chore(deps): Bump the minor-and-patch group with 11 updates by dependabot[bot] · Pull Request #352 · leehopper/personal-running-coach

dependabot · 2026-08-27T15:38:34Z

Updated Anthropic from 12.40.0 to 12.43.0.

Updated Aspire.Npgsql from 13.4.6 to 13.5.3.

Release notes

Sourced from Aspire.Npgsql's releases.

13.5.3 What's New in Aspire 13.5.3

Patch release for Aspire 13.5 that fixes Dashboard Graph view crashes for resources with multi-path icons and restores missing public URLs for DevTunnel resources.

🐛 Fixes

📊 Dashboard Graph view could crash for Azure Blob resources — Resources such as those created with AddBlobs use icons containing multiple SVG paths, which caused an XML parsing exception and broke the dashboard circuit. The graph now combines multi-path icons correctly. Regression introduced in 13.5. Fixes #19489. (#19585, backport of #19579, @sebastienros)
🌐 DevTunnel public URLs were missing from the Dashboard and MCP snapshots — DevTunnel port resources could report Running and Healthy while showing no public URLs. Proxyless port allocation is now limited to compute and container resources, allowing DevTunnels to publish their actual public endpoints. Regression introduced in 13.5. Fixes #19496. (#19625, backport of #19590, @karolz-ms, @danegsta)

🏷️ Housekeeping

🚀 Bumped branding to 13.5.3

Full Changelog: v13.5.2...v13.5.3

Full commit: b5f143315ffb6968ea939a9978797a5b20e4c688

13.5.2 What's New in Aspire 13.5.2

Patch release for Aspire 13.5 that removes an unused native helper binary from the Windows CLI archives so 13.5 servicing releases stay publishable to WinGet.

🐛 Fixes

🪟 Windows CLI archives shipped an unused ~4.9 MB hex1bpty.exe — The Windows CLI archives (aspire-cli-win-{x64,arm64}-*.zip) bundled Hex1b's out-of-process PTY host, which Aspire never executes (DCP owns every pseudo-terminal Aspire surfaces). Besides the wasted download, the extra unexplained executable stalled the WinGet publish, since every binary in the archive goes through executable and malware validation. A build-only MSBuild target now drops the file from the CLI publish output; Unix native assets are unaffected. Regression new in 13.5. ([#19557]([release/13.5] Exclude unused hex1bpty.exe from published CLI archives microsoft/aspire#19557), backport of #19554, @mitchdenny)

🏷️ Housekeeping

🚀 Bumped branding to 13.5.2

Full Changelog: [v13.5.1...v13.5.2](microsoft/aspire@v13.5.1...v13.5.2)

Full commit: [a22cec24d76e764b3681977e314ab4a0aeed0240](microsoft/aspire@a22cec2)

13.5.1 What's New in Aspire 13.5.1

Patch release for Aspire 13.5 fixing a TypeScript/Java polyglot AppHost compatibility regression when running the 13.5 SDK under an older (13.4.x) CLI, plus a DCP update and release-pipeline housekeeping.

🐛 Fixes

🍎 Polyglot AppHosts could crash on startup on macOS — On macOS, polyglot (TypeScript/Python/Java/Go/Rust) AppHosts could crash during startup due to an interaction between how DCP's Go runtime forks detached processes and how .NET Native AOT installs its signal handlers. Updated DCP (Developer Control Plane) to 0.25.13 to resolve the crash. ([#19528]([release/13.5] [main] Update dependencies from microsoft/dcp microsoft/aspire#19528))
🔗 Polyglot AppHosts on the 13.5 SDK crashed under an older CLI with MissingMethodException — A TypeScript or Java AppHost built with the 13.5 SDK failed to start when launched by an older (13.4.x) CLI, because the newer codegen called Aspire.TypeSystem members that don't exist in the CLI's older contract. Code generation now probes for these additive capabilities before using them, so older CLIs skip only the unsupported feature and startup succeeds. Regression introduced in 13.5 by #19365. Fixes #19503. ([#19524]([release/13.5] Preserve TypeSystem compatibility with older CLIs microsoft/aspire#19524), backport of #19506, @adamint)

🏷️ Housekeeping

📦 Updated DCP (Developer Control Plane) to 0.25.13 ([#19528]([release/13.5] [main] Update dependencies from microsoft/dcp microsoft/aspire#19528))
🔧 Restored WinGet publication using .NET 9 wingetcreate ([#19509]([release/13.5] fix(release): Restore WinGet publication with .NET 9 wingetcreate microsoft/aspire#19509))
🧹 Removed the pipeline-scoped Publish-Build-Assets group from the release pipeline ([#19523]([release/13.5] Remove pipeline-scoped Publish-Build-Assets group microsoft/aspire#19523), [#19163](Remove Publish-Build-Assets variable group from release/13.5 microsoft/aspire#19163))
🚀 Bumped branding to 13.5.1 ([#19531](Increment patch version from 0 to 1 microsoft/aspire#19531))

Full Changelog: [v13.5.0...v13.5.1](microsoft/aspire@v13.5.0...v13.5.1)

Full commit: [69db530a4816698cf1d5fa4557933e0ac4f127c6](microsoft/aspire@69db530)

13.5.0

Aspire 13.5.0

Aspire 13.5 is a developer-experience release focused on a richer, more interactive AppHost, closer C# and TypeScript parity, sharper tooling, more flexible deployment modeling, and a broad set of runtime-stability improvements.

Highlights

💬 Richer AppHost interactions — The Interaction Service now works across C# and TypeScript AppHosts with stable prompts and dynamic inputs, file uploads, progress dialogs, notifications, and user-defined resource command arguments that surface as dashboard controls and CLI options.
🖥️ Interactive terminal sessions — The experimental WithTerminal() API lets resources host REPLs, shells, TUIs, and other interactive programs directly in the dashboard, with an opt-in aspire terminal CLI command for attaching from your shell.
🌐 TypeScript AppHost is generally available — Polyglot AppHosts no longer require the ASPIREATS001 experimental diagnostic and gain custom health checks, container file copying, HTTPS developer certificates, faster startup, and several reliability fixes that further close the gap with C#.
🛠️ CLI installation and reliability — The Aspire CLI is available through npm and Nix alongside Homebrew, WinGet, mise, and NuGet. New C# AppHosts enable the CLI bundle by default, while aspire stop --force, aspire update --migrate, aspire doctor, docs search, signal handling, and stale-socket cleanup all improve day-to-day workflows.
🎨 Refreshed dashboard — The dashboard adopts official Aspire branding and a new accessible design-token system, with timestamp and exact numeric telemetry filters, console-log text search, clearer reconnect and health-check experiences, and correct telemetry streaming while filters are active.
💻 Rebranded VS Code extension — The extension is now named Aspire and adds an in-editor dashboard, Bun and MAUI debugging, resource commands in the tree view, discovered AppHosts, improved parameter handling, and more efficient workspace discovery.
☸️ More expressive deployments — Kubernetes and AKS gain first-class persistent volumes, Azure Container Apps adds deterministic unique resource naming, Azure environments support delegated subnets, and Docker Compose can publish Blazor gateways and configure shared memory.
☁️ Expanded hosting integrations — Azure resources can be referenced across resource groups, subscriptions, and tenants; the new Aspire.Hosting.Dotnet package models .NET projects by path; Radius deployment arrives in preview; and Foundry Local, Redis modules, dev tunnels, Go debugging, and other integrations gain new capabilities.

