Skip to content

chore(deps): Bump the minor-and-patch group with 9 updates#89

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/nuget/backend/minor-and-patch-d9d24730f0
Open

chore(deps): Bump the minor-and-patch group with 9 updates#89
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/nuget/backend/minor-and-patch-d9d24730f0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 7, 2026

Updated Anthropic from 12.16.0 to 12.20.0.

Updated Aspire.Npgsql from 13.2.3 to 13.2.4.

Release notes

Sourced from Aspire.Npgsql's releases.

13.2.4

Aspire 13.2.4

What's New in Aspire 13.2.4

Patch release addressing a security advisory in OpenTelemetry dependencies.

🐛 Fixes

  • 🔒 Bumped OpenTelemetry dependencies to address CVE-2026-40894 (#​16420)

🏷️ Housekeeping

  • 🚀 Bumped branding to
    13.2.4 (#​16436)

Commits viewable in compare view.

Updated Marten from 8.32.1 to 8.36.0.

Release notes

Sourced from Marten's releases.

8.36.0

Highlights

Marten 8.36.0 closes out #​4329 by adopting JasperFx.Events 1.35.0 and ships the corresponding docs and integration tests, plus a separately-tracked docs improvement for modular IConfigureMarten projection registration (#​4326) and two LINQ fixes.

  • Composite-projection cache eviction fix (via JasperFx.Events 1.35.0). Per-projection aggregate caches are no longer compacted between stages of a composite projection — each stage's cache stays at full size for the entire composite batch and is trimmed as a unit at the composite boundary. Options.CacheLimitPerTenant is a memory tunable again, not a correctness lever for downstream EnrichWith<T> / TryFindUpstreamCache lookups.
  • ForEntityIds for fan-out enrichment (via JasperFx.Events 1.35.0). New first-class declarative shape for events that reference several entities of the same type: 
    await group
    .EnrichWith<Provider>()
    .ForEvent<ShiftScheduled>()
    .ForEntityIds(e => e.ProviderIds)
    .AddReferences();
  • Cross-stage document visibility docs. composite.md calls out that downstream stages can't SQL-query upstream stages' in-flight writes, lists the four supported alternatives (Updated<T> synthetic events, EnrichWith<T>().AddReferences(), TryFindUpstreamCache<TId, T>, ReferencePeerView<T>), and includes inline samples sourced from the integration tests.
  • IConfigureMarten + DI projection registration docs. New section in events/projections/ioc.md showing how a module-style configuration can register a service-aware projection by taking its dependencies through the IConfigureMarten constructor and building the projection inside Configure(...). Closes #​4326.
  • LINQ fixes. string[].Contains parse failure under C# 14 + nullable + method init (#​4332), and Where clauses on the inner source of GroupJoin are now honored.

What's Changed

New Contributors

Full Changelog: JasperFx/marten@V8.35.0...V8.36.0

8.35.0

Heads up, this will cause a DDL change for some upsert functions due to a bug that was only apparent under high concurrency

What's Changed

Full Changelog: JasperFx/marten@V8.34.2...V8.35.0

8.34.2

What's Changed

Patch release. One bug fix.

  • Fix multi-property record structs misclassified as strong-typed-id wrappers by @​jeremydmiller in Fix multi-property record structs misclassified as strong-typed-id wrappers JasperFx/marten#4322 — when a document property's type was a multi-field record struct like Money(decimal Value, Guid CurrencyId), the LINQ resolver would throw BadLinqExpressionException on any nested member access (x.MoneyProp.Amount > 0). Root cause was ValueTypeIdGeneration.IsCandidate filtering properties only to those in DocumentMapping.ValidIdTypes (Guid/int/long/string), so a multi-field struct with a single matching property + a static Zero(Guid) builder got misdetected as a strong-typed-id wrapper. As a side effect the misdetection registered Money as a uuid column on Weasel's global PostgresqlProvider.Instance, poisoning LINQ resolution for the rest of the process. Fix: reject types whose canonical constructor takes more than one parameter before any further matching. Reported with full root-cause analysis by @​mmidkiff.

Full Changelog: JasperFx/marten@V8.34.1...V8.34.2

8.34.1

What's Changed

Patch release. Two fixes — one regression in the cold-start path, one Scoped-subscription bug that's been latent since AddSubscriptionWithServices shipped.

  • Bump JasperFx.Events 1.31.0 → 1.31.1 by @​jeremydmiller in Bump JasperFx.Events 1.31.0 -> 1.31.1 (CultureNotFoundException fix) JasperFx/marten#4321 — picks up the JasperFx fix for CultureNotFoundException at DocumentStore..ctor on hosts running with <InvariantGlobalization>true</InvariantGlobalization> (implied by <PublishAot>true</PublishAot>). The cold-start prefilter in ProjectionGraph.IsAssemblyKnownToHaveNoEvolvers was reading assembly.GetName().Name, which under invariant-globalization mode throws on culture-tagged satellite assemblies like pt-br. Reported today against the cold-start optimization changes that landed in 8.34.0.
  • Fix #​4318: ScopedSubscriptionServiceWrapper drops Options/Name/Version by @​jeremydmiller in Fix #4318: ScopedSubscriptionServiceWrapper drops Options/Name/Version JasperFx/marten#4320 — when a subscriber registered via AddSubscriptionWithServices<T>(ServiceLifetime.Scoped, configure) set Options.BatchSize, Options.SubscribeFromPresent(), Name, or Version in its constructor, those values were silently lost. Only IncludedEventTypes, StreamType, and IncludeArchivedEvents were copied from the resolved inner T to the wrapper. The Singleton path was unaffected. Thanks to @​Casper-Olsen for the root-cause analysis.

Full Changelog: JasperFx/marten@V8.34.0...V8.34.1

8.34.0

What's Changed

This release rolls in the JasperFx 1.28 / JasperFx.Events 1.31 upgrade chain, several cold-start and runtime-perf optimizations, two stability fixes (advisory locks, projection version suffix), and a new declarative ancillary-store enrichment API.

Full Changelog: JasperFx/marten@V8.33.0...V8.34.0

8.33.0

What's Changed

New Contributors

Full Changelog: JasperFx/marten@V8.32.1...V8.33.0

Commits viewable in compare view.

Updated Marten.EntityFrameworkCore from 8.32.1 to 8.36.0.

Release notes

Sourced from Marten.EntityFrameworkCore's releases.

8.36.0

Highlights

Marten 8.36.0 closes out #​4329 by adopting JasperFx.Events 1.35.0 and ships the corresponding docs and integration tests, plus a separately-tracked docs improvement for modular IConfigureMarten projection registration (#​4326) and two LINQ fixes.

  • Composite-projection cache eviction fix (via JasperFx.Events 1.35.0). Per-projection aggregate caches are no longer compacted between stages of a composite projection — each stage's cache stays at full size for the entire composite batch and is trimmed as a unit at the composite boundary. Options.CacheLimitPerTenant is a memory tunable again, not a correctness lever for downstream EnrichWith<T> / TryFindUpstreamCache lookups.
  • ForEntityIds for fan-out enrichment (via JasperFx.Events 1.35.0). New first-class declarative shape for events that reference several entities of the same type: 
    await group
    .EnrichWith<Provider>()
    .ForEvent<ShiftScheduled>()
    .ForEntityIds(e => e.ProviderIds)
    .AddReferences();
  • Cross-stage document visibility docs. composite.md calls out that downstream stages can't SQL-query upstream stages' in-flight writes, lists the four supported alternatives (Updated<T> synthetic events, EnrichWith<T>().AddReferences(), TryFindUpstreamCache<TId, T>, ReferencePeerView<T>), and includes inline samples sourced from the integration tests.
  • IConfigureMarten + DI projection registration docs. New section in events/projections/ioc.md showing how a module-style configuration can register a service-aware projection by taking its dependencies through the IConfigureMarten constructor and building the projection inside Configure(...). Closes #​4326.
  • LINQ fixes. string[].Contains parse failure under C# 14 + nullable + method init (#​4332), and Where clauses on the inner source of GroupJoin are now honored.

What's Changed

New Contributors

Full Changelog: JasperFx/marten@V8.35.0...V8.36.0

8.35.0

Heads up, this will cause a DDL change for some upsert functions due to a bug that was only apparent under high concurrency

What's Changed

Full Changelog: JasperFx/marten@V8.34.2...V8.35.0

8.34.2

What's Changed

Patch release. One bug fix.

  • Fix multi-property record structs misclassified as strong-typed-id wrappers by @​jeremydmiller in Fix multi-property record structs misclassified as strong-typed-id wrappers JasperFx/marten#4322 — when a document property's type was a multi-field record struct like Money(decimal Value, Guid CurrencyId), the LINQ resolver would throw BadLinqExpressionException on any nested member access (x.MoneyProp.Amount > 0). Root cause was ValueTypeIdGeneration.IsCandidate filtering properties only to those in DocumentMapping.ValidIdTypes (Guid/int/long/string), so a multi-field struct with a single matching property + a static Zero(Guid) builder got misdetected as a strong-typed-id wrapper. As a side effect the misdetection registered Money as a uuid column on Weasel's global PostgresqlProvider.Instance, poisoning LINQ resolution for the rest of the process. Fix: reject types whose canonical constructor takes more than one parameter before any further matching. Reported with full root-cause analysis by @​mmidkiff.

Full Changelog: JasperFx/marten@V8.34.1...V8.34.2

8.34.1

What's Changed

Patch release. Two fixes — one regression in the cold-start path, one Scoped-subscription bug that's been latent since AddSubscriptionWithServices shipped.

  • Bump JasperFx.Events 1.31.0 → 1.31.1 by @​jeremydmiller in Bump JasperFx.Events 1.31.0 -> 1.31.1 (CultureNotFoundException fix) JasperFx/marten#4321 — picks up the JasperFx fix for CultureNotFoundException at DocumentStore..ctor on hosts running with <InvariantGlobalization>true</InvariantGlobalization> (implied by <PublishAot>true</PublishAot>). The cold-start prefilter in ProjectionGraph.IsAssemblyKnownToHaveNoEvolvers was reading assembly.GetName().Name, which under invariant-globalization mode throws on culture-tagged satellite assemblies like pt-br. Reported today against the cold-start optimization changes that landed in 8.34.0.
  • Fix #​4318: ScopedSubscriptionServiceWrapper drops Options/Name/Version by @​jeremydmiller in Fix #4318: ScopedSubscriptionServiceWrapper drops Options/Name/Version JasperFx/marten#4320 — when a subscriber registered via AddSubscriptionWithServices<T>(ServiceLifetime.Scoped, configure) set Options.BatchSize, Options.SubscribeFromPresent(), Name, or Version in its constructor, those values were silently lost. Only IncludedEventTypes, StreamType, and IncludeArchivedEvents were copied from the resolved inner T to the wrapper. The Singleton path was unaffected. Thanks to @​Casper-Olsen for the root-cause analysis.

Full Changelog: JasperFx/marten@V8.34.0...V8.34.1

8.34.0

What's Changed

This release rolls in the JasperFx 1.28 / JasperFx.Events 1.31 upgrade chain, several cold-start and runtime-perf optimizations, two stability fixes (advisory locks, projection version suffix), and a new declarative ancillary-store enrichment API.

Full Changelog: JasperFx/marten@V8.33.0...V8.34.0

8.33.0

What's Changed

New Contributors

Full Changelog: JasperFx/marten@V8.32.1...V8.33.0

Commits viewable in compare view.

Updated SonarAnalyzer.CSharp from 10.24.0.138807 to 10.25.0.139117.

Release notes

Sourced from SonarAnalyzer.CSharp's releases.

10.25

?

Feature

  • NET-3613 - Support Cobertura coverage file format
    • Cobertura report paths can be passed via the sonar.cs.cobertura.reportsPaths parameter
  • NET-3665 - Update RSPEC before 10.25 release

False Positive

  • NET-3640 - Fix S3400 FP: Don't report function with conditional compilation body

Commits viewable in compare view.

Updated WolverineFx from 5.32.1 to 5.37.2.

Release notes

Sourced from WolverineFx's releases.

5.37.2

What's Changed

Full Changelog: JasperFx/wolverine@V5.37.0...V5.37.2

5.37.0

What's Changed

Full Changelog: JasperFx/wolverine@v5.36.1...V5.37.0

5.36.1

Upgrade to this version please if you use the EF Core transactional middleware and are using a very recent version of Wolverine

What's Changed

Full Changelog: JasperFx/wolverine@V5.36.0...v5.36.1

5.36.0

What's Changed

Full Changelog: JasperFx/wolverine@V5.35.2...V5.36.0

5.35.2

What's Changed

A small bug-fix and dependency-refresh release.

Persistence fixes

  • Oracle: timestamp default expressions now survive non-UTC DB sessions (#​2634) — OracleMessageStore.Initialize and the surrounding schema declared timestamp columns (health_check, started, posted, etc.) with a DEFAULT of SYS_EXTRACT_UTC(SYSTIMESTAMP). That returns a TIMESTAMP without a time zone, and when implicitly cast into the TIMESTAMP WITH TIME ZONE column Oracle stamps it with the session time zone — so for any session in UTC+N the just-persisted value's UTC equivalent was N hours in the past. That tripped the NodeAgentController.DoHealthChecksAsync staleness filter and surfaced as a NullReferenceException during the first leadership-election heartbeat (self!.AssignAgents([LeaderUri]) on a null self). All 18 occurrences swapped to SYSTIMESTAMP AT TIME ZONE 'UTC', with quote-doubling for the DDL contexts that go through Weasel's EXECUTE IMMEDIATE '...' wrapper.

Reliability hardening

  • Lock dbcontrol:// and oraclecontrol:// endpoints to BufferedInMemory (#​2637) — the database-backed control transport carries inter-node leader-election and agent-reassignment commands. Marking either endpoint Durable would route every control envelope through the same store-backed inbox/outbox the durability agent itself owns (deadlock); marking it Inline contradicts the batched-poll semantics. Both DatabaseControlEndpoint and OracleControlEndpoint now override supportsMode so any policy that tries to flip them off BufferedInMemory either silently skips (UseDurableInboxOnAllListeners, UseDurableOutboxOnAllSendingEndpoints, etc., already check SupportsMode) or fails fast with a clear InvalidOperationException.

Source-gen / startup

  • Aggregate IWolverineTypeLoader across all known assemblies (#​2632) by @​devployment — since 5.34.0, hosts on the source-generated codegen path silently dropped handlers that lived in referenced assemblies because tryDiscoverTypeLoaderFromAttribute only inspected Options.ApplicationAssembly. First invocation of one of those handlers threw IndeterminateRoutesException. The runtime now walks ApplicationAssembly and every assembly in Discovery.Assemblies, collects every [WolverineTypeManifest] loader it finds, and exposes their union via the new internal CompositeWolverineTypeLoader. Existing single-loader semantics are preserved when only one manifest is found.

Other

  • Saga timeout flag + scheduled-dispatch Activity tag (#​2631) by @​jeremydmiller — surfaces saga timeout and scheduled-dispatch metadata so the upcoming CritterWatch saga visualization can render in-flight saga state.

Dependencies

  • Bump JasperFx 1.28.0 → 1.28.2 and JasperFx.Events 1.29.0 → 1.31.1 (#​2638).

Full Changelog: JasperFx/wolverine@V5.35.1...V5.35.2

5.35.1

What's Changed

A bug-fix and small-feature release covering Oracle-in-Balanced-mode startup, a duplicate-poller defect on RavenDb, an AWS SQS sharded-slot naming fix, and a new SagaDescriptor surface for CritterWatch.

Persistence fixes

  • Oracle in DurabilityMode.Balanced now boots (#​2622) — OracleMessageStore.Initialize was a no-op, so hosts using Oracle persistence in Balanced mode failed to start with ArgumentOutOfRangeException("ControlEndpoint cannot be null for this usage"). The fix mirrors MessageDatabase.Initialize for Oracle and stands up a parallel OracleControlTransport / OracleControlEndpoint / OracleControlSender / OracleControlListener set under the new oraclecontrol:// protocol — necessary because the shared DatabaseControlSender / DatabaseControlListener assume @-prefixed placeholders and Guid values that map directly onto a DbParameter, neither of which Oracle accepts (:-prefixed placeholders, RAW(16) id columns requiring byte[]). Also fixes a latent OracleMessageStore.EnqueueAsync no-op that left LogRecordsAsync silently dropping node records, and makes FetchRecentRecordsAsync DBNull-safe on the description column. Adds a new OracleTests.LeaderElection project so the leadership-compliance suite runs against Oracle (marked [Trait("Category","Flaky")] because the suite needs careful TM/DML lock sequencing between back-to-back runs).

  • RavenDb: only one durability agent polls after host start (#​2623, #​2629) by @​Bishbulb (root-cause investigation and original fix) and @​jeremydmiller — RavenDbMessageStore.StartScheduledJobs eagerly built and started a RavenDbDurabilityAgent at boot in addition to the agent that NodeAgentController already builds and starts via IAgentFamily / MessageStoreCollection. Two RavenDbDurabilityAgent instances then polled the same database concurrently, both believed they held the scheduled-job lock, raced to mark the same envelopes Incoming, and surfaced ConcurrencyException plus double-fired timeouts. Drops the eager StartTimers() call; the cluster-managed agent is now the single owner of polling. The agent returned from StartScheduledJobs is held by WolverineRuntime.DurableScheduledJobs purely for its disposal-time StopAsync. Comes with a reflection-free regression test (added RavenDbDurabilityAgent.IsPolling and CompositeAgent.InnerAgents for the test to enumerate without poking at private fields). A companion regression-guard test for CosmosDb is included; investigation showed the equivalent CosmosDb path does NOT have the bug today (CosmosDbMessageStore.BuildAgentFamily returns null and Uri uses the cosmosdb:// scheme rather than wolverinedb://, so MessageStoreCollection never registers a competing agent).

Other improvements

  • AWS SQS: correct naming for sharded slot endpoints in #​1f294ce5 — fixes a regression where sharded slot endpoint URIs were assembled with the wrong segment ordering, causing the consumer side to listen at the wrong queue.

  • SagaDescriptor exported via ServiceCapabilities in #f0998c7b — adds a saga-shape descriptor (saga type, id type, current state) to the capabilities exporter so CritterWatch can surface saga inventory and current state in its dashboard.

Full Changelog: JasperFx/wolverine@V5.34.0...V5.35.1

5.34.0

What's Changed

This release introduces three new features (Claim Check pattern, declarative Polecat data requirements, and a new opt-in WolverineFx.RuntimeCompilation package as the first step toward AOT compatibility), a fix for a long-standing service-location footgun, several real RavenDB and EF Core durability fixes, plus the cold-start prep work done as part of issue #​1577.

Highlights

  • Add Claim Check / DataBus pattern with [Blob] attribute (#​2412) by @​jeremydmiller in #​2617 — off-load large message-property payloads to external storage on send and re-hydrate them on receive, so the on-the-wire envelope stays small. Core abstractions (IClaimCheckStore, ClaimCheckToken, [Blob], FileSystemClaimCheckStore, opts.UseClaimCheck(...)) live in Wolverine.Persistence. Two new backend NuGet packages ship alongside: WolverineFx.ClaimCheck.AzureBlobStorage and WolverineFx.ClaimCheck.AmazonS3. New documentation page under /guide/durability/claim-checks.
  • Declarative data-requirement attributes for Polecat (#​2552) by @​jeremydmiller in #​2615 — [DocumentExists<T>], [DocumentDoesNotExist<T>], and PolecatOps.Document<T>().MustExist(...) / .MustNotExist(...) mirror the Marten ergonomics, with the same batch-query optimization that folds multiple existence checks into a single Polecat IBatchedQuery round-trip.
  • Service-located IMessageBus / IMessageContext now see the active context (#​2583) by @​jeremydmiller in #​2616 — when user code service-locates IMessageBus (e.g., constructor injection on a service the handler resolves at runtime), it now receives the same MessageContext the handler itself uses, preserving outbox semantics. Implemented as a per-chain opt-in (gated on Chain.UsesServiceLocation) so chains that don't service-locate pay zero AsyncLocal overhead per message.
  • Cold-start optimizations and WolverineFx.RuntimeCompilation opt-in package (#​1577) by @​jeremydmiller in #​2613 and #cc00ca0a — first pass at the cold-start / AOT roadmap. Wires the Wolverine.SourceGeneration analyzer into the WolverineFx NuGet output (so source-generated IWolverineTypeLoader discovery flows transitively to consumers), pre-populates the WolverineMessageNaming cache during startup to eliminate first-message reflection cost, applies [DynamicallyAccessedMembers] annotations on the Activator.CreateInstance call sites for trimmer-friendliness, and adds ConfigureAwait(false) across 117 awaits on the per-message hot path. The new WolverineFx.RuntimeCompilation package becomes the future-facing opt-in API for runtime Roslyn compilation; default behavior is preserved.

RavenDB durability fixes

  • Fix bulk RavenDB inbox store leaking duplicates as inbox-unavailable (#​2606) by @​Bishbulb in #​2606
  • Take over expired RavenDB scheduled-job and leadership locks (#​2608) by @​Bishbulb in #​2608
  • Disable optimistic concurrency on RavenDB cluster-wide node sessions; load-then-modify on agent-assignment writes (#​2610) by @​Bishbulb in #​2610

EF Core / ancillary stores

  • Fix DurableLocalQueue to route incoming envelopes to ancillary stores (#​2611) by @​jeremydmiller — handler chains targeting an ancillary message store now have their incoming envelopes persisted in that store rather than the main store, fixing a class of "envelope stuck as Incoming forever" bugs.
  • Fix WolverineEnabled annotation collision in ancillary-store EF Core scenarios as part of #​2618 — MapWolverineEnvelopeStorage is now idempotent when called against the same model graph more than once.

Other improvements

  • Fix MessageBus clobbering per-message Envelope.Source in #​26e38002 — MessageBus.Send was overwriting the per-message Source with the host's ServiceName, masking the originating service in causation tracking.
  • Surface upcoming ServiceLocationPolicy.NotAllowed v6 default (#​2584) by @​jeremydmiller in #​2609 — chains that resolve dependencies via service location now log a warning at codegen time, with a clear migration path to the new opt-in Wolverine.RuntimeCompilation story for v6.

CI stabilization

  • Several flaky test classes fixed or marked in #​2612 and #​2618 — timeout bumps, IDisposable → IAsyncLifetime conversions, lifecycle cleanup; chronically broken-on-CI classes (SqliteTests.Transport.multi_tenancy_with_multiple_files, CosmosDbTests.LeaderElection.leader_election, Wolverine.RabbitMQ.Tests.send_by_topics, Wolverine.RabbitMQ.Tests.sending_raw_messages) tagged [Trait("Category", "Flaky")] with header comments documenting the symptom and the real follow-up fix.
  • JasperFx 1.28 / RuntimeCompiler 4.5 ambiguity fallout fixed in #​2618 — files importing both JasperFx.CodeGeneration and JasperFx.RuntimeCompiler now compile cleanly after the InitializeSynchronously extension method was moved into JasperFx.CodeGeneration upstream.

Issue-tracker housekeeping

  • #​2507 (Quartz.Net / TickerQ first-class integration) added to the 6.0 milestone with a phased plan documented on the issue.
  • #​1577 (cold-start optimization roadmap) updated with a six-phase plan and current-state checklist; phases 1–4 are non-breaking on v5.x and largely landed in this release.

Full Changelog: JasperFx/wolverine@V5.33.0...V5.34.0

5.33.0

What's Changed

This release includes a major reliability fix for distributed leader election, a port of the Polecat 2.x event store integration, and several other quality-of-life improvements.

Highlights

  • Fix #​2602: Leader split-brain via stale advisory lock by @​jeremydmiller in #​2607 — three-layer defensive fix that detects when a Postgres/SQL Server/MySQL/Oracle/SQLite advisory lock has been silently released server-side, steps down the local leader, releases its agents, and triggers a fresh leader election. Adds a new LeadershipLost node record type and an IWolverineObserver.LostLeadership() hook for monitoring.
  • Polecat 2.x event store integration by @​jeremydmiller in #​2598 — ports the aggregate handler workflow from Marten so SQL Server-backed projects can use Polecat as a native event store with Wolverine. Requires SQL Server 2025 for the native JSON type.
  • Fix #​2571: Preserve context fields on scheduled-send wrap/unwrap by @​jeremydmiller in #​2605 — saga IDs, tenant IDs, and other correlation fields now survive the scheduled-send envelope round-trip.
  • gRPC enhancements by @​jeremydmiller in #​2565 — middleware weaving, validate convention, user exception mapping, bidirectional streaming, code-first codegen, plus new samples.
  • Allow RabbitMQ exchanges to be declared passive by @​jeremydmiller in #​2574

Other Improvements

  • Move non-sticky-handlers guard inside the compile lock by @​jeremydmiller in #​2556
  • Add launchSettings.json to sample projects by @​jeremydmiller in #​2600

Full Changelog: JasperFx/wolverine@V5.32.1...V5.33.0

What's Changed

New Contributors

Full Changelog: JasperFx/wolverine@V5.32.1...V5.33.0

Commits viewable in compare view.

Updated WolverineFx.EntityFrameworkCore from 5.32.1 to 5.37.2.

Release notes

Sourced from WolverineFx.EntityFrameworkCore's releases.

5.37.2

What's Changed

Full Changelog: JasperFx/wolverine@V5.37.0...V5.37.2

5.37.0

What's Changed

Full Changelog: JasperFx/wolverine@v5.36.1...V5.37.0

5.36.1

Upgrade to this version please if you use the EF Core transactional middleware and are using a very recent version of Wolverine

What's Changed

Full Changelog: JasperFx/wolverine@V5.36.0...v5.36.1

5.36.0

What's Changed

Full Changelog: JasperFx/wolverine@V5.35.2...V5.36.0

5.35.2

What's Changed

A small bug-fix and dependency-refresh release.

Persistence fixes

  • Oracle: timestamp default expressions now survive non-UTC DB sessions (#​2634) — OracleMessageStore.Initialize and the surrounding schema declared timestamp columns (health_check, started, posted, etc.) with a DEFAULT of SYS_EXTRACT_UTC(SYSTIMESTAMP). That returns a TIMESTAMP without a time zone, and when implicitly cast into the TIMESTAMP WITH TIME ZONE column Oracle stamps it with the session time zone — so for any session in UTC+N the just-persisted value's UTC equivalent was N hours in the past. That tripped the NodeAgentController.DoHealthChecksAsync staleness filter and surfaced as a NullReferenceException during the first leadership-election heartbeat (self!.AssignAgents([LeaderUri]) on a null self). All 18 occurrences swapped to SYSTIMESTAMP AT TIME ZONE 'UTC', with quote-doubling for the DDL contexts that go through Weasel's EXECUTE IMMEDIATE '...' wrapper.

Reliability hardening

  • Lock dbcontrol:// and oraclecontrol:// endpoints to BufferedInMemory (#​2637) — the database-backed control transport carries inter-node leader-election and agent-reassignment commands. Marking either endpoint Durable would route every control envelope through the same store-backed inbox/outbox the durability agent itself owns (deadlock); marking it Inline contradicts the batched-poll semantics. Both DatabaseControlEndpoint and OracleControlEndpoint now override supportsMode so any policy that tries to flip them off BufferedInMemory either silently skips (UseDurableInboxOnAllListeners, UseDurableOutboxOnAllSendingEndpoints, etc., already check SupportsMode) or fails fast with a clear InvalidOperationException.

Source-gen / startup

  • Aggregate IWolverineTypeLoader across all known assemblies (#​2632) by @​devployment — since 5.34.0, hosts on the source-generated codegen path silently dropped handlers that lived in referenced assemblies because tryDiscoverTypeLoaderFromAttribute only inspected Options.ApplicationAssembly. First invocation of one of those handlers threw IndeterminateRoutesException. The runtime now walks ApplicationAssembly and every assembly in Discovery.Assemblies, collects every [WolverineTypeManifest] loader it finds, and exposes their union via the new internal CompositeWolverineTypeLoader. Existing single-loader semantics are preserved when only one manifest is found.

Other

  • Saga timeout flag + scheduled-dispatch Activity tag (#​2631) by @​jeremydmiller — surfaces saga timeout and scheduled-dispatch metadata so the upcoming CritterWatch saga visualization can render in-flight saga state.

Dependencies

  • Bump JasperFx 1.28.0 → 1.28.2 and JasperFx.Events 1.29.0 → 1.31.1 (#​2638).

Full Changelog: JasperFx/wolverine@V5.35.1...V5.35.2

5.35.1

What's Changed

A bug-fix and small-feature release covering Oracle-in-Balanced-mode startup, a duplicate-poller defect on RavenDb, an AWS SQS sharded-slot naming fix, and a new SagaDescriptor surface for CritterWatch.

Persistence fixes

  • Oracle in DurabilityMode.Balanced now boots (#​2622) — OracleMessageStore.Initialize was a no-op, so hosts using Oracle persistence in Balanced mode failed to start with ArgumentOutOfRangeException("ControlEndpoint cannot be null for this usage"). The fix mirrors MessageDatabase.Initialize for Oracle and stands up a parallel OracleControlTransport / OracleControlEndpoint / OracleControlSender / OracleControlListener set under the new oraclecontrol:// protocol — necessary because the shared DatabaseControlSender / DatabaseControlListener assume @-prefixed placeholders and Guid values that map directly onto a DbParameter, neither of which Oracle accepts (:-prefixed placeholders, RAW(16) id columns requiring byte[]). Also fixes a latent OracleMessageStore.EnqueueAsync no-op that left LogRecordsAsync silently dropping node records, and makes FetchRecentRecordsAsync DBNull-safe on the description column. Adds a new OracleTests.LeaderElection project so the leadership-compliance suite runs against Oracle (marked [Trait("Category","Flaky")] because the suite needs careful TM/DML lock sequencing between back-to-back runs).

  • RavenDb: only one durability agent polls after host start (#​2623, #​2629) by @​Bishbulb (root-cause investigation and original fix) and @​jeremydmiller — RavenDbMessageStore.StartScheduledJobs eagerly built and started a RavenDbDurabilityAgent at boot in addition to the agent that NodeAgentController already builds and starts via IAgentFamily / MessageStoreCollection. Two RavenDbDurabilityAgent instances then polled the same database concurrently, both believed they held the scheduled-job lock, raced to mark the same envelopes Incoming, and surfaced ConcurrencyException plus double-fired timeouts. Drops the eager StartTimers() call; the cluster-managed agent is now the single owner of polling. The agent returned from StartScheduledJobs is held by WolverineRuntime.DurableScheduledJobs purely for its disposal-time StopAsync. Comes with a reflection-free regression test (added RavenDbDurabilityAgent.IsPolling and CompositeAgent.InnerAgents for the test to enumerate without poking at private fields). A companion regression-guard test for CosmosDb is included; investigation showed the equivalent CosmosDb path does NOT have the bug today (CosmosDbMessageStore.BuildAgentFamily returns null and Uri uses the cosmosdb:// scheme rather than wolverinedb://, so MessageStoreCollection never registers a competing agent).

Other improvements

  • AWS SQS: correct naming for sharded slot endpoints in #​1f294ce5 — fixes a regression where sharded slot endpoint URIs were assembled with the wrong segment ordering, causing the consumer side to listen at the wrong queue.

  • SagaDescriptor exported via ServiceCapabilities in #f0998c7b — adds a saga-shape descriptor (saga type, id type, current state) to the capabilities exporter so CritterWatch can surface saga inventory and current state in its dashboard.

Full Changelog: JasperFx/wolverine@V5.34.0...V5.35.1

5.34.0

What's Changed

This release introduces three new features (Claim Check pattern, declarative Polecat data requirements, and a new opt-in WolverineFx.RuntimeCompilation package as the first step toward AOT compatibility), a fix for a long-standing service-location footgun, several real RavenDB and EF Core durability fixes, plus the cold-start prep work done as part of issue #​1577.

Highlights

  • Add Claim Check / DataBus pattern with [Blob] attribute (#​2412) by @​jeremydmiller in #​2617 — off-load large message-property payloads to external storage on send and re-hydrate them on receive, so the on-the-wire envelope stays small. Core abstractions (IClaimCheckStore, ClaimCheckToken, [Blob], FileSystemClaimCheckStore, opts.UseClaimCheck(...)) live in Wolverine.Persistence. Two new backend NuGet packages ship alongside: WolverineFx.ClaimCheck.AzureBlobStorage and WolverineFx.ClaimCheck.AmazonS3. New documentation page under /guide/durability/claim-checks.
  • Declarative data-requirement attributes for Polecat (#​2552) by @​jeremydmiller in #​2615 — [DocumentExists<T>], [DocumentDoesNotExist<T>], and PolecatOps.Document<T>().MustExist(...) / .MustNotExist(...) mirror the Marten ergonomics, with the same batch-query optimization that folds multiple existence checks into a single Polecat IBatchedQuery round-trip.
  • Service-located IMessageBus / IMessageContext now see the active context (#​2583) by @​jeremydmiller in #​2616 — when user code service-locates IMessageBus (e.g., constructor injection on a service the handler resolves at runtime), it now receives the same MessageContext the handler itself uses, preserving outbox semantics. Implemented as a per-chain opt-in (gated on Chain.UsesServiceLocation) so chains that don't service-locate pay zero AsyncLocal overhead per message.
  • Cold-start optimizations and WolverineFx.RuntimeCompilation opt-in package (#​1577) by @​jeremydmiller in #​2613 and #cc00ca0a — first pass at the cold-start / AOT roadmap. Wires the Wolverine.SourceGeneration analyzer into the WolverineFx NuGet output (so source-generated IWolverineTypeLoader discovery flows transitively to consumers), pre-populates the WolverineMessageNaming cache during startup to eliminate first-message reflection cost, applies [DynamicallyAccessedMembers] annotations on the Activator.CreateInstance call sites for trimmer-friendliness, and adds ConfigureAwait(false) across 117 awaits on the per-message hot path. The new WolverineFx.RuntimeCompilation package becomes the future-facing opt-in API for runtime Roslyn compilation; default behavior is preserved.

