Skip to content

Bump the dotnet-production group with 3 updates - #6

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dotnet-production-da336ce1ef
Open

Bump the dotnet-production group with 3 updates#6
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/dotnet-production-da336ce1ef

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown

Updated Marten from 9.21.0 to 9.22.4.

Release notes

Sourced from Marten's releases.

9.22.4

What's Changed

Full Changelog: JasperFx/marten@V9.22.3...V9.22.4

9.22.3

What's Changed

Full Changelog: JasperFx/marten@V9.22.1...V9.22.3

9.22.1

Security release. Upgrade is recommended for anyone using sharded tenancy together with Events.UseTenantPartitionedEvents.

A tenant id was interpolated into a double-quoted PostgreSQL identifier without doubling an embedded double quote, so a tenant id containing one could terminate the identifier and execute additional SQL statements. This is a different class from the two advisories previously published on this repository, both of which were the single-quoted string-literal class; neither of those fixes addressed this.

You are affected only if you use sharded tenancy, have UseTenantPartitionedEvents enabled, and your application passes attacker-influenced input as a tenant id. Note that the reachable surface includes ordinary session resolution, not just administrative provisioning calls — GetTenantAsync / FindOrCreateDatabase auto-provision an unknown tenant. Applications using tenant ids from a trusted fixed set are not exploitable.

Affected versions: 9.4.0 through 9.22.0.

Full details, including remediation guidance for existing data, are in the security advisory: GHSA-3vp4-34pf-2rcw

What changed

  • PerTenantEventSequences.QuotedSequenceName escapes embedded quotes, matching quote_ident/%I so the name still resolves to the same object the quick-append function finds. Covers the create, drop, schema-apply and cleanup paths.
  • BulkEventAppender no longer builds an unquoted sequence name from a suffix read back out of the tenants table. This also fixes a functional bug: PreserveSourceSequence bulk imports previously failed with 42601 for hyphenated and GUID tenant ids under sharded tenancy.
  • ShardedTenancy validates tenant ids destined for DDL, closing a long-standing asymmetry with the DefaultTenancy provisioning path. It is a narrow denylist rather than the existing identifier allowlist, so hyphenated and GUID tenant ids keep working.

Dependency

Requires Weasel.Postgresql 9.21.1, which escapes partition bound values (JasperFx/weasel#​416). Both halves are needed; the dependency is pulled in automatically.

Credit to Barak Srour (Apiiro) for the report.

9.22.0

The partitioning feature is new, but otherwise this was all about CritterWatch improvements for a huge installation

What's Changed

Full Changelog: JasperFx/marten@V9.21.0...V9.22.0

Commits viewable in compare view.

Updated Npgsql from 9.0.4 to 10.0.3.

Release notes

Sourced from Npgsql's releases.

10.0.3

Release milestone

Full Changelog: npgsql/npgsql@v10.0.2...v10.0.3

10.0.2

v10.0.2 contains several minor bug fixes.

Milestone issues

Full Changelog: npgsql/npgsql@v10.0.1...v10.0.2

10.0.1

v10.0.1 contains several minor bug fixes.

Milestone issues

Full Changelog: npgsql/npgsql@v10.0.0...v10.0.1

10.0.0

See the release notes.

The full list of changes is available here.

What's Changed

10.0.0-rc.1

9.0.5

v9.0.5 contains several minor bug fixes.

Milestone issues

Full Changelog: npgsql/npgsql@v9.0.4...v9.0.5

Commits viewable in compare view.

Updated Weasel.Storage from 9.17.0 to 9.23.2.

Release notes

Sourced from Weasel.Storage's releases.

9.23.2

What's Changed

JasperFx 2.38.0 brings the lifted ProjectionScenario test harness (JasperFx/jasperfx#​616) and the container-scoped projection fixes for live aggregation and validation (JasperFx/jasperfx#​617). Nothing Weasel consumes changed; the bump keeps the dependency line current so downstream stores can take one coherent update.

Full Changelog: JasperFx/weasel@V9.23.1...V9.23.2

9.23.1

What's Changed

Full Changelog: JasperFx/weasel@V9.23.0...V9.23.1

9.23.0

Two concurrency/correctness fixes, plus the JasperFx 2.37.0 floor that was staged in 9.22.0 but never shipped — so 9.23.0 carries all three.

SqlServerMigrator.EnsureDatabaseExistsAsync is safe under concurrent callers (#​415)

The check-then-create against master left the loser of the race holding SqlException 1801 — "Database 'x' already exists", and the method returned before the newly created database would accept logins. Neither mattered while a single process bootstrapped a single database at startup; both matter as soon as parallel test workers each provision their own database against a cold container.

  • 1801 is caught and treated as success. IF DB_ID(...) IS NULL CREATE DATABASE narrows the window but SQL Server does not make that pair atomic, so the catch is what closes it.
  • The method now waits until the database actually accepts a connection — unconditionally, since a concurrent creator leaves the same window open. When it returns, the database exists and is reachable.
  • The wait is bounded and expires loudly with a TimeoutException naming the database, and is configurable via DatabaseAvailabilityTimeout (default 30s) and DatabaseAvailabilityPollingInterval (default 1s). TimeSpan.Zero fails fast.
  • ] in a database name is escaped.
  • PostgresqlMigrator.EnsureDatabaseExistsAsync got the matching 42P04 duplicate_database catch. It needs no availability wait — Postgres accepts connections to a new database as soon as CREATE DATABASE returns.

