chore(deps): Bump the minor-and-patch group with 10 updates - #329
Open
dependabot[bot] wants to merge 1 commit into
Open
chore(deps): Bump the minor-and-patch group with 10 updates#329dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps Anthropic from 12.35.1 to 12.39.0 Bumps Marten from 9.15.4 to 9.22.5 Bumps Marten.EntityFrameworkCore from 9.15.4 to 9.22.5 Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.16.0 to 1.17.0 Bumps OpenTelemetry.Instrumentation.Http from 1.16.0 to 1.17.0 Bumps SonarAnalyzer.CSharp from 10.29.0.143774 to 10.31.0.145097 Bumps WolverineFx from 6.17.0 to 6.24.9 Bumps WolverineFx.EntityFrameworkCore from 6.17.0 to 6.24.9 Bumps WolverineFx.Marten from 6.17.0 to 6.24.9 Bumps WolverineFx.RuntimeCompilation from 6.17.0 to 6.24.9 --- updated-dependencies: - dependency-name: Anthropic dependency-version: 12.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Marten dependency-version: 9.22.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Marten.EntityFrameworkCore dependency-version: 9.22.5 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: OpenTelemetry.Instrumentation.AspNetCore dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: OpenTelemetry.Instrumentation.Http dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: SonarAnalyzer.CSharp dependency-version: 10.31.0.145097 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: WolverineFx dependency-version: 6.24.9 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: WolverineFx.EntityFrameworkCore dependency-version: 6.24.9 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: WolverineFx.Marten dependency-version: 6.24.9 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: WolverineFx.RuntimeCompilation dependency-version: 6.24.9 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
.NET
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated Anthropic from 12.35.1 to 12.39.0.
Updated Marten from 9.15.4 to 9.22.5.
Release notes
Sourced from Marten's releases.
9.22.5
Two source-generator and test-harness fixes that both surfaced on projections built through
AddProjectionWithServices, plus the JasperFx 2.42.2 adoption they ride on.Fixes
The source generator no longer breaks a projection that takes dependencies (#5192)
The bundled
JasperFx.Events.SourceGeneratorregisters anEventProjection's discovered published document types (#4166) by writing into your partial class. It used to emit a parameterless constructor to do it, which failed two ways for exactly the projections that need dependencies injected.It broke the build outright against a primary constructor. C# requires every other constructor to chain through the primary one, so this failed with CS8862 inside the generated
<T>.TypeRegistration.g.cs:And where it did compile, it silently did nothing. A projection registered through
AddProjectionWithServicesis built by the container, which calls the dependency-taking constructor — so the generated parameterless one never ran and the published types went unregistered. That also left the projection's teardown targets unregistered, so a rebuild did not wipe its documents.Registration now rides an override of
ProjectionBase.PublishedTypes(), which does not care how the instance was constructed.Affects 9.22.3 and 9.22.4. Earlier versions discovered published types syntactically, so only an explicit
ops.Store<Doc>(x)produced a registration and the far more commonops.Store(x)produced none — which meant the constructor was rarely emitted at all.One behavior change to be aware of: the generator used to skip registration entirely when your class already had an explicit parameterless constructor, a guard that existed only because you cannot add a second one. An override has no such conflict, so those projections now get their published types registered too. That is the intended #4166 behavior, but on upgrade it can newly provision document storage — and newly register teardown targets — for a projection that was quietly getting neither. If a projection writes into storage that must not be truncated on rebuild, set
DeletePublishedTypesOnTeardown = false.EventProjectionScenariono longer spends its wall clock asleep (#5195, in part)Almost none of a scenario's time was work. The harness wipes the event store and then starts the daemon, so the high-water agent's first look saw an empty store, read
CaughtUp, and settled intoSlowPollingTime— one second by default. Every append then raced a sleeping agent, and because the agent returns toCaughtUpafter each batch drains, the cost recurred at every batch boundary. Since a boundary is how a scenario says "these appends must land in different daemon batches", the more precisely a test described its batching, the slower it got.A scenario owns both the appends and the daemon that must notice them, so it now says so directly, through an in-process
IDaemonWakeup— a semaphore release, no database round trip and no LISTEN/NOTIFY. Nothing about your store's polling configuration changes.A flat ~250ms per boundary remains, from a hard-coded poll delay in
WaitForNonStaleDataAsync. That is the other half of #5195 and is still open.Dependencies
JasperFx / JasperFx.Events 2.42.2. Adopting it also enrolls Marten in the strong-typed identity event-sourcing compliance suite that landed in 2.42.0 (
IComplianceStoreRegistrar.RegisterValueType<T>()), taking the shared cross-store suite to 167 passing tests against Marten.9.22.4
What's Changed
Full Changelog: JasperFx/marten@V9.22.3...V9.22.4
9.22.3
What's Changed
Full Changelog: JasperFx/marten@V9.22.1...V9.22.3
9.22.1
Security release. Upgrade is recommended for anyone using sharded tenancy together with
Events.UseTenantPartitionedEvents.A tenant id was interpolated into a double-quoted PostgreSQL identifier without doubling an embedded double quote, so a tenant id containing one could terminate the identifier and execute additional SQL statements. This is a different class from the two advisories previously published on this repository, both of which were the single-quoted string-literal class; neither of those fixes addressed this.
You are affected only if you use sharded tenancy, have
UseTenantPartitionedEventsenabled, and your application passes attacker-influenced input as a tenant id. Note that the reachable surface includes ordinary session resolution, not just administrative provisioning calls —GetTenantAsync/FindOrCreateDatabaseauto-provision an unknown tenant. Applications using tenant ids from a trusted fixed set are not exploitable.Affected versions: 9.4.0 through 9.22.0.
Full details, including remediation guidance for existing data, are in the security advisory: GHSA-3vp4-34pf-2rcw
What changed
PerTenantEventSequences.QuotedSequenceNameescapes embedded quotes, matchingquote_ident/%Iso the name still resolves to the same object the quick-append function finds. Covers the create, drop, schema-apply and cleanup paths.BulkEventAppenderno longer builds an unquoted sequence name from a suffix read back out of the tenants table. This also fixes a functional bug:PreserveSourceSequencebulk imports previously failed with42601for hyphenated and GUID tenant ids under sharded tenancy.ShardedTenancyvalidates tenant ids destined for DDL, closing a long-standing asymmetry with theDefaultTenancyprovisioning path. It is a narrow denylist rather than the existing identifier allowlist, so hyphenated and GUID tenant ids keep working.Dependency
Requires Weasel.Postgresql 9.21.1, which escapes partition bound values (JasperFx/weasel#416). Both halves are needed; the dependency is pulled in automatically.
Credit to Barak Srour (Apiiro) for the report.
9.22.0
The partitioning feature is new, but otherwise this was all about CritterWatch improvements for a huge installation
What's Changed
Full Changelog: JasperFx/marten@V9.21.0...V9.22.0
9.21.0
Highlights
A small, low-risk release: two bug fixes reported against 9.20.x, a LINQ ordering fix, a Newtonsoft serialization fix, and a new health-check overload for Wolverine-managed daemon distribution.
Bug Fixes
mt_quick_append_eventsreturned{NULL}for an empty event array (#5062, #5088)array_length('{}', 1)isNULLin PostgreSQL rather than0, so calling the bulk append function with no events returned abigint[]whose single element wasNULL. Npgsql could not read that intolong[], and the resultingInvalidCastExceptionwas thrown from the batch's post-processing loop — where it displaced whatever exception had actually made the append fail. Callers were left with an unrelated, non-retryable error instead of the real one; for the reporter that dead-lettered Wolverine messages which would otherwise have been retried.Fixed on three fronts:
COALESCEs the array length, so an empty append means what it says: zero events appended, final version unchanged.ProjectionUpdateBatch.WaitForCompletion, for anAppendside effect that ended up with no events) no longer issues the call.OrderByagainst a dictionary indexer dropped the key (#5063, #5073)OrderBy(x => x.SomeDictionary["key"])generated SQL that ignored the indexer key, so the ordering was wrong (or arbitrary) rather than failing loudly.Lazy LINQ sequences serialized as objects under Newtonsoft (#5076, #5080)
A document property holding a deferred-execution sequence (
Select(...),Where(...)without a materializing call) was written by Newtonsoft as an iterator object rather than a JSON array, so it would not round-trip. These are now written as plain arrays.IMessageBatchis called concurrently (#5065, #5085)Not a behavior change, but a documentation fix worth flagging if you implement
IMessageBatchyourself: the async daemon raises projection side effects from multiple threads at once (measured at up to 8 concurrent publishers across 10 threads for a single-stream projection catching up). The interface previously said nothing about this. An implementation that appends to an unsynchronized collection will silently drop messages — the same hazard, in a real outbox, that showed up here as a "flaky" test.New
Provider-aware
databaseFilterfor the high-water health check (#5061, #5089)AddMartenHighWaterHealthCheck'sdatabaseFilteris captured at registration time, so it cannot resolve services — which makes it unable to express "the databases this node currently owns" when ownership is runtime state. That is precisely the case under Wolverine-managed daemon distribution, where agents are assigned per (database, tenant) and rebalanced over a node's lifetime.There is now an overload whose filter receives the
IServiceProviderand is re-evaluated on every probe:And where it did compile, it silently did nothing. A projection registered through
AddProjectionWithServicesis built by the container, which calls the dependency-taking constructor — so the generated parameterless one never ran and the published types went unregistered. That also left the projection's teardown targets unregistered, so a rebuild did not wipe its documents.Registration now rides an override of
ProjectionBase.PublishedTypes(), which does not care how the instance was constructed.Affects 9.22.3 and 9.22.4. Earlier versions discovered published types syntactically, so only an explicit
ops.Store<Doc>(x)produced a registration and the far more commonops.Store(x)produced none — which meant the constructor was rarely emitted at all.One behavior change to be aware of: the generator used to skip registration entirely when your class already had an explicit parameterless constructor, a guard that existed only because you cannot add a second one. An override has no such conflict, so those projections now get their published types registered too. That is the intended #4166 behavior, but on upgrade it can newly provision document storage — and newly register teardown targets — for a projection that was quietly getting neither. If a projection writes into storage that must not be truncated on rebuild, set
DeletePublishedTypesOnTeardown = false.EventProjectionScenariono longer spends its wall clock asleep (#5195, in part)Almost none of a scenario's time was work. The harness wipes the event store and then starts the daemon, so the high-water agent's first look saw an empty store, read
CaughtUp, and settled intoSlowPollingTime— one second by default. Every append then raced a sleeping agent, and because the agent returns toCaughtUpafter each batch drains, the cost recurred at every batch boundary. Since a boundary is how a scenario says "these appends must land in different daemon batches", the more precisely a test described its batching, the slower it got.A scenario owns both the appends and the daemon that must notice them, so it now says so directly, through an in-process
IDaemonWakeup— a semaphore release, no database round trip and no LISTEN/NOTIFY. Nothing about your store's polling configuration changes.A flat ~250ms per boundary remains, from a hard-coded poll delay in
WaitForNonStaleDataAsync. That is the other half of #5195 and is still open.Dependencies
JasperFx / JasperFx.Events 2.42.2. Adopting it also enrolls Marten in the strong-typed identity event-sourcing compliance suite that landed in 2.42.0 (
IComplianceStoreRegistrar.RegisterValueType<T>()), taking the shared cross-store suite to 167 passing tests against Marten.9.22.4
What's Changed
Full Changelog: JasperFx/marten@V9.22.3...V9.22.4
9.22.3
What's Changed
Full Changelog: JasperFx/marten@V9.22.1...V9.22.3
9.22.1
Security release. Upgrade is recommended for anyone using sharded tenancy together with
Events.UseTenantPartitionedEvents.A tenant id was interpolated into a double-quoted PostgreSQL identifier without doubling an embedded double quote, so a tenant id containing one could terminate the identifier and execute additional SQL statements. This is a different class from the two advisories previously published on this repository, both of which were the single-quoted string-literal class; neither of those fixes addressed this.
You are affected only if you use sharded tenancy, have
UseTenantPartitionedEventsenabled, and your application passes attacker-influenced input as a tenant id. Note that the reachable surface includes ordinary session resolution, not just administrative provisioning calls —GetTenantAsync/FindOrCreateDatabaseauto-provision an unknown tenant. Applications using tenant ids from a trusted fixed set are not exploitable.Affected versions: 9.4.0 through 9.22.0.
Full details, including remediation guidance for existing data, are in the security advisory: GHSA-3vp4-34pf-2rcw
What changed
PerTenantEventSequences.QuotedSequenceNameescapes embedded quotes, matchingquote_ident/%Iso the name still resolves to the same object the quick-append function finds. Covers the create, drop, schema-apply and cleanup paths.BulkEventAppenderno longer builds an unquoted sequence name from a suffix read back out of the tenants table. This also fixes a functional bug:PreserveSourceSequencebulk imports previously failed with42601for hyphenated and GUID tenant ids under sharded tenancy.ShardedTenancyvalidates tenant ids destined for DDL, closing a long-standing asymmetry with theDefaultTenancyprovisioning path. It is a narrow denylist rather than the existing identifier allowlist, so hyphenated and GUID tenant ids keep working.Dependency
Requires Weasel.Postgresql 9.21.1, which escapes partition bound values (JasperFx/weasel#416). Both halves are needed; the dependency is pulled in automatically.
Credit to Barak Srour (Apiiro) for the report.
9.22.0
The partitioning feature is new, but otherwise this was all about CritterWatch improvements for a huge installation
What's Changed
Full Changelog: JasperFx/marten@V9.21.0...V9.22.0
9.21.0
Highlights
A small, low-risk release: two bug fixes reported against 9.20.x, a LINQ ordering fix, a Newtonsoft serialization fix, and a new health-check overload for Wolverine-managed daemon distribution.
Bug Fixes
mt_quick_append_eventsreturned{NULL}for an empty event array (#5062, #5088)array_length('{}', 1)isNULLin PostgreSQL rather than0, so calling the bulk append function with no events returned abigint[]whose single element wasNULL. Npgsql could not read that intolong[], and the resultingInvalidCastExceptionwas thrown from the batch's post-processing loop — where it displaced whatever exception had actually made the append fail. Callers were left with an unrelated, non-retryable error instead of the real one; for the reporter that dead-lettered Wolverine messages which would otherwise have been retried.Fixed on three fronts:
COALESCEs the array length, so an empty append means what it says: zero events appended, final version unchanged.ProjectionUpdateBatch.WaitForCompletion, for anAppendside effect that ended up with no events) no longer issues the call.OrderByagainst a dictionary indexer dropped the key (#5063, #5073)OrderBy(x => x.SomeDictionary["key"])generated SQL that ignored the indexer key, so the ordering was wrong (or arbitrary) rather than failing loudly.Lazy LINQ sequences serialized as objects under Newtonsoft (#5076, #5080)
A document property holding a deferred-execution sequence (
Select(...),Where(...)without a materializing call) was written by Newtonsoft as an iterator object rather than a JSON array, so it would not round-trip. These are now written as plain arrays.IMessageBatchis called concurrently (#5065, #5085)Not a behavior change, but a documentation fix worth flagging if you implement
IMessageBatchyourself: the async daemon raises projection side effects from multiple threads at once (measured at up to 8 concurrent publishers across 10 threads for a single-stream projection catching up). The interface previously said nothing about this. An implementation that appends to an unsynchronized collection will silently drop messages — the same hazard, in a real outbox, that showed up here as a "flaky" test.New
Provider-aware
databaseFilterfor the high-water health check (#5061, #5089)AddMartenHighWaterHealthCheck'sdatabaseFilteris captured at registration time, so it cannot resolve services — which makes it unable to express "the databases this node currently owns" when ownership is runtime state. That is precisely the case under Wolverine-managed daemon distribution, where agents are assigned per (database, tenant) and rebalanced over a node's lifetime.There is now an overload whose filter receives the
IServiceProviderand is re-evaluated on every probe: