Bump the minor-and-patch group with 19 updates by dependabot[bot] · Pull Request #73 · guibilar/HestiaBackend

GH-5292 (#5294): Several of the SQL Server message store's per-envelope statements were scanning the whole envelope table. That cost grows with the size of the inbox and outbox, and those statements run once per message. The cause was how two kinds of value were bound as parameters.
- Envelope ids went out as sql_variant. The statements that mark envelopes as handled, reassign them, delete them and move them to the dead letter queue all filter on the envelope id. Weasel's generic command builder has no mapping for Guid, so it bound each id as DbType.Object, which SqlClient sends as sql_variant. SQL Server then had to compare CONVERT_IMPLICIT(sql_variant, [id]) on every row, which rules out a seek on the uniqueidentifier primary key. Ids are now bound as uniqueidentifier, so each statement is a primary key seek.
- Envelope addresses went out as nvarchar. received_at on the inbox and destination on the outbox are varchar(250) columns, but statements that filter on them bound the address as nvarchar. Under a SQL collation such as SQL_Latin1_General_CP1_CI_AS, the default on Azure SQL, that converts the column and defeats the index. The statements affected are the per-envelope updates and deletes, inbox recovery's page load, outbox loads by destination, the scheduled message updates and the duplicate check. They now bind the address as varchar.
- DateTime parameters kept only the date. The same generic mapping typed DateTime as DbType.Date. The message store now lets SqlClient type both values itself.
- The new test checks SQL Server's plan cache after running each of these statements. It requires that no plan contains sql_variant and that no plan converts an indexed envelope column. The full SqlServerTests suite passes (721 tests, 2 skipped).
- PostgreSQL, MySQL, SQLite and Oracle bind exactly as they did before.
- The underlying Weasel mappings are tracked as JasperFx/weasel#758 (Guid as sql_variant) and JasperFx/weasel#759 (DateTime as date). Wolverine works around both on its own, so this release doesn't wait for a Weasel release.

The `run` command no longer blocks a thread pool thread

JasperFx 2.96.2 (JasperFx/jasperfx#1093, fixes JasperFx/jasperfx#1092): Wolverine now depends on JasperFx 2.96.2. Before this release, the run command waited for shutdown by blocking a thread pool thread for the whole life of the application. That matters when a container's CPU limit is below one core. ProcessorCount is then 1, so the thread pool's minimum is one thread, and the run command held it. After that, every burst of work had to wait for the pool to add a thread, about 500 ms each time. The reporter saw a 200 ms Task.Delay loop wake up as much as about 950 ms late on Azure Container Apps.
- The run command now awaits shutdown instead of blocking. It still listens for the same three signals: ApplicationStopping, Ctrl+C, and the assembly load context unloading.
- When the host is already started (the AutoStartHost / WebApplicationFactory path), RunJasperFxCommands() used to block the calling thread. It now returns a task that completes when the host shuts down.
- This applies to every application started with RunJasperFxCommands() or RunWolverineCommands(), whatever its persistence or transport.

Full Changelog: JasperFx/wolverine@V6.59.0...V6.59.1

6.59.0 New

GH-5288 (#5289): Scheduled message management now knows about sagas. ScheduledMessageSummary.SagaId reports the saga id carried by each scheduled envelope. The new ScheduledMessageQuery.SagaId limits QueryAsync and CancelAsync to one saga's scheduled messages, such as its pending timeouts.
- There is no schema change. The filter reads every scheduled message that matches the rest of the query and pages the saga's messages in memory, so PageSize and TotalCount stay exact. On a large scheduled backlog, narrow the query with MessageType or an execution-time window as well.
- A CancelAsync with a SagaId that matches nothing cancels nothing.
- Supported by PostgreSQL, SQL Server, MySQL, SQLite, Oracle, RavenDB and CosmosDB. RavenDB and CosmosDB now treat PageSize <= 0 as "read every match", as the RDBMS stores already did.
#5287: WolverineFx.AI's AddLlmCallouts() now works under TypeLoadMode.Static when the application's pre-generated code was written without it. A library can ship its own static codegen and a host can add LLM callouts on top. In Static mode, callouts run on a pre-built handler that needs no generated code. Every other mode is unchanged.
- New LlmCalloutOptions.ConfigureChain(Action<HandlerChain>) customizes the callout chain in any mode. IHandlerPolicy doesn't reach the pre-built handler.
- DeduplicateCallouts is refused at startup in Static mode, because deduplication is woven into generated code.

Fixes

GH-5286 (#5290): A send that IHost.StopAsync() cancels mid-flight is no longer logged as a send failure. Azure Service Bus hands the runtime's cancellation token to the SDK, so an orderly shutdown used to produce two Error lines for a batch that was never lost. A durable agent now logs it at Information, because the envelopes stay in the outbox and are recovered on restart. A non-durable agent logs it at Warning, because those messages were not sent. A shutdown cancellation no longer counts toward the circuit breaker or the sending failure policies. A cancellation while the application is still running, or any other exception during shutdown, is still logged at Error.

6.58.0 New

GH-5279 (#5280, #5282): New opt-in Durability.UseTransactionScopedDurabilityPassLock for PostgreSQL. The serverless durability pass takes a transaction-scoped advisory lock (pg_try_advisory_xact_lock) instead of a session lock. This makes the pass lock safe behind a transaction-mode pooler such as PgBouncer or Supabase's pooler, where a session lock can leak onto a pooled connection or be held by two passes at once. #5282 hardens it:
- the lock connection stays out of an ambient TransactionScope
- an idle_in_transaction_session_timeout can no longer drop the lock in the middle of a pass
- a lock transaction that ends before the pass does is reported, and its pooled connection is discarded
- a session unlock that fails is logged as a warning
Wolverine also logs a one-time warning when the store doesn't support the setting, or when extension steps such as Marten's projection catch-up run under the open lock transaction. That open transaction can stall Marten's gap detection, which is tracked in JasperFx/marten#5791. See the serverless guide.

Fixes

GH-5276 (#5277, thanks @3nth): The HTTP transport's batch endpoint now answers 503 when a durable local queue cannot write the batch to its inbox. Before, it answered 200 while the messages were dropped, so a durable outbox deleted messages that were never stored on either side. The sender now keeps the batch and retries it.
GH-5278 (#5281): A durable TCP listener now answers ProcessingFailure instead of Received when its inbox could not store a batch. The sender keeps the batch and retries it, and a late duplicate is deduplicated by id. gRPC listeners can't be durable, so they aren't affected. A guard test now pins that.
#5275 (thanks @lahma): With Durability.EnableInboxPartitioning, PostgreSQL's durable inbox now refuses a redelivery whose identity was already handled. Before, the kept Handled row sat in a different partition and didn't collide, so the redelivery was handled a second time. This completes the stable-id deduplication from 6.57.0 for partitioned inboxes.

6.57.0 New

GH-5244 (#5272): NServiceBus interop now supports XML. Many NServiceBus systems still use the NServiceBus XmlSerializer, and they no longer have to switch to JSON before a migration to Wolverine can start. Every NServiceBus interop endpoint (Rabbit MQ, Azure Service Bus, Amazon SQS and SNS, and the SQL Server and PostgreSQL NServiceBus transports) now reads both JSON and XML, choosing per message from the NServiceBus.ContentType header. To send XML, use the new NServiceBusXmlSerializer: .UseNServiceBusInterop().DefaultSerializer(new NServiceBusXmlSerializer()). Because one endpoint reads both formats, NServiceBus endpoints can also move from XML to JSON gradually. See XML Serialization with NServiceBus.
#5268 (thanks @lahma) and #5273: A durable listener now gives a message from a non-Wolverine producer, which has no Wolverine id, a stable envelope id derived from the broker's own identity for that message. A redelivery is then deduplicated by the durable inbox instead of being handled twice. This covers Kafka (topic, partition and offset), NATS JetStream, Pulsar, Redis Streams, Amazon SQS and GCP Pub/Sub pull subscriptions. On SQS and Pub/Sub it applies in every endpoint mode. #5273 also makes raw JSON work on durable SQS listeners. A duplicate the durable inbox refuses is now logged at Information instead of as an error.
GH-5260 (#5261): New opt-in WolverineHttpOptions.RejectUnparseableHeaderValues answers 400 with ProblemDetails when a [FromHeader] value can't be parsed.

Fixes

GH-5244 (#5272): NServiceBus replies to Wolverine over Rabbit MQ now go to the queue marked UseForReplies(). Wolverine used to give NServiceBus its own wolverine.response.{guid} system queue as the reply address, which NServiceBus can't reach, so every reply ended up in NServiceBus's error queue.
GH-5247 (#5248): DurabilityAgent.StopAsync() now cancels its in-flight durability command and waits for it to finish. Before, a command still running at shutdown could outlive the host and fail against a disposed data source.
GH-5253 (#5256, thanks @thomhurst): A leadership lock acquisition cancelled by node shutdown is no longer logged as an error.
GH-5254 (#5265): Shutdown now waits for handlers still running on a buffered local queue.
GH-5257 (#5266): Stopping a listener now interrupts an inline retry cooldown instead of waiting it out, and the retry doesn't run after the stop.
GH-5262 (#5263): Lightweight EF Core handlers now collect domain events before their save, so the events are published atomically with it.
#5245 (thanks @ahyousif): Managed EF Core tenancy combined with WithDbContextAbstraction now reuses the tenant DbContext, so repository writes, the save and outbox enrollment all use one context. This could previously fail code generation.
#5250 (thanks @johnkaram02): A request that repeats a [FromHeader] header binds the comma-joined values instead of answering 500.
#5252 (thanks @johnkaram02) and #5259: Additional error actions such as AndPauseProcessing() chained after ScheduleRetryIndefinitely() / RequeueIndefinitely() now apply, including to the open-ended attempts after the listed delays.

Dependencies

JasperFx 2.96.1 and JasperFx.RuntimeCompiler 5.0.1 (#5258)
Weasel 9.47.1 (#5269)

Docs and build

The Best Practices guide is rewritten (#5270).
New docs for stable envelope ids from non-Wolverine producers, and for deduplicating CloudEvents (#5273).
./build.sh LocalGate runs every CI suite on one machine (GH-5125, #5246). The CI suites are rebalanced to stay under the 20 minute job limit (#5267), and the scaffold tests now pass on Windows (GH-5255, #5264).

6.56.0 New

GH-5238 (#5242): opts.UseHttpTransport() registers the HTTP transport inside UseWolverine(). http/https URIs then resolve in ListenForMessagesFrom(), PublishMessage<T>().To(uri), and runtime EndpointFor() / ToDestination(). Before this, the transport was only registered by ToHttpEndpoint(), and any other http URI failed with Unknown Transport scheme 'http'. /_wolverine/invoke now answers 415 instead of 500 for a content type with no registered serializer.

Fixes

GH-5235 (#5239): Host shutdown now stops the durability metrics sweeper and waits for any query it has in flight before stores are disposed. Removing a durability agent also waits for its in-flight query. A metrics query could previously outlive IHost.StopAsync() and throw ObjectDisposedException against a disposed NpgsqlDataSource.
GH-5236 (#5240): A Kafka listener with a durable inbox no longer crashes the process with a stack overflow when the inbox database is unavailable. DeferAsync() used to call back into the receiver inline, so the failed inbox write and the defer recursed. A deferred Kafka envelope now goes back to the receiver on its own task after a short pause, and only while the listener is running. After a stop or inbox-recovery pause, its uncommitted offset brings it back. Because Kafka has no native requeue, a Requeue error policy on a Kafka endpoint now redelivers after about one second instead of immediately.
GH-5237 (#5241): A CloudEvents HTTP endpoint now fails a single-envelope send that the receiver rejects. It used to count the send as delivered, so a durable endpoint aimed at /_wolverine/invoke could delete an outgoing envelope that was never received. HTTP transport responses are now disposed.

6.55.1 Fixes

GH-5230 (#5232): A database operation batch cancelled by Wolverine's own shutdown is no longer wrapped in DatabaseBatchCommandException and logged as an Error. Genuine SQL/connection failures are still reported.
GH-5231 (#5233): An HttpEndpoint aimed at /_wolverine/invoke in its default (buffered) mode now delivers by posting each envelope individually, instead of receiving a 415 for every batch and retrying forever. /batch/{queue} and .SendInline() endpoints are unchanged.

6.55.0 Highlights

WolverineFx.Bobcat is out of alpha, on Bobcat 1.0.0 (#5222, #5229). Bobcat 1.0.0 shipped tonight, and WolverineFx.Bobcat and WolverineFx.Bobcat.EventModel now publish as stable 6.55.0 instead of -alpha.1. WolverineFx.Bobcat.Http stays 6.55.0-alpha.1 until Alba 9 ships stable, because a stable package cannot depend on Alba 9.0.0-rc.2. A spec project that write-specs generates with no --wolverine-version pins the stable WolverineFx.Bobcat (#5222, #5223).

MessageCausedBy names your handler (#5224, #5225). IWolverineObserver.MessageCausedBy reported the generated handler class (Internal.Generated.WolverineHandlers.StartTripHandler939323516). It now reports the handler you wrote (TripService.StartTripHandler), the same string as the message.handler span tag, resolved at codegen time. Code generated by an earlier version keeps working through the old overload.

CosmosDB sagas start with a conditional create (#5221, thanks @thechucklingatom). A second start message for an existing saga id used to silently overwrite the running saga. It now fails with the SagaConcurrencyException that Marten, Azure Blob and S3 already raise, so one OnException<SagaConcurrencyException>() policy covers every provider.

Fixes

GH-5217: ListeningAgent.StartAsync is serialized, and deliveries are deferred to a drained BufferedReceiver (#5228)
GH-5218: an unresolvable tenant is treated as tenant-scoped on the single-envelope inbox write (#5227)
GH-5220: Azure Service Bus listeners join their receive loop before disposing the CancellationTokenSource (#5226)
GH-5215: reserved-word schema names are quoted in the remaining RDBMS and PostgreSQL SQL (#5216, thanks @marc-RocketRez)
GH-5213: a later pause supersedes an earlier pause's restart (#5214)
GH-5209: the dead letter history table round-trips with no schema drift (#5212)

Dependencies

JasperFx 2.96.0 (jasperfx#1083: an Observed vs Derived Origin no longer raises a SourceDisagreement)
Weasel 9.47.0 (#5219)
Bobcat 1.0.0

Full Changelog: JasperFx/wolverine@V6.54.0...V6.55.0

6.54.0 Highlights

Dead letter failure groups (#5209, #5210). Wolverine now fingerprints every message as it moves to dead letter storage, so dead letters can be managed one failure group at a time:

The default IDeadLetterFingerprinter hashes the exception type and the first stack frame from application code. Register your own to replace it.
DeadLetterEnvelopeQuery gains FailureGroup, ExceptionMessageMatch (Exact / Contains), TenantId and Archived.
A new SummarizeAllAsync overload groups by failure group, message type or endpoint, with first and last failure times.
ReplayMatchingAsync, DiscardMatchingAsync, ArchiveMatchingAsync and RestoreMatchingAsync report how many dead letters they affected.
A message that fails again after a replay reports its ReplayCount, LastReplayedAt and FirstFailedAt.
Archived dead letters drop out of summaries, queries and replays until restored, and can be expired separately with DurabilitySettings.ArchivedDeadLetterRetention.
IDeadLetters.Capabilities tells you what a store supports.