⚠️ Breaking changes

Notable changes include hosting context ServiceProvider properties being renamed to Services, PublishAsConnectionString becoming obsolete in favor of AddConnectionString, removal of aspire ps --resources and --include-hidden in favor of aspire describe, earlier proxyless endpoint port allocation, deprecation of the GitHub Models integration, removal of the dashboard AI Assistant, and opt-in rather than automatic dashboard launch from the VS Code extension.

See the full list and migration guidance in the Aspire 13.5 breaking changes.

📖 Learn more

For complete details, examples, migration guidance, and everything new in this release, read What's new in Aspire 13.5.

Thank you to all the community contributors who helped make Aspire 13.5 possible! 💜

Full Changelog: v13.4.6...v13.5.0

Full commit: e076d8e427cb3afb528dbd605acd74c3aea69f94

Commits viewable in compare view.

Updated Marten from 9.25.0 to 9.30.0.

Release notes

Sourced from Marten's releases.

9.30.0

Dependencies move to Weasel 9.27.0 and JasperFx 2.56.0.

Several fixes in this release share a failure mode worth calling out on its own: the write succeeded, the read disagreed, and nothing anywhere reported an error. Two of them ran undetected in production for weeks.

Patching

#5290 — the patching API built its JSON paths from raw C# member names, so a member carrying [JsonPropertyName] (or [JsonProperty] under Newtonsoft) was patched at a path the serializer never reads. The patch reported success, Load and Query kept returning the old value, and the phantom node was erased by the next full save — so there was no durable evidence anything had gone wrong. Patch paths now resolve through the same member machinery the LINQ provider uses, so Where(x => x.Name == v) and Patch(...).Set(x => x.Name, v) agree about where a member lives by construction. The predicate overloads had the same gap and are fixed with it.
#5295 — a patch that moves a value the schema also keeps in a .Duplicate() column now refreshes that column in more of the cases that need it: an aliased member, a patch on a parent of the duplicated member, and the destinations of the patching API's own Duplicate and Rename operations. Left unfixed, the document and the index that exists to search it disagreed — Load returned the new value while Query filtered on the same member returned nothing.

DCB

#5268 — Events.BuildHStoreTagIndexConcurrently builds the hstore tag index without holding ACCESS EXCLUSIVE on mt_events for the duration. On an ordinary event table that is CREATE INDEX CONCURRENTLY; under Events.UseTenantPartitionedEvents, where PostgreSQL refuses CONCURRENTLY on a partitioned parent outright, Marten emits the per-partition sequence it does accept. Opt-in, because a concurrent build cannot run inside a transaction and so changes what db-patch and db-dump write out. The out-of-band route from 9.29.0 (Events.IgnoreIndex(EventGraph.HStoreTagIndexName)) still works and is still supported.
#5276 (thanks @Noblix) — a session that fetched a DCB boundary, decided it had nothing to append, and saved anyway still bumped the mt_dcb_tag_version rows, invalidating a concurrent session that did have something to append. A boundary is now only enforced when the save actually appends. #5280 covers the repeated-fetch half: each row is asserted exactly once, oldest capture wins.
#5283 / #5286 — tag rules. Events.TagWith<T>(...) states once how an event is tagged and applies it wherever the event is built — ordinary appends, StartStream, aggregate handlers and bulk inserts alike — closing the gaps tag inference leaves open. Events.TagEventsBy(...) hands over a translator an application already owns instead of restating it one registration at a time.

LINQ

#5279 (thanks @svenclaesson) — two enum value-collection filters that silently returned zero rows. x.EnumArray.Contains(variable) resolved to the MemoryExtensions.Contains comparer overload rather than Enumerable.Contains, because enums do not implement IEquatable<T>; with ImplicitUsings on, most applications hit this by default.
#5287 — a HashSet<TEnum> in a Contains filter now projects to something Npgsql can bind.
#5289 (thanks @arnelirobles) — the parameterised MatchesJsonPath(sql, params object[]) overload threw for every call. It now works for any argument type, maps null onto DBNull, and reports a placeholder/parameter count mismatch with a message naming both counts instead of an IndexOutOfRangeException from inside the LINQ provider. Worth knowing: ^ is the placeholder character for that overload and is also a regex anchor, so it lands inside JSONPath literals by accident.

Async daemon

#5277 — the skip-ahead probe asked for min(seq_id) over a join, and PostgreSQL only rewrites MIN into an ordered index scan when the aggregate's input is a single relation. The probe therefore scanned every remaining row in the partition, on the one code path that exists precisely because the store is too large for the normal query to finish.
JasperFx 2.56.0 brings three high-water fixes reachable under load, including one from a deployment running 2,173 tenants across 512 shard databases (thanks @erdtsieck): a tenant agent seeded below its own committed position no longer pauses permanently, high water is primed exactly once so concurrent agent starts cannot read it at zero, and per-tenant catch-up no longer silently skips a tenant a concurrent reconciliation dropped. The middle one is not tenancy-specific — it is the shape behind an unexplained Paused shard after a rollout.

9.29.0

Data-loss and silent-failure fixes across the event append path, DCB tagging, and schema naming. Two of these lose or drop data with no error at all, so they are worth reading even if the rest is not relevant to you.

Data loss

A retried commit could lose its events entirely (#5262). QuickAppendEventsOperationBase released its pooled parameter buffers in PostprocessAsync, but the resilience pipeline can re-execute the same NpgsqlBatch — and a released PooledList reports Count = 0, which Npgsql binds as the array length. The retry sent empty event arrays, mt_quick_append_events wrote nothing and raised nothing, and SaveChangesAsync returned success having committed the documents without the events. The rentals now belong to the unit of work.

Commits are no longer retried when the outcome is unknown (#5262). A commit carries event appends and is not idempotent, so replaying one that already committed server-side appends the events twice. SaveChangesAsync now runs through a separate write pipeline that retries only when the previous attempt is known to have left nothing behind — a transient error PostgreSQL reported itself, or a failure Marten's own post-processing raised and rolled back. A command timeout or a dropped connection now surfaces instead of being replayed.

This is deliberately not NpgsqlException.IsTransient, whose definition is built for idempotent work and includes the whole connection-exception class. ConfigurePolly and ExtendPolly now govern reads only; ConfigureWritePolly / ExtendWritePolly are new for the commit path. See Resiliency Policies.

Only the first DCB tag of a given type was stored (#5265). mt_quick_append_events carries one array per tag type, parallel to the events, so it had exactly one slot per (event, tag type). An event legitimately carrying two tags of one type lost the rest — and a lost tag is not an error to a DCB query, it is simply absent from the answer. The surplus is now written as ordinary tag rows. In DcbStorageMode.HStore, which cannot represent the case at all, this now throws rather than dropping silently.

Schema

Long primary key constraint names could collide outright. A document table's PK constraint was left on Weasel's pkey_{table}_{columns} default, which passes 63 characters for a document type of no great length once tenant_id joins the key. PostgreSQL truncates rather than rejecting, and the constraint's backing index is schema-scoped, so two document types whose names agree for long enough failed with 42P07 relation "pkey_..." already exists. Also fixed for the natural key table (#5271). No-op for any schema that was not already being truncated.

Multi-database tenancy ignored Command Timeout on shard connection strings (#5269). StoreOptions.CommandTimeout was only ever raised from StoreOptions.Connection(...), which multi-database setups never call — so every command ran at the 5 second default no matter what the shards said. The database being used now has a say. An explicitly set store-wide value still wins.

FetchForWritingByTags broke later full-schema operations (#5264). EventGraph.Build<TDoc>() resolved the id type through MappingFor, which registers a DocumentMapping as a side effect — so a pure [BoundaryAggregate], which has no identity by design, became a document type with no IdMember. ResetAllData, ApplyAllConfiguredChangesToDatabaseAsync and the db-patch / db-apply commands then threw.