RavenDB durability fixes

  • Fix bulk RavenDB inbox store leaking duplicates as inbox-unavailable (#​2606) by @​Bishbulb in #​2606
  • Take over expired RavenDB scheduled-job and leadership locks (#​2608) by @​Bishbulb in #​2608
  • Disable optimistic concurrency on RavenDB cluster-wide node sessions; load-then-modify on agent-assignment writes (#​2610) by @​Bishbulb in #​2610

EF Core / ancillary stores

  • Fix DurableLocalQueue to route incoming envelopes to ancillary stores (#​2611) by @​jeremydmiller — handler chains targeting an ancillary message store now have their incoming envelopes persisted in that store rather than the main store, fixing a class of "envelope stuck as Incoming forever" bugs.
  • Fix WolverineEnabled annotation collision in ancillary-store EF Core scenarios as part of #​2618 — MapWolverineEnvelopeStorage is now idempotent when called against the same model graph more than once.

Other improvements

  • Fix MessageBus clobbering per-message Envelope.Source in #​26e38002 — MessageBus.Send was overwriting the per-message Source with the host's ServiceName, masking the originating service in causation tracking.
  • Surface upcoming ServiceLocationPolicy.NotAllowed v6 default (#​2584) by @​jeremydmiller in #​2609 — chains that resolve dependencies via service location now log a warning at codegen time, with a clear migration path to the new opt-in Wolverine.RuntimeCompilation story for v6.

CI stabilization

  • Several flaky test classes fixed or marked in #​2612 and #​2618 — timeout bumps, IDisposable → IAsyncLifetime conversions, lifecycle cleanup; chronically broken-on-CI classes (SqliteTests.Transport.multi_tenancy_with_multiple_files, CosmosDbTests.LeaderElection.leader_election, Wolverine.RabbitMQ.Tests.send_by_topics, Wolverine.RabbitMQ.Tests.sending_raw_messages) tagged [Trait("Category", "Flaky")] with header comments documenting the symptom and the real follow-up fix.
  • JasperFx 1.28 / RuntimeCompiler 4.5 ambiguity fallout fixed in #​2618 — files importing both JasperFx.CodeGeneration and JasperFx.RuntimeCompiler now compile cleanly after the InitializeSynchronously extension method was moved into JasperFx.CodeGeneration upstream.

Issue-tracker housekeeping

  • #​2507 (Quartz.Net / TickerQ first-class integration) added to the 6.0 milestone with a phased plan documented on the issue.
  • #​1577 (cold-start optimization roadmap) updated with a six-phase plan and current-state checklist; phases 1–4 are non-breaking on v5.x and largely landed in this release.

Full Changelog: JasperFx/wolverine@V5.33.0...V5.34.0

5.33.0

What's Changed

This release includes a major reliability fix for distributed leader election, a port of the Polecat 2.x event store integration, and several other quality-of-life improvements.

Highlights

  • Fix #​2602: Leader split-brain via stale advisory lock by @​jeremydmiller in #​2607 — three-layer defensive fix that detects when a Postgres/SQL Server/MySQL/Oracle/SQLite advisory lock has been silently released server-side, steps down the local leader, releases its agents, and triggers a fresh leader election. Adds a new LeadershipLost node record type and an IWolverineObserver.LostLeadership() hook for monitoring.
  • Polecat 2.x event store integration by @​jeremydmiller in #​2598 — ports the aggregate handler workflow from Marten so SQL Server-backed projects can use Polecat as a native event store with Wolverine. Requires SQL Server 2025 for the native JSON type.
  • Fix #​2571: Preserve context fields on scheduled-send wrap/unwrap by @​jeremydmiller in #​2605 — saga IDs, tenant IDs, and other correlation fields now survive the scheduled-send envelope round-trip.
  • gRPC enhancements by @​jeremydmiller in #​2565 — middleware weaving, validate convention, user exception mapping, bidirectional streaming, code-first codegen, plus new samples.
  • Allow RabbitMQ exchanges to be declared passive by @​jeremydmiller in #​2574

Other Improvements

  • Move non-sticky-handlers guard inside the compile lock by @​jeremydmiller in #​2556
  • Add launchSettings.json to sample projects by @​jeremydmiller in #​2600

Full Changelog: JasperFx/wolverine@V5.32.1...V5.33.0

What's Changed

New Contributors

Full Changelog: JasperFx/wolverine@V5.32.1...V5.33.0

Commits viewable in compare view.

Updated WolverineFx.Marten from 5.32.1 to 5.37.2.

Release notes

Sourced from WolverineFx.Marten's releases.

5.37.2

What's Changed

Full Changelog: JasperFx/wolverine@V5.37.0...V5.37.2

5.37.0

What's Changed

Full Changelog: JasperFx/wolverine@v5.36.1...V5.37.0

5.36.1

Upgrade to this version please if you use the EF Core transactional middleware and are using a very recent version of Wolverine

What's Changed

Full Changelog: JasperFx/wolverine@V5.36.0...v5.36.1

5.36.0

What's Changed

Description has been truncated

@dependabot
chore(deps): Bump the minor-and-patch group with 9 updates
be1eb11 
Bumps Anthropic from 12.16.0 to 12.20.0
Bumps Aspire.Npgsql from 13.2.3 to 13.2.4
Bumps Marten from 8.32.1 to 8.36.0
Bumps Marten.EntityFrameworkCore from 8.32.1 to 8.36.0
Bumps SonarAnalyzer.CSharp from 10.24.0.138807 to 10.25.0.139117
Bumps WolverineFx from 5.32.1 to 5.37.2
Bumps WolverineFx.EntityFrameworkCore from 5.32.1 to 5.37.2
Bumps WolverineFx.Marten from 5.32.1 to 5.37.2
Bumps YamlDotNet from 17.0.1 to 17.1.0

---
updated-dependencies:
- dependency-name: Anthropic
  dependency-version: 12.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Aspire.Npgsql
  dependency-version: 13.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Marten
  dependency-version: 8.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Marten.EntityFrameworkCore
  dependency-version: 8.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: SonarAnalyzer.CSharp
  dependency-version: 10.25.0.139117
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: WolverineFx
  dependency-version: 5.37.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: WolverineFx.EntityFrameworkCore
  dependency-version: 5.37.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: WolverineFx.Marten
  dependency-version: 5.37.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: YamlDotNet
  dependency-version: 17.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels May 7, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 7, 2026

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 20 package(s) with unknown licenses.
See the Details below.

License Issues

backend/src/RunCoach.Api/RunCoach.Api.csproj

PackageVersionLicenseIssue Type
Anthropic12.20.0NullUnknown License
Aspire.Npgsql13.2.4NullUnknown License
JasperFx1.29.1NullUnknown License
JasperFx.Events1.35.0NullUnknown License
JasperFx.RuntimeCompiler4.5.0NullUnknown License
Marten8.36.0NullUnknown License
Marten.EntityFrameworkCore8.36.0NullUnknown License
Microsoft.Extensions.AI.Abstractions10.5.1NullUnknown License
SonarAnalyzer.CSharp10.25.0.139117NullUnknown License
Weasel.Core8.15.0NullUnknown License
Weasel.EntityFrameworkCore8.15.0NullUnknown License
Weasel.Postgresql8.15.0NullUnknown License
WolverineFx5.37.2NullUnknown License
WolverineFx.EntityFrameworkCore5.37.2NullUnknown License
WolverineFx.Marten5.37.2NullUnknown License
WolverineFx.Postgresql5.37.2NullUnknown License
WolverineFx.RDBMS5.37.2NullUnknown License
YamlDotNet17.1.0NullUnknown License

backend/tests/RunCoach.Api.Tests/RunCoach.Api.Tests.csproj

PackageVersionLicenseIssue Type
Microsoft.Extensions.AI.Abstractions10.5.1NullUnknown License
SonarAnalyzer.CSharp10.25.0.139117NullUnknown License
Allowed Licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, 0BSD, Unlicense, CC0-1.0, CC-BY-4.0, Zlib, BSL-1.0, Python-2.0, PSF-2.0, Artistic-2.0, MPL-2.0, WTFPL, PostgreSQL
Excluded from license check: pkg:githubactions/SonarSource/sonarqube-scan-action, pkg:npm/runcoach-frontend

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
nuget/Anthropic 12.20.0 UnknownUnknown
nuget/Aspire.Npgsql 13.2.4 UnknownUnknown
nuget/JasperFx 1.29.1 UnknownUnknown
nuget/JasperFx.Events 1.35.0 UnknownUnknown
nuget/JasperFx.RuntimeCompiler 4.5.0 UnknownUnknown
nuget/Marten 8.36.0 UnknownUnknown
nuget/Marten.EntityFrameworkCore 8.36.0 UnknownUnknown
nuget/Microsoft.Extensions.AI.Abstractions 10.5.1 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Maintained🟢 1030 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
nuget/SonarAnalyzer.CSharp 10.25.0.139117 UnknownUnknown
nuget/Weasel.Core 8.15.0 UnknownUnknown
nuget/Weasel.EntityFrameworkCore 8.15.0 UnknownUnknown
nuget/Weasel.Postgresql 8.15.0 UnknownUnknown
nuget/WolverineFx 5.37.2 UnknownUnknown
nuget/WolverineFx.EntityFrameworkCore 5.37.2 UnknownUnknown
nuget/WolverineFx.Marten 5.37.2 UnknownUnknown
nuget/WolverineFx.Postgresql 5.37.2 UnknownUnknown
nuget/WolverineFx.RDBMS 5.37.2 UnknownUnknown
nuget/YamlDotNet 17.1.0 UnknownUnknown
nuget/Microsoft.Extensions.AI.Abstractions 10.5.1 🟢 6.7
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Maintained🟢 1030 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
Branch-Protection🟢 5branch protection is not maximal on development and all release branches
Signed-Releases⚠️ -1no releases found
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 9dependency not pinned by hash detected -- score normalized to 9
Fuzzing⚠️ 0project is not fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
nuget/SonarAnalyzer.CSharp 10.25.0.139117 UnknownUnknown

Scanned Files

  • backend/src/RunCoach.Api/RunCoach.Api.csproj
  • backend/tests/RunCoach.Api.Tests/RunCoach.Api.Tests.csproj

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Enable AddProjectionWithServices on modules in IConfigureMarten

0 participants