[dependabot]

Updated FluentValidation from 12.1.1 to 12.2.0.

Release notes

Sourced from FluentValidation's releases.

12.2.0

Release notes

Please read the upgrade guide if you are moving from 11.x to 12.x

Changes in 12.2.0

• Add Lithuanian language (#​2350)
• Add Belarusian language (#​2356)
• Add GetParentChain() to PropertyChain (#​2358)
• Fix ArgumentNullException in TestValidationResult when a failure has a null PropertyName (#​2362)
• Reject an inverted range when the comparer returns a negative other than -1 in RangeValidator (#​2370)
• Change EnumValidator to work under native AOT (#​2371)
• Fix PropertyChain.IsChildChainOf for sibling chains that share a name prefix (#​2372)
• Fix PropertyPath is incorrect in .When() on RuleForEach (#​2363)

Changes in 12.1.0

• Add Tamil language (#​2334)
• Add Telugu language (#​2333)
• Fixes to Japanese translations (#​2340)

Changes in 12.0.0

• Drops support for netstandard2.0, netstandard2.1, .net 5, .net 6 and .net 7. Minimum supported platform is now .net 8.
• Add support for dependent rules for custom rules (#​2170)
• Removes deprecated DI extensions
• Removes deprecated transform methods (#​2027)
• Remove the ability to disable the root-model null check (#​2069)
• Use Zomp.SyncMethodGenerator to clean up internal sync/async code paths and increase performance (#​2136)
• Add Serbian (Cyrillic) language; rename existing Serbian to Serbian (Latin) (#​2283)

Downloads

Binaries can be downloaded from nuget:

• FluentValidation - Main package

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 10.0.12 to 10.0.13.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.OpenApi from 10.0.12 to 10.0.13.

Release notes

Sourced from Microsoft.AspNetCore.OpenApi's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.ApiDescription.Server from 10.0.12 to 10.0.13.

Release notes

Sourced from Microsoft.Extensions.ApiDescription.Server's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.11.0

What's Changed

• Fix TRX logger mangling astral-plane (non-BMP) characters by @​azat-msft in Fix TRX logger mangling astral-plane (non-BMP) characters microsoft/vstest#16318
• Disable the MTP testhost by default by @​nohwnd in Disable the MTP testhost by default microsoft/vstest#16337
• Fix OS-blind apphost probe in MTP bridge on Unix (regression from #​16201) by @​azat-msft in Fix OS-blind apphost probe in MTP bridge on Unix (regression from #16201) microsoft/vstest#16336
• Retarget the MTP client onto Microsoft.Testing.Platform.ServerMode.Client.Sources by @​nohwnd in Retarget the MTP client onto Microsoft.Testing.Platform.ServerMode.Client.Sources microsoft/vstest#16300
• Pass arguments to PowerShell with -File instead of -command by @​nohwnd in Pass arguments to PowerShell with -File instead of -command microsoft/vstest#16363
• Respect console logger verbosity from a settings file by @​nohwnd in Respect console logger verbosity from a settings file microsoft/vstest#16044
• Fix backslash normalization in VSTestCLIRunSettings on Unix by @​nohwnd in [fix] Fix backslash normalization in VSTestCLIRunSettings on Unix microsoft/vstest#15795
• Docs: fix typo explicitely -> explicitly by @​vaibhav8a in docs: fix typo explicitely -> explicitly microsoft/vstest#16397
• Copy acceptance test diagnostic logs into the test results directory by @​nohwnd in Copy acceptance test diagnostic logs into the test results directory microsoft/vstest#16403

New Contributors

• @​vaibhav8a made their first contribution in docs: fix typo explicitely -> explicitly microsoft/vstest#16397

Full Changelog: microsoft/vstest@v18.10.1...v18.11.0

Commits viewable in compare view.

Updated microsoft.openapi.kiota from 1.35.0 to 1.36.1.

Release notes

Sourced from microsoft.openapi.kiota's releases.

1.36.1

Added

Changed

• Fixed small issues with release pipelines

1.36.0

Added

• Ruby: an error's message returns the property the description marks with x-ms-primary-error-message, as the other languages do. An error property named message is renamed message_escaped, like MessageEscaped in C#; when it is a string, message still returns it. kiota-ruby#​63

Changed

• Fixed relative description paths when opening or selecting clients in the VS Code Kiota workspace.

• Removed the retired lock-search command from the VS Code command palette. Lock-file migration remains available.

• Preserve inherited properties when a single oneOf or anyOf member defines its properties only through allOf. Fixes #​6778.

• Python: preserve false, zero, empty strings, and empty collections when parsing and serializing union type wrappers.

• All language refiners accept a generation logger consistently, retaining configuration-only compatibility constructors hidden from IntelliSense.

• Reject plugin-manifest file references whose path components become parent-directory traversal after Windows trims trailing spaces or dots.

• Fixed a stack overflow when generating API plugins from descriptions with cyclic allOf schemas.

• Dart: omit unsupported schema defaults with a generation warning, preserve supported literal and enum property and parameter defaults (including empty strings), initialize query parameters from schema defaults, and keep constructor initialization valid with or without backing stores.

• Dart: preserve nullable optional request-builder constructor parameters, including UUIDs and collections, so cloning accepts null arguments without overwriting existing path parameters.

• Dart: escape URL templates once at final emission to preserve literal dollar signs and backslashes in constructor defaults and method overrides.

• Dart: preserve schema string defaults named null, including enum wire values, without treating them as JSON-null sentinels.

• Dart: preserve query-parameter defaults inside single-member allOf wrappers, retaining outer-default precedence and explicit JSON-null defaults.

• Dart: validate parser-backed date, time, and UUID defaults before emission, omitting unsupported values with a generation warning.

• Ruby: a union of object types that no discriminator decides, such as a oneOf without a discriminator, now reads the payload into every object member, as TypeScript does, instead of returning an empty wrapper. A union whose discriminator matched no member does the same, and its array member is only read when no other member was picked. Requires the runtime gems at 0.24.0.

• Ruby: enum members hold their wire value, so a value such as incoming-payment or read is sent and read as the description declares it instead of as IncomingPayment or Read. Enum[:Name] now returns the wire value as a string. Requires the runtime gems at 0.24.0.

• Go: keep escaped namespace segments lowercase so imports match generated package directories on case-sensitive filesystems. Fixes #​7828.

• TypeScript: import response enum objects for request builders reached through path parameters. #​6884

• Resolve enum query parameters wrapped in single-member allOf schemas, including enum array items.

• Go: cast scalar enum values in union factories and avoid reading an empty discriminator name for undiscriminated unions. Addresses #​7808.

• Preserve models for multipart properties with default content types when other properties specify an encoding. #​7342

• Dart: escape enum options named value or values to avoid conflicts with generated and built-in enum members. #​7807

• Ruby: the client's root module has an eager_load! method that loads every autoloaded model, for servers that preload before forking.

• Ruby: generated files start with # frozen_string_literal: true, so string default values handed to user code are frozen.

• Ruby: generated string literals are double quoted, the StandardRB convention.

• Ruby: namespaces with nothing to autoload no longer get an empty barrel file, and generated files no longer require them (561 fewer files in a GitHub client).

• Ruby: a client generated with a multi-segment --namespace-name, such as integration_test.client, failed to load because its root file was written one directory too deep.

• Ruby: namespace barrels register their models and enums with autoload instead of requiring them, so a subclass no longer fails to load when its base class file is required first. Other files require the barrel rather than an individual model file, and models now load on first use. A type no barrel autoloads, such as a model named after its namespace, is now required directly: 1,315 constants referenced by a Meraki client never loaded, and a client generated from the current GitHub description failed to load because it required a file that is never written. #​7956

• Ruby: model properties are declared with attr_accessor, which removes the thousands of "possibly useless use of a variable" warnings ruby -w printed while loading a client.

• Ruby: enum hashes are frozen. kiota-ruby#​68

• C#: escape Unicode line and paragraph separators in generated string literals so generated clients remain valid C# source.

• External reference allowlist wildcards no longer cross the URI authority boundary, so a wildcard in the scheme or host cannot match text in the path, the user information or the port.

• Initialize inherited Dart model fields in constructor initializer lists.

• Replace only unresolved binary types with a native stream type, and translate a resolved model by its definition rather than its name, so a model whose schema is named binary, base64 or base64url keeps its own name across every language instead of being rendered as the native binary type. Generation no longer fails for C# and Java.

• Avoid redundant parsing branches for equivalent binary alternatives in Dart and PHP composed models.

• Preserve imports for distinct types from the same namespace when inlining error model inheritance.

• Dart: qualify model fields named node or deserializerMap during deserialization so local variables do not shadow them; escape override model members to preserve Dart annotations. Fixes #​7822.

• PHP: disambiguate enum constants that normalize to the same name while preserving wire values and existing constant names.

• Java: omit unused discriminator-mapping imports for union/intersection wrappers, avoiding imports of nonexistent models while retaining member and inherited-factory imports.

• Dart: omit unused discriminator-mapping imports for composed wrappers while preserving member and inherited-factory imports. Addresses #​7821.

• Preserve endpoints whose static path segments collide after name sanitization, such as /v1.1 and /v11. #​7143

• Ruby: a path with an escaped suffix, such as /domains/{domainName}!quote, generated a request builder method that passed the raw path parameter name where the signature had snake cased it, and referenced the builder class without its namespace. Both raised NameError on first use. #​7956
  ... (truncated)

Commits viewable in compare view.

Updated WolverineFx.Http from 6.41.0 to 6.51.1.

Release notes

Sourced from WolverineFx.Http's releases.

6.51.1

Bug fix release, and some doc updates too

What's Changed

• GH-5070 A new leader keeps its own persisted leader row after a crash takeover by @​jeremydmiller in GH-5070 A new leader keeps its own persisted leader row after a crash takeover JasperFx/wolverine#5071
• Leadership-election compliance on Bobcat, with agent-assignment telemetry on failure by @​jeremydmiller in Leadership-election compliance on Bobcat, with agent-assignment telemetry on failure JasperFx/wolverine#5074
• Bobcat 1.0.0-rc.1 by @​jeremydmiller in Bobcat 1.0.0-rc.1 JasperFx/wolverine#5079
• GH-5080 CloudEvents carries lower case Envelope.Headers as extension attributes by @​jeremydmiller in GH-5080 CloudEvents carries lower case Envelope.Headers as extension attributes JasperFx/wolverine#5084
• GH-5085 Serverless docs: reword the 15 DRAFT comments into the page by @​jeremydmiller in GH-5085 Serverless docs: reword the 15 DRAFT comments into the page JasperFx/wolverine#5086
• GH-5073 Atomic, deadlock-free inbox recovery claims on every store (supersedes #​5075) by @​jeremydmiller in GH-5073 Atomic, deadlock-free inbox recovery claims on every store (supersedes #5075) JasperFx/wolverine#5081

Full Changelog: JasperFx/wolverine@V6.51.0...v6.51.1

6.51.0

Everything since 6.50.1.

Highlights

• Warm-up nodes for blue/green deployments (#​4569, #​5024). Set opts.Durability.NodeRole = NodeRole.Warmup and a node joins the serving cluster but does none of the serving nodes' messaging. Its only job is to run the new release's projection shards in Rebuild mode, so the new projection versions are caught up before you cut over. The role is opt-in; the default is NodeRole.Serving, and no schema change is needed. Docs: Marten · Polecat
• DurabilityMode.ServerlessWithOutbox (#​5016, #​5044). The lean Serverless runtime, but with the transactional outbox kept:
  • Outgoing messages are persisted with the handler's transaction.
  • They are sent inline before the request completes.
  • Anything that couldn't be sent is recovered by a durability pass.
  • Follow-ups are in #​5058 (#​5046–#​5057), #​5060 (#​5059) and #​5065 (#​5038).
  • Docs: Serverless with the Transactional Outbox
• Wolverine.HTTP JSON options (#​5042, #​5064). HTTP handlers mapped directly now use ASP.NET Core's JsonOptions without needing MapWolverineEndpoints(). Two new properties, HttpChain.JsonSerializerOptions and HttpHandler.JsonSerializerOptions, give a single endpoint its own JSON options.
• Failure log level (#​5043, #​5064). Set it with chain.FailureLogLevel, opts.Policies.MessageFailureLogLevel(...) or [WolverineLogging(FailureLogLevel = ...)]. The default is still Error.

Durability fixes

• Durable database queue pops (#​5015, #​5020 by @​jcd1991, #​5021). A failed or lost pop no longer strands envelopes on a live node, on PostgreSQL, SQL Server, MySQL and Oracle. Thanks to @​dbelinsky-accureference for the report.
• InboxStaleTime (#​5022, #​5025, #​5039):
  • Its clock now measures the time since a node claimed the message, not since the message was first written.
  • It leaves scheduled rows alone.
  • A node keeps the clock running for the messages it still holds, so a long handler is no longer started a second time.
• Projection daemon self-healing (#​4986 by @​erdtsieck). A shard the daemon paused on a transient failure, such as connection pool exhaustion, is restarted with a capped backoff instead of staying paused until the pods restart.
• Serverless startup with RavenDB (#​5030, #​5041 by @​jcd1991). Plain Serverless mode no longer fails at startup with RavenDB persistence.
• Messages replayed on every restart (#​5040, #​5045, #​5062). A handled message is now marked handled in the store that holds its inbox row. This affected two setups:
  • a durable PostgreSQL queue with a DbContext enrolled in an ancillary store
  • Fisher or Polecat with an AddMessageHandler handler committing an ancillary session
• PostgreSQL transport schema (#​5062). The transport takes its storage schema from the store it is bound to, not from the last PostgreSQL store registered.
• More #​5038 follow-ups (#​5065):
  • Outside ServerlessWithOutbox, a failed inline send is retried by the destination's sending agent.
  • RavenDB and Cosmos DB take one durability pass lock per database or container.
  • EF Core and RavenDB write the same outgoing owner id as the other stores.
  • Plain Serverless warns about durable endpoints downgraded after startup.

Dependencies

• 6.50.2 (#​5018): Weasel 9.45.1, Polecat 5.40.2 and Marten 9.50.2, for the System.Security.Cryptography.Pkcs advisory GHSA-846f-f764-76mx.
• 6.51.0 (#​5063): JasperFx 2.90.1, Marten 9.50.3, Polecat 5.42.0 and Fisher 1.21.1.

6.50.2

A dependency patch release. No configuration or code changes needed.

Dependencies

This moves Wolverine onto the Critter Stack releases that fix CVE-2026-84008 / GHSA-846f-f764-76mx (System.Security.Cryptography.Pkcs, high-severity denial of service) (#​5018):

• Weasel 9.45.1: Weasel.SqlServer and Weasel.Oracle now reference the patched Pkcs directly.
• Polecat 5.40.2 (up from 5.38.0): Polecat now references the patched Pkcs directly. This also brings in Polecat 5.39 and 5.40.
• Marten 9.50.2 (up from 9.49.0) for Marten, Marten.AspNetCore and Marten.Newtonsoft. Marten was never affected by the advisory.

Wolverine 6.50.1 already pinned the patched Pkcs in WolverineFx.SqlServer, WolverineFx.Oracle and WolverineFx.ClaimCheck.SqlServer, so applications on 6.50.1 were already protected. Those pins stay, because Wolverine references Microsoft.Data.SqlClient and Oracle.ManagedDataAccess.Core directly. 6.50.2 means the upstream libraries carry the fix too, so a NuGet audit comes back clean whichever of them your application references directly.

6.50.1

Patch release with a memory-leak fix and two security dependency updates.

Fixes

• WolverineRuntime now disposes its Meter (#​5012, #​5013). The runtime's System.Diagnostics.Metrics.Meter used to stay in the process-wide static Meter registry after the host was disposed. The durable persistence gauges on it hold callbacks back into the runtime, so every disposed host stayed reachable for the life of the process. Test suites that build many WebApplicationFactory or Host instances with durable persistence saw the heap grow without bound. Thanks to @​AndriiKononenko3 for the detailed report and the retention path.

Security dependency updates

• CVE-2026-84008 / GHSA-846f-f764-76mx (System.Security.Cryptography.Pkcs, high-severity denial of service). The package arrived transitively at vulnerable versions through Microsoft.Data.SqlClient, Oracle.ManagedDataAccess.Core and Polecat. WolverineFx.SqlServer, WolverineFx.Oracle and WolverineFx.ClaimCheck.SqlServer now reference the patched version directly: 9.0.21 on net9.0 and 10.0.13 on net10.0. Every package built on them, including WolverineFx.Polecat and WolverineFx.Http.Polecat, picks up the fix.
• CVE-2026-70159 / GHSA-334f-vvp4-7g6p (Microsoft.AspNetCore.SignalR.Common, high-severity denial of service). WolverineFx.SignalR now depends on Microsoft.AspNetCore.SignalR.Client 9.0.21 on net9.0 and 10.0.13 on net10.0, up from 9.0.8.

6.50.0

Wolverine 6.50.0 is a feature release. The headline is a new way to send a message to every node in your cluster. Just as much of this release came from the community, though: five community pull requests landed, and several issue reports led straight to fixes.

The two Bobcat packages, WolverineFx.Bobcat and WolverineFx.Bobcat.Http, ship as 6.50.0-alpha.1 and are still pre-release.

Broadcast a message to every node in the cluster

• BroadcastToAllNodesAsync() (#​4993, closes #​4988). Wolverine's normal delivery is competing consumers, where exactly one node handles a message. Sometimes you want every node to hear about something instead: a cache to invalidate, a configuration change to pick up, some node-local state to reset. Now you can just do this:

  await bus.BroadcastToAllNodesAsync(new InvalidateCache("products"));

  Every running node, including the one that sent it, handles the message exactly once with its own handler. The sending node gets the message on the local routes its type already has, or on local://default, and it's never forwarded to the external routes PublishAsync() would use. Every other node gets a copy on its node control endpoint, which is the broker control queue if you've configured one and the database control queue otherwise. Nodes that have gone stale are skipped, using the same rule the leader applies before ejecting a node. A broadcast from inside a handler goes through the outbox like any other outgoing message, and correlation ids are stamped as usual. In Solo and Serverless durability modes the message is delivered to this node only, and MediatorOnly refuses it just like PublishAsync(). It's an extension method on IMessageBus, so no other IMessageBus implementation breaks, and TestMessageContext records broadcasts in a new BroadcastToAllNodes list for your unit tests. See the new Broadcast Messages to Every Node guide.

From the community

A big thank you to everyone who sent pull requests and reports for this release:

• @​jcd1991 contributed two PostgreSQL transport features:

  • Opt-in LISTEN/NOTIFY wakeups for PostgreSQL queues (#​4998, closes #​3480). With EnableQueueNotifications(), an idle queue listener is woken as soon as a message is written instead of waiting out its polling interval. In local benchmarks the median delivery time on an idle queue dropped from about 650ms to under 3ms. It's off by default because it holds one extra, long-lived database connection per database per running process. Read the trade-offs in the new Queue Notifications with LISTEN/NOTIFY section before you turn it on.
  • FIFO ordering for sharded PostgreSQL queue batches (#​4970, closes #​4862, reported by @​alexandrefresnais). Messages for one group id that went through a PostgreSQL shard queue could run out of order. EnableDeterministicQueueOrdering() now preserves their order, and it was followed up for SQL Server, MySQL, Oracle and SQLite in #​4987.

• @​jcd1991 also fixed Wolverine.HTTP treating a container-registered service as the JSON request body on POST and PUT endpoints (#​5010, closes #​3863, reported by @​erdtsieck). The same parameter on a GET endpoint was correctly injected, but on a POST or PUT every call failed with a 500. An explicitly registered, non-keyed concrete type is now resolved from the container on every endpoint. This is a behavior change: if you register a type in the container and post it as a request body without [FromBody], add [FromBody] to keep binding it from the request.

• @​erdtsieck found and fixed a ping-pong in agent assignment during blue/green warm-ups (#​5000, closes #​4999). Projection partitions that could only run on the previous version's nodes moved between those nodes on every evaluation, which showed up in production as 1,000 to 3,000 ReassignAgent commands a minute. A partition that fits nowhere now stays where it is unless another node is strictly lighter. The follow-up in #​5001 makes it settle in one move.

• @​PascalEschbach contributed a big round of NATS follow-ups (#​4976, closes #​4973), with tests for every change:

  • one schedule subject per message, with listeners that skip schedule control messages;
  • resources setup provisioning declared streams once per connection;
  • per-tenant connection configuration, tenant subject mappers, and a new TrustTenantIdHeader setting;
  • safer dead letter forwarding that only terminates the original after a confirmed forward;
  • a deadline on every JetStream publish;
  • named consumers for dotted subjects;
  • NATS logging through the host's ILoggerFactory;
  • a health check that reports a failed listener start.

  #​4985 followed up on the core side.

• @​Maflend reported that the static handler registry ignored custom discovery rules once conventional discovery was disabled (#​4984), a regression since 6.44.0. It's fixed in #​4992.

• @​uniquelau's report in marten#​5652 led to #​5011, below: the leader no longer builds every event store's full usage descriptor on every heartbeat.

Agents and event subscriptions

• The leader's heartbeat no longer builds the full event store descriptor (#​5011, closes #​5002). Assigning event subscription agents only needs each store's async shard names and its database topology. Wolverine now reads those through JasperFx 2.87.1's IEventStore.RegisteredShardNames() and the new IEventStore.TryDescribeDatabasesAsync(), instead of a full TryCreateUsage() that also read the highest event sequence and described every projection, subscription and event type, for every store, every 10 seconds. To get the full saving, also take Marten 9.50.1, Polecat 5.40.1 or Fisher 1.20.2, which answer TryDescribeDatabasesAsync() straight from their tenancy.
• A projection rebuild always hands its shard back to continuous execution (#​5008, closes #​5003). A rebuild that threw used to leave the shard stopped, for good if it had already paused on a transient failure. The registered-projection rebuild path that CritterWatch uses never resumed the shard at all. Both paths now resume it whether the rebuild succeeded or failed. The health-check sweep also leaves a shard alone while its projection is being rebuilt, using JasperFx's new IProjectionDaemon.IsRebuilding(), so it can no longer start a second copy of the shard on top of a running rebuild.

Transports and persistence

• SQL Server queue tables can switch between the default layout and OptimizeQueueThroughput() (#​4991, closes #​4989).
• EnableDeterministicQueueOrdering() for SQL Server, MySQL, Oracle and SQLite (#​4987).

HTTP

• Wolverine.Http binds single-Value strong-typed id wrappers, such as record struct OrderId(Guid Value), without a TryParse (#​4995, closes #​4978).
  ... (truncated)

6.49.0

Wolverine 6.49.0 is a feature release. The big themes are optimized envelope ids for SQL Server, additive per-message topic routing across NATS, RabbitMQ and MQTT, a long list of NATS hardening, and a big round of Event Modeling and Bobcat work. Thank you to @​knotekbr, @​me-azlam-kp, @​faustodc, @​luisarellano09 and @​alesdvorakcz, whose reports, tests and pull requests are all over this one.

The two Bobcat packages, WolverineFx.Bobcat and WolverineFx.Bobcat.Http, ship as 6.49.0-alpha.3 and are still pre-release.

SQL Server

• Optimized envelope ids for SQL Server, automatically (#​4967, closes #​4902, analysis and measurements by @​alesdvorakcz). Wolverine's default envelope ids sort in time order the way .NET and PostgreSQL compare GUIDs, but SQL Server compares a uniqueidentifier starting from its last six bytes, so to SQL Server those ids arrive in random order and fragment the clustered inbox, outbox and dead letter tables. One production inbox was measured at 99% fragmented with its pages half full. The new EnvelopeIdGeneration.NewIdSqlServerOrder uses the same NewId algorithm with the timestamp where SQL Server sorts on it. Wolverine now switches to it on its own at startup when every message store in the application is SQL Server -- plain SQL Server persistence, the SQL Server transport, EF Core on SQL Server, or Polecat -- and you haven't set EnvelopeIdGeneration yourself. There's no schema change. If a SQL Server-only application sends messages to Wolverine services that store their envelopes in PostgreSQL, opt out, because the receiving service uses the same id as its inbox key and PostgreSQL indexes these ids worse than random GUIDs. Either set opts.EnvelopeIdGeneration = EnvelopeIdGeneration.NewId or use the new optimizeEnvelopeIdsForSqlServer: false overloads of PersistMessagesWithSqlServer(), UseSqlServerPersistenceAndTransport() and Polecat's IntegrateWithWolverine(). Behind it, IMessageStore gains a PreferredEnvelopeIdGeneration member with a default implementation, so existing stores are unaffected.

Routing

• Publish to a broker topic and to a local queue at the same time (#​4960 and #​4966, superseding #​4930 from @​luisarellano09). A per-message topic rule -- PublishMessagesToNatsSubject<T>(), PublishMessagesToRabbitMqExchange<T>() or PublishMessagesToMqttTopic<T>() -- used to silently switch off an explicit PublishMessage<T>().ToLocalQueue() rule, local routing to a handler, and broker conventions for the same message type. Each of those now has an overload that takes additive: true, so the other routing rules still apply. The original overloads are unchanged. A custom IMessageRouteSource can opt into the same behavior through the new IPassThroughMessageRouteSource, and ExplainRoutingFor() labels such a source [additive, pass-through].
• MultipleHandlerBehavior.Separated for conventional routing on Amazon SQS, Azure Service Bus queues and GCP Pub/Sub (#​4948, #​4949, #​4951, closing #​4524, #​4525 and #​4526). Each handler type gets its own queue or subscription, on top of a small new hook for routing conventions.

NATS

• An inline endpoint throws a broker-refused publish to the caller (#​4958, closes #​4955). A JetStream publish the server refuses -- a stream full under DiscardPolicy.New, a failed Nats-Expected-* check, an oversized message -- used to be retried three times, logged as errors, and dropped, while SendAsync() returned as if it worked. Now it isn't retried, and SendAsync() throws the new SendRejectedException with the JetStream error inside. Other transports can throw SendRejectedException from their senders to get the same treatment.
• Resource setup creates a declared stream from its declaration (#​4957, closes #​4956). A missing stream that was declared with DefineStream() used to be created as a default work-queue stream, which then showed up as drift under Provisioning(Verify).
• Leftovers from the 6.47 JetStream hardening (#​4945, #​4860): the transport reuses a live connection across start retries; header values are sanitized of CR/LF; stream mirrors, sources and placement can be declared; and JetStream publish options are configurable through ConfigureJetStreamPublish.

HTTP

• A request body Kestrel refuses keeps Kestrel's status code (#​4934 by @​knotekbr, closes #​4933). A body over [RequestSizeLimit], for example, now answers 413 instead of a 500 saying the body could not be deserialized.
• An optional body sent chunked is no longer silently dropped (#​4936 by @​knotekbr, closes #​4935), followed by exact parity with Minimal API for optional bodies (#​4944) and Kestrel-backed tests for request bodies (#​4942), since TestServer and Kestrel don't agree on the details.

Persistence and durability

• Conjoined EF Core multi-tenancy with partition-per-tenant (#​4937, closes #​3531, #​3541 and #​3542). EF Core sagas support partition-per-tenant, there's a rebuild API for turning on PartitionPerTenant for a table that already exists, and EF Core, Marten and Polecat conjoined tenancy are tested together in one database. Along the way, this fixed a saga saved with a temporary EF Core key landing under a tenant id that was a random GUID.
• A handled message is never brought back to life by a late retry (#​4950, the main remaining work on #​4216). Every message store now leaves a handled inbox row alone when a retry is booked for it after the fact. Before, most stores turned it back into a scheduled message that would run a second time. RavenDB and CosmosDB also got an update-first reschedule and a fixed release query.
• CosmosDB under MessageIdentity.IdAndDestination (#​4969, closes #​4216). Running the shared message store tests under that identity found that it put slashes into Cosmos document ids, which Cosmos does not allow, so every update quietly missed its document. That's fixed, and CosmosDB and RavenDB both now run the whole contract under that identity.
• The database control listener stops without waiting out its poll delay (#​4952 by @​me-azlam-kp), which took up to five seconds off a quiet node's shutdown on the relational stores and CosmosDB.
• A composite listener keeps disposing its children after one fails (#​4953 by @​faustodc).
• Fixed the CosmosDB CI hang (#​4913) by moving to Microsoft.Azure.Cosmos 3.63.2 and pinning the emulator image.

Agents and leadership

• Leadership election and agent assignment follow-ups (#​4932). A database split across nodes is consolidated onto the node running most of it, and pins are respected. A dead node's queued starts are abandoned instead of stalling. There's a cold-start hold, and a new leadership eligibility setting. Both new DurabilitySettings have backward-compatible defaults.

Code generation

• Generated code no longer depends on what else the process planned first (#​4946, closes #​4877). The local variable a continuation frame declares used to be numbered from a process-wide static counter.

Event Modeling and Bobcat

• A new Event Modeling tutorial (#​4963, closes #​4918) walks the whole Critter Stack workflow in one place: declaring the model in code, importing a board with Bobcat, the generated specifications, and scaffolding.
• wolverine scaffold follows Bobcat's Features/{Chapter} layout (#​4959), gains --json output with stable notice codes (#​4947, closes #​4928), and has a round of output fixes: record views built with Create, the events that start a stream first, and long attributes on their own line (#​4929). Scaffolded HTTP endpoints are tested against Marten, Polecat and Fisher, and a stream start answers 201 with its id (#​4947, closes #​4927).
• The CritterCrush review (#​4924, closing 15 issues) covered the event-model scaffold, [Emits] inference, definition discovery, describe-event-model, and new WolverineFx.Bobcat assertions.
• Tracked sessions record the events each session appended (#​4943, closes #​4931, #​4865, #​4919 and #​4926), along with WolverineFx.Bobcat support for DCB tags, paragraphs and FetchLatest read models, and DCB and multi-stream scaffolding.
• Bobcat specifies a DCB decision's consistency boundary (#​4964, refs #​4940), checked deterministically.
• ThenEventuallyCaused checks the events an act caused past an async boundary (#​4965, closes #​4939). The new WolverineFx.Bobcat step finds them by correlation id once the async daemons catch up, and there's an opt-in correlation header for every HTTP endpoint.

6.48.3

A patch release for blue/green warm-ups at fleet scale, from a second production report by @​erdtsieck on 6.48.2: every green-only agent went to the first green node to register, and the two green nodes that joined seconds later got nothing for half an hour.

• A warm-up spreads over every green node that joins (#​4904, @​erdtsieck). Four causes, all in the leader: the pending-start ledger was re-applied over the whole grid before every family's pass, so the passes after the event-subscription family put each still-queued agent back on the first green node and the decision to move it never left the leader; a move of a start that was still only queued waited in the source node's lane behind that node's whole backlog, and now goes straight to the new node; the group-affinity fallback had no per-node ceiling; and a move of an agent whose first move had not landed could start it on a third node, so an outstanding move is now left alone until it lands.
• Three gaps in that new machinery, found by a randomized soak on real dispatcher lanes (#​4909). A start queued for a node that had since left no longer steals the claim of a newer start elsewhere; a queued re-drive of a start whose assignment row has not surfaced yet is no longer withdrawn by a later move as if it had never run; and a pending move that goes unconfirmed past the ledger's TTL during a long start — the field's own shape, 27-second starts against a 20-second TTL — is re-driven as the stop-then-start it was, never as a bare start that skips the stop at a source whose copy is still coming up.
• Fleet-scale simulated scenarios (#​4905, @​erdtsieck). A full blue/green deploy, a green node dying mid-wave, the leader dying mid-warm-up, starts failing against some databases, slow starts on every node, and blue pods that captured different tenant sets, replayed through the simulated cluster with real dispatcher lanes; a production-sized shape (512 databases, ~100,000 agents) is opt-in with WOLVERINE_FLEET_SCALE=production.
• A chain that only reads through IQuerySession but sends messages now gets its commit (#​4910, @​srimalw; #​4912 for Polecat and Fisher). The IQuerySession permutation of #​2941: the read-only parameter was served by casting the outbox-enrolled session, but CanApply ignored it, so a scheduled cascade was never handled and a durable local message only ever ran from memory. Reading alone still does not make a chain transactional; reading plus sending does — an injected IMessageBus, a returned OutgoingMessages, or a cascading return value.

Everything else is as in 6.48.2.

6.48.2

A patch release for agent assignment at fleet scale, from a production report by @​erdtsieck: ~62,000 per-tenant event-subscription agents on 5 to 8 nodes, where a newly elected leader spent 66 minutes in its first assignment evaluation during a blue/green warm-up and three leaders in a row were replaced before one finished.

• Matching agents to capable nodes goes through a hash set instead of a list scan (#​4886, @​erdtsieck). AssignmentGrid.MatchAgentsToCapableNodesFor was quadratic in the agent count whenever any capability differed between nodes — which a single bumped projection version is enough to trigger.
• The rest of that first evaluation is no longer quadratic either (#​4893). Four more scans of the same shape on the same path: batchCommands removing each start command from the list one at a time, the heartbeat Fill()-ing every running agent into the node record, per-placement Fill() on the grid's node, and per-placement recounts in both even distribution paths. Measured through the leader's real evaluation at the reported shape: the even blue/green path's first evaluation went from 76 s to under 5 s.
• A newly elected leader holds unplaced agents for one evaluation after a takeover (#​4899). The pending-assignment ledger is leader-local, so a leader replacing one that died with starts in flight could not see them and could start an agent a second time on another node. New DurabilitySettings.LeaderTakeoverHoldEvaluations (default 1, 0 disables) withholds bare first-time placements for that many evaluations after election, so the predecessor's starts can surface as assignment rows and be kept where they are. It stands down when no other node holds any assignment, so a cold start pays nothing.
• Lifecycle and soak coverage for assignment (#​4893, #​4896). A simulated cluster drives the leader's real evaluation through whole lifecycles — a full blue/green deploy, a leader replaced or killed mid-wave, scale-down, repeated scale-up/down — asserting no double start, no cross-fleet placement and bounded convergence at every step, plus an opt-in randomized soak (WOLVERINE_CHAOS_SOAK=<rounds>) that stays out of CI.

Everything else is as in 6.48.1.

6.48.1

A patch release for one global partitioning bug found by @​alexandrefresnais right after 6.48.0.

• A global partition slot's backlog now resumes on its new owner in the order it was sent (#​4863). When a slot moved, the losing node's un-executed companion backlog was released to the inbox (GH-4777) and recovered by the new owner (GH-4776), but the recovery enqueued it in the page query's arbitrary order, so messages sharing a group id ran out of sequence on the gaining node. Inbox recovery now accumulates a sweep's pages and hands them to the listener ordered by the envelope's sent time, with the id as tie-break. Provider-agnostic, no schema or query change.

Everything else is as in 6.48.0.

6.48.0

A fast follow-up to 6.47.0 with five fixes, three of them for how a Wolverine cluster behaves when nodes come and go.

Clustering and agent distribution

• A leader could silently lose the ability to command a peer after five quiet minutes (#​4868, #​4869). The idle sending-agent cleanup disposed the sender to a peer's control queue, and the cached message route kept handing requests to the disposed agent, where a completed block dropped them without a trace. Node agent commands (StartAgents, StopAgents, QueryAgentPresence) were logged as enqueued, never reached the broker, and timed out, so agents stopped on a scaled-in node were never re-placed. Routes now resolve their sending agent on every use. Reported from production on Azure Container Apps with Azure Service Bus control queues; the workaround there was a very long SendingAgentIdleTimeout.
• A global partition slot moved away from a node whose listener was paused by back pressure kept running on both nodes (#​4866, #​4872). The stop path returned early when the listener had already been taken down by back pressure, skipping the companion-queue drain from GH-4777 and leaving the status TooBusy, so the back pressure sweep later restarted the slot on a node that no longer owned it. Reported with a complete reproduction by @​alexandrefresnais.
• An operator's restart or pin now reports when the agent did not start (#​4871). ApplyRestrictionsAsync waits for the released or pinned agent to appear in the persisted node assignments and throws AgentRestrictionsNotConfirmedException naming it, instead of returning as if the agent had started. New DurabilitySettings.AgentRestrictionConfirmationTimeout (default 10 seconds) bounds the wait. This is what lets CritterWatch stop acknowledging a restart that started nothing.

RabbitMQ

• One listener failing to rebuild after a connection recovery no longer strands every listener behind it (#​4864, #​4867, by @​tannerwatson). Each agent is rebuilt independently, failures are retried on a bounded schedule, and channel teardown tolerates a channel the client already closed or disposed. Seen in production across a 3-node RabbitMQ cluster roll, where 15 of 47 pods were left with listeners at zero consumers while health checks stayed green.

Deduplication

• [Deduplicated] takes its own claim window (#​4857, #​4858, by @​uniquelau). [Deduplicated(WindowInSeconds = 600)] gives one handler a different claim lifetime from the host-wide DeduplicationWindow, matching what [DeduplicatedWithResponse] already offered for HTTP. Works across the RDBMS, Marten, Polecat and Fisher deduplicators; pre-generated code for handlers without a window is unchanged.

Thanks to @​alexandrefresnais, @​tannerwatson and @​uniquelau for the reports, reproductions and pull requests.

6.47.0

Wolverine 6.47.0 is a release that largely came from outside the core team. The biggest change in it, a hardening pass over the NATS JetStream transport, was reported, designed and written by a community member, and so was the fix for a global partitioning handoff that stranded scheduled messages. Thank you to everyone who sent code, reproductions, or diagnoses this time around.

Community contributions

• @​PascalEschbach reported eight distinct problems in the NATS transport on #​4845, three of them silent message losses, and then fixed every one of them in #​4856. The report alone was unusually good: each item came with the mechanism, not just the symptom, and the PR arrived with a test per item that fails without its fix. Details under NATS below.
• @​BlackChepo found and fixed the case where a scheduled message parked under a global partition slot was promoted by the node that had just given the slot up, which threw into a stopped listener and committed the rows under a live node so recovery never touched them again (#​4823, GH-4822).
• @​smoqmilus reported, reproduced and diagnosed two losses of a forwarded scheduled envelope (GH-4824), and is credited as a co-author on the fix (#​4830).
• @​chrisbbe added the Marten-backed Native AOT smoke lane (#​4826) that exposed three startup failures no native image in CI had ever reached, and is credited as co-author on the direct construction of the internal agent routers (#​4842).

NATS JetStream

Sending durably over JetStream, with an outbox in front of a stream, lost messages in several places without an error or a log line. All of them are closed (#​4856, with follow-ups in #​4859):

• A publish the server refuses now fails the send. NATS answers a refused publish (a full stream under DiscardPolicy.New, a failed Nats-Expected-* check, an oversized message) with a PubAck carrying an error, not an exception. Wolverine read only the sequence, reported success, and the durable outbox deleted a message the stream never stored. It throws now, the outbox keeps the message, and a duplicate Nats-Msg-Id is still a success.
• A message Wolverine moves to the error queue is dead-lettered on Wolverine's decision, not only once JetStream's MaxDeliver is used up. A buffered listener acknowledges on receipt, so under the old guard the message was simply gone. The dead letter copy carries its own Nats-Msg-Id, because the original's id had it discarded as a duplicate when the dead letter subject sat in the same stream.
• Sharded subject streams use work-queue retention. AsWorkQueue() has always meant interest retention, which drops a message published while no consumer is bound, which is exactly the startup and rebalancing window a sharded topology has. The streams UseShardedNatsSubjects() declares now keep a message until it is acknowledged. AsWorkQueue() itself is unchanged; its docs now say what it does.
• Dropped core NATS messages are logged. A full subscription channel silently dropped messages; the loss is now a warning, throttled per subscription.
• ConfigureNatsOpts() gives you the last word over the NATS.Net client options, for the pending channel size, ping interval and anything else Wolverine does not surface. It applies to the shared and every tenant connection.
• Listeners reconcile their named consumers on start, so changing AckWait or MaxDeliver in code just works. Provisioning(NatsProvisioning.CreateOnly | CreateOrUpdate | Verify) controls what startup does with declared streams and named consumers that already exist, with Verify failing the start and listing every deviation. Resource setup and the listener now write the same consumer settings, filter included, so a Verify host starts cleanly after resource setup.
• Resource setup honors the JetStream domain, so a leaf node no longer creates streams in its own JetStream instead of the configured domain. Only a 404 counts as "missing" anywhere Wolverine looks a stream or consumer up; any other failure propagates with its real message.
• InvokeAsync() fails at once when nobody is listening. A request now carries a per-request reply subject, so the server's "no responders" answer reaches the waiting call and it fails in milliseconds with WolverineRequestReplyException instead of waiting out its timeout. The responding side answers on that exact subject, which a NATS user limited to allow_responses requires.

Global partitioning and durability

An exploratory pass over global partitioning after the long chain of slot handoff fixes, looking for the next "runs on a node that does not own the slot" before it was reported (#​4853). It found two:

• A slot handoff releases the backlog that came through the shard queue. Every earlier regression fixture published from a node that owned the slot, so every inbox row carried the companion address. In a real cluster that is the minority path: a non-owner's message goes into the shard queue, and the owner's pop wrote the inbox row at the slot's address, which the handoff release did not cover. There is now a real multi-node Balanced fixture for this path.
• The shard queue bridge reports its depth, so the back pressure it applies is visible.

And around it:

• Scheduled messages parked under a slot are promoted on the node that owns it now, not the one that just gave it up (#​4823).
• A forwarded scheduled envelope is stored as outgoing before its inbox row is retired, which closes two losses: a poll by the owning node between the send and the delete, and a failed first send (#​4830).
• Ejecting a stale node, the step that releases every envelope the dead node owned, was the one link in crash recovery with no log line. It logs a warning now, and each sub-threshold stale observation on the way to it at debug (#​4854).
• A requeue from an external durable listener no longer double-counts Envelope.Attempts; a database or broker queue saw attempts go 1 then 3 (#​4855).

Native AOT

The 6.46.0 AOT work stopped at the first failure each publish cycle, because the smoke target did. That is fixed, and the lanes it now runs found the rest:

• Every Native AOT smoke lane runs and all the failures are reported together (#​4839). The literal explanation in the 6.46 bug reports was "each one appears once the previous one is worked around".
• Marten- and Polecat-backed native lanes (#​4826, #​4828). The first native image in CI to boot a store-backed HTTP application found three startup failures: SideEffectPolicy could not find Execute on IStartStream, the HTTP IEndpointMetadataProvider close was trimmed, and Marten could not map Envelope in a native image. All three are rooted or avoided now.
• The message routers are de-genericized (#​4849). A handler returning a value type, the ordinary InvokeAsync<Guid> request/reply shape, killed a native image at startup because the routing warm-up closed a generic over it reflectively. The routers take the message type as an argument now, so the one reflective close every message type had to be rooted for is gone, along with everything that existed to prop it up.
• The framework's own agent messages are constructed directly (#​4842). They are internal, so generated code could never name them in a rooting block, and an application with a durable message store trimmed exactly those instantiations.
• The side-effect roots match the test the policy actually applies, the HTTP rooting order is guarded, and a Balanced native lane runs in CI (#​4847).

Also in this release

• WolverineFx.InMemory is a new package that runs Wolverine over the JasperFx.Events.InMemory prototyping store, so a store-agnostic application's handlers run before anyone has chosen Marten, Polecat or Fisher. Only Wolverine's store-agnostic usage is supported (#​4844).

6.46.0

Wolverine 6.46.0 is the release where Native AOT stopped being aspirational. Ten of the changes below came out of one sustained hunt, and the pattern that emerged is worth stating plainly: under Native AOT, the fix is almost never to root a generic harder — it is to stop closing one.

Thank you to the people outside the core team who shipped code in this one. Five of the fixes here came from the community, and several of them are in corners the maintainers would not have found on their own.

Community contributions

• @​ayuksekkaya — two separate fixes, both from real usage. [FromClaim] code generation was broken for URI claim types (#​4783), and EF Core had three distinct problems in one report: [Entity] on a step method, query plans, and multi-tenant DbContext resolution (#​4769).
• @​alesdvorakcz — a handled inbox row now gives up its owner (#​4775, GH-4739). This is the kind of durability bug that only shows up under real load, and the fix is in the hot path.
• @​uniquelau — a fallback authorization policy now counts in the anonymous User-scope warning (#​4779), plus a documentation fix for something that bites every newcomer: the first-use handler compile counts against a tracked session's timeout (#​4786).
• @​erdtsieck — [Deduplicated] claims are kept in the main store when you run a database per tenant (#​4813). Every [Deduplicated] chain used to throw on its first keyed message in that configuration.

Native AOT

Sagas work under Native AOT now (#​4809). That took three separate blockers, and each one taught us a rule that is now written down:

• [DynamicDependency] preserves metadata, not code. An AOT root over a value-type instantiation is silently ineffective — no warning, no diagnostic, just a missing type at startup. The roots that appear to work survive through reference-type canonical sharing, which is why this went unnoticed for so long.
• A generic virtual method cannot be rooted at all. The fix is a factory supplied by generated code.
• A reflectively-closed frame needs a root only if a policy places it. A frame built during code generation is both unreachable in a native image and uncollectable by the hook — so half the places we thought needed attention never did.

Acting on those: a frame can now contribute its own AOT root (#​4801), the EF Core frames closed over your DbContext are rooted (#​4803), and the Marten, Polecat and Fisher FetchLatest frames were de-genericized rather than rooted (#​4793, #​4806). The HTTP and response-aware chain paths got the closed generics they need (#​4790), and an [UnconditionalSuppressMessage] scope that ILC rejects outright was fixed (#​4791).

Two things worth calling out for anyone running AOT in production:

• The partitioning and deduplication rules closed a generic over a value type at startup — grouping by a Guid tenant id, or a [DeduplicationIdentity] on a Guid, which needs no configuration at all. Both crashed the host at startup in a native image. Neither was reachable by any existing rooting mechanism, so both now avoid closing the generic at all.
• There is also an honest piece of bookkeeping in this release: an audit of all 284 trim/AOT suppressions in core and the relational stores found that 62 of the 89 that justify themselves with a reachability claim are wrong — the member does run in a native image. Most are safe anyway, for reasons unrelated to what they claim. The measurement is checked in, because the stated reason being wrong is exactly what kept this class of bug invisible.

Durability and clustered agents

A wave of fixes to inbox ownership and global partition slots, all of them cases where a message could stall rather than fail:

• A global partition's companion queue is now recovered on the slot's owner (#​4794) and drained when the slot moves (#​4795).
• The inbox release is held until in-flight handlers finish (#​4799), and a bounded drain that gives up on them now says so (#​4798).
• CosmosDB and RavenDB release the owner when they mark an inbox document handled (#​4792).
• Solo mode honors a paused agent restriction (#​4800).
• A message arriving over the HTTP transport used to be stored in the durable inbox under an address nothing was listening on, so a replayed dead letter — or the messages of a node that died mid-handler — were skipped on every durability pass, silently, forever (#​4814). The skip itself was unlogged, which is why it took a bug report; it logs now.
• MQTT could lose a persistent session's backlog outright. The broker starts flushing queued messages the moment the connection comes up, before Wolverine has registered its listeners, and there was no receive handler attached at all in the earliest part of that window — so MQTTnet acknowledged those messages and dropped them with no exception, no dead letter, and not even a log line. Worse, a resolution miss was cached, so one early message poisoned that topic for the life of the process.
• MQTT's broker-per-tenant sender was still fire-and-forget under a durable outbox: the send never threw, the outbox deleted its row believing it had succeeded, and a restart lost the message. Fixing it needed a new seam in core, because TenantedSender deliberately cannot forward an ISenderCallback — doing so broke fire-and-forget senders in a previous attempt. There is now a CallbackAwareTenantedSender for the senders that settle the outbox themselves, with the original left exactly as it was. Every broker-per-tenant transport can use it; only MQTT does so far.

Security and dependencies

• The vulnerable System.Formats.Asn1 7.0.0 is lifted, and the whole package graph is audited (#​4781, GH-4773).
• Roslyn pins are scoped to the TFMs that actually reference them (#​4780, GH-4768).
• Marten 9.46.0, with the JasperFx 2.80.2, Weasel 9.41.0 and Fisher 1.19.0 versions that move with it. Fisher advances deliberately: an added member on a JasperFx.Events interface breaks a store at runtime rather than at compile time, so leaving a store package behind is the actual hazard.

6.45.0

Wolverine 6.45.0 is mostly a community release. Seven people outside JasperFx shaped it, and the headline feature came in as a contributor's pull request with 17 tests already passing.

Idempotency keys that answer with the first response

6.44 could stop a POST running twice. It could not tell the second caller what the first one created.

[Deduplicated] refuses a repeat with a status code, which is the right answer when the client can go and fetch the resource. It is the wrong answer when the client is the one that lost the connection mid-request and has no idea what id it created. The docs said as much, and said replaying the original response was out of scope.

6.45 adds [DeduplicatedWithResponse], which stores the first response and replays it:

[DeduplicatedWithResponse(DeduplicationScope.User | DeduplicationScope.Endpoint)]
[WolverinePost("/orders")]
public static (OrderCreated, OrderPlaced) Post(PlaceOrder command) { ... }

A repeat under the same Idempotency-Key gets the original status — a 201 stays a 201 — along with the body and the Location header. The handler does not run again, and its cascaded messages are not sent again.

Three details worth knowing before you reach for it:

Scope is required, not optional. A claimed key used to be global across every endpoint, tenant and user. That was tolerable when a duplicate was merely refused; it is not tolerable when a stored response is replayed to whoever presents the key. So the attribute will not let you declare it without saying who a key belongs to, and refuses at startup if you try.

The request is compared by a hash of the bytes sent — method, path, query string and body. A repeat that differs gets 422 rather than being answered with a response that does not belong to it. The corollary: a retry has to resend the same bytes, so a client that re-serializes and reorders JSON properties will see a 422.

It is opt-in and provisions its own table. opts.Durability.EnableDeduplicatedResponses = true, a separate wolverine_deduplicated_responses table, and nothing changes for an application that does not ask for it. PostgreSQL, SQL Server, MySQL and SQLite, which covers Marten and EF Core applications. F# endpoints are supported — [Deduplicated] still does not support them.

Three more deduplication fixes landed alongside it. Two cases where a claim outlived a request that did no work: middleware ending the request early with a success code, and a caller hanging up while the request was failing — in the second, the release itself was being cancelled by the caller's own disconnect, so the key survived for the full window. Deduplication keys also now compare the same way on every engine; they previously followed the database's default collation, so Abc and abc were one claim on SQL Server and MySQL but two on PostgreSQL and SQLite.

Thank you

• @​uniquelau — [DeduplicatedWithResponse] itself, the two claim-leak fixes, the collation report, the EnableRelayOfUserName diagnosis, and a doc correction. Four pull requests and three issues in one release.
• @​lahma — found that an inline InvokeAsync retry discarded the failed attempt's outgoing messages, and fixed it.
• @​thechucklingatom — every application pointed at the same CosmosDB database joined one Wolverine cluster, so a durability agent could recover another application's envelopes into a node with no handler for them. Now each application can keep its own container.
• @​alesdvorakcz — reported, with Query Store evidence from a failed blue/green deploy, that ReleaseIncomingAsync scanned the whole inbox on SQL Server. Measured at 6,748 logical reads before and 3 after.
• @​faustodc — a deterministic reproduction of a message-loss window in the SQLite durable queue: the dequeue committed before the inbox row was written, so a crash mid-handler lost the message entirely.
• @​chrisbbe — a Native AOT crash with a stack trace precise enough to find four more frames with the same defect.
• @​jeremad — envelopes executed twice when a node started on a PostgreSQL queue backlog.

And from the core team, @​erdtsieck caught the worst regression in 6.44 — every durable-inbox message dead-lettered on partitioned Marten inboxes — and reported it with the exact SQL that QueueSqlCommand was rejecting, which is why it was fixed the same day.

Durability and reliability

• The partitioned mark-as-handled command was two statements joined by ;, which Marten's QueueSqlCommand rejects — so every durable-inbox message was dead-lettered. (#​4736)
• A Balanced node is registered before its transports start, so a node starting on a PostgreSQL queue backlog no longer executes envelopes twice. (#​4734)
• The SQLite durable dequeue now moves the queue row into the incoming-envelope table in the same transaction, closing a window where a message was in neither place while its handler ran. (#​4758)
• Ownership-release statements can use the owner index on SQL Server. A filtered index cannot serve a parameterized owner_id = @​owner, so these were clustered index scans; a blue/green deploy had been failing on the resulting command timeouts. (#​4739)
• Two more pieces of per-attempt state survived an inline retry: a flushed context swallowed the retry's messages, and a forwarded message could not be retried at all. (#​4743)
• A partially-initialized HttpChain could never serve a request again — a missed type lookup overwrote an already-resolved handler type with null. (#​4749)

Native AOT

... (truncated)

6.44.0

This release came overwhelmingly from outside the core team. Six people outside JasperFx reported or fixed
the work in it, including three who sent the pull request themselves, and one report that reconstructed a
production cluster failure in enough detail to find two defects nobody had suspected.

Thank you

@​alesdvorakcz (Aleš Dvořák)	Found and fixed the EF Core mark-as-handled identity bug (#​4703 / GH-4701) — a fanned-out message under MessageIdentity.IdAndDestination had every destination's inbox row retired by the first handler to commit, losing the copies whose handlers had not run, with no dead letter and no log. Also reported GH-4704.
@​ayuksekkaya (Ali Yuksekkaya)	Two OpenAPI accuracy PRs (#​4722, #​4724) and the t...

Description has been truncated