Projections and DCB

EF Core projection rebuilds corrupted the DbContext (#5266). The daemon applies a range's slices through a 10-wide block, all sharing one storage instance — and the EF Core storage wraps a single non-thread-safe DbContext. Requires JasperFx 2.53.0, which lets a storage declare it cannot take concurrent slices.

Bulk-imported events now carry DCB tags in hstore mode (#5267), thanks to @erdtsieck. Previously every bulk-imported event landed untagged, so a store whose history arrived by migration had a consistency boundary that silently excluded most of it.

The DCB hstore tag index can be built out of band (#5268). Enabling hstore mode on an existing store built a GIN index under ACCESS EXCLUSIVE — a write outage rather than a migration, with no way around it under per-tenant partitioning. EventGraph.HStoreTagIndexName can now be passed to Events.IgnoreIndex so an operator builds it themselves; see the DCB docs for the procedure.

A lost append race under conjoined tenancy surfaced as a raw PostgresException (#5270). The exception transform recognised the stream-version guard index by an enumerated list of names, and partitioning gives each partition a differently-named child index. It was missing three, not one — including on the single-tenant configuration #3520 was meant to have fixed. Now matched by shape.

Also

The Inline FetchForWriting aggregate cache now really does skip the snapshot load — IdentityMapDocumentStorage.LoadManyAsync was issuing an empty-id query even when the item map had satisfied everything (#5258, #5259, #5260).
Weasel 9.25.1 and JasperFx 2.53.0. Do not pin Weasel 9.25.0 — its identifier validation rejects primary key constraint names that PostgreSQL accepts, which breaks Marten in two places, one of them silently.

Thanks

@erdtsieck for #5262, #5264, #5267, #5268 and #5269 — several of these were forensic reports of silent data loss with the mechanism worked out, which is how they got fixed this quickly. @Noblix for the #5265 repro.

9.28.0

Full Changelog: JasperFx/marten@V9.27.0...V9.28.0

What's Changed

Implement JasperFx's IDocumentCommitListener (jasperfx#679) by @jeremydmiller in Implement JasperFx's IDocumentCommitListener (jasperfx#679) JasperFx/marten#5261

Full Changelog: JasperFx/marten@V9.27.0...V9.28.0

9.27.0

Adopts JasperFx 2.51.0 and the four capabilities it promotes into the shared Critter Stack contracts. One of them is a genuinely new Marten feature; the other three close gaps where Marten had the capability but not under the shared spelling.

Aggregate snapshot caching for `FetchForWriting` (#5251)

An opt-in, node-local cache of aggregate snapshots that lets FetchForWriting skip loading the stored snapshot and read only the events after it — effectively an identity map for aggregates with a lifetime longer than a session. Off for every aggregate type; enabled per type, because the win is proportional to how often one stream is fetched for writing:

opts.Events.CacheAggregatesForWriting<Order>(sizeLimit: 1000);

The cached snapshot is only ever a baseline. The stream version and every event after the cached version are still read on every call, and the optimistic concurrency assertion on append is untouched — so a stale entry costs a larger delta query, never a wrong aggregate and never a suppressed EventStreamUnexpectedMaxEventIdException. That is what makes a deliberately incoherent, node-local cache the right shape here, and why there is no distributed-cache option: a distributed cache would reintroduce exactly the round trip this exists to remove.

Both the Async and Inline lifecycles are supported, and they genuinely differ. An Inline snapshot is written in the same transaction as the events, so it is always exactly at the stream head — a hit needs an exact version match, and the entry is written back only after a successful commit, because the inline projection mutates the very instance FetchForWriting handed out.

IAggregateWriteCache and friends live in JasperFx.Events.Fetching, so one cache implementation serves Marten, Polecat and Fisher alike. No new package lands on core Marten: the default is backed by JasperFx.Core's existing LRU rather than Microsoft.Extensions.Caching.Memory.

Docs: Optimizing Performance → Caching Aggregate Snapshots for FetchForWriting.

`IDocumentSessionOperations.PendingStreams` (#5250)

Store-agnostic code can now read the StreamActions a session has queued but not yet committed — for a listener or a pre-commit hook deciding something from the events the session is about to write — without naming a store.

⚠️ Worth knowing if you are implementing these contracts yourself: this is the same non-covariance trap as 9.26's Events accessor. Marten's PendingChanges.Streams() returns IList<StreamAction>, and IList<T> is not assignable to IReadOnlyList<T>, so the member bound to the interface's throwing default with no compile error anywhere. It now carries an explicit implementation, pinned by PendingStreamActionsCompliance.

In Marten this is the same collection as IDocumentSession.PendingChanges.Streams(), handed back as a live view rather than a copy.

`BinaryEventAttribute` — one lookup instead of two (#5248)

Marten.Events.BinaryEventAttribute now derives from the promoted JasperFx.Events.BinaryEventAttribute, which 2.51.0 unsealed for exactly this. EventGraph.ResolveBinarySerializerFor drops back to a single attribute lookup. Entirely non-breaking — existing [BinaryEvent] usages compile and resolve unchanged.

Compliance (#5249)

DocumentComplianceConfig.StreamIdentity is now replayed by Marten's document compliance fixture rather than inferred, and two new shared suites are enrolled: PendingStreamActionsCompliance and AggregateWriteCacheCompliance (wave 10).

Upgrading

No breaking changes and no migration. Everything new here is opt-in.

Full changelog: JasperFx/marten@V9.26.0...V9.27.0

9.26.0

Consumes JasperFx 2.50.0, which promoted two things into the shared contracts. Both changes here are additive — existing code compiles and behaves identically.

Reach the event store from a store-agnostic session (jasperfx#669)

JasperFx.Events.Documents gained an Events accessor on its session contracts, so a consumer that opens its own session through IDocumentSessionFactory can now reach the event store without naming Marten:

tier	member
`IDocumentReadOperations`	`IQueryEventStore Events`
`IDocumentSessionOperations`	`IEventStoreOperations Events`

Marten implements both. This does not affect handlers taking a chain parameter — Wolverine already fills those. It matters for the two shapes where you decide when a session exists: a background or timer publisher that opens a session and appends, and a deliberate second read session opened alongside a chain's writing session.

⚠️ Worth knowing if you maintain a store or a session wrapper. C# interface implementation is not return-type covariant, so a session that already declares an Events property of its own event-store type does not satisfy the contract member — it binds to a default that throws, and the build still succeeds with zero errors. Marten's own IQuerySession.Events returns Marten.Events.IQueryEventStore, a subtype, which is exactly this case; both tiers needed an explicit implementation. The shared compliance suite is what catches it.

`IEventBinarySerializer` promoted to `JasperFx.Events`

Binary event serialization (#4515) was Marten-specific, so a consumer compiling one body of source against several Critter Stack stores needed a separate identical serializer per store. The two-method interface and [BinaryEvent] now live in JasperFx.Events, and one serializer serves every store.

Non-breaking, in both directions:

Marten.Events.IEventBinarySerializer still exists and now derives from the core interface, so existing implementations keep compiling and also satisfy the core type.
EventGraph.UseBinarySerializer<T>, DefaultBinarySerializer, IEventStoreOptions and EventMapping.BinarySerializer widened to accept the core interface, so a store-agnostic serializer can be registered.
Both the Marten and the core [BinaryEvent] attributes are honored.

Fixed: binary serializer registration was order-dependent

EventMapping resolved its binary serializer in its constructor, and AddEventType<T>() builds mappings eagerly. So this threw "no IEventBinarySerializer was registered" out of what reads as a plain type registration:

opts.Events.AddEventType<SomeBinaryEvent>();          // [BinaryEvent]-marked
opts.Events.DefaultBinarySerializer = mySerializer;   // too late

while the same two lines in the opposite order worked. Resolution is lazy now, deferring the failure to first use — which is what the documentation always described. The guard is volatile, because it is read from the append path on many threads and a torn read would route a binary event down the JSON path silently rather than throwing.

Also

Enrolled in the two new shared compliance suites, DocumentSessionEventsCompliance and BinaryEventSerializationCompliance.
Docs updated: events/binary-serialization.md, documents/sessions.md.

Full changelog: JasperFx/marten@9.25.0...9.26.0

Commits viewable in compare view.

Updated Marten.EntityFrameworkCore from 9.25.0 to 9.30.0.

Release notes

Sourced from Marten.EntityFrameworkCore's releases.

9.30.0

Dependencies move to Weasel 9.27.0 and JasperFx 2.56.0.

Several fixes in this release share a failure mode worth calling out on its own: the write succeeded, the read disagreed, and nothing anywhere reported an error. Two of them ran undetected in production for weeks.

Patching

#5290 — the patching API built its JSON paths from raw C# member names, so a member carrying [JsonPropertyName] (or [JsonProperty] under Newtonsoft) was patched at a path the serializer never reads. The patch reported success, Load and Query kept returning the old value, and the phantom node was erased by the next full save — so there was no durable evidence anything had gone wrong. Patch paths now resolve through the same member machinery the LINQ provider uses, so Where(x => x.Name == v) and Patch(...).Set(x => x.Name, v) agree about where a member lives by construction. The predicate overloads had the same gap and are fixed with it.
#5295 — a patch that moves a value the schema also keeps in a .Duplicate() column now refreshes that column in more of the cases that need it: an aliased member, a patch on a parent of the duplicated member, and the destinations of the patching API's own Duplicate and Rename operations. Left unfixed, the document and the index that exists to search it disagreed — Load returned the new value while Query filtered on the same member returned nothing.

DCB

#5268 — Events.BuildHStoreTagIndexConcurrently builds the hstore tag index without holding ACCESS EXCLUSIVE on mt_events for the duration. On an ordinary event table that is CREATE INDEX CONCURRENTLY; under Events.UseTenantPartitionedEvents, where PostgreSQL refuses CONCURRENTLY on a partitioned parent outright, Marten emits the per-partition sequence it does accept. Opt-in, because a concurrent build cannot run inside a transaction and so changes what db-patch and db-dump write out. The out-of-band route from 9.29.0 (Events.IgnoreIndex(EventGraph.HStoreTagIndexName)) still works and is still supported.
#5276 (thanks @Noblix) — a session that fetched a DCB boundary, decided it had nothing to append, and saved anyway still bumped the mt_dcb_tag_version rows, invalidating a concurrent session that did have something to append. A boundary is now only enforced when the save actually appends. #5280 covers the repeated-fetch half: each row is asserted exactly once, oldest capture wins.
#5283 / #5286 — tag rules. Events.TagWith<T>(...) states once how an event is tagged and applies it wherever the event is built — ordinary appends, StartStream, aggregate handlers and bulk inserts alike — closing the gaps tag inference leaves open. Events.TagEventsBy(...) hands over a translator an application already owns instead of restating it one registration at a time.

LINQ

#5279 (thanks @svenclaesson) — two enum value-collection filters that silently returned zero rows. x.EnumArray.Contains(variable) resolved to the MemoryExtensions.Contains comparer overload rather than Enumerable.Contains, because enums do not implement IEquatable<T>; with ImplicitUsings on, most applications hit this by default.
#5287 — a HashSet<TEnum> in a Contains filter now projects to something Npgsql can bind.
#5289 (thanks @arnelirobles) — the parameterised MatchesJsonPath(sql, params object[]) overload threw for every call. It now works for any argument type, maps null onto DBNull, and reports a placeholder/parameter count mismatch with a message naming both counts instead of an IndexOutOfRangeException from inside the LINQ provider. Worth knowing: ^ is the placeholder character for that overload and is also a regex anchor, so it lands inside JSONPath literals by accident.

Async daemon

#5277 — the skip-ahead probe asked for min(seq_id) over a join, and PostgreSQL only rewrites MIN into an ordered index scan when the aggregate's input is a single relation. The probe therefore scanned every remaining row in the partition, on the one code path that exists precisely because the store is too large for the normal query to finish.
JasperFx 2.56.0 brings three high-water fixes reachable under load, including one from a deployment running 2,173 tenants across 512 shard databases (thanks @erdtsieck): a tenant agent seeded below its own committed position no longer pauses permanently, high water is primed exactly once so concurrent agent starts cannot read it at zero, and per-tenant catch-up no longer silently skips a tenant a concurrent reconciliation dropped. The middle one is not tenancy-specific — it is the shape behind an unexplained Paused shard after a rollout.

9.29.0

Data-loss and silent-failure fixes across the event append path, DCB tagging, and schema naming. Two of these lose or drop data with no error at all, so they are worth reading even if the rest is not relevant to you.

Data loss

A retried commit could lose its events entirely (#5262). QuickAppendEventsOperationBase released its pooled parameter buffers in PostprocessAsync, but the resilience pipeline can re-execute the same NpgsqlBatch — and a released PooledList reports Count = 0, which Npgsql binds as the array length. The retry sent empty event arrays, mt_quick_append_events wrote nothing and raised nothing, and SaveChangesAsync returned success having committed the documents without the events. The rentals now belong to the unit of work.

Commits are no longer retried when the outcome is unknown (#5262). A commit carries event appends and is not idempotent, so replaying one that already committed server-side appends the events twice. SaveChangesAsync now runs through a separate write pipeline that retries only when the previous attempt is known to have left nothing behind — a transient error PostgreSQL reported itself, or a failure Marten's own post-processing raised and rolled back. A command timeout or a dropped connection now surfaces instead of being replayed.

This is deliberately not NpgsqlException.IsTransient, whose definition is built for idempotent work and includes the whole connection-exception class. ConfigurePolly and ExtendPolly now govern reads only; ConfigureWritePolly / ExtendWritePolly are new for the commit path. See Resiliency Policies.

Only the first DCB tag of a given type was stored (#5265). mt_quick_append_events carries one array per tag type, parallel to the events, so it had exactly one slot per (event, tag type). An event legitimately carrying two tags of one type lost the rest — and a lost tag is not an error to a DCB query, it is simply absent from the answer. The surplus is now written as ordinary tag rows. In DcbStorageMode.HStore, which cannot represent the case at all, this now throws rather than dropping silently.

Schema

Long primary key constraint names could collide outright. A document table's PK constraint was left on Weasel's pkey_{table}_{columns} default, which passes 63 characters for a document type of no great length once tenant_id joins the key. PostgreSQL truncates rather than rejecting, and the constraint's backing index is schema-scoped, so two document types whose names agree for long enough failed with 42P07 relation "pkey_..." already exists. Also fixed for the natural key table (#5271). No-op for any schema that was not already being truncated.

Multi-database tenancy ignored Command Timeout on shard connection strings (#5269). StoreOptions.CommandTimeout was only ever raised from StoreOptions.Connection(...), which multi-database setups never call — so every command ran at the 5 second default no matter what the shards said. The database being used now has a say. An explicitly set store-wide value still wins.