This promotes logic that already existed in SqlServerDatabaseBootstrap in the EF Core test project into the shipped assembly; that helper now delegates.

AssertValidIdentifier rejects " and ; (#​416)

Closes out the identifier half of #​416, whose literal-escaping half shipped in 9.21.1. PostgresqlMigrator.AssertValidIdentifier is the only identifier check in the stack — DbObjectName and PostgresqlObjectName do no validation — yet it permitted the two characters that let an object name escape the statement it is written into: " closes a quoted identifier, and ; starts a new statement. It also now rejects all whitespace rather than just the literal space, so a newline cannot introduce a -- comment.

PostgresqlIdentifierInvalidException gained a constructor that names the rule that was broken; the existing one is untouched. DbObjectName and PostgresqlObjectName are now documented as not being sanitizing boundaries.

Dependencies

  • JasperFx floor raised to 2.37.0 (#​417).

Full changelog: JasperFx/weasel@V9.21.0...V9.23.0

9.21.0

What's Changed

Full Changelog: JasperFx/weasel@V9.20.0...V9.21.0

9.20.0

What's Changed

Full Changelog: JasperFx/weasel@V9.19.1...V9.20.0

9.19.1

What's Changed

Full Changelog: JasperFx/weasel@9.18.0...V9.19.1

9.18.0

EF Core migration generation (epic #​371)

Weasel can now generate standard EF Core migration files from its own schema model — the reverse of the existing EF → Weasel mapping. Any IDatabase (Marten system tables, Wolverine envelope storage, Polecat event storage, EF-projection tables) can emit compilable, attribute-only migrations that teams apply with dotnet ef database update, idempotent scripts, or bundles. See the new Migration Generation and Mixed EF + Critter Stack Apps docs.

  • Translation layer (#​375): Weasel schema objects → EF MigrationOperation lists with raw store types throughout; identity/computed/index/FK provider mapping; raw-SQL fallback for everything EF can't model (partitioned tables, functions, sprocs)
  • C# emitter + stub DbContext (#​381): attribute-only migration files with real Up()/Down() bodies (no BuildTargetModel — verified first-class by the #​364 spike on EF 9 + EF 10); stub context with the __EFMigrationsHistory table relocated into the critter-stack schema and a design-time factory for the EF CLI
  • Incremental migrations (#​377): a serialized JSON schema snapshot (Weasel's design-time analog of EF's ModelSnapshot) with an in-memory differ — no live database needed — plus a live-database baseline mode that wraps Weasel's own migration SQL in Sql() operations
  • db-ef-migration CLI (#​378): add <Name> (first-run scaffold + incremental adds), script (canonical EF-toolchain guidance), and baseline (adopt a pre-existing database by recording history rows without executing)
  • Inverted validation harness (#​379): generated migrations are Roslyn-compiled and applied through the real EF runtime in CI, then must match a Weasel-created schema catalog-for-catalog with a zero Weasel delta
  • Documentation (#​380)

Computed / generated columns (#​373, closes #​363)

PostgreSQL GENERATED ALWAYS AS (...) STORED and SQL Server AS (...) [PERSISTED] columns now round-trip fully: fluent GeneratedAs/ComputedAs builders, catalog introspection in FetchExisting, and delta detection with canonicalized expression comparison. Changed definitions migrate via lossless drop + re-add; computed columns unknown to the model are left alone.

ManagedTenantPartitions parity with ManagedListPartitions (#​374, closes #​362)

SQL Server managed tenant partitioning closes its gaps against the PostgreSQL feature set ahead of the Wolverine conjoined-tenancy epic:

  • TenantDropBehavior.DeleteData — physically remove a tenant's rows before MERGE RANGE (hard-delete parity)
  • Tenant bucketing: AllowOrdinalSharing + explicit-ordinal registration so many tenants can share one partition (the 15,000-partition-ceiling mitigation); shared ordinals are only merged/purged when their last tenant leaves
  • MigrateAllTablesAsync back-fill for tables joining an existing managed set
  • Batch adds return per-table TablePartitionStatus[] with per-table failure isolation

Also in this release (staged as 9.17.0, previously unreleased)

  • EF Core mapping sweep (#​361): dual-schema comparison harness + fixes for casing, indexes, defaults, identity, delete behaviors, and SQL Server includes; new ci-build-efcore.yml
  • EF Core follow-up round (#​372): sequences (HiLo), check constraints, computed-column emission, index methods (HasMethod("gin")), opt-in column drift detection, Oracle casing parity, MySQL EF CI

Full Changelog: JasperFx/weasel@9.16.4...9.18.0

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the dotnet-production group with 3 updates
00cbe06 
Bumps Marten from 9.21.0 to 9.22.4
Bumps Npgsql from 9.0.4 to 10.0.3
Bumps Weasel.Storage from 9.17.0 to 9.23.2

---
updated-dependencies:
- dependency-name: Marten
  dependency-version: 9.22.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-production
- dependency-name: Npgsql
  dependency-version: 10.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dotnet-production
- dependency-name: Weasel.Storage
  dependency-version: 9.23.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dotnet-production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Aug 6, 2026
@dependabot
dependabot Bot requested a review from meetdhruva as a code owner August 6, 2026 03:17
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code labels Aug 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@meetdhruva meetdhruva Awaiting requested review from meetdhruva meetdhruva is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants