asian wide glyphs, and are slightly over-fitted to absorb renderer differences.
  • RadzenChart: multiple value axes with RadzenBarSeries no longer behave like category axes. Fixes #​2597.
  • RadzenChart: fixed crosshair label formatting and null handling at axis edges.
  • RadzenChart: the legend line swatch now uses the custom series stroke color.
  • RadzenPieSeries: fixed the pie not displaying anything in certain scenarios.
  • RadzenPivotDataGrid: Sum/Average aggregates no longer degrade to Count for dynamic data (e.g. IDictionary) — the configured aggregate Type is used when reflection cannot resolve the property type.
  • RadzenDataGrid: escaped the popup id in setPopupAriaExpanded to fix a querySelector error with dynamically generated columns.

Breaking changes

  • RangeSnapshotCommandBase (Spreadsheet) now snapshots cells as detached clones (Dictionary<CellRef, Cell?>) instead of a value/formula/format tuple — only affects code deriving from this class.

Commits viewable in compare view.

Pinned WolverineFx.Marten at 6.17.1.

Release notes

Sourced from WolverineFx.Marten's releases.

6.17.1

Wolverine 6.17.1 is a bug-fix release covering EF Core outbox enlistment gaps in Wolverine.Http, persistence provider resolution, HTTP route parameter binding, multi-tenancy message store roles, and a RavenDB startup race. It also upgrades the Marten dependency to 9.14.1.

EF Core & persistence

  • HTTP endpoints that inject a DbContext and cascade messages only through a tuple return are now enlisted in the EF Core outbox, so cascaded messages are no longer sent before the transaction commits when using Lightweight mode (#​3358, #​3362)
  • Wolverine.Http endpoints that persist entities through storage actions (IStorageAction<T> / storage side effects) are likewise enlisted in the EF Core outbox in Lightweight mode (#​3353, #​3357)
  • When both EF Core and Marten (or another catch-all provider like RavenDb) are registered, the selective EF Core persistence provider is now evaluated first regardless of registration order, so DbContext-based handlers get the correct transactional middleware (#​3359, #​3361)
  • MessageStoreRole.Ancillary is now honored for tenanted message stores (static tenants and master-table tenancy) instead of silently reporting Main (#​3351), with the registration behavior now covered by tests across PostgreSQL, SQL Server, SQLite, MySQL, and Oracle

HTTP

  • [FromRoute(Name = "...")] is now honored on plain endpoint method parameters (previously only inside [AsParameters] types), enabling route segments like {journey-id} that aren't valid C# identifiers (#​3356 — thanks to @​outofrange-consulting!)

RavenDB

  • Fixed a node sequence startup race that could cause duplicate node assignments when multiple nodes started concurrently (#​3352)

Dependencies

  • Marten upgraded to 9.14.1, which brings a substantial round of LINQ query-translation improvements plus event-store partitioning, high-water, and AoT fixes (#​3363)

Documentation

  • Corrected the HTTP QUERY verb documentation: transactional middleware is applied based on a chain's dependencies (e.g. taking an IDocumentSession or DbContext), not the HTTP verb (#​3355, #​3360)

6.17.0

Why is this such a big release? Because @​jeremydmiller went on a 3 night vacation and the community decided to throw in issues and pull requests left and right!

A big theme was filling in the remaining gaps of "Name Broker" and "Broker per Tenant" support in every external messaging transport where it made sense to add that rather than just being Rabbit MQ, Azure Service Bus, and hit and miss everywhere else. We also added HTTP QUERY support.

What's Changed

Commits viewable in compare view.

Pinned WolverineFx.RuntimeCompilation at 6.17.1.

Release notes

Sourced from WolverineFx.RuntimeCompilation's releases.

6.17.1

Wolverine 6.17.1 is a bug-fix release covering EF Core outbox enlistment gaps in Wolverine.Http, persistence provider resolution, HTTP route parameter binding, multi-tenancy message store roles, and a RavenDB startup race. It also upgrades the Marten dependency to 9.14.1.

EF Core & persistence

  • HTTP endpoints that inject a DbContext and cascade messages only through a tuple return are now enlisted in the EF Core outbox, so cascaded messages are no longer sent before the transaction commits when using Lightweight mode (#​3358, #​3362)
  • Wolverine.Http endpoints that persist entities through storage actions (IStorageAction<T> / storage side effects) are likewise enlisted in the EF Core outbox in Lightweight mode (#​3353, #​3357)
  • When both EF Core and Marten (or another catch-all provider like RavenDb) are registered, the selective EF Core persistence provider is now evaluated first regardless of registration order, so DbContext-based handlers get the correct transactional middleware (#​3359, #​3361)
  • MessageStoreRole.Ancillary is now honored for tenanted message stores (static tenants and master-table tenancy) instead of silently reporting Main (#​3351), with the registration behavior now covered by tests across PostgreSQL, SQL Server, SQLite, MySQL, and Oracle

HTTP

  • [FromRoute(Name = "...")] is now honored on plain endpoint method parameters (previously only inside [AsParameters] types), enabling route segments like {journey-id} that aren't valid C# identifiers (#​3356 — thanks to @​outofrange-consulting!)

RavenDB

  • Fixed a node sequence startup race that could cause duplicate node assignments when multiple nodes started concurrently (#​3352)

Dependencies

  • Marten upgraded to 9.14.1, which brings a substantial round of LINQ query-translation improvements plus event-store partitioning, high-water, and AoT fixes (#​3363)

Documentation

  • Corrected the HTTP QUERY verb documentation: transactional middleware is applied based on a chain's dependencies (e.g. taking an IDocumentSession or DbContext), not the HTTP verb (#​3355, #​3360)

6.17.0

Why is this such a big release? Because @​jeremydmiller went on a 3 night vacation and the community decided to throw in issues and pull requests left and right!

A big theme was filling in the remaining gaps of "Name Broker" and "Broker per Tenant" support in every external messaging transport where it made sense to add that rather than just being Rabbit MQ, Azure Service Bus, and hit and miss everywhere else. We also added HTTP QUERY support.

What's Changed

Commits viewable in compare view.

@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Jul 11, 2026
@dependabot
Bump Marten and 4 others
80631d1 
Bumps Marten from 9.12.0 to 9.14.1
Bumps OpenTelemetry.Instrumentation.Runtime from 1.15.1 to 1.16.0
Bumps Radzen.Blazor from 11.1.0 to 11.1.3
Bumps WolverineFx.Marten from 6.16.0 to 6.17.1
Bumps WolverineFx.RuntimeCompilation from 6.16.0 to 6.17.1

---
updated-dependencies:
- dependency-name: Marten
  dependency-version: 9.14.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Radzen.Blazor
  dependency-version: 11.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
- dependency-name: WolverineFx.Marten
  dependency-version: 6.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: WolverineFx.RuntimeCompilation
  dependency-version: 6.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the nuget-minor-patch group with 5 updates Bump Marten and 4 others Jul 12, 2026
@dependabot
dependabot Bot force-pushed the dependabot/nuget/nuget-minor-patch-49cb85693e branch from 3ea5e76 to 80631d1 Compare July 12, 2026 04:00
@andregoepel
andregoepel merged commit 52256db into main Jul 12, 2026
4 checks passed
@andregoepel
andregoepel deleted the dependabot/nuget/nuget-minor-patch-49cb85693e branch July 12, 2026 04:15
@dependabot dependabot Bot mentioned this pull request Jul 12, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@andregoepel