FetchForWritingByTags broke later full-schema operations (#5264). EventGraph.Build<TDoc>() resolved the id type through MappingFor, which registers a DocumentMapping as a side effect — so a pure [BoundaryAggregate], which has no identity by design, became a document type with no IdMember. ResetAllData, ApplyAllConfiguredChangesToDatabaseAsync and the db-patch / db-apply commands then threw.

Projections and DCB

EF Core projection rebuilds corrupted the DbContext (#5266). The daemon applies a range's slices through a 10-wide block, all sharing one storage instance — and the EF Core storage wraps a single non-thread-safe DbContext. Requires JasperFx 2.53.0, which lets a storage declare it cannot take concurrent slices.

Bulk-imported events now carry DCB tags in hstore mode (#5267), thanks to @erdtsieck. Previously every bulk-imported event landed untagged, so a store whose history arrived by migration had a consistency boundary that silently excluded most of it.

The DCB hstore tag index can be built out of band (#5268). Enabling hstore mode on an existing store built a GIN index under ACCESS EXCLUSIVE — a write outage rather than a migration, with no way around it under per-tenant partitioning. EventGraph.HStoreTagIndexName can now be passed to Events.IgnoreIndex so an operator builds it themselves; see the DCB docs for the procedure.

A lost append race under conjoined tenancy surfaced as a raw PostgresException (#5270). The exception transform recognised the stream-version guard index by an enumerated list of names, and partitioning gives each partition a differently-named child index. It was missing three, not one — including on the single-tenant configuration #3520 was meant to have fixed. Now matched by shape.

Also

The Inline FetchForWriting aggregate cache now really does skip the snapshot load — IdentityMapDocumentStorage.LoadManyAsync was issuing an empty-id query even when the item map had satisfied everything (#5258, #5259, #5260).
Weasel 9.25.1 and JasperFx 2.53.0. Do not pin Weasel 9.25.0 — its identifier validation rejects primary key constraint names that PostgreSQL accepts, which breaks Marten in two places, one of them silently.

Thanks

@erdtsieck for #5262, #5264, #5267, #5268 and #5269 — several of these were forensic reports of silent data loss with the mechanism worked out, which is how they got fixed this quickly. @Noblix for the #5265 repro.

9.28.0

Full Changelog: JasperFx/marten@V9.27.0...V9.28.0

What's Changed

Implement JasperFx's IDocumentCommitListener (jasperfx#679) by @jeremydmiller in Implement JasperFx's IDocumentCommitListener (jasperfx#679) JasperFx/marten#5261

Full Changelog: JasperFx/marten@V9.27.0...V9.28.0

9.27.0

Adopts JasperFx 2.51.0 and the four capabilities it promotes into the shared Critter Stack contracts. One of them is a genuinely new Marten feature; the other three close gaps where Marten had the capability but not under the shared spelling.

Aggregate snapshot caching for `FetchForWriting` (#5251)

An opt-in, node-local cache of aggregate snapshots that lets FetchForWriting skip loading the stored snapshot and read only the events after it — effectively an identity map for aggregates with a lifetime longer than a session. Off for every aggregate type; enabled per type, because the win is proportional to how often one stream is fetched for writing:

opts.Events.CacheAggregatesForWriting<Order>(sizeLimit: 1000);

The cached snapshot is only ever a baseline. The stream version and every event after the cached version are still read on every call, and the optimistic concurrency assertion on append is untouched — so a stale entry costs a larger delta query, never a wrong aggregate and never a suppressed EventStreamUnexpectedMaxEventIdException. That is what makes a deliberately incoherent, node-local cache the right shape here, and why there is no distributed-cache option: a distributed cache would reintroduce exactly the round trip this exists to remove.

Both the Async and Inline lifecycles are supported, and they genuinely differ. An Inline snapshot is written in the same transaction as the events, so it is always exactly at the stream head — a hit needs an exact version match, and the entry is written back only after a successful commit, because the inline projection mutates the very instance FetchForWriting handed out.

IAggregateWriteCache and friends live in JasperFx.Events.Fetching, so one cache implementation serves Marten, Polecat and Fisher alike. No new package lands on core Marten: the default is backed by JasperFx.Core's existing LRU rather than Microsoft.Extensions.Caching.Memory.

Docs: Optimizing Performance → Caching Aggregate Snapshots for FetchForWriting.

`IDocumentSessionOperations.PendingStreams` (#5250)

Store-agnostic code can now read the StreamActions a session has queued but not yet committed — for a listener or a pre-commit hook deciding something from the events the session is about to write — without naming a store.

⚠️ Worth knowing if you are implementing these contracts yourself: this is the same non-covariance trap as 9.26's Events accessor. Marten's PendingChanges.Streams() returns IList<StreamAction>, and IList<T> is not assignable to IReadOnlyList<T>, so the member bound to the interface's throwing default with no compile error anywhere. It now carries an explicit implementation, pinned by PendingStreamActionsCompliance.

In Marten this is the same collection as IDocumentSession.PendingChanges.Streams(), handed back as a live view rather than a copy.

`BinaryEventAttribute` — one lookup instead of two (#5248)

Marten.Events.BinaryEventAttribute now derives from the promoted JasperFx.Events.BinaryEventAttribute, which 2.51.0 unsealed for exactly this. EventGraph.ResolveBinarySerializerFor drops back to a single attribute lookup. Entirely non-breaking — existing [BinaryEvent] usages compile and resolve unchanged.

Compliance (#5249)

DocumentComplianceConfig.StreamIdentity is now replayed by Marten's document compliance fixture rather than inferred, and two new shared suites are enrolled: PendingStreamActionsCompliance and AggregateWriteCacheCompliance (wave 10).

Upgrading

No breaking changes and no migration. Everything new here is opt-in.

Full changelog: JasperFx/marten@V9.26.0...V9.27.0

9.26.0

Consumes JasperFx 2.50.0, which promoted two things into the shared contracts. Both changes here are additive — existing code compiles and behaves identically.

Reach the event store from a store-agnostic session (jasperfx#669)

JasperFx.Events.Documents gained an Events accessor on its session contracts, so a consumer that opens its own session through IDocumentSessionFactory can now reach the event store without naming Marten:

tier	member
`IDocumentReadOperations`	`IQueryEventStore Events`
`IDocumentSessionOperations`	`IEventStoreOperations Events`

Marten implements both. This does not affect handlers taking a chain parameter — Wolverine already fills those. It matters for the two shapes where you decide when a session exists: a background or timer publisher that opens a session and appends, and a deliberate second read session opened alongside a chain's writing session.

⚠️ Worth knowing if you maintain a store or a session wrapper. C# interface implementation is not return-type covariant, so a session that already declares an Events property of its own event-store type does not satisfy the contract member — it binds to a default that throws, and the build still succeeds with zero errors. Marten's own IQuerySession.Events returns Marten.Events.IQueryEventStore, a subtype, which is exactly this case; both tiers needed an explicit implementation. The shared compliance suite is what catches it.

`IEventBinarySerializer` promoted to `JasperFx.Events`

Binary event serialization (#4515) was Marten-specific, so a consumer compiling one body of source against several Critter Stack stores needed a separate identical serializer per store. The two-method interface and [BinaryEvent] now live in JasperFx.Events, and one serializer serves every store.

Non-breaking, in both directions:

Marten.Events.IEventBinarySerializer still exists and now derives from the core interface, so existing implementations keep compiling and also satisfy the core type.
EventGraph.UseBinarySerializer<T>, DefaultBinarySerializer, IEventStoreOptions and EventMapping.BinarySerializer widened to accept the core interface, so a store-agnostic serializer can be registered.
Both the Marten and the core [BinaryEvent] attributes are honored.