All changes are additive. The relational stores pick up seven nullable columns on wolverine_dead_letters, an index and a new wolverine_dead_letter_history table through the normal schema migration. See the dead letter storage guide.

Deduplication fixes (#5205, #5206, #5208), and Bobcat 1.0.0-rc.4 dependency pins (#5211). The WolverineFx.Bobcat* packages remain alpha (6.54.0-alpha.1).

What's Changed

GH-5205, GH-5206: [DeduplicatedWithResponse] claim-in-transaction gaps ([WriteAggregate] T / [BoundaryModel], and repeats refused over committed work) by @jeremydmiller in GH-5205, GH-5206: [DeduplicatedWithResponse] claim-in-transaction gaps ([WriteAggregate] T / [BoundaryModel], and repeats refused over committed work) JasperFx/wolverine#5208
Bobcat 1.0.0-rc.4 by @jeremydmiller in Bobcat 1.0.0-rc.4 JasperFx/wolverine#5211
GH-5209 Dead letters: failure fingerprints, operation counts, replay history, archive/restore and tenant scoping by @jeremydmiller in GH-5209 Dead letters: failure fingerprints, operation counts, replay history, archive/restore and tenant scoping JasperFx/wolverine#5210

Full Changelog: JasperFx/wolverine@V6.53.0...V6.54.0

6.53.0 What's Changed

GH-5202: keep the ASB response queue identity stable during startup by @DeandreT in GH-5202: keep the ASB response queue identity stable during startup JasperFx/wolverine#5203

New Contributors

@DeandreT made their first contribution in GH-5202: keep the ASB response queue identity stable during startup JasperFx/wolverine#5203

Full Changelog: JasperFx/wolverine@V6.52.0...V6.53.0

6.52.0

Wolverine 6.52.0 is a feature release. The headline items are Aspire-style registration by connection-string name for every transport and every message store, timer agents for short-cadence recurring schedules, and the 6.x groundwork for Wolverine 7.0's one-chain-per-handler model. There are no breaking API changes. Two behavior changes are worth knowing about up front: recurring schedules that fire more often than every 15 minutes now run on a timer agent (opt out per schedule with UseScheduledMessages()), and outgoing envelopes a transport cannot map are dead-lettered instead of being logged and deleted.

Many thanks to everyone who reported issues and sent fixes: @uniquelau, @johnkaram02, @erdtsieck, @ahmetvayhan and @pritamrao.

Aspire parity: named connections

Named-connection overloads for every transport (Aspire parity, GH-5126) by @jeremydmiller in Named-connection overloads for every transport (Aspire parity, GH-5126) JasperFx/wolverine#5159
Message storage by connection-string name for every RDBMS provider (PostgreSQL, SQL Server, MySQL, SQLite, Oracle), NpgsqlDataSource / MySqlDataSource from the container, named static tenants, a Named Connection Strings table in describe, and docs that lead with the named form (GH-5127, GH-5156) by @jeremydmiller in Message storage by connection-string name for every RDBMS provider, plus named-connection docs and describe (GH-5127, GH-5156) JasperFx/wolverine#5174
Aspire samples moved to Aspire 13.6.3, added to wolverine.slnx, with a ServiceDefaults project for traces, metrics and /health (GH-5124) by @jeremydmiller in GH-5124 Aspire samples on Aspire 13.6.3 with shared service defaults, in wolverine.slnx JasperFx/wolverine#5182

Messaging and error handling

Timer agents for short-cadence recurring schedules: one agent per schedule under opts.Schedules.TimerThreshold (15 minutes), same dedup id as the scheduled path, pause and resume through IRecurringScheduleControl (GH-5168) by @jeremydmiller in GH-5168 Timer-based recurring messages: one agent per short-cadence schedule JasperFx/wolverine#5183
DoThenRetry(action, maxAttempts) error policy that works both inline and from a queue (GH-5068) by @jeremydmiller in GH-5068 DoThenRetry() error policy that works inline and from a queue JasperFx/wolverine#5179
Unmappable outgoing envelopes are dead-lettered on Azure Service Bus, SNS and Kafka instead of being reported as sent (GH-5055) by @jeremydmiller in GH-5055 Dead letter outgoing envelopes a transport cannot map JasperFx/wolverine#5185
Durable outbox coalesces stores and deletes per tenant database, so one slow tenant no longer holds back every tenant's sends (GH-5171) by @jeremydmiller in GH-5171 Coalesce durable outbox/inbox writes per tenant database JasperFx/wolverine#5180
6.x prep for HandlerChain 1:1 in 7.0: MultipleHandlerBehavior.ClassicCombineIntoOneLogicalHandler is [Obsolete] (still the default), a startup warning for combined handlers, opt-in AssertNoCombinedHandlers(), fixes for latent Separated bugs, a handler.type OpenTelemetry tag on every chain, and logical deduplication scoped per chain (GH-5133) by @jeremydmiller in GH-5133 6.x prep for 7.0's one chain per handler type: obsolete ClassicCombine, fix latent Separated bugs, per-handler OTel tag, per-chain dedup scoping JasperFx/wolverine#5184

HTTP

[DeduplicatedWithResponse] ClaimInTransaction, plus two Marten commit-failure fixes (GH-5160, GH-5165, GH-5166) by @jeremydmiller with @uniquelau in GH-5160, GH-5165, GH-5166: [DeduplicatedWithResponse] ClaimInTransaction, plus two Marten commit-failure fixes JasperFx/wolverine#5169
WolverineHttpOptions.DefaultClaimInTransaction, an application-wide default (GH-5160) by @jeremydmiller in GH-5160: WolverineHttpOptions.DefaultClaimInTransaction, a global opt-in for [DeduplicatedWithResponse(ClaimInTransaction)] JasperFx/wolverine#5173
A string response declares its UTF-8 byte count as Content-Length (GH-5187) by @johnkaram02 in GH-5187: a string response declares its UTF-8 byte count as Content-Length JasperFx/wolverine#5188
Bind array and list query parameters whose [FromQuery] name is not a C# identifier (GH-5189) by @johnkaram02 in GH-5189: bind array and list query parameters whose [FromQuery] name is not a C# identifier JasperFx/wolverine#5190

Operability and diagnostics

ServiceCapabilities reads each store on its own and reports FailedSections, so a failed section is distinguishable from an empty one (GH-5162) by @jeremydmiller in GH-5162 ServiceCapabilities: isolate each store, record FailedSections JasperFx/wolverine#5175
AssignmentGrid.Agent.UnplacedReason (AwaitingCapacity, NoCapableNode, Paused, TakeoverHold, Superseded), a capacity log line and an optional NodeAcceptThreshold (GH-5163) by @jeremydmiller in GH-5163 Unplaced agents carry an UnplacedReason; leader logs agents awaiting capacity JasperFx/wolverine#5176 and GH-5163 follow-up: UnplacedReason names are a stable contract; close the null-reason gaps JasperFx/wolverine#5186
Header-equality filter on DeadLetterEnvelopeQuery, honored by bulk replay and discard, across every dead letter store (GH-5164) by @jeremydmiller in GH-5164 DeadLetterEnvelopeQuery header-equality filter JasperFx/wolverine#5181
db-list / db-dump / db-patch discover the Oracle message store (GH-5172) by @jeremydmiller in GH-5172 Oracle message store is discoverable by the Weasel db-* commands JasperFx/wolverine#5177

Documentation

The remaining serverless and Cosmos DB documentation (GH-5054) by @jeremydmiller in GH-5054 Serverless docs: finish the remaining checklist items JasperFx/wolverine#5178
Memory sizing for managed event subscription distribution at tenants x projections scale: set MaximumHopperSize to about 2 x BatchSize (GH-5170, follow-up JasperFx/jasperfx#1076) by @jeremydmiller in Bump to 6.52.0 JasperFx/wolverine#5199

Full Changelog: JasperFx/wolverine@V6.51.3...V6.52.0

6.51.3

Wolverine 6.51.3 is a durability release. Nearly everything in it came out of a run of reports against the durable inbox and outbox, plus a new durable receiver compliance rig (src/Testing/DurableComplianceRig, Bobcat specs across PostgreSQL, SQL Server, Marten and EF Core over local, database, RabbitMQ and SQS endpoints) that turned up the rest. There are no breaking API changes; the one schema addition (a nullable envelope_id column on the deduplication table) is optional and an unmigrated table keeps working.

Many thanks to everyone who reported these with reproductions: @billshuck, @dbelinsky-accureference, @endava-marinela-marchitan, @devployment, @kowalczb, @Patrick2607 and @ahmetvayhan.

Durable inbox hardening

Durable inbox hardening, part 1: transactions, idempotency, deduplication, GH-5123 and the CISqlServer split by @jeremydmiller in Durable inbox hardening, part 1: transactions, idempotency, deduplication, GH-5123 and the CISqlServer split JasperFx/wolverine#5129
- A late DbTransaction dispose in MessageContext.ClearState() could kill another handler's Npgsql transaction
- Eager idempotency now writes its placeholder inside the handler's transaction (Marten, EF Core, Polecat, Fisher), so a requeued failure is no longer dead lettered as a duplicate of itself
- EF Core marks the inbox row Handled only after its own commit, and inside the tenant transaction for database-per-tenant
- A handler that calls ReScheduleAsync and then returns normally keeps its retry
- A [Deduplicated] claim stranded by a crash can be taken over by the same envelope (new nullable envelope_id column, opt-in IEnvelopeAwareDeduplicationStore)
- Envelope.DeduplicationId now crosses RabbitMQ, the generic EnvelopeMapper brokers and MQTT
- Two copies of one envelope in a single batch are reported as DuplicateIncomingEnvelopeException instead of pausing the listener or tripping the tenant write brake (PostgreSQL, SQL Server, MySQL, SQLite, Oracle)
- RabbitMQ quorum queues: opt-in x-delivery-limit (.DeliveryLimit(n), DeliveryLimitForDurableQuorumQueues(n)), a startup warning, and DeferAsync publishes before it acks. New docs section "Quorum Queues and the Durable Inbox"
Durable receiver hardening, part 2: batch member settlement, inbox ownership, paused local queues by @jeremydmiller in Durable receiver hardening, part 2: batch member settlement, inbox ownership, paused local queues JasperFx/wolverine#5157
Durable receiver hardening, part 3: drain release vs. a new receiver's first claim; heartbeat only while holding (F18) by @jeremydmiller in Durable receiver hardening, part 3: drain release vs. a new receiver's first claim; heartbeat only while holding (F18) JasperFx/wolverine#5158

Durable bug fixes

GH-5107 PostgreSQL queue sender moves the outbox row atomically for every durable send by @jeremydmiller in GH-5107 PostgreSQL queue sender moves the outbox row atomically for every durable send JasperFx/wolverine#5109
GH-5107 SQL Server queue sender moves the outbox row atomically for every durable send by @jeremydmiller in GH-5107 SQL Server queue sender moves the outbox row atomically for every durable send JasperFx/wolverine#5112
GH-5107 MySQL queue sender moves the outbox row atomically for every durable send by @jeremydmiller in GH-5107 MySQL queue sender moves the outbox row atomically for every durable send JasperFx/wolverine#5113
GH-5107 Oracle queue sender moves the outbox row atomically for every durable send by @jeremydmiller in GH-5107 Oracle queue sender moves the outbox row atomically for every durable send JasperFx/wolverine#5114
GH-5107 SQLite queue sender moves the outbox row atomically for every durable send by @jeremydmiller in GH-5107 SQLite queue sender moves the outbox row atomically for every durable send JasperFx/wolverine#5115
GH-5105 Durable receiver awaits the dead-letter write; a failed write is never reported as dead lettered by @jeremydmiller in GH-5105 Durable receiver awaits the dead-letter write; a failed write is never reported as dead lettered JasperFx/wolverine#5110
GH-5108 Logical deduplication claim rides the EF Core transaction by @jeremydmiller in GH-5108 Logical deduplication claim rides the EF Core transaction JasperFx/wolverine#5111
GH-5116 A disposed message store refuses a dead letter instead of dropping it by @jeremydmiller in GH-5116 A disposed message store refuses a dead letter instead of dropping it JasperFx/wolverine#5118
GH-5119 Durable receivers settle the inbox row even when the broker delivery is already acked (durable SQS listeners since 6.40.0) by @jeremydmiller in GH-5119 Durable receivers settle the inbox row even when the broker delivery is already acked JasperFx/wolverine#5121
GH-5120 A durable batch's scheduled retry is held in memory instead of lost by @jeremydmiller in GH-5120 A durable batch's scheduled retry is held in memory instead of lost JasperFx/wolverine#5122

Testing

GH-5106 Bobcat failure reports carry the message, correlation, causation and trace ids by @jeremydmiller in GH-5106 Bobcat failure reports carry the message, correlation, causation and trace ids JasperFx/wolverine#5117

Full Changelog: JasperFx/wolverine@V6.51.2...V6.51.3

6.51.2

Bug fix release on the JasperFx 2.91.0 / Marten 9.51.0 / Polecat 5.43.0 / Fisher 1.21.2 matched set, plus the Bobcat specification work

What's Changed

WolverineFx.ComplianceTests suppresses NU5104 for its prerelease Bobcat dependency by @jeremydmiller in WolverineFx.ComplianceTests suppresses NU5104 for its prerelease Bobcat dependency JasperFx/wolverine#5090
WolverineFx.Bobcat takes the Critter Stack vocabulary, Bobcat's samples and the spec writer (#5082) by @jeremydmiller in WolverineFx.Bobcat takes the Critter Stack vocabulary, Bobcat's samples and the spec writer (#5082) JasperFx/wolverine#5083
GH-5087 Database queue listeners: deferral survives stop; SQLite StopAsync joins its workers by @jeremydmiller in GH-5087 Database queue listeners: deferral survives stop; SQLite StopAsync joins its workers JasperFx/wolverine#5093
WolverineFx.Bobcat: scheduled messages are explicit (#5077); ThenHandled, scheduled grammars, body-less HTTP acts, GivenReceived (#5076) by @jeremydmiller in WolverineFx.Bobcat: scheduled messages are explicit (#5077); ThenHandled, scheduled grammars, body-less HTTP acts, GivenReceived (#5076) JasperFx/wolverine#5091
Wolverine 6.51.2: GH-5092 coordinator only observes, GH-5087 MySQL/Oracle join, JasperFx 2.91.0 matched set by @jeremydmiller in Wolverine 6.51.2: GH-5092 coordinator only observes, GH-5087 MySQL/Oracle join, JasperFx 2.91.0 matched set JasperFx/wolverine#5095
Keep a blocking receive loop on its dedicated thread past the first await (GH-4330 follow-up) by @lahma in Keep a blocking receive loop on its dedicated thread past the first await (GH-4330 follow-up) JasperFx/wolverine#5096
GH-5089 Event Model: match the EmittedEvents manifest to a handler overload by its ParameterTypes by @jeremydmiller in GH-5089 Event Model: match the EmittedEvents manifest to a handler overload by its ParameterTypes JasperFx/wolverine#5100
GH-5099 Wolverine.HTTP: an omitted query, header or form value binds the parameter's declared default by @jeremydmiller in GH-5099 Wolverine.HTTP: an omitted query, header or form value binds the parameter's declared default JasperFx/wolverine#5101
Don't dispose a DbDataSource the message store does not own by @lahma in Don't dispose a DbDataSource the message store does not own JasperFx/wolverine#5097
Docs: Specifications with Bobcat (WolverineFx.Bobcat reference page) by @jeremydmiller in Docs: Specifications with Bobcat (WolverineFx.Bobcat reference page) JasperFx/wolverine#5103
GH-5098 Event subscription capabilities match tenant-neutrally by @jeremydmiller in GH-5098 Event subscription capabilities match tenant-neutrally JasperFx/wolverine#5102
GH-5094 Wolverine.Fisher: opt-in Wolverine-managed event subscription distribution by @jeremydmiller in GH-5094 Wolverine.Fisher: opt-in Wolverine-managed event subscription distribution JasperFx/wolverine#5104

Committed directly to main

GH-5067 event-model --url stamps the pushed Event Model with its checkout root, repository and branch (dded67e95)
GH-5078 AgentAssignmentsChanged is obsolete, and the test observer's dead branch for it is removed (c1b22941a)

Full Changelog: JasperFx/wolverine@v6.51.1...V6.51.2

6.51.1

Bug fix release, and some doc updates too

What's Changed

GH-5070 A new leader keeps its own persisted leader row after a crash takeover by @jeremydmiller in GH-5070 A new leader keeps its own persisted leader row after a crash takeover JasperFx/wolverine#5071
Leadership-election compliance on Bobcat, with agent-assignment telemetry on failure by @jeremydmiller in Leadership-election compliance on Bobcat, with agent-assignment telemetry on failure JasperFx/wolverine#5074
Bobcat 1.0.0-rc.1 by @jeremydmiller in Bobcat 1.0.0-rc.1 JasperFx/wolverine#5079
GH-5080 CloudEvents carries lower case Envelope.Headers as extension attributes by @jeremydmiller in GH-5080 CloudEvents carries lower case Envelope.Headers as extension attributes JasperFx/wolverine#5084
GH-5085 Serverless docs: reword the 15 DRAFT comments into the page by @jeremydmiller in GH-5085 Serverless docs: reword the 15 DRAFT comments into the page JasperFx/wolverine#5086
GH-5073 Atomic, deadlock-free inbox recovery claims on every store (supersedes #5075) by @jeremydmiller in GH-5073 Atomic, deadlock-free inbox recovery claims on every store (supersedes #5075) JasperFx/wolverine#5081

Full Changelog: JasperFx/wolverine@V6.51.0...v6.51.1

6.51.0

Everything since 6.50.1.

Highlights

Warm-up nodes for blue/green deployments (#4569, #5024). Set opts.Durability.NodeRole = NodeRole.Warmup and a node joins the serving cluster but does none of the serving nodes' messaging. Its only job is to run the new release's projection shards in Rebuild mode, so the new projection versions are caught up before you cut over. The role is opt-in; the default is NodeRole.Serving, and no schema change is needed. Docs: Marten · Polecat
DurabilityMode.ServerlessWithOutbox (#5016, #5044). The lean Serverless runtime, but with the transactional outbox kept:
- Outgoing messages are persisted with the handler's transaction.
- They are sent inline before the request completes.
- Anything that couldn't be sent is recovered by a durability pass.
- Follow-ups are in #5058 (#5046–#5057), #5060 (#5059) and #5065 (#5038).
- Docs: Serverless with the Transactional Outbox
Wolverine.HTTP JSON options (#5042, #5064). HTTP handlers mapped directly now use ASP.NET Core's JsonOptions without needing MapWolverineEndpoints(). Two new properties, HttpChain.JsonSerializerOptions and HttpHandler.JsonSerializerOptions, give a single endpoint its own JSON options.
Failure log level (#5043, #5064). Set it with chain.FailureLogLevel, opts.Policies.MessageFailureLogLevel(...) or [WolverineLogging(FailureLogLevel = ...)]. The default is still Error.

Durability fixes

Durable database queue pops (#5015, #5020 by @jcd1991, #5021). A failed or lost pop no longer strands envelopes on a live node, on PostgreSQL, SQL Server, MySQL and Oracle. Thanks to @dbelinsky-accureference for the report.
InboxStaleTime (#5022, #5025, #5039):
- Its clock now measures the time since a node claimed the message, not since the message was first written.
- It leaves scheduled rows alone.
- A node keeps the clock running for the messages it still holds, so a long handler is no longer started a second time.
Projection daemon self-healing (#4986 by @erdtsieck). A shard the daemon paused on a transient failure, such as connection pool exhaustion, is restarted with a capped backoff instead of staying paused until the pods restart.
Serverless startup with RavenDB (#5030, #5041 by @jcd1991). Plain Serverless mode no longer fails at startup with RavenDB persistence.
Messages replayed on every restart (#5040, #5045, #5062). A handled message is now marked handled in the store that holds its inbox row. This affected two setups:
- a durable PostgreSQL queue with a DbContext enrolled in an ancillary store
- Fisher or Polecat with an AddMessageHandler handler committing an ancillary session
PostgreSQL transport schema (#5062). The transport takes its storage schema from the store it is bound to, not from the last PostgreSQL store registered.
More #5038 follow-ups (#5065):
- Outside ServerlessWithOutbox, a failed inline send is retried by the destination's sending agent.
- RavenDB and Cosmos DB take one durability pass lock per database or container.
- EF Core and RavenDB write the same outgoing owner id as the other stores.
- Plain Serverless warns about durable endpoints downgraded after startup.

Dependencies

6.50.2 (#5018): Weasel 9.45.1, Polecat 5.40.2 and Marten 9.50.2, for the System.Security.Cryptography.Pkcs advisory GHSA-846f-f764-76mx.
6.51.0 (#5063): JasperFx 2.90.1, Marten 9.50.3, Polecat 5.42.0 and Fisher 1.21.1.

6.50.2

A dependency patch release. No configuration or code changes needed.

Dependencies

This moves Wolverine onto the Critter Stack releases that fix CVE-2026-84008 / GHSA-846f-f764-76mx (System.Security.Cryptography.Pkcs, high-severity denial of service) (#5018):

Weasel 9.45.1: Weasel.SqlServer and Weasel.Oracle now reference the patched Pkcs directly.
Polecat 5.40.2 (up from 5.38.0): Polecat now references the patched Pkcs directly. This also brings in Polecat 5.39 and 5.40.
Marten 9.50.2 (up from 9.49.0) for Marten, Marten.AspNetCore and Marten.Newtonsoft. Marten was never affected by the advisory.

Wolverine 6.50.1 already pinned the patched Pkcs in WolverineFx.SqlServer, WolverineFx.Oracle and WolverineFx.ClaimCheck.SqlServer, so applications on 6.50.1 were already protected. Those pins stay, because Wolverine references Microsoft.Data.SqlClient and Oracle.ManagedDataAccess.Core directly. 6.50.2 means the upstream libraries carry the fix too, so a NuGet audit comes back clean whichever of them your application references directly.

