Skip to content

Bump the nuget-minor-patch group with 3 updates - #32

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/nuget/nuget-minor-patch-5c9e02c96d
Open

Bump the nuget-minor-patch group with 3 updates#32
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/nuget/nuget-minor-patch-5c9e02c96d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 16, 2026

Copy link
Copy Markdown
Contributor

Updated Marten from 9.23.0 to 9.24.0.

Release notes

Sourced from Marten's releases.

9.24.0

Fixes

Cross-tenant event rewrites under UseTenantPartitionedEvents (#​5234)

If you use Events.UseTenantPartitionedEvents together with event masking or stream compaction, read this one.

Under per-tenant event partitioning each tenant draws from its own sequence, so seq_id is not unique across tenants — seq_id = 1 exists in every tenant's partition. Three operations that rewrite mt_events keyed their WHERE on seq_id alone, so while the read side was correctly scoped by ForTenant(...), the write escaped it:

  • Masking destroyed an uninvolved tenant's event payload and replaced it with the calling tenant's masked JSON — a cross-tenant write and disclosure, in the right-to-erasure feature.
  • Compaction permanently deleted an uninvolved tenant's events and left the calling tenant's whole aggregate state, as Compacted<T>, sitting in their stream.

Nothing threw in either case. All three operations now carry the tenant predicate.

Damage already written by an earlier version cannot be reversed by this fix — restore the affected tenants from a backup or archival storage. Stores that never enabled UseTenantPartitionedEvents are unaffected, because a single global sequence makes seq_id store-unique there.

Reported with executed failing tests by @​arnelirobles.

EF Core inline projection connection leak (#​5228)

The EF Core integration's placeholder connection was released only on the success path of BeforeCommitAsync. A projection that threw, an optimistic concurrency failure, or a throw inside the commit hook each stranded a pooled connection — and because an inline multi-stream projection builds its storage for events it will not even process, a workload that merely had one registered leaked on every failed save. Measured at 20 saves: 41 stranded backends before, 2 after. Reported by @​markotny.

Compiled query parameters inside Select() (#​5233)

Count(predicate) inside a projection is now re-bound per invocation of an ICompiledQuery instead of being frozen at plan time. A projection Marten cannot translate to SQL, which is applied by a delegate compiled once per plan, now throws InvalidCompiledQueryException at plan time when it reads a value off the compiled query instance, rather than silently returning the first invocation's results forever.

Dead letter persistence failures are no longer swallowed (#​5229)

IEventDatabase.StoreDeadLetterEventAsync wrapped its whole body in an empty catch. A failed write dropped the only record that a projection skipped an event, with no exception and no log line; a wrong storage argument made the method a silent no-op. Failures are now logged at Error with the projection, shard, sequence and tenant, and a wrong argument throws.

Features

Count(predicate) translated inside Select() projections (#​5223)

x.Lines.Count(line => line.IsActive) in a projection is now computed by PostgreSQL rather than by deserializing the whole document on the client. Same translation Where() has used since 9.14.1. This also fixes bare boolean predicates and && compounds in the Where() form — Where(x => x.Lines.Count(l => l.IsActive) == 3) previously threw.

Custom fetch planners (#​5226)

StoreOptions.Projections.FetchPlanners is now public, so an application can supply its own IFetchPlanner to take over FetchForWriting() / FetchLatest() for the aggregate types it recognizes.

Opt-in FetchForWriting metrics (#​5227)

OpenTelemetryOptions.TrackFetchForWritingMetrics() enables a marten.fetch_for_writing.events_replayed histogram, tagged by aggregate type and fetch plan, so the cost of Live / Async / Inline is directly comparable.

Both contributed by @​erdtsieck.

Internal

  • The NoDataReturnedCall SQL audit now reports a visible skip for operations whose SQL it cannot see, instead of passing on a stand-in string (#​5222).
  • Dependencies: JasperFx / JasperFx.Events 2.48.0 (#​5235), Weasel 9.24.0 unchanged.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.8.1 to 18.9.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.9.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.8.0...v18.9.0

Commits viewable in compare view.

Updated Radzen.Blazor from 11.2.4 to 11.2.5.

Release notes

Sourced from Radzen.Blazor's releases.

11.2.5

11.2.5 - 2026-08-14

Fixes

  • RadzenNumeric no longer swallows keystrokes or registers phantom digits when Immediate and Format are used together. While typing, the input keeps the raw text and the format is applied on change or blur, so the caret no longer jumps and digits are no longer rounded away mid-edit. Digits that are literals in the format string (e.g. ### m2) no longer leak into the parsed value on reparse. Fixes #​2661
  • RadzenProfileMenu closes again when clicking outside the menu or when activating a menu item - regression introduced in 11.2.4. Fixes #​2662
  • RadzenProfileMenu and RadzenSplitButton are now preserved in the trimmer configuration so their popup-close callbacks keep working in trimmed WebAssembly apps.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps Marten from 9.23.0 to 9.24.0
Bumps Microsoft.NET.Test.Sdk from 18.8.1 to 18.9.0
Bumps Radzen.Blazor from 11.2.4 to 11.2.5

---
updated-dependencies:
- dependency-name: Marten
  dependency-version: 9.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-minor-patch
- dependency-name: Radzen.Blazor
  dependency-version: 11.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Aug 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants