Skip to content

chore(deps): Bump the minor-and-patch group with 11 updates - #356

Merged
leehopper merged 2 commits into
mainfrom
dependabot/nuget/backend/minor-and-patch-4d419ea6c5
Sep 5, 2026
Merged

chore(deps): Bump the minor-and-patch group with 11 updates#356
leehopper merged 2 commits into
mainfrom
dependabot/nuget/backend/minor-and-patch-4d419ea6c5

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 3, 2026

Copy link
Copy Markdown
Contributor

Updated Anthropic from 12.40.0 to 12.45.0.

Updated Aspire.Npgsql from 13.4.6 to 13.5.3.

Release notes

Sourced from Aspire.Npgsql's releases.

13.5.3

What's New in Aspire 13.5.3

Patch release for Aspire 13.5 that fixes Dashboard Graph view crashes for resources with multi-path icons and restores missing public URLs for DevTunnel resources.

🐛 Fixes

  • 📊 Dashboard Graph view could crash for Azure Blob resources — Resources such as those created with AddBlobs use icons containing multiple SVG paths, which caused an XML parsing exception and broke the dashboard circuit. The graph now combines multi-path icons correctly. Regression introduced in 13.5. Fixes #​19489. (#​19585, backport of #​19579, @​sebastienros)

  • 🌐 DevTunnel public URLs were missing from the Dashboard and MCP snapshots — DevTunnel port resources could report Running and Healthy while showing no public URLs. Proxyless port allocation is now limited to compute and container resources, allowing DevTunnels to publish their actual public endpoints. Regression introduced in 13.5. Fixes #​19496. (#​19625, backport of #​19590, @​karolz-ms, @​danegsta)

🏷️ Housekeeping

  • 🚀 Bumped branding to 13.5.3

Full Changelog: v13.5.2...v13.5.3

Full commit: b5f143315ffb6968ea939a9978797a5b20e4c688

13.5.2

What's New in Aspire 13.5.2

Patch release for Aspire 13.5 that removes an unused native helper binary from the Windows CLI archives so 13.5 servicing releases stay publishable to WinGet.

🐛 Fixes

  • 🪟 Windows CLI archives shipped an unused ~4.9 MB hex1bpty.exe — The Windows CLI archives (aspire-cli-win-{x64,arm64}-*.zip) bundled Hex1b's out-of-process PTY host, which Aspire never executes (DCP owns every pseudo-terminal Aspire surfaces). Besides the wasted download, the extra unexplained executable stalled the WinGet publish, since every binary in the archive goes through executable and malware validation. A build-only MSBuild target now drops the file from the CLI publish output; Unix native assets are unaffected. Regression new in 13.5. ([#​19557]([release/13.5] Exclude unused hex1bpty.exe from published CLI archives microsoft/aspire#19557), backport of #​19554, @​mitchdenny)

🏷️ Housekeeping

  • 🚀 Bumped branding to 13.5.2

Full Changelog: [v13.5.1...v13.5.2](microsoft/aspire@v13.5.1...v13.5.2)

Full commit: [a22cec24d76e764b3681977e314ab4a0aeed0240](microsoft/aspire@a22cec2)

13.5.1

What's New in Aspire 13.5.1

Patch release for Aspire 13.5 fixing a TypeScript/Java polyglot AppHost compatibility regression when running the 13.5 SDK under an older (13.4.x) CLI, plus a DCP update and release-pipeline housekeeping.

🐛 Fixes

  • 🍎 Polyglot AppHosts could crash on startup on macOS — On macOS, polyglot (TypeScript/Python/Java/Go/Rust) AppHosts could crash during startup due to an interaction between how DCP's Go runtime forks detached processes and how .NET Native AOT installs its signal handlers. Updated DCP (Developer Control Plane) to 0.25.13 to resolve the crash. ([#​19528]([release/13.5] [main] Update dependencies from microsoft/dcp microsoft/aspire#19528))

  • 🔗 Polyglot AppHosts on the 13.5 SDK crashed under an older CLI with MissingMethodException — A TypeScript or Java AppHost built with the 13.5 SDK failed to start when launched by an older (13.4.x) CLI, because the newer codegen called Aspire.TypeSystem members that don't exist in the CLI's older contract. Code generation now probes for these additive capabilities before using them, so older CLIs skip only the unsupported feature and startup succeeds. Regression introduced in 13.5 by #​19365. Fixes #​19503. ([#​19524]([release/13.5] Preserve TypeSystem compatibility with older CLIs microsoft/aspire#19524), backport of #​19506, @​adamint)

🏷️ Housekeeping

Full Changelog: [v13.5.0...v13.5.1](microsoft/aspire@v13.5.0...v13.5.1)

Full commit: [69db530a4816698cf1d5fa4557933e0ac4f127c6](microsoft/aspire@69db530)

13.5.0

Aspire 13.5.0

Aspire 13.5 is a developer-experience release focused on a richer, more interactive AppHost, closer C# and TypeScript parity, sharper tooling, more flexible deployment modeling, and a broad set of runtime-stability improvements.

Highlights

  • 💬 Richer AppHost interactions — The Interaction Service now works across C# and TypeScript AppHosts with stable prompts and dynamic inputs, file uploads, progress dialogs, notifications, and user-defined resource command arguments that surface as dashboard controls and CLI options.
  • 🖥️ Interactive terminal sessions — The experimental WithTerminal() API lets resources host REPLs, shells, TUIs, and other interactive programs directly in the dashboard, with an opt-in aspire terminal CLI command for attaching from your shell.
  • 🌐 TypeScript AppHost is generally available — Polyglot AppHosts no longer require the ASPIREATS001 experimental diagnostic and gain custom health checks, container file copying, HTTPS developer certificates, faster startup, and several reliability fixes that further close the gap with C#.
  • 🛠️ CLI installation and reliability — The Aspire CLI is available through npm and Nix alongside Homebrew, WinGet, mise, and NuGet. New C# AppHosts enable the CLI bundle by default, while aspire stop --force, aspire update --migrate, aspire doctor, docs search, signal handling, and stale-socket cleanup all improve day-to-day workflows.
  • 🎨 Refreshed dashboard — The dashboard adopts official Aspire branding and a new accessible design-token system, with timestamp and exact numeric telemetry filters, console-log text search, clearer reconnect and health-check experiences, and correct telemetry streaming while filters are active.
  • 💻 Rebranded VS Code extension — The extension is now named Aspire and adds an in-editor dashboard, Bun and MAUI debugging, resource commands in the tree view, discovered AppHosts, improved parameter handling, and more efficient workspace discovery.
  • ☸️ More expressive deployments — Kubernetes and AKS gain first-class persistent volumes, Azure Container Apps adds deterministic unique resource naming, Azure environments support delegated subnets, and Docker Compose can publish Blazor gateways and configure shared memory.
  • ☁️ Expanded hosting integrations — Azure resources can be referenced across resource groups, subscriptions, and tenants; the new Aspire.Hosting.Dotnet package models .NET projects by path; Radius deployment arrives in preview; and Foundry Local, Redis modules, dev tunnels, Go debugging, and other integrations gain new capabilities.

⚠️ Breaking changes

Notable changes include hosting context ServiceProvider properties being renamed to Services, PublishAsConnectionString becoming obsolete in favor of AddConnectionString, removal of aspire ps --resources and --include-hidden in favor of aspire describe, earlier proxyless endpoint port allocation, deprecation of the GitHub Models integration, removal of the dashboard AI Assistant, and opt-in rather than automatic dashboard launch from the VS Code extension.

See the full list and migration guidance in the Aspire 13.5 breaking changes.

📖 Learn more

For complete details, examples, migration guidance, and everything new in this release, read What's new in Aspire 13.5.

Thank you to all the community contributors who helped make Aspire 13.5 possible! 💜

Full Changelog: v13.4.6...v13.5.0

Full commit: e076d8e427cb3afb528dbd605acd74c3aea69f94

Commits viewable in compare view.

Updated Marten from 9.25.0 to 9.31.2.

Release notes

Sourced from Marten's releases.

9.31.2

A diagnostics-only patch release. No behavioural change to the write path.

A failed batched write now reports the SQL that failed

When a batched write failed, Marten threw a MartenCommandException whose message rendered an empty command text. Reported from the field on an async projection:

Marten Command Failure:$ $ $ 42601: syntax error at end of input POSITION: 56
Error trying to build and apply changes to event subscription MyProjection:All

The $ $ $ is the message template interpolating a command that was always null. ReadNpgsqlCommand() looks for an NpgsqlCommand in exception.Data, and on the ExecuteBatchPagesAsync path there is no single command to put there — AutoClosingLifetime transformed the exception with nothing recorded at all, and WrapAndThrow(NpgsqlBatch, ...) recorded the batch under a key that nothing ever read.

The practical consequence: the offending SQL was unrecoverable from the exception and from the logs, for every async projection write. That is precisely the situation where hand-written SQL — a QueueSqlCommand, a custom IStorageOperation, a projection side effect — turns out to be malformed, and the one thing you need to see is the statement.

MartenCommandException now recovers the SQL from three sources, in order:

  1. the NpgsqlCommand it was handed;
  2. NpgsqlException.BatchCommand — Npgsql identifies the exact statement the server rejected when the failure came out of a batch execution;
  3. an NpgsqlBatch recorded on the exception.

The recovered statement is also exposed on a new MartenCommandException.CommandText property, so it can be read programmatically rather than scraped out of the message.

AutoClosingLifetime executes its batches inline rather than through handleCommandException, so it now records its batch. The other three connection lifetimes already routed through WrapAndThrow(NpgsqlBatch, ...) and only needed a reader for the key they were already writing.

Two guardrails worth knowing about: a batch renders at most five statements, so a 500-operation projection page cannot turn one failure into an unreadable log entry, and the whole resolution is wrapped in a catch — building a diagnostic must never replace the real failure.

Also released as 8.38.1 on the 8.x line.

9.31.1

A single-fix patch release that moves Marten to JasperFx 2.61.0, picking up the source generator fix for JasperFx/jasperfx#​733. Weasel stays on 9.29.0.

Self-aggregating snapshots silently skipped a constructor-based Create

A self-aggregating snapshot may declare its Create handler as an event-shaped constructor, public Foo(FooCreated e), instead of a named static Create. That works on its own. Adding a ShouldDelete method to the same aggregate switched the source generator to a different emitter — one that built its dispatch switch from named conventional methods only — so the constructor's event type got no case arm at all.

Nothing failed loudly. The generated code compiled, the constructor never ran, and the next Apply-only event built the aggregate through RuntimeHelpers.GetUninitializedObject, skipping every field initializer. The visible symptom was an ApplyEventException wrapping a NullReferenceException out of an Apply that appended to a collection property:

JasperFx.Events.Daemon.ApplyEventException: Failure to apply event #​0 Id(...)
 ---> System.NullReferenceException: Object reference not set to an instance of an object.
   at TempGuidAggregate.Apply(TagAdded @​event)

The quieter outcome, where no Apply happens to dereference anything, is a silently blank aggregate.

Both documented workarounds — converting the constructor to a static Create, or registering the delete through DeleteEvent<T>() instead of ShouldDelete — become unnecessary on this release.

The same omission was also in the generated EventTypes property on every self-aggregating path, including the ones whose dispatch was already correct, so an aggregate with a constructor Create and no ShouldDelete gains its creating event in that list here too.

Covered by Bug_jasperfx_733_event_constructor_create_with_should_delete across inline, async and live aggregation, plus the delete arm itself. See #​5322.

9.31.0

Every fix in this release removes a silent wrong answer — not a crash, not an exception, but a plausible-looking result that was wrong with nothing to tell you so. A stream folded into partial aggregates. Paging that returned arbitrary pages. Monitoring that went dark rather than broken. A search reading a key that did not exist. An index that was never created.

Plus one genuinely new feature: weighted full text search with relevance ranking.

New: weighted full text indexes and ts_rank ordering

A full text index used to concatenate its members into one flat vector, so a match in a title was exactly as relevant as a match in a long description. Now it can be weighted, and ranked:

opts.Schema.For<Achievement>().WeightedFullTextIndex(idx => idx
    .Weighted(a => a.Title, TextSearchWeight.A)
    .Weighted(a => a.Tagline, TextSearchWeight.B)
    .Weighted(a => a.Description, TextSearchWeight.C));

var results = await session.Query<Achievement>()
    .Where(a => a.WebStyleSearch(term))
    .OrderByTextRank(term, TextSearchFunction.WebStyle)
    .ToListAsync();

The rank resolves the same tsvector the Where clause matched on, read from the index definition. That is the load-bearing design constraint rather than an implementation detail: a rank computed over a different vector than the filter matched on returns rows in an order that looks plausible and means nothing — a far quieter failure than returning the wrong rows.

Requires Weasel 9.29.0 (weasel#​541), which made it possible to index an expression that is already a tsvector. See the full text documentation for the costs worth knowing first — GIN cannot order, so this is a post-filter sort; and adding weights to an existing index drops and recreates it.

Silent wrong answers, fixed

Async projections folded one stream into several partial aggregates (#​5305, originally #​4085). When a stream's events disagreed about tenant_id, the daemon sliced it per tenant and applied the pieces over each other, so an Apply saw a document with every property at its default. Marten had set ForceSingleTenancy since the original fix, but TenantedEventSlicer honoured that flag on only one of its two overloads — and the async daemon reaches the other one. The flag was being set on precisely the path that could not read it. Fixed upstream in JasperFx 2.58.0.

OrderBy after a GroupJoin/SelectMany was dropped from the SQL (#​5311). Silently, and with Skip/Take it was worse: OFFSET and LIMIT were emitted while the ordering was not, and unordered paging in PostgreSQL has no stable row order — so rows repeat across pages while others never appear. Where on a bare-side selector and Count over a join were wrong in the same surface and are fixed too.

A store with monitoring off dropped the monitoring columns another store had added (#​5309). Two DocumentStores over one DatabaseSchemaName that disagreed about EnableExtendedProgressionTracking kept stripping each other's mt_event_progression columns — last writer wins, silent on both sides. A service beside a seeder or a reporting job is an ordinary arrangement, and neither was doing anything wrong. The shape of that table no longer depends on configuration at all.

Full text search rewrote JSON keys, not just the column (#​5314, thanks @​mlh758). A member whose serialized name contained data produced d.data ->> 'd.data' — a key that does not exist. Two quiet consequences: that member contributed nothing to the search, and the expression no longer matched the index, so the GIN index could not serve the query either.

A second full text index over different members was silently discarded (#​5315). Index names derive from the table rather than from the members, so two FullTextIndex() calls collided by construction and the second was thrown away — never registered, never created, never searched. Ambiguity is now refused with an explanatory exception instead of resolved by declaration order.

A DCB boundary aggregate failed far from its cause (JasperFx 2.60.0). An identity-less [BoundaryAggregate] folded by Evolve(IEvent) got no evolver and no diagnostic, surfacing much later as FetchForWritingByTags<T> throwing "No source-generated dispatcher found" — naming neither the type nor the reason. Now it generates, and a [BoundaryAggregate] with nothing to fold events with is reported as JFXEVT007.

A DCB tag version was captured after the events were read (#​5300). Two batched statements do not share a READ COMMITTED snapshot, so the version could reflect a concurrent append. Captured before the read now.

Also in this release

  • A projection-run CLI command arrives with JasperFx 2.60.0 and needs no Marten change — every host referencing JasperFx.Events picks it up. It replays one projection over a stream slice or DCB tag match and prints per-event before/after state, writing nothing.
  • Bug_5268's concurrent index test no longer depends on how much unrelated transaction load happens to be in flight (#​5308), so validating a dependency bump by running the whole suite at once is trustworthy again.
  • BuildSlicer now agrees with FetchAsyncPlan about global aggregates (#​5307). Alignment rather than a fix — no reachable corruption depended on it, and the reasoning is written down at the call site so the question does not have to be reconstructed next time.

Upgrade notes

OrderByFragment.Expressions changed from List<string> to List<ISqlFragment>. A public API break, deliberately taken: an ordering could not carry a parameter while the clause was a list of strings, which is why the older ngram ranking inlines its search term rather than binding it. Nothing outside Marten's own LINQ internals is likely to touch this type, but it is a compile break if you did.

... (truncated)

9.30.0

Dependencies move to Weasel 9.27.0 and JasperFx 2.56.0.

Several fixes in this release share a failure mode worth calling out on its own: the write succeeded, the read disagreed, and nothing anywhere reported an error. Two of them ran undetected in production for weeks.

Patching

  • #​5290 — the patching API built its JSON paths from raw C# member names, so a member carrying [JsonPropertyName] (or [JsonProperty] under Newtonsoft) was patched at a path the serializer never reads. The patch reported success, Load and Query kept returning the old value, and the phantom node was erased by the next full save — so there was no durable evidence anything had gone wrong. Patch paths now resolve through the same member machinery the LINQ provider uses, so Where(x => x.Name == v) and Patch(...).Set(x => x.Name, v) agree about where a member lives by construction. The predicate overloads had the same gap and are fixed with it.
  • #​5295 — a patch that moves a value the schema also keeps in a .Duplicate() column now refreshes that column in more of the cases that need it: an aliased member, a patch on a parent of the duplicated member, and the destinations of the patching API's own Duplicate and Rename operations. Left unfixed, the document and the index that exists to search it disagreed — Load returned the new value while Query filtered on the same member returned nothing.

DCB

  • #​5268 — Events.BuildHStoreTagIndexConcurrently builds the hstore tag index without holding ACCESS EXCLUSIVE on mt_events for the duration. On an ordinary event table that is CREATE INDEX CONCURRENTLY; under Events.UseTenantPartitionedEvents, where PostgreSQL refuses CONCURRENTLY on a partitioned parent outright, Marten emits the per-partition sequence it does accept. Opt-in, because a concurrent build cannot run inside a transaction and so changes what db-patch and db-dump write out. The out-of-band route from 9.29.0 (Events.IgnoreIndex(EventGraph.HStoreTagIndexName)) still works and is still supported.
  • #​5276 (thanks @​Noblix) — a session that fetched a DCB boundary, decided it had nothing to append, and saved anyway still bumped the mt_dcb_tag_version rows, invalidating a concurrent session that did have something to append. A boundary is now only enforced when the save actually appends. #​5280 covers the repeated-fetch half: each row is asserted exactly once, oldest capture wins.
  • #​5283 / #​5286 — tag rules. Events.TagWith<T>(...) states once how an event is tagged and applies it wherever the event is built — ordinary appends, StartStream, aggregate handlers and bulk inserts alike — closing the gaps tag inference leaves open. Events.TagEventsBy(...) hands over a translator an application already owns instead of restating it one registration at a time.

LINQ

  • #​5279 (thanks @​svenclaesson) — two enum value-collection filters that silently returned zero rows. x.EnumArray.Contains(variable) resolved to the MemoryExtensions.Contains comparer overload rather than Enumerable.Contains, because enums do not implement IEquatable<T>; with ImplicitUsings on, most applications hit this by default.
  • #​5287 — a HashSet<TEnum> in a Contains filter now projects to something Npgsql can bind.
  • #​5289 (thanks @​arnelirobles) — the parameterised MatchesJsonPath(sql, params object[]) overload threw for every call. It now works for any argument type, maps null onto DBNull, and reports a placeholder/parameter count mismatch with a message naming both counts instead of an IndexOutOfRangeException from inside the LINQ provider. Worth knowing: ^ is the placeholder character for that overload and is also a regex anchor, so it lands inside JSONPath literals by accident.

Async daemon

  • #​5277 — the skip-ahead probe asked for min(seq_id) over a join, and PostgreSQL only rewrites MIN into an ordered index scan when the aggregate's input is a single relation. The probe therefore scanned every remaining row in the partition, on the one code path that exists precisely because the store is too large for the normal query to finish.
  • JasperFx 2.56.0 brings three high-water fixes reachable under load, including one from a deployment running 2,173 tenants across 512 shard databases (thanks @​erdtsieck): a tenant agent seeded below its own committed position no longer pauses permanently, high water is primed exactly once so concurrent agent starts cannot read it at zero, and per-tenant catch-up no longer silently skips a tenant a concurrent reconciliation dropped. The middle one is not tenancy-specific — it is the shape behind an unexplained Paused shard after a rollout.

9.29.0

Data-loss and silent-failure fixes across the event append path, DCB tagging, and schema naming. Two of these lose or drop data with no error at all, so they are worth reading even if the rest is not relevant to you.