6.50.1

Patch release with a memory-leak fix and two security dependency updates.

Fixes

WolverineRuntime now disposes its Meter (#5012, #5013). The runtime's System.Diagnostics.Metrics.Meter used to stay in the process-wide static Meter registry after the host was disposed. The durable persistence gauges on it hold callbacks back into the runtime, so every disposed host stayed reachable for the life of the process. Test suites that build many WebApplicationFactory or Host instances with durable persistence saw the heap grow without bound. Thanks to @AndriiKononenko3 for the detailed report and the retention path.

Security dependency updates

CVE-2026-84008 / GHSA-846f-f764-76mx (System.Security.Cryptography.Pkcs, high-severity denial of service). The package arrived transitively at vulnerable versions through Microsoft.Data.SqlClient, Oracle.ManagedDataAccess.Core and Polecat. WolverineFx.SqlServer, WolverineFx.Oracle and WolverineFx.ClaimCheck.SqlServer now reference the patched version directly: 9.0.21 on net9.0 and 10.0.13 on net10.0. Every package built on them, including WolverineFx.Polecat and WolverineFx.Http.Polecat, picks up the fix.
CVE-2026-70159 / GHSA-334f-vvp4-7g6p (Microsoft.AspNetCore.SignalR.Common, high-severity denial of service). WolverineFx.SignalR now depends on Microsoft.AspNetCore.SignalR.Client 9.0.21 on net9.0 and 10.0.13 on net10.0, up from 9.0.8.

6.50.0

Wolverine 6.50.0 is a feature release. The headline is a new way to send a message to every node in your cluster. Just as much of this release came from the community, though: five community pull requests landed, and several issue reports led straight to fixes.

The two Bobcat packages, WolverineFx.Bobcat and WolverineFx.Bobcat.Http, ship as 6.50.0-alpha.1 and are still pre-release.

Broadcast a message to every node in the cluster

BroadcastToAllNodesAsync() (#4993, closes #4988). Wolverine's normal delivery is competing consumers, where exactly one node handles a message. Sometimes you want every node to hear about something instead: a cache to invalidate, a configuration change to pick up, some node-local state to reset. Now you can just do this:
```
await bus.BroadcastToAllNodesAsync(new InvalidateCache("products"));
```
Every running node, including the one that sent it, handles the message exactly once with its own handler. The sending node gets the message on the local routes its type already has, or on local://default, and it's never forwarded to the external routes PublishAsync() would use. Every other node gets a copy on its node control endpoint, which is the broker control queue if you've configured one and the database control queue otherwise. Nodes that have gone stale are skipped, using the same rule the leader applies before ejecting a node. A broadcast from inside a handler goes through the outbox like any other outgoing message, and correlation ids are stamped as usual. In Solo and Serverless durability modes the message is delivered to this node only, and MediatorOnly refuses it just like PublishAsync(). It's an extension method on IMessageBus, so no other IMessageBus implementation breaks, and TestMessageContext records broadcasts in a new BroadcastToAllNodes list for your unit tests. See the new Broadcast Messages to Every Node guide.

From the community

A big thank you to everyone who sent pull requests and reports for this release:

@jcd1991 contributed two PostgreSQL transport features:
- Opt-in LISTEN/NOTIFY wakeups for PostgreSQL queues (#4998, closes #3480). With EnableQueueNotifications(), an idle queue listener is woken as soon as a message is written instead of waiting out its polling interval. In local benchmarks the median delivery time on an idle queue dropped from about 650ms to under 3ms. It's off by default because it holds one extra, long-lived database connection per database per running process. Read the trade-offs in the new Queue Notifications with LISTEN/NOTIFY section before you turn it on.
- FIFO ordering for sharded PostgreSQL queue batches (#4970, closes #4862, reported by @alexandrefresnais). Messages for one group id that went through a PostgreSQL shard queue could run out of order. EnableDeterministicQueueOrdering() now preserves their order, and it was followed up for SQL Server, MySQL, Oracle and SQLite in #4987.
@jcd1991 also fixed Wolverine.HTTP treating a container-registered service as the JSON request body on POST and PUT endpoints (#5010, closes #3863, reported by @erdtsieck). The same parameter on a GET endpoint was correctly injected, but on a POST or PUT every call failed with a 500. An explicitly registered, non-keyed concrete type is now resolved from the container on every endpoint. This is a behavior change: if you register a type in the container and post it as a request body without [FromBody], add [FromBody] to keep binding it from the request.
@erdtsieck found and fixed a ping-pong in agent assignment during blue/green warm-ups (#5000, closes #4999). Projection partitions that could only run on the previous version's nodes moved between those nodes on every evaluation, which showed up in production as 1,000 to 3,000 ReassignAgent commands a minute. A partition that fits nowhere now stays where it is unless another node is strictly lighter. The follow-up in #5001 makes it settle in one move.
@PascalEschbach contributed a big round of NATS follow-ups (#4976, closes #4973), with tests for every change:
- one schedule subject per message, with listeners that skip schedule control messages;
- resources setup provisioning declared streams once per connection;
- per-tenant connection configuration, tenant subject mappers, and a new TrustTenantIdHeader setting;
- safer dead letter forwarding that only terminates the original after a confirmed forward;
- a deadline on every JetStream publish;
- named consumers for dotted subjects;
- NATS logging through the host's ILoggerFactory;
- a health check that reports a failed listener start.
#4985 followed up on the core side.
@Maflend reported that the static handler registry ignored custom discovery rules once conventional discovery was disabled (#4984), a regression since 6.44.0. It's fixed in #4992.
@uniquelau's report in marten#5652 led to #5011, below: the leader no longer builds every event store's full usage descriptor on every heartbeat.

Agents and event subscriptions

The leader's heartbeat no longer builds the full event store descriptor (#5011, closes #5002). Assigning event subscription agents only needs each store's async shard names and its database topology. Wolverine now reads those through JasperFx 2.87.1's IEventStore.RegisteredShardNames() and the new IEventStore.TryDescribeDatabasesAsync(), instead of a full TryCreateUsage() that also read the highest event sequence and described every projection, subscription and event type, for every store, every 10 seconds. To get the full saving, also take Marten 9.50.1, Polecat 5.40.1 or Fisher 1.20.2, which answer TryDescribeDatabasesAsync() straight from their tenancy.
A projection rebuild always hands its shard back to continuous execution (#5008, closes #5003). A rebuild that threw used to leave the shard stopped, for good if it had already paused on a transient failure. The registered-projection rebuild path that CritterWatch uses never resumed the shard at all. Both paths now resume it whether the rebuild succeeded or failed. The health-check sweep also leaves a shard alone while its projection is being rebuilt, using JasperFx's new IProjectionDaemon.IsRebuilding(), so it can no longer start a second copy of the shard on top of a running rebuild.

Transports and persistence

SQL Server queue tables can switch between the default layout and OptimizeQueueThroughput() (#4991, closes #4989).
EnableDeterministicQueueOrdering() for SQL Server, MySQL, Oracle and SQLite (#4987).

HTTP

Wolverine.Http binds single-Value strong-typed id wrappers, such as record struct OrderId(Guid Value), without a TryParse (#4995, closes #4978).
... (truncated)

Commits viewable in compare view.

Updated WolverineFx.RabbitMQ from 6.49.0 to 6.60.0.

Release notes

Sourced from WolverineFx.RabbitMQ's releases.

6.60.0 What's Changed

JasperFx 2.97.0 by @jeremydmiller in JasperFx 2.97.0 JasperFx/wolverine#5299
GH-5296 Query saga instances by saga type: filters, ordering, paging and counts by @jeremydmiller in GH-5296 Query saga instances by saga type: filters, ordering, paging and counts JasperFx/wolverine#5301
GH-5297 IDocumentStoreDiagnostics for EF Core DbContexts by @jeremydmiller in GH-5297 IDocumentStoreDiagnostics for EF Core DbContexts JasperFx/wolverine#5302
GH-5295 Explicit IDbContextOutbox binds the ancillary store by @jeremydmiller in GH-5295 Explicit IDbContextOutbox<T> binds the ancillary store JasperFx/wolverine#5303
GH-5298 Lightweight saga storage honours the AddSagaType table name by @jeremydmiller in GH-5298 Lightweight saga storage honours the AddSagaType table name JasperFx/wolverine#5304
GH-5300 CosmosDB saga storage: ISagaStoreDiagnostics read and QuerySagasAsync by @jeremydmiller in GH-5300 CosmosDB saga storage: ISagaStoreDiagnostics read and QuerySagasAsync JasperFx/wolverine#5305

Full Changelog: JasperFx/wolverine@V6.59.1...V6.60.0

6.59.1

This is a patch release with two fixes. Upgrading is a package bump only: there is no schema change and no API change.

SQL Server: the inbox and outbox seek on their indexes again

GH-5292 (#5294): Several of the SQL Server message store's per-envelope statements were scanning the whole envelope table. That cost grows with the size of the inbox and outbox, and those statements run once per message. The cause was how two kinds of value were bound as parameters.
- Envelope ids went out as sql_variant. The statements that mark envelopes as handled, reassign them, delete them and move them to the dead letter queue all filter on the envelope id. Weasel's generic command builder has no mapping for Guid, so it bound each id as DbType.Object, which SqlClient sends as sql_variant. SQL Server then had to compare CONVERT_IMPLICIT(sql_variant, [id]) on every row, which rules out a seek on the uniqueidentifier primary key. Ids are now bound as uniqueidentifier, so each statement is a primary key seek.
- Envelope addresses went out as nvarchar. received_at on the inbox and destination on the outbox are varchar(250) columns, but statements that filter on them bound the address as nvarchar. Under a SQL collation such as SQL_Latin1_General_CP1_CI_AS, the default on Azure SQL, that converts the column and defeats the index. The statements affected are the per-envelope updates and deletes, inbox recovery's page load, outbox loads by destination, the scheduled message updates and the duplicate check. They now bind the address as varchar.
- DateTime parameters kept only the date. The same generic mapping typed DateTime as DbType.Date. The message store now lets SqlClient type both values itself.
- The new test checks SQL Server's plan cache after running each of these statements. It requires that no plan contains sql_variant and that no plan converts an indexed envelope column. The full SqlServerTests suite passes (721 tests, 2 skipped).
- PostgreSQL, MySQL, SQLite and Oracle bind exactly as they did before.
- The underlying Weasel mappings are tracked as JasperFx/weasel#758 (Guid as sql_variant) and JasperFx/weasel#759 (DateTime as date). Wolverine works around both on its own, so this release doesn't wait for a Weasel release.

The `run` command no longer blocks a thread pool thread

JasperFx 2.96.2 (JasperFx/jasperfx#1093, fixes JasperFx/jasperfx#1092): Wolverine now depends on JasperFx 2.96.2. Before this release, the run command waited for shutdown by blocking a thread pool thread for the whole life of the application. That matters when a container's CPU limit is below one core. ProcessorCount is then 1, so the thread pool's minimum is one thread, and the run command held it. After that, every burst of work had to wait for the pool to add a thread, about 500 ms each time. The reporter saw a 200 ms Task.Delay loop wake up as much as about 950 ms late on Azure Container Apps.
- The run command now awaits shutdown instead of blocking. It still listens for the same three signals: ApplicationStopping, Ctrl+C, and the assembly load context unloading.
- When the host is already started (the AutoStartHost / WebApplicationFactory path), RunJasperFxCommands() used to block the calling thread. It now returns a task that completes when the host shuts down.
- This applies to every application started with RunJasperFxCommands() or RunWolverineCommands(), whatever its persistence or transport.

Full Changelog: JasperFx/wolverine@V6.59.0...V6.59.1

6.59.0 New

GH-5288 (#5289): Scheduled message management now knows about sagas. ScheduledMessageSummary.SagaId reports the saga id carried by each scheduled envelope. The new ScheduledMessageQuery.SagaId limits QueryAsync and CancelAsync to one saga's scheduled messages, such as its pending timeouts.
- There is no schema change. The filter reads every scheduled message that matches the rest of the query and pages the saga's messages in memory, so PageSize and TotalCount stay exact. On a large scheduled backlog, narrow the query with MessageType or an execution-time window as well.
- A CancelAsync with a SagaId that matches nothing cancels nothing.
- Supported by PostgreSQL, SQL Server, MySQL, SQLite, Oracle, RavenDB and CosmosDB. RavenDB and CosmosDB now treat PageSize <= 0 as "read every match", as the RDBMS stores already did.
#5287: WolverineFx.AI's AddLlmCallouts() now works under TypeLoadMode.Static when the application's pre-generated code was written without it. A library can ship its own static codegen and a host can add LLM callouts on top. In Static mode, callouts run on a pre-built handler that needs no generated code. Every other mode is unchanged.
- New LlmCalloutOptions.ConfigureChain(Action<HandlerChain>) customizes the callout chain in any mode. IHandlerPolicy doesn't reach the pre-built handler.
- DeduplicateCallouts is refused at startup in Static mode, because deduplication is woven into generated code.

Fixes

GH-5286 (#5290): A send that IHost.StopAsync() cancels mid-flight is no longer logged as a send failure. Azure Service Bus hands the runtime's cancellation token to the SDK, so an orderly shutdown used to produce two Error lines for a batch that was never lost. A durable agent now logs it at Information, because the envelopes stay in the outbox and are recovered on restart. A non-durable agent logs it at Warning, because those messages were not sent. A shutdown cancellation no longer counts toward the circuit breaker or the sending failure policies. A cancellation while the application is still running, or any other exception during shutdown, is still logged at Error.

6.58.0 New

GH-5279 (#5280, #5282): New opt-in Durability.UseTransactionScopedDurabilityPassLock for PostgreSQL. The serverless durability pass takes a transaction-scoped advisory lock (pg_try_advisory_xact_lock) instead of a session lock. This makes the pass lock safe behind a transaction-mode pooler such as PgBouncer or Supabase's pooler, where a session lock can leak onto a pooled connection or be held by two passes at once. #5282 hardens it:
- the lock connection stays out of an ambient TransactionScope
- an idle_in_transaction_session_timeout can no longer drop the lock in the middle of a pass
- a lock transaction that ends before the pass does is reported, and its pooled connection is discarded
- a session unlock that fails is logged as a warning
Wolverine also logs a one-time warning when the store doesn't support the setting, or when extension steps such as Marten's projection catch-up run under the open lock transaction. That open transaction can stall Marten's gap detection, which is tracked in JasperFx/marten#5791. See the serverless guide.

Fixes

GH-5276 (#5277, thanks @3nth): The HTTP transport's batch endpoint now answers 503 when a durable local queue cannot write the batch to its inbox. Before, it answered 200 while the messages were dropped, so a durable outbox deleted messages that were never stored on either side. The sender now keeps the batch and retries it.
GH-5278 (#5281): A durable TCP listener now answers ProcessingFailure instead of Received when its inbox could not store a batch. The sender keeps the batch and retries it, and a late duplicate is deduplicated by id. gRPC listeners can't be durable, so they aren't affected. A guard test now pins that.
#5275 (thanks @lahma): With Durability.EnableInboxPartitioning, PostgreSQL's durable inbox now refuses a redelivery whose identity was already handled. Before, the kept Handled row sat in a different partition and didn't collide, so the redelivery was handled a second time. This completes the stable-id deduplication from 6.57.0 for partitioned inboxes.

6.57.0 New

GH-5244 (#5272): NServiceBus interop now supports XML. Many NServiceBus systems still use the NServiceBus XmlSerializer, and they no longer have to switch to JSON before a migration to Wolverine can start. Every NServiceBus interop endpoint (Rabbit MQ, Azure Service Bus, Amazon SQS and SNS, and the SQL Server and PostgreSQL NServiceBus transports) now reads both JSON and XML, choosing per message from the NServiceBus.ContentType header. To send XML, use the new NServiceBusXmlSerializer: .UseNServiceBusInterop().DefaultSerializer(new NServiceBusXmlSerializer()). Because one endpoint reads both formats, NServiceBus endpoints can also move from XML to JSON gradually. See XML Serialization with NServiceBus.
#5268 (thanks @lahma) and #5273: A durable listener now gives a message from a non-Wolverine producer, which has no Wolverine id, a stable envelope id derived from the broker's own identity for that message. A redelivery is then deduplicated by the durable inbox instead of being handled twice. This covers Kafka (topic, partition and offset), NATS JetStream, Pulsar, Redis Streams, Amazon SQS and GCP Pub/Sub pull subscriptions. On SQS and Pub/Sub it applies in every endpoint mode. #5273 also makes raw JSON work on durable SQS listeners. A duplicate the durable inbox refuses is now logged at Information instead of as an error.
GH-5260 (#5261): New opt-in WolverineHttpOptions.RejectUnparseableHeaderValues answers 400 with ProblemDetails when a [FromHeader] value can't be parsed.

Fixes

GH-5244 (#5272): NServiceBus replies to Wolverine over Rabbit MQ now go to the queue marked UseForReplies(). Wolverine used to give NServiceBus its own wolverine.response.{guid} system queue as the reply address, which NServiceBus can't reach, so every reply ended up in NServiceBus's error queue.
GH-5247 (#5248): DurabilityAgent.StopAsync() now cancels its in-flight durability command and waits for it to finish. Before, a command still running at shutdown could outlive the host and fail against a disposed data source.
GH-5253 (#5256, thanks @thomhurst): A leadership lock acquisition cancelled by node shutdown is no longer logged as an error.
GH-5254 (#5265): Shutdown now waits for handlers still running on a buffered local queue.
GH-5257 (#5266): Stopping a listener now interrupts an inline retry cooldown instead of waiting it out, and the retry doesn't run after the stop.
GH-5262 (#5263): Lightweight EF Core handlers now collect domain events before their save, so the events are published atomically with it.
#5245 (thanks @ahyousif): Managed EF Core tenancy combined with WithDbContextAbstraction now reuses the tenant DbContext, so repository writes, the save and outbox enrollment all use one context. This could previously fail code generation.
#5250 (thanks @johnkaram02): A request that repeats a [FromHeader] header binds the comma-joined values instead of answering 500.
#5252 (thanks @johnkaram02) and #5259: Additional error actions such as AndPauseProcessing() chained after ScheduleRetryIndefinitely() / RequeueIndefinitely() now apply, including to the open-ended at...

Description has been truncated

Bumps dotnet-ef from 10.0.13 to 10.0.14 Bumps Ical.Net from 5.2.3 to 5.2.4 Bumps MailKit from 4.18.1 to 4.18.2 Bumps Microsoft.AspNetCore.Authentication.JwtBearer from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.DataProtection.EntityFrameworkCore from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.Identity.EntityFrameworkCore from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.Mvc.Testing from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.OpenApi from 10.0.13 to 10.0.14 Bumps Microsoft.AspNetCore.TestHost from 10.0.13 to 10.0.14 Bumps Microsoft.EntityFrameworkCore from 10.0.13 to 10.0.14 Bumps Microsoft.EntityFrameworkCore.Design from 10.0.13 to 10.0.14 Bumps Microsoft.EntityFrameworkCore.InMemory from 10.0.13 to 10.0.14 Bumps Microsoft.EntityFrameworkCore.Relational from 10.0.13 to 10.0.14 Bumps SkiaSharp from 4.153.1 to 4.154.0 Bumps SkiaSharp.NativeAssets.Linux.NoDependencies from 4.153.1 to 4.154.0 Bumps System.Security.Cryptography.Pkcs from 10.0.13 to 10.0.14 Bumps WolverineFx from 6.49.0 to 6.60.0 Bumps WolverineFx.RabbitMQ from 6.49.0 to 6.60.0 Bumps WolverineFx.RuntimeCompilation from 6.49.0 to 6.60.0 --- updated-dependencies: - dependency-name: dotnet-ef dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Ical.Net dependency-version: 5.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: MailKit dependency-version: 4.18.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.AspNetCore.Authentication.JwtBearer dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.AspNetCore.DataProtection.EntityFrameworkCore dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.AspNetCore.Identity.EntityFrameworkCore dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.AspNetCore.Mvc.Testing dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.AspNetCore.OpenApi dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.AspNetCore.TestHost dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.EntityFrameworkCore dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.EntityFrameworkCore.Design dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.EntityFrameworkCore.InMemory dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: Microsoft.EntityFrameworkCore.Relational dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: SkiaSharp dependency-version: 4.154.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: SkiaSharp.NativeAssets.Linux.NoDependencies dependency-version: 4.154.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: System.Security.Cryptography.Pkcs dependency-version: 10.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: WolverineFx dependency-version: 6.60.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: WolverineFx.RabbitMQ dependency-version: 6.60.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: WolverineFx.RuntimeCompilation dependency-version: 6.60.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Nov 2, 2026

This was referenced Nov 2, 2026

Bump the minor-and-patch group with 16 updates #71

Closed

Bump the dotnet group with 11 updates #72

Closed

Navigation Menu

Repository navigation

Bump the minor-and-patch group with 19 updates - #73

Bump the minor-and-patch group with 19 updates#73
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dot-config/minor-and-patch-7b8ecc3f76

dependabot Bot commented on behalf of github Nov 2, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 2, 2026

5.2.4

What's Changed

6.60.0

What's Changed

6.59.1

SQL Server: the inbox and outbox seek on their indexes again

The run command no longer blocks a thread pool thread

6.59.0

New

Fixes

6.58.0

New

Fixes

6.57.0

New

Fixes

Dependencies

Docs and build

6.56.0

New

Fixes

6.55.1

Fixes

6.55.0

Highlights

Fixes

Dependencies

6.54.0

Highlights

What's Changed

6.53.0

What's Changed

New Contributors

6.52.0

Aspire parity: named connections

Messaging and error handling

HTTP

Operability and diagnostics

Documentation

6.51.3

Durable inbox hardening

Durable bug fixes

Testing

6.51.2

What's Changed

Committed directly to main

6.51.1

What's Changed

6.51.0

Highlights

Durability fixes

Dependencies

6.50.2

Dependencies

6.50.1

Fixes

Security dependency updates

6.50.0

Broadcast a message to every node in the cluster

From the community

Agents and event subscriptions

Transports and persistence

HTTP

6.60.0

What's Changed

6.59.1

SQL Server: the inbox and outbox seek on their indexes again

The run command no longer blocks a thread pool thread

6.59.0

New

Fixes

6.58.0

New

Fixes

6.57.0

New

Fixes

Uh oh!

The `run` command no longer blocks a thread pool thread

The `run` command no longer blocks a thread pool thread