Fixed: binary serializer registration was order-dependent

EventMapping resolved its binary serializer in its constructor, and AddEventType<T>() builds mappings eagerly. So this threw "no IEventBinarySerializer was registered" out of what reads as a plain type registration:

opts.Events.AddEventType<SomeBinaryEvent>();          // [BinaryEvent]-marked
opts.Events.DefaultBinarySerializer = mySerializer;   // too late

while the same two lines in the opposite order worked. Resolution is lazy now, deferring the failure to first use — which is what the documentation always described. The guard is volatile, because it is read from the append path on many threads and a torn read would route a binary event down the JSON path silently rather than throwing.

Also

Enrolled in the two new shared compliance suites, DocumentSessionEventsCompliance and BinaryEventSerializationCompliance.
Docs updated: events/binary-serialization.md, documents/sessions.md.

Full changelog: JasperFx/marten@9.25.0...9.26.0

Commits viewable in compare view.

Updated OpenTelemetry from 1.17.0 to 1.18.0.

Release notes

Sourced from OpenTelemetry's releases.

1.18.0

For highlights and announcements pertaining to this release see: Release Notes > 1.18.0.

The following changes are from the previous release 1.17.0.

NuGet: OpenTelemetry v1.18.0
- Fixed self-diagnostics log lines being silently dropped when an event message or parameter contained enough 3-byte UTF-8 characters to overflow the internal buffer estimate. Such content is now truncated.
  (#7543)
- Fixed activity creation throwing when multiple tracer providers return a sampler attribute with the same key.
  (#7558)
- Added the otel.sdk.processor.log.processed SDK self-observability metric.
  (#7486)
- Added the otel.sdk.processor.span.processed SDK self-observability metric.
  (#7598)
- BatchActivityExportProcessor and SimpleActivityExportProcessor no longer forward spans to the exporter once Shutdown has been called, and BatchActivityExportProcessor.Shutdown now waits for in-flight OnEnd calls to finish enqueueing before flushing.
  (#7598)
- Fix logger, meter and tracer providers leaking background threads if an exception is thrown by their constructor after resource creation.
  (#7615)
- CircularBufferBuckets.Copy optimized to use bulk array copies.
  (#7670)
- Restored configured MaxScale after delta exponential histogram collection.
  (#7671)
See CHANGELOG for details.
NuGet: OpenTelemetry.Api v1.18.0
- Avoid formatting exceptions and creating exception attributes when RecordException is called on a span that is not recorded.
  (#7669)
See CHANGELOG for details.
NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.18.0

No notable changes.

See CHANGELOG for details.
NuGet: OpenTelemetry.Exporter.Console v1.18.0
- Added support for serializing attribute values that are key/value lists (IEnumerable<KeyValuePair<string, object?>>). These attributes will be serialized as JSON objects.
  (#7015)

... (truncated)

1.18.0-rc.1

The following changes are from the previous release 1.17.0.

NuGet: OpenTelemetry v1.18.0-rc.1
- Fixed self-diagnostics log lines being silently dropped when an event message or parameter contained enough 3-byte UTF-8 characters to overflow the internal buffer estimate. Such content is now truncated.
  (#7543)
- Fixed activity creation throwing when multiple tracer providers return a sampler attribute with the same key.
  (#7558)
- Added the otel.sdk.processor.log.processed SDK self-observability metric.
  (#7486)
- Added the otel.sdk.processor.span.processed SDK self-observability metric.
  (#7598)
- BatchActivityExportProcessor and SimpleActivityExportProcessor no longer forward spans to the exporter once Shutdown has been called, and BatchActivityExportProcessor.Shutdown now waits for in-flight OnEnd calls to finish enqueueing before flushing.
  (#7598)
- Fix logger, meter and tracer providers leaking background threads if an exception is thrown by their constructor after resource creation.
  (#7615)
- CircularBufferBuckets.Copy optimized to use bulk array copies.
  (#7670)
- Restored configured MaxScale after delta exponential histogram collection.
  (#7671)
See CHANGELOG for details.
NuGet: OpenTelemetry.Api v1.18.0-rc.1
- Avoid formatting exceptions and creating exception attributes when RecordException is called on a span that is not recorded.
  (#7669)
See CHANGELOG for details.
NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.18.0-rc.1

No notable changes.

See CHANGELOG for details.
NuGet: OpenTelemetry.Exporter.Console v1.18.0-rc.1
- Added support for serializing attribute values that are key/value lists (IEnumerable<KeyValuePair<string, object?>>). These attributes will be serialized as JSON objects.
  (#7015)
See CHANGELOG for details.

... (truncated)

1.18.0-beta.1

The following changes are from the previous release 1.17.0-beta.1.

NuGet: OpenTelemetry.Exporter.Prometheus.AspNetCore v1.18.0-beta.1
- Fix concurrent scrapes returning an empty response under contention. Now the exporter will return an HTTP 500 error instead.
  (#7571)
- Waiting for concurrent scrapes to finish before collecting no longer blocks, which could stall concurrent scrapes being waited on.
  (#7571)
- Fixed the interaction between PrometheusAspNetCoreOptions.TranslationStrategy and content negotiation. The configured strategy is now applied before content negotiation, instead of the negotiated escaping scheme replacing the strategy's, and the Content-Type header now reports the escaping scheme that was applied rather than the one that was negotiated.
  (#7610)
- Fixed metric values and histogram bucket bounds being written with 17 significant digits instead of their shortest round-trippable representation.
  (#7589)
- Fixed the canonical representation used for histogram le and summary quantile label values falling back to 17 significant digits incorrectly.
  (#7589)
- Fixed a race where a slow scrape could return an HTTP 200 instead of 408.
  (#7615)
- Updated OpenTelemetry core component version(s) to 1.18.0.
  (#7674)
See CHANGELOG for details.
NuGet: OpenTelemetry.Exporter.Prometheus.HttpListener v1.18.0-beta.1
- Fix concurrent scrapes returning an empty response under contention. Now the exporter will return an HTTP 500 error instead.
  (#7571)
- Waiting for concurrent scrapes to finish before collecting no longer blocks, which could stall concurrent scrapes being waited on.
  (#7571)
- A scrape which is still collecting when the listener is disposed now returns an HTTP 503 response.
  (#7587)
- Shutting down the listener no longer waits indefinitely for its request processing loop to stop, and no longer throws if the loop faulted.
  (#7587)
- Fixed the interaction between PrometheusHttpListenerOptions.TranslationStrategy and content negotiation. The configured strategy is now applied before content negotiation, instead of the negotiated escaping scheme replacing the strategy's, and the Content-Type header now reports the escaping scheme that was applied rather than the one that was negotiated.
  (#7610)
- Fixed metric values and histogram bucket bounds being written with 17 significant digits instead of their shortest round-trippable representation.
  (#7589)
- Fixed the canonical representation used for histogram le and summary quantile label values falling back to 17 significant digits incorrectly.
  (#7589)

... (truncated)

Commits viewable in compare view.

Updated OpenTelemetry.Api from 1.17.0 to 1.18.0.

Release notes

Sourced from OpenTelemetry.Api's releases.

1.18.0

For highlights and announcements pertaining to this release see: Release Notes > 1.18.0.

The following changes are from the previous release 1.17.0.