Data loss

A retried commit could lose its events entirely (#​5262). QuickAppendEventsOperationBase released its pooled parameter buffers in PostprocessAsync, but the resilience pipeline can re-execute the same NpgsqlBatch — and a released PooledList reports Count = 0, which Npgsql binds as the array length. The retry sent empty event arrays, mt_quick_append_events wrote nothing and raised nothing, and SaveChangesAsync returned success having committed the documents without the events. The rentals now belong to the unit of work.

Commits are no longer retried when the outcome is unknown (#​5262). A commit carries event appends and is not idempotent, so replaying one that already committed server-side appends the events twice. SaveChangesAsync now runs through a separate write pipeline that retries only when the previous attempt is known to have left nothing behind — a transient error PostgreSQL reported itself, or a failure Marten's own post-processing raised and rolled back. A command timeout or a dropped connection now surfaces instead of being replayed.

This is deliberately not NpgsqlException.IsTransient, whose definition is built for idempotent work and includes the whole connection-exception class. ConfigurePolly and ExtendPolly now govern reads only; ConfigureWritePolly / ExtendWritePolly are new for the commit path. See Resiliency Policies.

Only the first DCB tag of a given type was stored (#​5265). mt_quick_append_events carries one array per tag type, parallel to the events, so it had exactly one slot per (event, tag type). An event legitimately carrying two tags of one type lost the rest — and a lost tag is not an error to a DCB query, it is simply absent from the answer. The surplus is now written as ordinary tag rows. In DcbStorageMode.HStore, which cannot represent the case at all, this now throws rather than dropping silently.

Schema

Long primary key constraint names could collide outright. A document table's PK constraint was left on Weasel's pkey_{table}_{columns} default, which passes 63 characters for a document type of no great length once tenant_id joins the key. PostgreSQL truncates rather than rejecting, and the constraint's backing index is schema-scoped, so two document types whose names agree for long enough failed with 42P07 relation "pkey_..." already exists. Also fixed for the natural key table (#​5271). No-op for any schema that was not already being truncated.

Multi-database tenancy ignored Command Timeout on shard connection strings (#​5269). StoreOptions.CommandTimeout was only ever raised from StoreOptions.Connection(...), which multi-database setups never call — so every command ran at the 5 second default no matter what the shards said. The database being used now has a say. An explicitly set store-wide value still wins.

FetchForWritingByTags broke later full-schema operations (#​5264). EventGraph.Build<TDoc>() resolved the id type through MappingFor, which registers a DocumentMapping as a side effect — so a pure [BoundaryAggregate], which has no identity by design, became a document type with no IdMember. ResetAllData, ApplyAllConfiguredChangesToDatabaseAsync and the db-patch / db-apply commands then threw.

Projections and DCB

EF Core projection rebuilds corrupted the DbContext (#​5266). The daemon applies a range's slices through a 10-wide block, all sharing one storage instance — and the EF Core storage wraps a single non-thread-safe DbContext. Requires JasperFx 2.53.0, which lets a storage declare it cannot take concurrent slices.

Bulk-imported events now carry DCB tags in hstore mode (#​5267), thanks to @​erdtsieck. Previously every bulk-imported event landed untagged, so a store whose history arrived by migration had a consistency boundary that silently excluded most of it.

The DCB hstore tag index can be built out of band (#​5268). Enabling hstore mode on an existing store built a GIN index under ACCESS EXCLUSIVE — a write outage rather than a migration, with no way around it under per-tenant partitioning. EventGraph.HStoreTagIndexName can now be passed to Events.IgnoreIndex so an operator builds it themselves; see the DCB docs for the procedure.

A lost append race under conjoined tenancy surfaced as a raw PostgresException (#​5270). The exception transform recognised the stream-version guard index by an enumerated list of names, and partitioning gives each partition a differently-named child index. It was missing three, not one — including on the single-tenant configuration #​3520 was meant to have fixed. Now matched by shape.

Also

  • The Inline FetchForWriting aggregate cache now really does skip the snapshot load — IdentityMapDocumentStorage.LoadManyAsync was issuing an empty-id query even when the item map had satisfied everything (#​5258, #​5259, #​5260).
  • Weasel 9.25.1 and JasperFx 2.53.0. Do not pin Weasel 9.25.0 — its identifier validation rejects primary key constraint names that PostgreSQL accepts, which breaks Marten in two places, one of them silently.

Thanks

@​erdtsieck for #​5262, #​5264, #​5267, #​5268 and #​5269 — several of these were forensic reports of silent data loss with the mechanism worked out, which is how they got fixed this quickly. @​Noblix for the #​5265 repro.

9.28.0

Full Changelog: JasperFx/marten@V9.27.0...V9.28.0

What's Changed

Full Changelog: JasperFx/marten@V9.27.0...V9.28.0

9.27.0

Adopts JasperFx 2.51.0 and the four capabilities it promotes into the shared Critter Stack contracts. One of them is a genuinely new Marten feature; the other three close gaps where Marten had the capability but not under the shared spelling.

Aggregate snapshot caching for FetchForWriting (#​5251)

An opt-in, node-local cache of aggregate snapshots that lets FetchForWriting skip loading the stored snapshot and read only the events after it — effectively an identity map for aggregates with a lifetime longer than a session. Off for every aggregate type; enabled per type, because the win is proportional to how often one stream is fetched for writing:

opts.Events.CacheAggregatesForWriting<Order>(sizeLimit: 1000);

The cached snapshot is only ever a baseline. The stream version and every event after the cached version are still read on every call, and the optimistic concurrency assertion on append is untouched — so a stale entry costs a larger delta query, never a wrong aggregate and never a suppressed EventStreamUnexpectedMaxEventIdException. That is what makes a deliberately incoherent, node-local cache the right shape here, and why there is no distributed-cache option: a distributed cache would reintroduce exactly the round trip this exists to remove.

Both the Async and Inline lifecycles are supported, and they genuinely differ. An Inline snapshot is written in the same transaction as the events, so it is always exactly at the stream head — a hit needs an exact version match, and the entry is written back only after a successful commit, because the inline projection mutates the very instance FetchForWriting handed out.

IAggregateWriteCache and friends live in JasperFx.Events.Fetching, so one cache implementation serves Marten, Polecat and Fisher alike. No new package lands on core Marten: the default is backed by JasperFx.Core's existing LRU rather than Microsoft.Extensions.Caching.Memory.

Docs: Optimizing Performance → Caching Aggregate Snapshots for FetchForWriting.

IDocumentSessionOperations.PendingStreams (#​5250)

Store-agnostic code can now read the StreamActions a session has queued but not yet committed — for a listener or a pre-commit hook deciding something from the events the session is about to write — without naming a store.

⚠️ Worth knowing if you are implementing these contracts yourself: this is the same non-covariance trap as 9.26's Events accessor. Marten's PendingChanges.Streams() returns IList<StreamAction>, and IList<T> is not assignable to IReadOnlyList<T>, so the member bound to the interface's throwing default with no compile error anywhere. It now carries an explicit implementation, pinned by PendingStreamActionsCompliance.

In Marten this is the same collection as IDocumentSession.PendingChanges.Streams(), handed back as a live view rather than a copy.

BinaryEventAttribute — one lookup instead of two (#​5248)

Marten.Events.BinaryEventAttribute now derives from the promoted JasperFx.Events.BinaryEventAttribute, which 2.51.0 unsealed for exactly this. EventGraph.ResolveBinarySerializerFor drops back to a single attribute lookup. Entirely non-breaking — existing [BinaryEvent] usages compile and resolve unchanged.

Compliance (#​5249)

DocumentComplianceConfig.StreamIdentity is now replayed by Marten's document compliance fixture rather than inferred, and two new shared suites are enrolled: PendingStreamActionsCompliance and AggregateWriteCacheCompliance (wave 10).

Upgrading

No breaking changes and no migration. Everything new here is opt-in.

Full changelog: JasperFx/marten@V9.26.0...V9.27.0

9.26.0

Consumes JasperFx 2.50.0, which promoted two things into the shared contracts. Both changes here are additive — existing code compiles and behaves identically.

Reach the event store from a store-agnostic session (jasperfx#​669)

JasperFx.Events.Documents gained an Events accessor on its session contracts, so a consumer that opens its own session through IDocumentSessionFactory can now reach the event store without naming Marten:

tier member
IDocumentReadOperations IQueryEventStore Events
IDocumentSessionOperations IEventStoreOperations Events

Marten implements both. This does not affect handlers taking a chain parameter — Wolverine already fills those. It matters for the two shapes where you decide when a session exists: a background or timer publisher that opens a session and appends, and a deliberate second read session opened alongside a chain's writing session.

⚠️ Worth knowing if you maintain a store or a session wrapper. C# interface implementation is not return-type covariant, so a session that already declares an Events property of its own event-store type does not satisfy the contract member — it binds to a default that throws, and the build still succeeds with zero errors. Marten's own IQuerySession.Events returns Marten.Events.IQueryEventStore, a subtype, which is exactly this case; both tiers needed an explicit implementation. The shared compliance suite is what catches it.

IEventBinarySerializer promoted to JasperFx.Events

Binary event serialization (#​4515) was Marten-specific, so a consumer compiling one body of source against several Critter Stack stores needed a separate identical serializer per store. The two-method interface and [BinaryEvent] now live in JasperFx.Events, and one serializer serves every store.

Non-breaking, in both directions:

  • Marten.Events.IEventBinarySerializer still exists and now derives from the core interface, so existing implementations keep compiling and also satisfy the core type.
  • EventGraph.UseBinarySerializer<T>, DefaultBinarySerializer, IEventStoreOptions and EventMapping.BinarySerializer widened to accept the core interface, so a store-agnostic serializer can be registered.
  • Both the Marten and the core [BinaryEvent] attributes are honored.

Fixed: binary serializer registration was order-dependent

EventMapping resolved its binary serializer in its constructor, and AddEventType<T>() builds mappings eagerly. So this threw "no IEventBinarySerializer was registered" out of what reads as a plain type registration:

opts.Events.AddEventType<SomeBinaryEvent>();          // [BinaryEvent]-marked
opts.Events.DefaultBinarySerializer = mySerializer;   // too late

while the same two lines in the opposite order worked. Resolution is lazy now, deferring the failure to first use — which is what the documentation always described. The guard is volatile, because it is read from the append path on many threads and a torn read would route a binary event down the JSON path silently rather than throwing.

Also

  • Enrolled in the two new shared compliance suites, DocumentSessionEventsCompliance and BinaryEventSerializationCompliance.
  • Docs updated: events/binary-serialization.md, documents/sessions.md.

Full changelog: JasperFx/marten@9.25.0...9.26.0

Commits viewable in compare view.

Updated Marten.EntityFrameworkCore from 9.25.0 to 9.31.2.

Release notes

Sourced from Marten.EntityFrameworkCore's releases.

9.31.2

A diagnostics-only patch release. No behavioural change to the write path.

A failed batched write now reports the SQL that failed

When a batched write failed, Marten threw a MartenCommandException whose message rendered an empty command text. Reported from the field on an async projection:

Marten Command Failure:$ $ $ 42601: syntax error at end of input POSITION: 56
Error trying to build and apply changes to event subscription MyProjection:All

The $ $ $ is the message template interpolating a command that was always null. ReadNpgsqlCommand() looks for an NpgsqlCommand in exception.Data, and on the ExecuteBatchPagesAsync path there is no single command to put there — AutoClosingLifetime transformed the exception with nothing recorded at all, and WrapAndThrow(NpgsqlBatch, ...) recorded the batch under a key that nothing ever read.

The practical consequence: the offending SQL was unrecoverable from the exception and from the logs, for every async projection write. That is precisely the situation where hand-written SQL — a QueueSqlCommand, a custom IStorageOperation, a projection side effect — turns out to be malformed, and the one thing you need to see is the statement.

MartenCommandException now recovers the SQL from three sources, in order:

  1. the NpgsqlCommand it was handed;
  2. NpgsqlException.BatchCommand — Npgsql identifies the exact statement the server rejected when the failure came out of a batch execution;
  3. an NpgsqlBatch recorded on the exception.

The recovered statement is also exposed on a new MartenCommandException.CommandText property, so it can be read programmatically rather than scraped out of the message.

AutoClosingLifetime executes its batches inline rather than through handleCommandException, so it now records its batch. The other three connection lifetimes already routed through WrapAndThrow(NpgsqlBatch, ...) and only needed a reader for the key they were already writing.

Two guardrails worth knowing about: a batch renders at most five statements, so a 500-operation projection page cannot turn one failure into an unreadable log entry, and the whole resolution is wrapped in a catch — building a diagnostic must never replace the real failure.

Also released as 8.38.1 on the 8.x line.

9.31.1

A single-fix patch release that moves Marten to JasperFx 2.61.0, picking up the source generator fix for JasperFx/jasperfx#​733. Weasel stays on 9.29.0.

Self-aggregating snapshots silently skipped a constructor-based Create

A self-aggregating snapshot may declare its Create handler as an event-shaped constructor, public Foo(FooCreated e), instead of a named static Create. That works on its own. Adding a ShouldDelete method to the same aggregate switched the source generator to a different emitter — one that built its dispatch switch from named conventional methods only — so the constructor's event type got no case arm at all.

Nothing failed loudly. The generated code compiled, the constructor never ran, and the next Apply-only event built the aggregate through RuntimeHelpers.GetUninitializedObject, skipping every field initializer. The visible symptom was an ApplyEventException wrapping a NullReferenceException out of an Apply that appended to a collection property:

JasperFx.Events.Daemon.ApplyEventException: Failure to apply event #​0 Id(...)
 ---> System.NullReferenceException: Object reference not set to an instance of an object.
   at TempGuidAggregate.Apply(TagAdded @​event)

The quieter outcome, where no Apply happens to dereference anything, is a silently blank aggregate.

Both documented workarounds — converting the constructor to a static Create, or registering the delete through DeleteEvent<T>() instead of ShouldDelete — become unnecessary on this release.

