chore(deps): Bump the minor-and-patch group with 10 updates - #324
Open
dependabot[bot] wants to merge 1 commit into
Open
chore(deps): Bump the minor-and-patch group with 10 updates#324dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps Anthropic from 12.35.1 to 12.39.0 Bumps Marten from 9.15.4 to 9.21.0 Bumps Marten.EntityFrameworkCore from 9.15.4 to 9.21.0 Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.16.0 to 1.17.0 Bumps OpenTelemetry.Instrumentation.Http from 1.16.0 to 1.17.0 Bumps SonarAnalyzer.CSharp from 10.29.0.143774 to 10.31.0.145097 Bumps WolverineFx from 6.17.0 to 6.24.1 Bumps WolverineFx.EntityFrameworkCore from 6.17.0 to 6.24.1 Bumps WolverineFx.Marten from 6.17.0 to 6.24.1 Bumps WolverineFx.RuntimeCompilation from 6.17.0 to 6.24.1 --- updated-dependencies: - dependency-name: Anthropic dependency-version: 12.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Marten dependency-version: 9.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Marten.EntityFrameworkCore dependency-version: 9.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: OpenTelemetry.Instrumentation.AspNetCore dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: OpenTelemetry.Instrumentation.Http dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: SonarAnalyzer.CSharp dependency-version: 10.31.0.145097 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: WolverineFx dependency-version: 6.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: WolverineFx.EntityFrameworkCore dependency-version: 6.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: WolverineFx.Marten dependency-version: 6.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: WolverineFx.RuntimeCompilation dependency-version: 6.24.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
.NET
Dependency ReviewThe following issues were found:
Snapshot WarningsRe-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice. License Issuesbackend/src/RunCoach.Api/RunCoach.Api.csproj
backend/tests/RunCoach.Api.Tests/RunCoach.Api.Tests.csproj
OpenSSF ScorecardScorecard details
Scanned Files
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated Anthropic from 12.35.1 to 12.39.0.
Updated Marten from 9.15.4 to 9.21.0.
Release notes
Sourced from Marten's releases.
9.21.0
Highlights
A small, low-risk release: two bug fixes reported against 9.20.x, a LINQ ordering fix, a Newtonsoft serialization fix, and a new health-check overload for Wolverine-managed daemon distribution.
Bug Fixes
mt_quick_append_eventsreturned{NULL}for an empty event array (#5062, #5088)array_length('{}', 1)isNULLin PostgreSQL rather than0, so calling the bulk append function with no events returned abigint[]whose single element wasNULL. Npgsql could not read that intolong[], and the resultingInvalidCastExceptionwas thrown from the batch's post-processing loop — where it displaced whatever exception had actually made the append fail. Callers were left with an unrelated, non-retryable error instead of the real one; for the reporter that dead-lettered Wolverine messages which would otherwise have been retried.Fixed on three fronts:
COALESCEs the array length, so an empty append means what it says: zero events appended, final version unchanged.ProjectionUpdateBatch.WaitForCompletion, for anAppendside effect that ended up with no events) no longer issues the call.OrderByagainst a dictionary indexer dropped the key (#5063, #5073)OrderBy(x => x.SomeDictionary["key"])generated SQL that ignored the indexer key, so the ordering was wrong (or arbitrary) rather than failing loudly.Lazy LINQ sequences serialized as objects under Newtonsoft (#5076, #5080)
A document property holding a deferred-execution sequence (
Select(...),Where(...)without a materializing call) was written by Newtonsoft as an iterator object rather than a JSON array, so it would not round-trip. These are now written as plain arrays.IMessageBatchis called concurrently (#5065, #5085)Not a behavior change, but a documentation fix worth flagging if you implement
IMessageBatchyourself: the async daemon raises projection side effects from multiple threads at once (measured at up to 8 concurrent publishers across 10 threads for a single-stream projection catching up). The interface previously said nothing about this. An implementation that appends to an unsynchronized collection will silently drop messages — the same hazard, in a real outbox, that showed up here as a "flaky" test.New
Provider-aware
databaseFilterfor the high-water health check (#5061, #5089)AddMartenHighWaterHealthCheck'sdatabaseFilteris captured at registration time, so it cannot resolve services — which makes it unable to express "the databases this node currently owns" when ownership is runtime state. That is precisely the case under Wolverine-managed daemon distribution, where agents are assigned per (database, tenant) and rebalanced over a node's lifetime.There is now an overload whose filter receives the
IServiceProviderand is re-evaluated on every probe:It never calls
IProjectionDaemon.CatchUpAsync— doing so under a live coordinator is what produces theProgressionProgressOutOfOrderExceptionandpk_mt_event_progressionduplicate-key errors suites have been retrying around. Resuming the agents that already own the shards means there is only ever one writer.#3733 — a comma in an agent Uri voided a whole batch confirmation (#3736)
AgentsStarted,StartAgents,AgentsStoppedandStopAgentsjoined theirUri[]on a comma, which RFC 3986 permits unescaped in a path segment. Agent URIs embed tenant ids and projection names, so one comma shattered an agent into fragments — and because the read side built the array in a single projection, the resulting throw took out the confirmation for the entire batch. Newline is the delimiter now, and entries are parsed individually so a bad one names itself.The comma remains the default on the wire for payloads that do not contain one, so rolling upgrades keep working in both directions.
#3706 — RabbitMQ acks were cumulative (#3737)
Every ack went out as
BasicAckAsync(tag, multiple: true), acknowledging every lower delivery tag on the channel. That is only correct when completions happen in delivery order, and they do not withConsumerDispatchConcurrency > 1— acking one message silently acknowledged deliveries whose handlers were still running, and a crash at that moment lost them.Acks are now per message. Two dead-letter paths that relied on the cumulative sweep settle themselves, most importantly the un-mappable-message branch in
WorkerQueueMessageConsumer, which dead-lettered and returned without touching the delivery at all. This unblocks the planned native-ack parallel endpoint mode.Also included
6.24.0
Two data-loss fixes — but for unusual usages
This release closes two bugs that silently destroyed data rather than failing loudly. Both are worth reading before you skip the rest of these notes.
Durable inbox rows were orphaned when a circuit breaker tripped (#3680).
DurableReceiverchecked its latched flag before callingMarkReceived. The latched path still persists each envelope to the inbox as a safety net — but on an envelope that never went throughMarkReceived,Statusis the enum default (Outgoing) andDestinationis null. Both are filter columns for inbox recovery, so the rows were written in a state no recovery sweep on any node could ever see. The nullListeneralso skipped the nack back to the broker, and the broker's redelivery after restart hitDuplicateIncomingEnvelopeException— which acks and drops. Net result: genuine message loss under a durable inbox any time a circuit breaker trip latched the receiver mid-flight. Measured on the circuit-breaker suite, 9 of 1,200 messages were lost per run.Dropping one tenant from a shared partition bucket destroyed its co-tenants' data (#3686). Found alongside #3683. Tenant bucketing — registering several small tenants against one partition suffix so they share a physical partition — is documented and exposed through
PartitionPerTenant(p => p.AllowPartitionSharing = true), and it did not work on either engine. It had no test coverage, because the doc sample demonstrating it is compile-only and never executed.Global partitioning
Part of the GlobalPartitioning epic (#3482).
Wolverine.ComplianceTests.Partitioning.ShardedProcessing, so a new transport costs one small test classThe new suites immediately found two real bugs:
EndpointMode.Durableon every slot, and aNatsEndpointonly supportsDurablewhen JetStream-backed — so everyUseShardedNatsSubjects()call threw at configuration time. The topology now enables JetStream on its own endpoints and declares a work-queue stream per shard, without which the listener died at startup onstream not foundglobal-persistent://public/default/orders1. They now use the topic's short name, matching every other transportMulti-tenancy and persistence
ITenantedentity — had no partition for any tenant registered before that table existed.IConjoinedTenantPartitions<T>.MigrateTenantPartitionsAsync()reconciles every partitioned table against the full registered tenant set, with per-tableTenantPartitionResultreportingTransports
NullReferenceExceptionFilterSubjectwas only assigned whenConsumerNamewas empty, so every durable consumer on a stream received every message. The fix needs aFilterSubjectsmulti-filter — a single filter cannot cover both{subject}and{subject}.scheduled, and a work-queue stream discards an uncovered control message"OAUTH2-JWT". Azure Event Grid's custom JWT authentication requiresCUSTOM-JWT, so those brokers could not be reached through Wolverine's authentication support at all. You could already set the method by hand throughMqttClientOptionsBuilder.WithAuthentication(), but that gave up Wolverine's token refresh loop — the whole reason to useMqttJwtAuthenticationOptions. You no longer have to chooseWolverineHttpTransportClientused the endpoint'sOutboundUripurely as anIHttpClientFactoryclient name, then posted to that client'sBaseAddress— so operator commands sent back over the HTTP transport failed withAn invalid request URI was providedPerformance
RabbitMQ consumer dispatch concurrency is now per-endpoint (#3492). The client default of 1 was the bottleneck. Simulated handler, 2,000 msg/s offered load, 30s measured window:
ConsumerDispatchConcurrencyThe 5.1x and 12.2x multiples understate it — at 1 and 5 the listener never catches up at all.
Amazon SQS batches message deletions and chunks outgoing batches on the 256KB request size limit (#3493)
Azure Service Bus session listeners are no longer quadratic — the n² session loops are now n.
MaxConcurrentCallsis surfaced, and a batched defer settles the original message (#3494)HTTP and gRPC
... (truncated)
6.23.1
Agent distribution
TL;DR: if you pause a projection from CritterWatch on 6.23.0, restarting it appears to do nothing for a full minute. This fixes that.
A paused projection or subscription agent now resumes immediately when you restart it (#3663). On 6.23.0 the restart was accepted, the pause restriction was cleared, and then nothing happened until the pending-assignment ledger's TTL expired — 2 ×
CheckAssignmentPeriod, so 60 seconds with the defaults. Long enough that an operator reasonably concludes the agent is never coming back.The ledger introduced in 6.23.0 (#3622) only counted an assignment as confirmed if a later evaluation saw the agent running and still assigned to the same node. A pause makes those two conditions mutually exclusive: the first evaluation that can observe the delivered assignment is the same one that detaches the agent. The entry was never confirmed, nothing on the stop path cleared it, and the restart's
AssignAgentwas suppressed as a duplicate still in flight. Delivery alone now confirms the entry, which is the only question the ledger was ever asking.Pausing an agent no longer briefly starts it first (#3666).
ApplyRestrictionsAsynckickstarted a health check before persisting the operator's restriction change, so that evaluation ran against the old restrictions and could act against the very intent being applied — for a pause, re-assigning and starting the agent one beat before the merged evaluation stopped it again. Besides the wasted daemon start/stop cycle, this is what armed the stale ledger entry behind #3663.PostgreSQL
Advisory-lock sessions stay invisible to Marten's async-daemon gap detection (#3664). Marten 9.16.1+ will not skip a stale event-sequence gap while any session whose open transaction predates that gap is still alive (marten#4953). A session parked in an open transaction for the life of the process therefore reads as a permanent "possible reserver" and can hold the high-water mark — and every async projection — behind a gap that is genuinely dead.
Wolverine's long-held locks were already shaped correctly: leader election and node coordination hold session-scoped advisory locks on a dedicated connection with no transaction, so they show up as
state='idle'with a NULLxact_start. Those sessions are now also taggedapplication_name = 'wolverine-advisory-lock:<database>', which turns apg_stat_activityinvestigation from guesswork into something you can read at a glance. The constraints are pinned in tests and in the Postgres durability docs, including the trap worth knowing in your own code: never add a keepalive query inside a long-lived open transaction — it bumpsstate_change, makes the session look active, and re-promotes it to candidate reserver.Note for combined Marten + Wolverine deployments: older guidance suggested Postgres's
idle_in_transaction_session_timeoutas a dead-gap backstop. Prefer upgrading Marten and usingSkipStaleGapsDespiteLiveTransactionsAfterinstead.6.23.0
Projection & agent distribution
TL;DR: this prevents Wolverine from going into a panic doing agent assignments and churning crazily hard during Kubernetes rollouts or cluster starts and that's a very good thing
The bulk of this release. A wave of fixes (WO-1..8) to the agent assignment plane that together remove the re-assignment churn and livelock that could leave projection agents flapping or wedged.
AssignAgentfloods (#3622)IEventSubscriptionAgent.Failuresurfaces aShardFailure— category, the failing event's sequence and type, and the root exception type — through health checks and a newIWolverineObserver.AgentPausedhook plus aNodeRecordType.AgentPausedrecord. Failures bound to a specific event (ApplyEvent,EventSerialization,UnknownEventType) or to two processes racing one shard (ProgressionOutOfOrder) are no longer auto-restarted, since they would die on the identical event every time (#3637, #3638)Durability.AgentStartRetryAttempts/AgentStartRetryDelay, instead of idling a fullCheckAssignmentPeriodafter a startup race (#3519)FindAgentUriAsyncoverload (#3647) and a store-awareTryRebuildRegisteredProjectionAsyncoverload (#3618)Bumps JasperFx.Events to 2.36.1, Marten to 9.20.0 and Polecat to 5.7.0.
HTTP
Content-Typeon an[AcceptsContentType]route returns 415 rather than 404 (#3649)[AsParameters]endpoints no longer advertise a form body, which had been dropping them from route matching entirely (#3630)PublishMessage<T>andSendMessage<T>— now describe the message they read from the body. They had been advertising no request body at all in OpenAPI (#3646)Transports
ListenToPubsubSubscriptionOnNamedBroker(#3631)EnvelopeMapperreads both timestamp header formats (#3645)EnclosedMessageTypesheader is split before the message type is resolved, so interop works across Azure Service Bus, SNS, SQS and the database transports (#3628)Persistence
DbBatch, so the work splits per statement.Other
Contributors
Thank you to everyone who contributed to this release:
... (truncated)
6.22.0
Wolverine 6.22.0 rolls up the claim-check backend wave, distributed-agent and durability hardening, HTTP/OpenAPI binding fixes, and the Marten 9.18 / JasperFx 2.34 critter-stack alignment.
Dependency alignment
Marten.AspNetCore/Marten.Newtonsoft), Polecat[5.5.0,6.0.0)Claim-check offloading
IClaimCheckStore(#3564)Distributed agents & durability
IHost.ClearAllWolverineStorageAsync()(#3592)EventSubscriptionAgentrestores continuous execution after Rebuild/Rewind (#3520)running_on_node, marten#5001) (#3578)HTTP & OpenAPI
[FromQuery]on arrays/collections instead of misrouting to complex-flattening (#3602)[FromQuery] decimalcorrectly + shape-test OpenAPI parameter description across type families (#3586)[FromQuery]/[FromHeader]parameter twice in OpenAPI (#3586)StreamPaged,StreamPagedByCursor, ETag support (#3593)DbContextparameter as the HTTP request body (#3538)Transports
WolverineFx.Mqtt5package (MQTTnet 5) (#3517)Description has been truncated