NuGet: OpenTelemetry v1.18.0
- Fixed self-diagnostics log lines being silently dropped when an event message or parameter contained enough 3-byte UTF-8 characters to overflow the internal buffer estimate. Such content is now truncated.
  (#7543)
- Fixed activity creation throwing when multiple tracer providers return a sampler attribute with the same key.
  (#7558)
- Added the otel.sdk.processor.log.processed SDK self-observability metric.
  (#7486)
- Added the otel.sdk.processor.span.processed SDK self-observability metric.
  (#7598)
- BatchActivityExportProcessor and SimpleActivityExportProcessor no longer forward spans to the exporter once Shutdown has been called, and BatchActivityExportProcessor.Shutdown now waits for in-flight OnEnd calls to finish enqueueing before flushing.
  (#7598)
- Fix logger, meter and tracer providers leaking background threads if an exception is thrown by their constructor after resource creation.
  (#7615)
- CircularBufferBuckets.Copy optimized to use bulk array copies.
  (#7670)
- Restored configured MaxScale after delta exponential histogram collection.
  (#7671)
See CHANGELOG for details.
NuGet: OpenTelemetry.Api v1.18.0
- Avoid formatting exceptions and creating exception attributes when RecordException is called on a span that is not recorded.
  (#7669)
See CHANGELOG for details.
NuGet: OpenTelemetry.Api.ProviderBuilderExtensions v1.18.0

No notable changes.

See CHANGELOG for details.
NuGet: OpenTelemetry.Exporter.Console v1.18.0
- Added support for serializing attribute values that are key/value lists (IEnumerable<KeyValuePair<string, object?>>). These attributes will be serialized as JSON objects.
  (#7015)

... (truncated)

1.18.0-rc.1

The following changes are from the previous release 1.17.0.

NuGet: OpenTelemetry v1.18.0-rc.1
- Fixed self-diagnostics log lines being silently dropped when an event message or parameter contained enough 3-byte UTF-8 characters to overflow the internal buffer estimate. Such content is now truncated.
  (#7543)
- Fixed activity creation throwing when multiple tracer providers return a sampler attr...

_Description has bee...

Description has been truncated

Bumps Anthropic from 12.40.0 to 12.43.0 Bumps Aspire.Npgsql from 13.4.6 to 13.5.3 Bumps Marten from 9.25.0 to 9.30.0 Bumps Marten.EntityFrameworkCore from 9.25.0 to 9.30.0 Bumps OpenTelemetry from 1.17.0 to 1.18.0 Bumps OpenTelemetry.Api from 1.17.0 to 1.18.0 Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.17.0 to 1.18.0 Bumps OpenTelemetry.Extensions.Hosting from 1.17.0 to 1.18.0 Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.17.0 to 1.18.0 Bumps OpenTelemetry.Instrumentation.Http from 1.17.0 to 1.18.0 Bumps SonarAnalyzer.CSharp from 10.32.0.713 to 10.33.0.1635 --- updated-dependencies: - dependency-name: Anthropic dependency-version: 12.43.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Aspire.Npgsql dependency-version: 13.5.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Marten dependency-version: 9.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: Marten.EntityFrameworkCore dependency-version: 9.30.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: OpenTelemetry dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: OpenTelemetry.Api dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: OpenTelemetry.Extensions.Hosting dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: OpenTelemetry.Instrumentation.AspNetCore dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: OpenTelemetry.Instrumentation.Http dependency-version: 1.18.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: SonarAnalyzer.CSharp dependency-version: 10.33.0.1635 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-27T15:41:52Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
❌ 6 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 3 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: The number of snapshots compared for the base SHA (2) and the head SHA (1) do not match. You may see unexpected removals in the diff.

Re-running this action after a short time may resolve the issue. See the documentation for more information and troubleshooting advice.

License Issues

backend/tests/RunCoach.Api.Tests/RunCoach.Api.Tests.csproj

Package	Version	License	Issue Type
SonarAnalyzer.CSharp	10.33.0.1635	LicenseRef-scancode-sonar-sal-1.0	Incompatible License
SonarAnalyzer.CSharp	10.33.0.1635	LicenseRef-scancode-sonar-sal-1.0	Incompatible License
SonarAnalyzer.CSharp	10.33.0.1635	LicenseRef-scancode-sonar-sal-1.0	Incompatible License

backend/src/RunCoach.Api/RunCoach.Api.csproj

Package	Version	License	Issue Type
SonarAnalyzer.CSharp	10.33.0.1635	LicenseRef-scancode-sonar-sal-1.0	Incompatible License
SonarAnalyzer.CSharp	10.33.0.1635	LicenseRef-scancode-sonar-sal-1.0	Incompatible License
SonarAnalyzer.CSharp	10.33.0.1635	LicenseRef-scancode-sonar-sal-1.0	Incompatible License
Weasel.Storage	9.27.0	Null	Unknown License
Weasel.Storage	9.27.0	Null	Unknown License
Weasel.Storage	9.27.0	Null	Unknown License

Allowed Licenses:
MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD, Unlicense, CC0-1.0, CC-BY-4.0, OFL-1.1, Zlib, BSL-1.0, Python-2.0, PSF-2.0, Artistic-2.0, MPL-2.0, WTFPL, PostgreSQL

Excluded from license check:
pkg:githubactions/SonarSource/sonarqube-scan-action, pkg:npm/runcoach-frontend

OpenSSF Scorecard

Scorecard details

Package

Version

Score

Details

nuget/SonarAnalyzer.CSharp

10.33.0.1635

Unknown

nuget/Anthropic

12.43.0

Unknown

nuget/Aspire.Npgsql

13.5.3

Unknown

nuget/JasperFx

2.56.0

Unknown

nuget/JasperFx.Events

2.56.0

Unknown

nuget/Marten

9.30.0

Unknown

nuget/Marten.EntityFrameworkCore

9.30.0

Unknown

nuget/OpenTelemetry

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	🟢 5	badge detected: Passing
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 41 contributing companies or organizations

nuget/OpenTelemetry.Api

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	🟢 5	badge detected: Passing
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 41 contributing companies or organizations

nuget/OpenTelemetry.Api.ProviderBuilderExtensions

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	🟢 5	badge detected: Passing
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 41 contributing companies or organizations

nuget/OpenTelemetry.Exporter.OpenTelemetryProtocol

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	🟢 5	badge detected: Passing
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 41 contributing companies or organizations

nuget/OpenTelemetry.Extensions.Hosting

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	🟢 5	badge detected: Passing
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 41 contributing companies or organizations

nuget/OpenTelemetry.Instrumentation.AspNetCore

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 9	dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices	🟢 5	badge detected: Passing
SAST	🟢 10	SAST tool is run on all commits
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 23 contributing companies or organizations

nuget/OpenTelemetry.Instrumentation.Http

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 9	dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices	🟢 5	badge detected: Passing
SAST	🟢 10	SAST tool is run on all commits
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 23 contributing companies or organizations

nuget/SonarAnalyzer.CSharp

10.33.0.1635

Unknown

nuget/Weasel.Core

9.27.0

Unknown

nuget/Weasel.EntityFrameworkCore

9.27.0

Unknown

nuget/Weasel.Postgresql

9.27.0

Unknown

nuget/Weasel.Storage

9.27.0

Unknown

nuget/Anthropic

12.43.0

Unknown

nuget/Aspire.Npgsql

13.5.3

Unknown

nuget/JasperFx

2.56.0

Unknown

nuget/JasperFx.Events

2.56.0

Unknown

nuget/Marten

9.30.0

Unknown

nuget/Marten.EntityFrameworkCore

9.30.0

Unknown

nuget/OpenTelemetry

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	🟢 5	badge detected: Passing
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 41 contributing companies or organizations

nuget/OpenTelemetry.Api

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	🟢 5	badge detected: Passing
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 41 contributing companies or organizations

nuget/OpenTelemetry.Api.ProviderBuilderExtensions

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	🟢 5	badge detected: Passing
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 41 contributing companies or organizations