The same omission was also in the generated EventTypes property on every self-aggregating path, including the ones whose dispatch was already correct, so an aggregate with a constructor Create and no ShouldDelete gains its creating event in that list here too.

Covered by Bug_jasperfx_733_event_constructor_create_with_should_delete across inline, async and live aggregation, plus the delete arm itself. See #​5322.

9.31.0

Every fix in this release removes a silent wrong answer — not a crash, not an exception, but a plausible-looking result that was wrong with nothing to tell you so. A stream folded into partial aggregates. Paging that returned arbitrary pages. Monitoring that went dark rather than broken. A search reading a key that did not exist. An index that was never created.

Plus one genuinely new feature: weighted full text search with relevance ranking.

New: weighted full text indexes and ts_rank ordering

A full text index used to concatenate its members into one flat vector, so a match in a title was exactly as relevant as a match in a long description. Now it can be weighted, and ranked:

opts.Schema.For<Achievement>().WeightedFullTextIndex(idx => idx
    .Weighted(a => a.Title, TextSearchWeight.A)
    .Weighted(a => a.Tagline, TextSearchWeight.B)
    .Weighted(a => a.Description, TextSearchWeight.C));

var results = await session.Query<Achievement>()
    .Where(a => a.WebStyleSearch(term))
    .OrderByTextRank(term, TextSearchFunction.WebStyle)
    .ToListAsync();

The rank resolves the same tsvector the Where clause matched on, read from the index definition. That is the load-bearing design constraint rather than an implementation detail: a rank computed over a different vector than the filter matched on returns rows in an order that looks plausible and means nothing — a far quieter failure than returning the wrong rows.

Requires Weasel 9.29.0 (weasel#​541), which made it possible to index an expression that is already a tsvector. See the full text documentation for the costs worth knowing first — GIN cannot order, so this is a post-filter sort; and adding weights to an existing index drops and recreates it.

Silent wrong answers, fixed

Async projections folded one stream into several partial aggregates (#​5305, originally #​4085). When a stream's events disagreed about tenant_id, the daemon sliced it per tenant and applied the pieces over each other, so an Apply saw a document with every property at its default. Marten had set ForceSingleTenancy since the original fix, but TenantedEventSlicer honoured that flag on only one of its two overloads — and the async daemon reaches the other one. The flag was being set on precisely the path that could not read it. Fixed upstream in JasperFx 2.58.0.

OrderBy after a GroupJoin/SelectMany was dropped from the SQL (#​5311). Silently, and with Skip/Take it was worse: OFFSET and LIMIT were emitted while the ordering was not, and unordered paging in PostgreSQL has no stable row order — so rows repeat across pages while others never appear. Where on a bare-side selector and Count over a join were wrong in the same surface and are fixed too.

A store with monitoring off dropped the monitoring columns another store had added (#​5309). Two DocumentStores over one DatabaseSchemaName that disagreed about EnableExtendedProgressionTracking kept stripping each other's mt_event_progression columns — last writer wins, silent on both sides. A service beside a seeder or a reporting job is an ordinary arrangement, and neither was doing anything wrong. The shape of that table no longer depends on configuration at all.

Full text search rewrote JSON keys, not just the column (#​5314, thanks @​mlh758). A member whose serialized name contained data produced d.data ->> 'd.data' — a key that does not exist. Two quiet consequences: that member contributed nothing to the search, and the expression no longer matched the index, so the GIN index could not serve the query either.

A second full text index over different members was silently discarded (#​5315). Index names derive from the table rather than from the members, so two FullTextIndex() calls collided by construction and the second was thrown away — never registered, never created, never searched. Ambiguity is now refused with an explanatory exception instead of resolved by declaration order.

A DCB boundary aggregate failed far from its cause (JasperFx 2.60.0). An identity-less [BoundaryAggregate] folded by Evolve(IEvent) got no evolver and no diagnostic, surfacing much later as FetchForWritingByTags<T> throwing "No source-generated dispatcher found" — naming neither the type nor the reason. Now it generates, and a [BoundaryAggregate] with nothing to fold events with is reported as JFXEVT007.

A DCB tag version was captured after the events were read (#​5300). Two batched statements do not share a READ COMMITTED snapshot, so the version could reflect a concurrent append. Captured before the read now.

Also in this release

  • A projection-run CLI command arrives with JasperFx 2.60.0 and needs no Marten change — every host referencing JasperFx.Events picks it up. It replays one projection over a stream slice or DCB tag match and prints per-event before/after state, writing nothing.
  • Bug_5268's concurrent index test no longer depends on how much unrelated transaction load happens to be in flight (#​5308), so validating a dependency bump by running the whole suite at once is trustworthy again.
  • BuildSlicer now agrees with FetchAsyncPlan about global aggregates (#​5307). Alignment rather than a fix — no reachable corruption depended on it, and the reasoning is written down at the call site so the question does not have to be reconstructed next time.

Upgrade notes

OrderByFragment.Expressions changed from List<string> to List<ISqlFragment>. A public API break, deliberately taken: an ordering could not carry a parameter while the clause was a list of strings, which is why the older ngram ranking inlines its search term rather than binding it. Nothing outside Marten's own LINQ internals is likely to touch this type, but it is a compile break if you did.

... (truncated)

9.30.0

Dependencies move to Weasel 9.27.0 and JasperFx 2.56.0.

Several fixes in this release share a failure mode worth calling out on its own: the write succeeded, the read disagreed, and nothing anywhere reported an error. Two of them ran undetected in production for weeks.

Patching

  • #​5290 — the patching API built its JSON paths from raw C# member names, so a member carrying [JsonPropertyName] (or [JsonProperty] under Newtonsoft) was patched at a path the serializer never reads. The patch reported success, Load and Query kept returning the old value, and the phantom node was erased by the next full save — so there was no durable evidence anything had gone wrong. Patch paths now resolve through the same member machinery the LINQ provider uses, so Where(x => x.Name == v) and Patch(...).Set(x => x.Name, v) agree about where a member lives by construction. The predicate overloads had the same gap and are fixed with it.
  • #​5295 — a patch that moves a value the schema also keeps in a .Duplicate() column now refreshes that column in more of the cases that need it: an aliased member, a patch on a parent of the duplicated member, and the destinations of the patching API's own Duplicate and Rename operations. Left unfixed, the document and the index that exists to search it disagreed — Load returned the new value while Query filtered on the same member returned nothing.

