Skip to content

chore: Bump Marten and 3 others#470

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/Nexus.Application/multi-a92b35d1de
Closed

chore: Bump Marten and 3 others#470
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/Nexus.Application/multi-a92b35d1de

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updated Marten from 8.37.4 to 9.15.1.

Release notes

Sourced from Marten's releases.

9.15.1

Patch release for a silent data-correctness regression. If you use ForTenant() on an identity-mapped or dirty-tracked session, upgrade.

Fixed

  • #​4947 — ForTenant() on an identity session stopped returning tenancy-neutral documents (reported by @​dervagabund, with a repro — thank you). A ForTenant() view of an identity- or dirty-tracked session no longer saw global (tenancy-neutral) documents tracked by the parent session. Since a global document has exactly one row per id for the whole database, LoadAsync through the ForTenant view missed the identity map, went to the database, and returned null for a document that is there. A silent wrong answer, not an error.

    Affected: 9.13.0, 9.14.x, 9.15.0. Introduced by the fix for #​4801, which tenant-scoped the identity map and version tracker for ForTenant sessions. That was correct for conjoined documents — where the same id means a different document per tenant — but it was applied per session rather than per document type, so it also isolated document types that are tenancy-neutral and must be shared.

    Sharing is now decided per document type. A nested ForTenant session shares the parent's identity-map and version-tracker entry for a type only when the storage is identity-mapped, the type is not Conjoined, and the nested session's database is the same instance as the parent's (under database-per-tenant, the same id in another tenant's database is a different document even for a tenancy-neutral type). The isolation introduced by #​4801 is preserved exactly — the Bug_4801 suite still passes, and the new tests include guard rails asserting conjoined documents stay isolated.

Full changelog: JasperFx/marten@9.15.0...9.15.1

9.15.0

Closed issues

  • #​4942 — sharded tenancy: auto-assign never repaired half-provisioned tenants (PR #​4945). findOrAssignTenantDatabaseAsync returned early on an existing assignment row, skipping createPartitionsForTenant + per-tenant event-sequence provisioning — so a tenant whose provisioning was interrupted (assignment committed, partitions missing) failed every write with 23514 forever. Both early-return paths (including a second race-window hole under the advisory lock) now run the same idempotent repair the explicit AddTenantToShardAsync(tenantId, databaseId) overload always ran, guarded to once per process per tenant via the resolution cache.
  • #​4941 — two-day silent projection outage (closed with full mapping). Root cause was #​4942; the invisibility was JasperFx/jasperfx#​506/#​507, fixed in JasperFx 2.27.0 which this release consumes.

Also in this release

  • Bundles the fixed JasperFx.Events.SourceGenerator analyzer (JasperFx/jasperfx#​505) — CS1061 compile break for no-parameterless-ctor aggregates with instance Apply returning the aggregate.
  • Follow-up enhancement filed as #​4944 (database-driven partition sweep via pg_inherits) for the #​4943 provisioning-tool scenario.

Verified against Wolverine (full solution + CoreTests/MartenTests/distribution/Http suites, zero failures) and CritterWatch before publishing. Thanks to @​erdtsieck for the dump-verified root-cause analysis.

9.14.1

Marten 9.14.1 is a patch release focused on a substantial round of LINQ query-translation improvements, plus event-store partitioning, high-water, and AoT fixes, and refreshed Weasel/JasperFx dependencies.

LINQ query translation

This release significantly expands what the LINQ provider can push down to PostgreSQL instead of falling back to slower strategies or throwing:

  • Collection Any(predicate) filters now translate to JSONPath and OR-of-containment strategies, and the old explode/ctid fallback has been replaced by a correlated EXISTS strategy. All() shapes and duplicated array fields moved onto the same EXISTS strategy. The net effect is correct, index-friendlier SQL for nested-collection predicates.
  • Indexing into complex child collections inside Where() clauses is now supported (e.g. x.Children[0].Name == "...").
  • Aggregates over collections — Sum/Min/Max/Average — can now be used inside Where() clauses.
  • Regex.IsMatch() is translated in Where() clauses.
  • IComparable.CompareTo() now works for non-string comparables such as Guid (#​4920), alongside broader CompareTo() coverage, string IsOneOf via the ?| operator, and CollectionIsEmpty via ICollectionAware.
  • GinIndexJsonDataMember() was added for member-scoped expression GIN indexes.

#​4916 — subclass queries now use duplicated fields and the base id

Querying a document subclass and filtering on a Duplicate()'d field or the base-class id previously emitted a JSONB filter (CAST(d.data ->> 'FarmId' as uuid)) instead of the real column, missing the duplicated column and the primary-key index:

o.Schema.For<Animal>().AddSubClass<Cow>().Duplicate(x => x.FarmId);

Query<Cow>().Where(x => x.FarmId == id)  // now: d.farm_id = :p0     (was: CAST(d.data ->> 'FarmId' ...))
Query<Cow>().Where(x => x.Id == id)      // now: d.id = :p0          (was: CAST(d.data ->> 'Id' ...))

A subclass shares its parent's table, so the parent's column-backed members (duplicated fields, the id, the soft-delete flag) are now inherited by the subclass's query member resolution. Querying the parent type was already correct and is unchanged.

Event store, partitioning & daemon

  • #​4924 — hyphenated / GUID tenant ids under UseTenantPartitionedEvents. Registering a tenant whose partition suffix contains a - (so every GUID tenant id) made ApplyAllConfiguredChangesToDatabaseAsync() throw 42601 because the per-tenant CREATE SEQUENCE / DROP SEQUENCE DDL emitted the identifier unquoted. The schema-apply statements are now quoted (matching the quick-append function and the imperative provisioning path), so hyphenated tenants migrate cleanly. Quote — not sanitize — so the append function can still resolve the sequence by its raw suffix.
  • #​4915 — projection coordinator shutdown. The projection coordinator now drains on disposal, and via the Weasel 9.16.3 bump the advisory-lock ObjectDisposedException path latches-and-rethrows so a HotCold cold node's leadership loop terminates instead of re-polling a disposed data source during shutdown.
  • #​4913 — high-water scan under partitioning (JasperFx 2.26.0). Under UseTenantPartitionedEvents the store-global high-water agent was continuously running select max(seq_id) from mt_events, an unfiltered scan that fans out across every tenant partition on every poll. That store-global mark is not used to advance tenant projections (they advance per-tenant), so the recurring scan is now skipped under partitioning; tenant high water is driven by the per-tenant coordinator and poll timer.
  • jasperfx#​502 (#​4922) — GetProjectionStatusesAsync now resolves the correct named database.

AoT / trimming

  • #​4917 — corrected AoT annotations in the event graph.
  • The AddEventType / QueryRawEventDataOnly generic-constraint tightening was reversed, and event-mapping construction now routes through the cached GenericFactoryCache while preserving the trimming root (#​4930).

Dependencies

  • Weasel 9.16.3 (#​4932) — advisory-lock disposed-pool fix (marten#​4915).
  • JasperFx 2.26.0 — the #​4913 high-water fix, plus 2.25.0's ShardState.DatabaseIdentifier (jasperfx#​501).

Closed issues

#​4913, #​4915, #​4916, #​4917, #​4924, and jasperfx#​502.

9.14.0

Marten 9.14.0 is the recommended upgrade for all 9.x users. It combines the LINQ SQL-injection security fix (first shipped in 9.13.0) with the fix for the projection-coordinator shutdown race in #​4874 and the accompanying dependency updates.

Beyond the LINQ updates, this made the new Per-Tenant Event Partitioning much more robust as we're testing that in conjunction with a JasperFx client for ludicrous scalability.

🔒 Security — SQL injection in the LINQ provider (GHSA-rfx3-98h7-v3xp)

Several LINQ / tenant-management code paths interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted literal without escaping or parameterization. A value containing a single quote could break out of the literal and inject SQL. The primary vector — a Dictionary<,> indexer key in a Where filter (a common "filter by attribute name" / EAV pattern) — was reported privately with an executed proof-of-concept and enabled filter / multi-tenant authorization bypass and blind data exfiltration.

Fixed sinks (#​4911):

  • DictionaryItemMember — dictionary indexer key, e.g. Where(x => x.Attributes[key] == v)
  • DictionaryContainsKeyFilter — Dictionary.ContainsKey(key) (Newtonsoft serializer + the Enum branch, which bypass System.Text.Json's quote escaping)
  • SelectParser — a constant string projected through Select(x => new { L = runtimeString })
  • DeleteAllForTenant — tenant id reaching per-tenant projection teardown (now parameterized)
  • DatabaseScopedTenantPartitions — tenant id inlined into partition DDL
  • EventLoader — per-tenant partition-pruning literal (defense-in-depth)

Each sink now escapes embedded single quotes or binds the value as a parameter; regression tests lock down every vector, and a follow-up LINQ-wide audit cleared the rest of the query hot path (full-text search, string-method translations, comparisons, IsOneOf/Contains/subset operators, and patching paths). Affected versions: 7.0.0 – 9.12.0. Also patched in 8.37.4 (8.x line) and 9.13.0.

Reported responsibly by @​svenclaesson — thank you. See advisory GHSA-rfx3-98h7-v3xp (CVE pending assignment).

🛠️ Reliability — projection-coordinator shutdown drain race (#​4874)

On host shutdown, the native HotCold projection coordinator could abort with ObjectDisposedException: 'Npgsql.PoolingDataSource' — the coordinator's leadership poll issued an OpenAsync against an already-disposed data source while tenancy was tearing down. This is the "case B" ordering storm reported against #​4874 (distinct from the async-tenancy foundation laid in #​4907, which did not resolve it).

The fix ships through the dependency updates below, with a Marten-side regression test (Bug_4874_coordinator_drain_ordering, #​4912):

  • JasperFx 2.24.1 (jasperfx#​499/#​500) — ProjectionCoordinatorBase terminates the leadership loop on a disposed data source / wrapped cancellation instead of re-polling.
  • Weasel 9.16.2 (weasel#​349/#​350) — AdvisoryLock guards against a disposed NpgsqlDataSource during shutdown (short-circuits while disposing and treats a disposed-pool ObjectDisposedException as a non-acquire rather than propagating).

⬆️ Dependency updates

  • JasperFx 2.24.0 → 2.24.1
  • Weasel 9.16.1 → 9.16.2
  • Weasel.EntityFrameworkCore 9.2.1 → 9.16.2 (released from its prior version hold now that the Weasel line is published)

Full changelog since 9.13.0

  • #​4911 — SQL injection fix in the LINQ provider (carried into this release)
  • #​4912 — regression test for the #​4874 case-B coordinator-drain ordering storm
  • JasperFx 2.24.1 / Weasel 9.16.2 / EFCore 9.16.2 bump (#​4874 shutdown-race fix)

9.13.0

Security release. Fixes SQL injection in the LINQ provider via unescaped string literals (#​4911).

Several LINQ / tenant-management code paths interpolated a runtime, potentially attacker-influenced value into generated SQL as a single-quoted literal without escaping or parameterization; a value containing a single quote could break out and inject SQL. The primary vector — a Dictionary<,> indexer key in a Where filter — was reported privately with an executed proof-of-concept (filter / multi-tenant authorization bypass, blind exfiltration).

Fixed sinks:

  • DictionaryItemMember — dictionary indexer key
  • DictionaryContainsKeyFilter — ContainsKey key (Newtonsoft serializer + Enum branch)
  • SelectParser — constant string projected via Select(...)
  • DeleteAllForTenant — tenant id in per-tenant projection teardown (now parameterized)
  • DatabaseScopedTenantPartitions — tenant id in partition DDL
  • EventLoader — per-tenant partition-pruning literal (defense-in-depth)

All 9.x users should upgrade. The 8.x line is fixed in 8.37.4. See advisory GHSA-rfx3-98h7-v3xp.

9.12.0

A couple significant bug fixes, and yet more support for CritterWatch

What's Changed

Full Changelog: JasperFx/marten@V9.11.0...V9.12.0

9.11.0

What's Changed

Full Changelog: JasperFx/marten@V9.10.0...V9.11.0

9.10.0

The new option might help the async daemon perform better in the face of concurrency exceptions on event appending with the QuickAppend option. It's opt in to avoid folks needing to do schema migrations

What's Changed

New Contributors

Full Changelog: JasperFx/marten@V9.9.1...V9.10.0

9.9.1

This will be a valuable upgrade for anyone who experiences a high degree of optimistic concurrency failures while using QuickAppend options, which is the default behavior in V9. This will help stop gaps in the event sequence, which in turn will make the Async Daemon healthier.

Also though, see Wolverine for help in preventing concurrent access in the first place

What's Changed

Full Changelog: JasperFx/marten@V9.9.0...V9.9.1

9.9.0

What's Changed

Full Changelog: JasperFx/marten@V9.8.2...V9.9.0

9.8.2

Couple bug reports related to the Daemon, one performance related for folks using the archived partitioning on the event store

What's Changed

Full Changelog: JasperFx/marten@V9.8.1...V9.8.2

9.8.1

This might impact folks migrating from Marten 8 to Marten 9. Strictly an issue with database migrations

What's Changed

Full Changelog: JasperFx/marten@V9.8.0...V9.8.1

9.8.0

This was pretty well 100% about CritterWatch. The new APIs are all to support CritterWatch

What's Changed

Full Changelog: JasperFx/marten@V9.7.5...V9.8.0

9.7.5

What's Changed

Full Changelog: JasperFx/marten@V9.7.4...V9.7.5

9.7.4

What's Changed

Full Changelog: JasperFx/marten@V9.7.3...V9.7.4

9.7.3

Small release. Couple fixes for daemon resiliency and CritterWatch administration actions

What's Changed

Full Changelog: JasperFx/marten@V9.7.2...V9.7.3

9.7.2

What's Changed

Full Changelog: JasperFx/marten@V9.7.1...V9.7.2

9.7.1

What's Changed

Full Changelog: JasperFx/marten@V9.7.0...V9.7.1

9.7.0

There's a few bug fixes, and the new functionality is really for CritterWatch.

What's Changed

Full Changelog: JasperFx/marten@V9.6.0...V9.7.0

9.6.0

There's a couple tenant aware APIs that are new, so this had to be a minor point bump. The majority of the work in this release was stress testing projection rebuilds and ensuring there was never any concurrent access of un-thread safe dictionaries inside of the async daemon that happened as a side effect of 9.0 changes.

What's Changed

Full Changelog: JasperFx/marten@V9.5.3...V9.6.0

9.5.3

This is a little optimization to the new 9.* code that eliminated the runtime codegen, and a fix for the daemon being a little vulnerable to concurrency in its internals -- which is also an optimization here.

What's Changed

Full Changelog: JasperFx/marten@9.5.2...V9.5.3

9.5.2

Bug fixes

  • #​4619 (#​4632) — mt_archive_stream emits explicit column lists in its INSERT…SELECT, surviving ALTER TABLE ADD COLUMN migrations that reorder the physical column layout (previously failed with 42804 after a column was added to mt_events).
  • #​4625 (#​4633) — BulkInsertEventsAsync writes mt_streams.type from the StreamAction's AggregateType, restoring UseMandatoryStreamTypeDeclaration support on the bulk path.
  • #​4641 (#​4646) — AddMartenManagedTenantsAsync no longer leaves a half-installed schema under AutoCreate.None. The admin call eagerly applies the events feature via a per-feature CreateMigrationAsync + scoped CreateOrUpdate apply, so the next append succeeds end-to-end on a virgin schema (previously failed with 42P01 / 42883).
  • #​4645 (#​4647) — DCB non-HStore tag query JOIN now includes e.tenant_id = t.tenant_id, eliminating own-event duplication under per-tenant sequences with UseTenantPartitionedEvents.

Test coverage

  • #​4617 closed — full TenantPartitionedEventsTests project (~170 tests across 50 files) covering append / read / projections / admin / DCB / async daemon / regressions under UseTenantPartitionedEvents.
  • Three projection coverage gaps closed: #​4650 (FlatTableProjection), #​4651 (DetermineActionAsync), #​4652 (doc-tables-NOT-partitioned-by-default invariant).
  • #​4649 investigated and pinned as documented intentional asymmetry — AutoCreate.CreateOnly continues to work via the lazy schema-apply path, by design (no SUT change needed).

Known follow-up — NOT in this release

  • #​4648 — AddGlobalProjection × UseTenantPartitionedEvents fails MT002 because the global event decorator writes to the *DEFAULT* tenant slot, which can't be a Postgres partition suffix. Test pin is in master asserting the throw; the underlying fix requires either routing global-aggregate events through a sibling non-partitioned table or reserving a default-tenant partition suffix. Marked as an enhancement, deferred to a later release.

🤖 Release notes assembled with Claude Code

9.5.1

What's Changed

Full Changelog: JasperFx/marten@V9.5.0...V9.5.1

9.5.0

The minor point bump here is because of some CritterWatch related features, otherwise this is all bug fixes

What's Changed

New Contributors

Full Changelog: JasperFx/marten@V9.4.0...V9.5.0

9.4.0

Marten 9.4.0

Per-tenant event partitioning and a tenant-aware async projection daemon (#​4596 / CritterWatch#​209). Built on JasperFx 2.5.0.

Highlights

  • Per-tenant event partitioning — opt in with opts.Events.UseTenantPartitionedEvents = true. On top of conjoined event tenancy, Marten partitions mt_events / mt_streams by tenant_id (native PostgreSQL LIST partitioning), gives each tenant its own event sequence (mt_events_sequence_{suffix}), and keys mt_event_progression by (name, tenant_id). Removes the single shared event store as a scalability bottleneck across tenants.
  • Tenant-aware async daemon — vectorized per-tenant high-water detection (one query per database reports the high-water position for every active tenant), per-tenant projection rebuild isolation, and cross-tenant rebuild fan-out.
  • Composite single-pass rebuild executor — read-once / fan-out rebuild for composite projections, with progression keyed on the composite's single {Name}:All shard.

Constraints for per-tenant partitioning

Validated at DocumentStore construction:

  • Requires Events.TenancyStyle = TenancyStyle.Conjoined.
  • Requires a quick append mode (EventAppendMode.Quick / QuickWithServerTimestamps); EventAppendMode.Rich is out of scope.
  • Cannot currently be combined with Events.UseArchivedStreamPartitioning (sub-partitioning by both tenant_id and is_archived is a planned follow-up).

The flag defaults to false; existing stores keep the global append path byte-for-byte.

Dependencies

  • Consumes the released JasperFx 2.5.0 packages (per-tenant partitioning surface, tenant-aware daemon abstractions, composite rebuild executor, and the SubscriptionAgent optimized-rebuild double-load fix).

Documentation

9.3.5

What's Changed

Full Changelog: JasperFx/marten@V9.3.4...V9.3.5

9.3.4

What's Changed

New Contributors

Full Changelog: JasperFx/marten@V9.3.3...V9.3.4

9.3.3

What's Changed

Full Changelog: JasperFx/marten@V9.3.2...V9.3.3

9.3.2

What's Changed

Full Changelog: JasperFx/marten@V9.3.1...V9.3.2

9.3.1

Marten 9.3.1

Fix release — bumps all four JasperFx.* dependencies to 2.2.1.

Package From To
JasperFx 2.2.0 2.2.1
JasperFx.Events 2.2.0 2.2.1
JasperFx.Events.SourceGenerator 2.2.0 2.2.1
JasperFx.SourceGenerator 2.2.0 2.2.1

No Marten-side code changes — straight dependency bump (#​4585).

Full Changelog: JasperFx/marten@V9.3.0...V9.3.1

9.3.0

Marten 9.3.0

The big-ticket items in this release are binary event serialization (#​4515) and the PostGIS + pgvector companion packages lifted into the Marten repo from CritterWatch.

Major

  • Binary event serialization for the event store (#​4515 — landed across #​4578, #​4581, #​4583, #​4584). Opt individual event types into a binary wire format (MemoryPack out of the box, or any IEventBinarySerializer you bring) on a per-event-type basis. JSON-serialized and binary-serialized events coexist in the same mt_events table so the feature can be turned on in an existing system with no migration of existing data. Works on every EventAppendMode (Rich + Quick + QuickWithServerTimestamps) and through BulkEventAppender. New optional NuGet: Marten.MemoryPack. See the binary-serialization docs for the design, registration, and the versioned-event-types schema-evolution recommendation.

  • PostGIS + pgvector companion packages (#​4576). Two new optional NuGets imported from CritterWatch:

    • Marten.PostGIS — UsePostGIS() opt-in that enables the postgis extension on every database Marten manages (multi-tenant aware), wires NetTopologySuite + GeoJSON serialization, and exposes four spatial query helpers (NearestToAsync, WithinDistanceAsync, ContainingAsync, IntersectingAsync). See the PostGIS docs.
    • Marten.PgVector — UsePgVector() opt-in that enables the vector extension on every database (also addresses #​2515 — extensions in tenant databases). VectorSearchAsync for similarity search plus an embedding-aware VectorProjection base class. See the pgvector docs.

Fixes

  • #​4575: CreatedAt.MapTo() regression in v9 (#​4577). The closed-shape storage rewrite ported every other metadata-column read-back but missed mt_created_at; this restores the v8 behavior where a [CreatedAt]-annotated / m.CreatedAt.MapTo(...)-mapped member is populated after a load.

Build / Release

  • Pack target updated (#​4582). Marten.PostGIS, Marten.PgVector, and Marten.MemoryPack are now included in the Nuke Pack target — without this they would silently never reach NuGet. 9 packages ship in 9.3.0 (up from 6): Marten, Marten.Newtonsoft, Marten.NodaTime, Marten.AspNetCore, Marten.EntityFrameworkCore, Marten.SourceGenerator, Marten.PostGIS, Marten.PgVector, Marten.MemoryPack.

  • Weasel 9.0.2 dependency bump (JasperFx/weasel#​299). Fixes PostgresqlMigrator.executeWithConcurrencyRetryAsync to reopen a Closed/Broken connection between retry attempts — eliminates the intermittent Connection is not open failure surfaced under concurrent migration races.

Documentation updates

Pages added or updated in 9.3.0:

Local docker

The local docker-compose.yml (from #​4576) layers postgresql-17-postgis-3 + postgresql-17-pgvector on the official multi-arch postgres:17 image so the Marten test suite can exercise the new extensions locally. PLv8 was dropped — Marten core SQL no longer requires it.

Full Changelog: JasperFx/marten@V9.2.1...V9.3.0

9.2.1

What's Changed

Full Changelog: JasperFx/marten@V9.2.0...V9.2.1

9.2.0

Marten 9.2.0

Features & changes

  • Override IEventStore.AllDatabases() on DocumentStore (#​4570, #​4571). Implements the store-agnostic database accessor added to JasperFx.Events.IEventStore. Delegates straight to ITenancy (mirroring IMartenStorage.AllDatabases()) and projects to IEventDatabase, so store-neutral monitoring/tooling can reach every database to call the read abstractions (AllProjectionProgress, FetchDeadLetterCountsAsync / CountDeadLetterEventsAsync) even when only IEventStore is registered in DI.

Dependencies

  • Upgraded all JasperFx.* packages to 2.2.0 (JasperFx, JasperFx.Events, JasperFx.Events.SourceGenerator, JasperFx.SourceGenerator).

Full Changelog: JasperFx/marten@V9.0.2...V9.2.0

9.0.2

Marten 9.0.2

A patch release that fixes #​4557 — self-aggregating projections failing for consumers that reference only the Marten package.

Fixes

  • #​4557 — Self-aggregating projections now work out of the box. Marten 9 dispatches conventional Apply/Create/ShouldDelete projection methods through the compile-time JasperFx.Events.SourceGenerator and has no runtime fallback, but the generator shipped as a DevelopmentDependency and never flowed to a consumer that only referenced the Marten package — surfacing as InvalidProjectionException: No source-generated dispatcher found ... at DocumentStore.For(...). Marten now bundles the analyzer in its own NuGet package, so a plain <PackageReference Include="Marten" /> runs the generator automatically. (#​4558)

  • Self-aggregating record aggregates work without a Snapshot<T> call site and without partial. Bumped JasperFx.Events / JasperFx.Events.SourceGenerator to 2.1.1 (JasperFx/jasperfx#​367): the generator now emits a self-aggregating evolver for a record from its own declaration (parity with classes), which also fixes the cross-assembly case where the aggregate type is defined in a different assembly than its registration.

  • Docs. Corrected the migration guide's projection section, which incorrectly stated Marten falls back to a runtime evolver lookup for non-partial convention projections; documented that self-aggregating Snapshot<T> types do not need to be partial (only projection subclasses do).

Dependency bumps

  • JasperFx.Events 2.1.0 → 2.1.1
  • JasperFx.Events.SourceGenerator 2.1.0 → 2.1.1

No public API changes from 9.0.1.

9.0.1

Marten 9.0.1

A patch release on the Critter Stack 2026 foundation, rolling up the latest JasperFx 2.0.1 / JasperFx.Events 2.1.0 / Weasel 9.0.1 dependencies along with several source-generator and reliability fixes.

Foundation bumps

  • JasperFx 2.0.0 → 2.0.1
  • JasperFx.Events / JasperFx.Events.SourceGenerator → 2.1.0
  • JasperFx.SourceGeneration → JasperFx.SourceGenerator 2.0.1 (package renamed; #​4555)
  • Weasel.Postgresql / Weasel.EntityFrameworkCore 9.0.0 → 9.0.1

Fixes

  • Self-aggregating source-generator fixes (via JasperFx.Events 2.1.0, consumed in #​4547):
    • #​4542 — required members on self-aggregating snapshot types no longer break generated evolver construction; default! is emitted only when a public parameterless constructor exists, otherwise RuntimeHelpers.GetUninitializedObject is used.
    • #​4543 — nullable [ReadAggregate] aggregate parameters generate correctly.
  • #​4546 — IEventDatabase dead-letter count reads (CountDeadLetterEventsAsync / FetchDeadLetterCountsAsync) are implemented on MartenDatabase via LINQ over the DeadLetterEvent document.
  • #​4540 — opt-in System.Text.Json source-generation context support (SystemTextJsonSerializer.UseTypeInfoResolver) for AOT/trimming-friendly metadata.
  • #​4552 — intermittent CI flakes fixed: feature_flag_positive advisory-lock contention (distinct ApplyChangesLockId, #​4553) and the conjoined multi-tenant query_before_saving XX000: tuple concurrently updated migration-DDL race (resolved upstream in Weasel 9.0.1 / weasel#​293).

No public API breaking changes from 9.0.0. RestoreV8Defaults() continues to revert the 9.0 default flips.

9.0.0

Marten 9.0.0 — Critter Stack 2026

The headline release of the Critter Stack 2026 wave, on the final JasperFx 2.0 + Weasel 9.0 foundation.

Highlights

  • Foundation: JasperFx 2.0.0 / JasperFx.Events 2.0.0 / Weasel 9.0.0 (final). Targets net9.0;net10.0.
  • No runtime code generation. Roslyn is gone — JasperFx.RuntimeCompiler is no longer a dependency. Document/event storage is hand-written closed-shape; compiled queries use Marten.SourceGenerator. No codegen write step for Marten.
  • Cold-start + AOT: AOT-publishable in Static mode; lazy document-mapping materialization; per-query handler-factory caching.
  • Dedupe pillar (jasperfx#​214): IStorageOperation rebased on Weasel.Core; async-daemon distributor concretes consumed from JasperFx.Events.Daemon; OperationRole / BulkInsertMode relocated to Weasel.Core.
  • Defaults flipped to best-perf: QuickWithServerTimestamps append mode, advanced async tracking, bigint events, lightweight default sessions, System.Text.Json default — all revertable via RestoreV8Defaults().
  • Versioning: IRevisioned.Version stays int (V8-compatible); new ILongVersioned (long) for MultiStreamProjection documents.
  • DCB: optional HSTORE tag storage; FetchForWritingByTags<T> for identity-less boundary aggregates.

See the migration guide (docs/migration-guide.md). Master plan: marten#​4349. Ships in lockstep with Polecat 4.0.

Commits viewable in compare view.

Updated WolverineFx.Http from 5.39.5 to 6.18.0.

Release notes

Sourced from WolverineFx.Http's releases.

6.18.0

Wolverine 6.18.0

A security-relevant serialization fix, a startup-fatal codegen fix, a silently-dead-listener fix in RabbitMQ, the first F# saga codegen support of any persistence provider, and the CI split that makes "merge when green" mean something again.

If you use MassTransit interop over a durable listener, take this release. See the first section.

⚠️ Security-relevant: reserved envelope headers could be spoofed through the durable inbox

#​3408 — fixed in #​3411

EnvelopeSerializer wrote the typed envelope properties to the wire format and then appended every Envelope.Headers entry verbatim, with no reserved-key filter — and the appended entries came last. Because the reader parses reserved keys straight back into typed properties, a Headers entry under a reserved key silently overwrote the real property on the next read.

A value in envelope.Headers["tenant-id"] is inert while the envelope is in memory. It stops being inert the moment the envelope crosses the serializer — any durable listener, the inbox/outbox, or the scheduled-message store:

  1. Something puts tenant-id into envelope.Headers.
  2. The durable inbox persists the envelope; the header is appended after the (null) typed property.
  3. On read back, env.TenantId is set from it.

saga-id reaches another saga's state, and id rewrites Envelope.Id — the inbox's dedupe identity.

This was live, not theoretical. MassTransitEnvelope.TransferData already copies every incoming MassTransit header into envelope.Headers unfiltered (and by assignment, not TryAdd). Any Wolverine app doing MassTransit interop over a durable listener has had this path open. If that describes you, this release is the one to take.

The fix filters reserved keys on the write side, so the typed property stays authoritative and a reserved key sitting in Headers becomes a no-op. causation-id is deliberately not filtered — DeliveryOptions intentionally carries it as a loose header for Wolverine.Marten's OutboxedSessionFactory, and it is never promoted by the reader.

Startup-fatal codegen fix

#​3399 — fixed in #​3406 — invalid generated class name for batched (array) message types. This one prevents the application from starting.

Fixes

  • #​3388 (#​3400) — refuse a competing Marten daemon under Wolverine-managed event subscription distribution. A DaemonMode.Solo/HotCold daemon alongside managed distribution is now an actionable startup exception instead of two schedulers quietly fighting over the same shards.
  • CritterWatch #​698 (#​3396) — IAgentRuntime.ApplyRestrictionsAsync persisted the restriction and then never dispatched the commands it computed, so pausing an agent had no immediate effect. Reported by @​erdtsieck against a live cluster.
  • #​3385 (#​3403) — a header-identified saga invoked over a gRPC hop failed with an opaque Internal status. It now returns an actionable diagnostic telling you to put the saga identity on the request DTO.
  • #​3398 (#​3404) — [AsParameters] now rejects unparseable values in collection query parameters, closing the gap left by the scalar fix in #​3372.
  • #​3365 (#​3412) — the Polecat primary IEventStore bridge registered twice, so GetServices<IEventStore>() returned the same store instance two times and anything iterating it double-counted. Polecat's own AddPolecat() had started registering IEventStore and Wolverine was still bridging it as well.
  • #​3391 (#​3419) — RabbitMQ: a successful eager channel restart never re-consumed. A callback-exception restart could leave an open channel with zero consumers while reporting State = Connected — a silently dead listener. The listener now defers to ReconnectedAsync(), which re-declares and re-consumes. Also pins the ConnectionMonitor tracking invariant that #​3370 fixed but nothing guarded.

OpenAPI

#​3380 (#​3418) — OpenAPI parameters are now derived from the full binding chain rather than the handler signature alone. Two real defects closed:

  • Query/header values bound only by an After/Finally postprocessor were omitted from the operation entirely.
  • Route parameter types were read off resolved binding variables, so they degraded to the route constraint (or string) whenever the description was assembled before those frames resolved — which is exactly the build-time OpenAPI / openapi CLI path, because ASP.NET caches the first ApiExplorer read.

More importantly, this ships the OpenAPI shape-test harness that was missing. Adding a shape assertion is now one endpoint plus one [Fact], which is why this class of omission kept shipping unnoticed.

New: Azure Service Bus emulator support

#​3366 (#​3409) — the docs told you to call UseAzureServiceBusTesting(), which only ever existed in Wolverine's own test suite. It is now a real, shipping API:

... (truncated)

6.17.3

Bug-fix and scale release, following the 6.17.2 community sweep. Every item below came from a community report or a review finding — thank you all.

Closed issues

  • #​3375 — durability metrics polling pinned a connection per database per node (PR #​3384 by @​erdtsieck). Each durability agent ran its own in-phase PeriodicTimer, so at high database counts the metrics polling itself became significant connection pressure. Agents now register their store with a node-wide sequential sweeper that walks the node's databases one at a time across the UpdateMetricsPeriod window — at most one metrics connection in flight per node, regardless of database count. The registration set is re-read every pass, so databases join and leave the sweep as agents start and stop without a restart.
  • #​3332 — CIAWS was disabled by a broken SNS per-tenant LocalStack setup (PR #​3364 by @​Steve-XYZ). Test-only; re-enables the AWS CI job. Partially addresses #​3350 (the CIPolecat half remains open).
  • RabbitMQ listeners ghosted after a broker restart on a channel callback exception (PR #​3370 by @​kconfesor). The agent stayed latched after a channel-only shutdown and was never rebuilt, so a listener came back "connected" but dead. Reviewed specifically against the #​3171/#​3187 channel-only-shutdown work to confirm it does not reintroduce the latched-Disconnected state that #​3187 fixed. Two follow-ups are tracked in #​3391.
  • ProductSupport#​33 — CritterWatch telemetry was caught by tracked-session waits (PR #​3390, reported by @​uniquelau). A monitored host publishes telemetry that a TrackedSession would pick up and then sit waiting on messages the test never sent. The default ignore rule now covers all of INotToBeRouted (agent commands and framework telemetry), with a deliberate carve-out for Acknowledgement / FailureAcknowledgement, which the session's own acknowledgement APIs depend on. If you are on an older version, IgnoreMessagesMatchingType(t => t.CanBeCastTo<INotToBeRouted>()) is the workaround.

Fixes from review

  • Metrics sweeper: unregistration race and a hot-spin guard (PR #​3393, follow-ups from the #​3384 post-merge review). The sweeper removed a registration by URI alone, so when an agent for a database stopped after a replacement agent for the same database had registered — exactly what agent redistribution does — the stopping agent evicted the live registration, and that database silently stopped being polled until the node restarted. Unregistration now removes only the exact registration instance it created. Separately, UpdateMetricsPeriod = TimeSpan.Zero would hot-spin the sweep loop (the pre-#​3384 PeriodicTimer threw); it is now rejected at configuration time, with DurabilityMetricsEnabled = false as the way to turn polling off.

Marten test-helper: PauseThenCatchUpOnMartenDaemonActivity

  • #​3388 — cold first catch-up appeared to stall (PR #​3394, reported by @​uniquelau). Investigated in depth. The reported mechanism — that coordinator.ResumeAsync() does not start never-started shards — does not hold: under Wolverine-managed distribution the coordinator is WolverineProjectionCoordinator, whose ResumeAsync builds the daemon lazily and starts every shard, bypassing agent assignment entirely. The cold path works, and there are now four tests proving it (including with a second subscription-agent consumer sharing the agent family).

    The real defect was a timeout mismatch, and it explains the reported symptom exactly. The stage runs inside a child TrackedSession whose token cancels at TrackedSession.Timeout — 5 seconds by default — while the catch-up ignored that token and waited on an internal 60-second budget. The session gave up first and left the catch-up envelope started-but-never-finished, which reads as a hang. This is a genuine 6.16 → 6.17 behavior change: the old active ForceAll finished inside 5 seconds; resume-and-wait on a cold daemon or a busy machine does not. The catch-up now honors the session's token and raises an actionable TimeoutException naming the store and pointing at TrackActivity().Timeout(...).

    If you hit this on 6.17.0–6.17.2, raising the tracked-session timeout is the fix.

Docs

  • New page: gRPC + Sagas (PR #​3389, following @​erikshafer's coverage in PR #​3386). gRPC services can start and continue sagas with no gRPC-specific code — the saga identity must be on the message body, because a gRPC method is a thin shim in front of IMessageBus.InvokeAsync<T> and the chain that runs is the handler's. The header-identified gap is tracked as #​3385, with a clear diagnostic planned.
  • Testing guide (PR #​3395): tracked sessions ignore framework telemetry by default as of this release, and — the trap behind #​3388 — Timeout() bounds the whole session including its stages, so a slow stage like PauseThenCatchUpOnMartenDaemonActivity() is capped by the session's 5-second default, not by any budget internal to the stage.

Full changelog: JasperFx/wolverine@V6.17.2...V6.17.3

6.17.2

Community-issue sweep release. Every fix below shipped same-day from issues filed by the community — thank you all.

Closed issues

  • #​3371 — any ApiExplorer read before server start permanently emptied every OpenAPI document (PR #​3373 by @​uniquelau). WolverineApiDescriptionProvider now enumerates the HttpGraph (complete when MapWolverineEndpoints() returns) instead of the start-time EndpointDataSource, so ASP.NET's version-keyed cache can never freeze an empty first read. If you monitor Wolverine hosts with CritterWatch and expose OpenAPI, upgrade to this release (see JasperFx/CritterWatch#​689).
  • #​3374 — [AsParameters] + compound-handler LoadAsync binding the same route variable generated uncompilable code (CS0136/CS0841, host failed at startup) (PR #​3381). Binding frames are now emitted once per chain and re-homed so any second consumer reuses them; both the [FromRoute] and [AsParameters]-parameter variants are covered. The related OpenAPI gap (route params bound only by LoadAsync missing from the operation) is tracked as #​3380.
  • #​3372 — [AsParameters] query binder silently ignored unparseable values (PR #​3379). New opt-in WolverineHttpOptions.RejectUnparseableQueryValues: a present-but-unparseable query value short-circuits with a 400 ProblemDetails naming the parameter, matching ASP.NET minimal APIs; missing values keep their initializer in both modes. The default flips to strict in Wolverine 7.0.
  • #​3368 — gRPC server-side tenant-id detection (PRs #​3369 by @​erikshafer + #​3382). The server now reads back what the client interceptor stamps: envelope propagation onto the scoped IMessageContext, plus a full ITenantDetectionPolicies-style mirror (opts.TenantId.IsRequestHeaderValue(...), IsClaimTypeNamed(...), DetectWith<T>()) that sets the codegen tenant variable Marten/Polecat session frames consume — with a zero-config default when the client stamps tenant-id. New docs page: gRPC multi-tenancy.
  • #​3375 (docs half) — documented DurabilityMetricsEnabled = false and raising UpdateMetricsPeriod as mitigations for metrics-polling connection load at high tenant-database counts (PR #​3378). The per-node sweeper implementation is in progress on the issue.

Dependency bumps

  • Marten 9.15.0 (sharded-tenancy provisioning repair, marten#​4942) and JasperFx 2.27.0 (daemon block observability, jasperfx#​506/#​507) — the fixes from the marten#​4941 silent-outage incident (PR #​3383).

6.17.1

Wolverine 6.17.1 is a bug-fix release covering EF Core outbox enlistment gaps in Wolverine.Http, persistence provider resolution, HTTP route parameter binding, multi-tenancy message store roles, and a RavenDB startup race. It also upgrades the Marten dependency to 9.14.1.

EF Core & persistence

  • HTTP endpoints that inject a DbContext and cascade messages only through a tuple return are now enlisted in the EF Core outbox, so cascaded messages are no longer sent before the transaction commits when using Lightweight mode (#​3358, #​3362)
  • Wolverine.Http endpoints that persist entities through storage actions (IStorageAction<T> / storage side effects) are likewise enlisted in the EF Core outbox in Lightweight mode (#​3353, #​3357)
  • When both EF Core and Marten (or another catch-all provider like RavenDb) are registered, the selective EF Core persistence provider is now evaluated first regardless of registration order, so DbContext-based handlers get the correct transactional middleware (#​3359, #​3361)
  • MessageStoreRole.Ancillary is now honored for tenanted message stores (static tenants and master-table tenancy) instead of silently reporting Main (#​3351), with the registration behavior now covered by tests across PostgreSQL, SQL Server, SQLite, MySQL, and Oracle

HTTP

  • [FromRoute(Name = "...")] is now honored on plain endpoint method parameters (previously only inside [AsParameters] types), enabling route segments like {journey-id} that aren't valid C# identifiers (#​3356 — thanks to @​outofrange-consulting!)

RavenDB

  • Fixed a node sequence startup race that could cause duplicate node assignments when multiple nodes started concurrently (#​3352)

Dependencies

  • Marten upgraded to 9.14.1, which brings a substantial round of LINQ query-translation improvements plus event-store partitioning, high-water, and AoT fixes (#​3363)

Documentation

  • Corrected the HTTP QUERY verb documentation: transactional middleware is applied based on a chain's dependencies (e.g. taking an IDocumentSession or DbContext), not the HTTP verb (#​3355, #​3360)

6.17.0

Why is this such a big release? Because @​jeremydmiller went on a 3 night vacation and the community decided to throw in issues and pull requests left and right!

A big theme was filling in the remaining gaps of "Name Broker" and "Broker per Tenant" support in every external messaging transport where it made sense to add that rather than just being Rabbit MQ, Azure Service Bus, and hit and miss everywhere else. We also added HTTP QUERY support.

What's Changed

Description has been truncated

@dependabot
chore: Bump Marten and 3 others
0037433 
Bumps Marten from 8.37.4 to 9.15.1
Bumps WolverineFx.Http from 5.39.5 to 6.18.0
Bumps WolverineFx.Http.Marten from 5.39.5 to 6.18.0
Bumps WolverineFx.Marten from 5.39.5 to 6.18.0

---
updated-dependencies:
- dependency-name: Marten
  dependency-version: 9.15.1
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: WolverineFx.Http
  dependency-version: 6.18.0
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: WolverineFx.Http.Marten
  dependency-version: 6.18.0
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: WolverineFx.Marten
  dependency-version: 6.18.0
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: WolverineFx.Http
  dependency-version: 6.18.0
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: WolverineFx.Http.Marten
  dependency-version: 6.18.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
This was referenced Jul 14, 2026
Closed
Closed
@dependabot @github

dependabot Bot commented on behalf of github Jul 15, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 15, 2026
@dependabot
dependabot Bot deleted the dependabot/nuget/Nexus.Application/multi-a92b35d1de branch July 15, 2026 09:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies dotnet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

No source-generated dispatcher found for Marten.Events.Aggregation.SingleStreamProjection<MyType, System.Guid>

0 participants