nuget/OpenTelemetry.Exporter.OpenTelemetryProtocol

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	🟢 5	badge detected: Passing
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 41 contributing companies or organizations

nuget/OpenTelemetry.Extensions.Hosting

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	🟢 5	badge detected: Passing
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 41 contributing companies or organizations

nuget/OpenTelemetry.Instrumentation.AspNetCore

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 9	dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices	🟢 5	badge detected: Passing
SAST	🟢 10	SAST tool is run on all commits
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 23 contributing companies or organizations

nuget/OpenTelemetry.Instrumentation.Http

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 9	dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices	🟢 5	badge detected: Passing
SAST	🟢 10	SAST tool is run on all commits
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 23 contributing companies or organizations

nuget/SonarAnalyzer.CSharp

10.33.0.1635

Unknown

nuget/Weasel.Core

9.27.0

Unknown

nuget/Weasel.EntityFrameworkCore

9.27.0

Unknown

nuget/Weasel.Postgresql

9.27.0

Unknown

nuget/Weasel.Storage

9.27.0

Unknown

nuget/SonarAnalyzer.CSharp

10.33.0.1635

Unknown

nuget/Anthropic

12.43.0

Unknown

nuget/Aspire.Npgsql

13.5.3

Unknown

nuget/JasperFx

2.56.0

Unknown

nuget/JasperFx.Events

2.56.0

Unknown

nuget/Marten

9.30.0

Unknown

nuget/Marten.EntityFrameworkCore

9.30.0

Unknown

nuget/OpenTelemetry

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	🟢 5	badge detected: Passing
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 41 contributing companies or organizations

nuget/OpenTelemetry.Api

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	🟢 5	badge detected: Passing
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 41 contributing companies or organizations

nuget/OpenTelemetry.Api.ProviderBuilderExtensions

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	🟢 5	badge detected: Passing
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 41 contributing companies or organizations

nuget/OpenTelemetry.Exporter.OpenTelemetryProtocol

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	🟢 5	badge detected: Passing
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 41 contributing companies or organizations

nuget/OpenTelemetry.Extensions.Hosting

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 10	all dependencies are pinned
CII-Best-Practices	🟢 5	badge detected: Passing
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 41 contributing companies or organizations

nuget/OpenTelemetry.Instrumentation.AspNetCore

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 9	dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices	🟢 5	badge detected: Passing
SAST	🟢 10	SAST tool is run on all commits
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 23 contributing companies or organizations

nuget/OpenTelemetry.Instrumentation.Http

1.18.0

🟢 8.8

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 9	dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices	🟢 5	badge detected: Passing
SAST	🟢 10	SAST tool is run on all commits
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ 0	Project has not signed or included provenance with any releases.
Packaging	🟢 10	packaging workflow detected
License	🟢 10	license file detected
Branch-Protection	🟢 5	branch protection is not maximal on development and all release branches
Security-Policy	🟢 10	security policy file detected
CI-Tests	🟢 10	30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 10	project has 23 contributing companies or organizations

nuget/SonarAnalyzer.CSharp

10.33.0.1635

Unknown

nuget/Weasel.Core

9.27.0

Unknown

nuget/Weasel.EntityFrameworkCore

9.27.0

Unknown

nuget/Weasel.Postgresql

9.27.0

Unknown

nuget/Weasel.Storage

9.27.0

Unknown

nuget/SonarAnalyzer.CSharp

10.33.0.1635

Unknown

Scanned Files

.github/workflows/codeql.yml
.github/workflows/license-review.yml
.github/workflows/license-sbom.yml
backend/src/RunCoach.Api/RunCoach.Api.csproj
backend/tests/RunCoach.Api.Tests/RunCoach.Api.Tests.csproj
frontend/node_modules/fast-uri/.github/workflows/ci.yml
frontend/node_modules/fast-uri/.github/workflows/lock-threads.yml
frontend/node_modules/fast-uri/.github/workflows/package-manager-ci.yml
frontend/node_modules/json-schema-traverse/.github/workflows/build.yml
frontend/node_modules/json-schema-traverse/.github/workflows/publish.yml
frontend/package-lock.json
package-lock.json

dependabot · 2026-09-03T15:38:30Z

Superseded by #356.

dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Aug 27, 2026

dependabot Bot closed this Sep 3, 2026

dependabot Bot deleted the dependabot/nuget/backend/minor-and-patch-4d29f85f1c branch September 3, 2026 15:38

Navigation Menu

chore(deps): Bump the minor-and-patch group with 11 updates - #352

chore(deps): Bump the minor-and-patch group with 11 updates#352
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/backend/minor-and-patch-4d29f85f1c

dependabot Bot commented on behalf of github Aug 27, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 27, 2026

Uh oh!

dependabot Bot commented on behalf of github Sep 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

13.5.3

What's New in Aspire 13.5.3

🐛 Fixes

🏷️ Housekeeping

13.5.2

What's New in Aspire 13.5.2

🐛 Fixes

🏷️ Housekeeping

13.5.1

What's New in Aspire 13.5.1

🐛 Fixes

🏷️ Housekeeping

13.5.0

Aspire 13.5.0

Highlights

⚠️ Breaking changes

📖 Learn more

9.30.0

Patching

DCB

LINQ

Async daemon

9.29.0

Data loss

Schema

Projections and DCB

Also

Thanks

9.28.0

What's Changed

9.27.0

Aggregate snapshot caching for FetchForWriting (#​5251)

IDocumentSessionOperations.PendingStreams (#​5250)

BinaryEventAttribute — one lookup instead of two (#​5248)

Compliance (#​5249)

Upgrading

9.26.0

Reach the event store from a store-agnostic session (jasperfx#​669)

IEventBinarySerializer promoted to JasperFx.Events

Fixed: binary serializer registration was order-dependent

Also

9.30.0

Patching

DCB

LINQ

Async daemon

9.29.0

Data loss

Schema

Projections and DCB

Also

Thanks

9.28.0

What's Changed

9.27.0

Aggregate snapshot caching for FetchForWriting (#​5251)

IDocumentSessionOperations.PendingStreams (#​5250)

BinaryEventAttribute — one lookup instead of two (#​5248)

Compliance (#​5249)

Upgrading

9.26.0

Reach the event store from a store-agnostic session (jasperfx#​669)

IEventBinarySerializer promoted to JasperFx.Events

Fixed: binary serializer registration was order-dependent

Also

1.18.0

1.18.0-rc.1

1.18.0-beta.1

1.18.0

1.18.0-rc.1

Uh oh!

github-actions Bot commented Aug 27, 2026

Dependency Review

Snapshot Warnings

License Issues

backend/tests/RunCoach.Api.Tests/RunCoach.Api.Tests.csproj

backend/src/RunCoach.Api/RunCoach.Api.csproj

dependabot Bot commented on behalf of github Aug 27, 2026 •

edited

Loading

Aggregate snapshot caching for `FetchForWriting` (#5251)

`IDocumentSessionOperations.PendingStreams` (#5250)

`BinaryEventAttribute` — one lookup instead of two (#5248)

Compliance (#5249)

Reach the event store from a store-agnostic session (jasperfx#669)

`IEventBinarySerializer` promoted to `JasperFx.Events`

Aggregate snapshot caching for `FetchForWriting` (#5251)

`IDocumentSessionOperations.PendingStreams` (#5250)

`BinaryEventAttribute` — one lookup instead of two (#5248)

Compliance (#5249)

Reach the event store from a store-agnostic session (jasperfx#669)

`IEventBinarySerializer` promoted to `JasperFx.Events`