DCB

  • #​5268 — Events.BuildHStoreTagIndexConcurrently builds the hstore tag index without holding ACCESS EXCLUSIVE on mt_events for the duration. On an ordinary event table that is CREATE INDEX CONCURRENTLY; under Events.UseTenantPartitionedEvents, where PostgreSQL refuses CONCURRENTLY on a partitioned parent outright, Marten emits the per-partition sequence it does accept. Opt-in, because a concurrent build cannot run inside a transaction and so changes what db-patch and db-dump write out. The out-of-band route from 9.29.0 (Events.IgnoreIndex(EventGraph.HStoreTagIndexName)) still works and is still supported.
  • #​5276 (thanks @​Noblix) — a session that fetched a DCB boundary, decided it had nothing to append, and saved anyway still bumped the mt_dcb_tag_version rows, invalidating a concurrent session that did have something to append. A boundary is now only enforced when the save actually appends. #​5280 covers the repeated-fetch half: each row is asserted exactly once, oldest capture wins.
  • #​5283 / #​5286 — tag rules. Events.TagWith<T>(...) states once how an event is tagged and applies it wherever the event is built — ordinary appends, StartStream, aggregate handlers and bulk inserts alike — closing the gaps tag inference leaves open. Events.TagEventsBy(...) hands over a translator an application already owns instead of restating it one registration at a time.

LINQ

  • #​5279 (thanks @​svenclaesson) — two enum value-collection filters that silently returned zero rows. x.EnumArray.Contains(variable) resolved to the MemoryExtensions.Contains comparer overload rather than Enumerable.Contains, because enums do not implement IEquatable<T>; with ImplicitUsings on, most applications hit this by default.
  • #​5287 — a HashSet<TEnum> in a Contains filter now projects to something Npgsql can bind.
  • #​5289 (thanks @​arnelirobles) — the parameterised MatchesJsonPath(sql, params object[]) overload threw for every call. It now works for any argument type, maps null onto DBNull, and reports a placeholder/parameter count mismatch with a message naming both counts instead of an IndexOutOfRangeException from inside the LINQ provider. Worth knowing: ^ is the placeholder character for that overload and is also a regex anchor, so it lands inside JSONPath literals by accident.

Async daemon

  • #​5277 — the skip-ahead probe asked for min(seq_id) over a join, and PostgreSQL only rewrites MIN into an ordered index scan when the aggregate's input is a single relation. The probe therefore scanned every remaining row in the partition, on the one code path that exists precisely because the store is too large for the normal query to finish.
  • JasperFx 2.56.0 brings three high-water fixes reachable under load, including one from a deployment running 2,173 tenants across 512 shard databases (thanks @​erdtsieck): a tenant agent seeded below its own committed position no longer pauses permanently, high water is primed exactly once so concurrent agent starts cannot read it at zero, and per-tenant catch-up no longer silently skips a tenant a concurrent reconciliation dropped. The middle one is not tenancy-specific — it is the shape behind an unexplained Paused shard after a rollout.

9.29.0

Data-loss and silent-failure fixes across the event append path, DCB tagging, and schema naming. Two of these lose or drop data with no error at all, so they are worth reading even if the rest is not relevant to you.

Data loss

A retried commit could lose its events entirely (#​5262). QuickAppendEventsOperationBase released its pooled parameter buffers in PostprocessAsync, but the resilience pipeline can re-execute the same NpgsqlBatch — and a released PooledList reports Count = 0, which Npgsql binds as the array length. The retry sent empty event arrays, mt_quick_append_events wrote nothing and raised nothing, and SaveChangesAsync returned success having committed the documents without the events. The rentals now belong to the unit of work.

Commits are no longer retried when the outcome is unknown (#​5262). A commit carries event appends and is not idempotent, so replaying one that already committed server-side appends the events twice. SaveChangesAsync now runs through a separate write pipeline that retries only when the previous attempt is known to have left nothing behind — a transient error PostgreSQL reported itself, or a failure Marten's own post-processing raised and rolled back. A command timeout or a dropped connection now surfaces instead of being replayed.

This is deliberately not NpgsqlException.IsTransient, whose definition is built for idempotent work and includes the whole connection-exception class. ConfigurePolly and ExtendPolly now govern reads only; ConfigureWritePolly / ExtendWritePolly are new for the commit path. See Resiliency Policies.

Only the first DCB tag of a given type was stored (#​5265). mt_quick_append_events carries one array per tag type, parallel to the events, so it had exactly one slot per (event, tag type). An event legitimately carrying two tags of one type lost the rest — and a lost tag is not an error to a DCB query, it is simply absent from the answer. The surplus is now written as ordinary tag rows. In DcbStorageMode.HStore, which cannot represent the case at all, this now throws rather than dropping silently.

Schema

Long primary key constraint names could collide outright. A document table's PK constraint was left on Weasel's pkey_{table}_{columns} default, which passes 63 characters for a document type of no great length once tenant_id joins the key. PostgreSQL truncates rather than rejecting, and the constraint's backing index is schema-scoped, so two document types whose names agree for long enough failed with 42P07 relation "pkey_..." already exists. Also fixed for the natural key table (#​5271). No-op for any schema that was not already being truncated.

Multi-database tenancy ignored Command Timeout on shard connection strings (#​5269). StoreOptions.CommandTimeout was only ever raised from StoreOptions.Connection(...), which multi-database setups never call — so every command ran at the 5 second default no matter what the shards said. The database being used now has a say. An explicitly set store-wide value still wins.

FetchForWritingByTags broke later full-schema operations (#​5264). EventGraph.Build<TDoc>() resolved the id type through MappingFor, which registers a DocumentMapping as a side effect — so a pure [BoundaryAggregate], which has no identity by design, became a document type with no IdMember. ResetAllData, ApplyAllConfiguredChangesToDatabaseAsync and the db-patch / db-apply commands then threw.

Projections and DCB

EF Core projection rebuilds corrupted the DbContext (#​5266). The daemon applies a range's slices through a 10-wide block, all sharing one storage instance — and the EF Core storage wraps a single non-thread-safe DbContext. Requires JasperFx 2.53.0, which lets a storage declare it cannot take concurrent slices.

Bulk-imported events now carry DCB tags in hstore mode (#​5267), thanks to @​erdtsieck. Previously every bulk-imported event landed untagged, so a store whose history arrived by migration had a consistency boundary that silently excluded most of it.

The DCB hstore tag index can be built out of band (#​5268). Enabling hstore mode on an existing store built a GIN index under ACCESS EXCLUSIVE — a write outage rather than a migration, with no way around it under per-tenant partitioning. EventGraph.HStoreTagIndexName can now be passed to Events.IgnoreIndex so an operator builds it themselves; see the DCB docs for the procedure.

A lost append race under conjoined tenancy surfaced as a raw PostgresException (#​5270). The exception transform recognised the stream-version guard index by an enumerated list of names, and partitioning gives each partition a differently-named child index. It was missing three, not one — including on the single-tenant configuration #​3520 was meant to have fixed. Now matched by shape.

Also

  • The Inline FetchForWriting aggregate cache now really does skip the snapshot load — IdentityMapDocumentStorage.LoadManyAsync was issuing an empty-id query even when the item map had satisfied everything (#​5258, #​5259, #​5260).
  • Weasel 9.25.1 and JasperFx 2.53.0. Do not pin Weasel 9.25.0 — its identifier validation rejects primary key constraint names that PostgreSQL accepts, which breaks Marten in two places, one of them silently.

Thanks

@​erdtsieck for #​5262, #​5264, #​5267, #​5268 and #​5269 — several of these were forensic reports of silent data loss with the mechanism worked out, which is how they got fixed this quickly. @​Noblix for the #​5265 repro.

9.28.0

Full Changelog: JasperFx/marten@V9.27.0...V9.28.0

What's Changed

Full Changelog: JasperFx/marten@V9.27.0...V9.28.0

9.27.0

Adopts JasperFx 2.51.0 and the four capabilities it promotes into the shared Critter Stack contracts. One of them is a genuinely new Marten feature; the other three close gaps where Marten had the capability but not under the shared spelling.

Aggregate snapshot caching for FetchForWriting (#​5251)

An opt-in, node-local cache of aggregate snapshots that lets FetchForWriting skip loading the stored snapshot and read only the events after it — effectively an identity map for aggregates with a lifetime longer than a session. Off for every aggregate type; enabled per type, because the win is proportional to how often one stream is fetched for writing:

opts.Events.CacheAggregatesForWriting<Order>(sizeLimit: 1000);

The cached snapshot is only ever a baseline. The stream version and every event after the cached version are still read on every call, and the optimistic concurrency assertion on append is untouched — so a stale entry costs a larger delta query, never a wrong aggregate and never a suppressed EventStreamUnexpectedMaxEventIdException. That is what makes a deliberately incoherent, node-local cache the right shape here, and why there is no distributed-cache option: a distributed cache would reintroduce exactly the round trip this exists to remove.

Both the Async and Inline lifecycles are supported, and they genuinely differ. An Inline snapshot is written in the same transaction as the events, so it is always exactly at the stream head — a hit needs an exact version match, and the entry is written back only *after...

_Description has bee...

Description has been truncated

@dependabot
chore(deps): Bump the minor-and-patch group with 11 updates
28be724 
Bumps Anthropic from 12.40.0 to 12.45.0
Bumps Aspire.Npgsql from 13.4.6 to 13.5.3
Bumps Marten from 9.25.0 to 9.31.2
Bumps Marten.EntityFrameworkCore from 9.25.0 to 9.31.2
Bumps OpenTelemetry from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Api from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Extensions.Hosting from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.17.0 to 1.18.0
Bumps OpenTelemetry.Instrumentation.Http from 1.17.0 to 1.18.0
Bumps SonarAnalyzer.CSharp from 10.32.0.713 to 10.33.0.1635

---
updated-dependencies:
- dependency-name: Anthropic
  dependency-version: 12.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Aspire.Npgsql
  dependency-version: 13.5.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Marten
  dependency-version: 9.31.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Marten.EntityFrameworkCore
  dependency-version: 9.31.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry.Api
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: SonarAnalyzer.CSharp
  dependency-version: 10.33.0.1635
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Sep 3, 2026
@dependabot dependabot Bot mentioned this pull request Sep 3, 2026
Closed
@github-actions

github-actions Bot commented Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
See the Details below.

License Issues

backend/src/RunCoach.Api/RunCoach.Api.csproj

PackageVersionLicenseIssue Type
Weasel.Storage9.29.0NullUnknown License
Allowed Licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD, Unlicense, CC0-1.0, CC-BY-4.0, OFL-1.1, Zlib, BSL-1.0, Python-2.0, PSF-2.0, Artistic-2.0, MPL-2.0, WTFPL, PostgreSQL
Excluded from license check: pkg:githubactions/SonarSource/sonarqube-scan-action, pkg:nuget/SonarAnalyzer.CSharp, pkg:npm/runcoach-frontend

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
nuget/Anthropic 12.45.0 UnknownUnknown
nuget/Aspire.Npgsql 13.5.3 UnknownUnknown
nuget/JasperFx 2.61.0 UnknownUnknown
nuget/JasperFx.Events 2.61.0 UnknownUnknown
nuget/Marten 9.31.2 UnknownUnknown
nuget/Marten.EntityFrameworkCore 9.31.2 UnknownUnknown
nuget/OpenTelemetry 1.18.0 🟢 8.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 41 contributing companies or organizations
nuget/OpenTelemetry.Api 1.18.0 🟢 8.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 41 contributing companies or organizations
nuget/OpenTelemetry.Api.ProviderBuilderExtensions 1.18.0 🟢 8.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 41 contributing companies or organizations
nuget/OpenTelemetry.Exporter.OpenTelemetryProtocol 1.18.0 🟢 8.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 41 contributing companies or organizations
nuget/OpenTelemetry.Extensions.Hosting 1.18.0 🟢 8.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Pinned-Dependencies🟢 10all dependencies are pinned
CII-Best-Practices🟢 5badge detected: Passing
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Security-Policy🟢 10security policy file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 41 contributing companies or organizations
nuget/OpenTelemetry.Instrumentation.AspNetCore 1.18.0 🟢 8.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
License🟢 10license file detected
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices🟢 5badge detected: Passing
Packaging🟢 10packaging workflow detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Security-Policy🟢 10security policy file detected
SAST🟢 10SAST tool is run on all commits
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 23 contributing companies or organizations
nuget/OpenTelemetry.Instrumentation.Http 1.18.0 🟢 8.8
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
Dependency-Update-Tool🟢 10update tool detected
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
License🟢 10license file detected
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
CII-Best-Practices🟢 5badge detected: Passing
Packaging🟢 10packaging workflow detected
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Security-Policy🟢 10security policy file detected
SAST🟢 10SAST tool is run on all commits
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
CI-Tests🟢 1030 out of 30 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 10project has 23 contributing companies or organizations
nuget/SonarAnalyzer.CSharp 10.33.0.1635 🟢 5.7
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
SAST⚠️ 0no SAST tool detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Binary-Artifacts🟢 6binaries present in source code
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Fuzzing🟢 10project is fuzzed
nuget/Weasel.Core 9.29.0 UnknownUnknown
nuget/Weasel.EntityFrameworkCore 9.29.0 UnknownUnknown
nuget/Weasel.Postgresql 9.29.0 UnknownUnknown
nuget/Weasel.Storage 9.29.0 UnknownUnknown
nuget/SonarAnalyzer.CSharp 10.33.0.1635 🟢 5.7
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
SAST⚠️ 0no SAST tool detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Binary-Artifacts🟢 6binaries present in source code
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Fuzzing🟢 10project is fuzzed

Scanned Files

  • backend/src/RunCoach.Api/RunCoach.Api.csproj
  • backend/tests/RunCoach.Api.Tests/RunCoach.Api.Tests.csproj

@leehopper leehopper mentioned this pull request Sep 4, 2026
Merged
2 tasks
@leehopper
leehopper enabled auto-merge (squash) September 5, 2026 00:09
@leehopper
leehopper merged commit ef5792f into main Sep 5, 2026
16 checks passed
@dependabot
dependabot Bot deleted the dependabot/nuget/backend/minor-and-patch-4d419ea6c5 branch September 5, 2026 00:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

DevTunnel port resources are Running but Dashboard URLs are empty in 13.5.0 Graph view crashes with 'multiple root elements' on AddBlobs

1 participant

@leehopper