Bump NATS.Client.Core and NATS.Client.JetStream

[dependabot]

Updated NATS.Client.Core from 2.7.2 to 2.8.2.

Release notes

Sourced from NATS.Client.Core's releases.

2.8.2

Patch release on the 2.8 line. Fixes ordered push consumer subscription teardown. Thanks to @​haoguanjun for the fix.

What's Changed

• Bump MessagePack from 3.1.1 to 3.1.7 Bump MessagePack from 3.1.1 to 3.1.7 nats-io/nats.net#1183
• Clarify DI package descriptions Clarify DI package descriptions nats-io/nats.net#1163
• Fix ordered push consumer subscription leak on teardown Fix ordered push consumer subscription leak on teardown nats-io/nats.net#1188
• Simplify ordered push consumer sub teardown Simplify ordered push consumer sub teardown nats-io/nats.net#1191
• Release 2.8.2 Release 2.8.2 nats-io/nats.net#1189

Full Changelog: nats-io/nats.net@v2.8.1...v2.8.2

2.8.1

Patch release on the 2.8 line. Bug fixes across JetStream, KV, subscriptions, and connection logging, plus a small Services helper for handling error responses on the requester side.

What's Changed

• Add helpers to detect Nats-Service-Error on responses (#​1152)
• Fix durable consumer create when only DurableName is set (#​1150)
• kv: cap duplicate_window at max_age (#​1149)
• Quiet recoverable server-error logs (#​1148) (thanks @​garrett-sutton)
• Fix subscription timeout overflow (#​1134) (thanks @​Prochy)
• test: fix Windows CI flaps (#​1147)
• docs: add JetStream basic example (#​1138)

New Services Extensions

Detect service errors on responses (#​1152)

Services signal failures using Nats-Service-Error / Nats-Service-Error-Code response headers. The requester side previously had to read those headers by hand. New extensions on NatsMsg<T> (in the NATS.Net namespace) cover the common patterns:

var reply = await nats.RequestAsync<MyReq, MyResp>("svc.echo", req);

if (reply.IsServiceSuccess())
{
    // use reply.Data
}

// or throw on error
reply.EnsureServiceSuccess();

// or inspect the status
var status = reply.GetServiceStatus();
// status.IsSuccess, status.Code, status.Message, status.HasNoResponders

Full Changelog: nats-io/nats.net@v2.8.0...v2.8.1

Download from NuGet at https://www.nuget.org/packages/NATS.Net/2.8.1

2.8.0

Happy to announce the NATS .NET 2.8.0 stable release of the 2.8 line. It picks up the NATS Server v2.14 client surface (consumer reset, $JS.FC.* flow-control replies, Consumer field on stream source/mirror, AllowBatchPublish on stream config), ships two breaking changes that landed in the preview cycle, and fixes in-flight message loss on consumer/connection dispose behind an opt-in drain.

A big thank you to all NATS contributors and community members who helped make this release possible. <3

NATS Server v2.14 Features

• ResetConsumerAsync on INatsJSContext and INatsJSConsumer (ADR-60), to reset a pinned consumer's state (#​1126).
• $JS.FC.* flow-control replies are parsed by the JS metadata layer, for streams that publish with the js_ack_fc_v2 flag (#​1127).
• Consumer field on StreamSource and stream mirror config, for pre-created mirror/source consumers (#​1128).
• AllowBatchPublish on StreamConfig (JSON allow_batched), required by streams that opt into fast-ingest batch publishing per ADR-50 (#​1120). The fast-ingest publisher itself lives in orbit.net alongside the existing atomic batch publisher.

Breaking Changes

Subject Validation On By Default (#​1093)

Subjects containing whitespace (space, tab, CR, LF) now throw NatsException. This closes a class of CRLF injection issues from malformed subjects.

Opt out if you rely on legacy subjects that contain whitespace:

var opts = NatsOpts.Default with { SkipSubjectValidation = true };

NKeyPair Removed From NATS.Client.Core (#​1101)

NATS.Client.Core.NKeys and NKeyPair are removed. Signing now goes through the NATS.NKeys package, which lets the nkey/Ed25519 code be versioned independently of the client.

For typical users this is transparent: keep using NatsAuthOpts.NKeyFile, CredsFile, Jwt + Seed, or AuthCredCallback and the client wires up the new signer automatically.

Only direct callers of NATS.Client.Core.NKeyPair need to switch:

// Before
using NATS.Client.Core;
var kp = NKeyPair.FromSeed(seed);
var sig = kp.Sign(nonce);

// After
using NATS.NKeys;
var kp = KeyPair.FromSeed(seed);
var sig = kp.Sign(nonce);

Other Notable Changes

• Server error event (#​745): a new event on NatsConnection surfaces server-side errors to client code.
• Message loss on consumer dispose (#​1085): opt-in drain keeps in-flight messages from being dropped when a consumer or connection is disposed. Enable with:

... (truncated)

2.8.0-preview.3

Third preview of NATS .NET 2.8 completes the nats-server v2.14 feature set for the client. See PRs below for specifics.

This release also includes a fix for in-flight message loss on consumer/connection dispose. The new drain path is opt-in, so defaults preserve current behavior. The dispose ordering refactor touches a hot path though, so please give your workloads a once-over and report anything that looks off.

Opt in:

var opts = NatsOpts.Default with
{
    DrainSubscriptionsOnDispose = true,
    ConsumerDrainOnDisposeTimeout = TimeSpan.FromSeconds(10),
};

Changes:

• Add consumer reset API (#​1126)
• Add $JS.FC support to JS metadata parser (#​1127)
• Add consumer field on stream source/mirror (#​1128)
• Fix message loss on consumer dispose (#​1085)

Full Changelog: nats-io/nats.net@v2.8.0-preview.2...v2.8.0-preview.3

2.8.0-preview.2

Second preview of NATS .NET 2.8 ships nats-server v2.14 support: streams that opt into fast-ingest batch publishing per ADR-50 can now set the new AllowBatchPublish field on StreamConfig (the fast-ingest publisher itself will live in orbit.net alongside the existing atomic batch publisher). Also picks up a Pin ID handling fix for duplicate status headers, the new flat README intro, and assorted CI and test flake fixes.

Changes:

• Add AllowBatchPublish stream config field (#​1120)
• Bump OpenTelemetry and OpenTelemetry.Exporter.OpenTelemetryProtocol (#​1121)
• Fix setting wrong pin id from status header (#​1116) (thanks @​colprog)
• Fix slow-consumer test first-ping RTT flap (#​1115)
• Fix net481 TLS test flakes (#​1111)
• Rewrite README intro (#​1114)

Full Changelog: nats-io/nats.net@v2.8.0-preview.1...v2.8.0-preview.2

2.8.0-preview.1

Happy to ship the first preview of NATS .NET 2.8. The theme of this release is tightening the protocol layer and shrinking the core API surface, so this preview carries two breaking changes. Please try it and report anything odd before we cut the stable.

Package on NuGet: https://www.nuget.org/packages/NATS.Net

Breaking changes:

• Subject validation is on by default. Subjects containing whitespace (space, tab, CR, LF) now throw. This closes a class of CRLF injection issues from malformed subjects. Opt out with SkipSubjectValidation = true on NatsOpts.
• NATS.Client.Core.NKeys and NKeyPair are removed. Signing now goes through the NATS.NKeys package (https://www.nuget.org/packages/NATS.NKeys), which lets the nkey/Ed25519 code be versioned independently of the client.

Also includes protocol size checks (64MB incoming payload cap, in line with nats.js), KV watcher cancellation fix, credential loading state reset on failure, and Pin ID handling improvements.

Thanks to the NATS community who contributed PRs, reviews, and bug reports on this one ❤️

• auth: sign nonce regardless of auth_required (#​1109) (thanks @​Lionel-Zieminski)
• auth: use NATS.NKeys package for nkey signing (#​1101) [breaking]
• conn: reset state on credential loading failure (#​1107) (thanks @​Prochy)
• Improve package metadata and README (#​1103)
• tests: fix TlsPreferTest flap on net481 (#​1108)
• Fix release workflow (#​1106)
• Fix test flaps (#​1083)
• ci: add contents and actions read permissions to Claude workflow (#​1102)
• tls: document Prefer mode plaintext behavior (#​1094)
• tests: increase NuidTests thread join timeouts (#​1100)
• Improve Pin ID handling (#​1099) (thanks @​colprog)
• Fix KV watcher cancellation behavior (#​1084)
• Clear ArrayPool buffers before returning to pool (#​1097)
• Enable subject validation by default (#​1093) [breaking]
• Add protocol size checks (#​1095)
• Fix Range attribute for MaxBytes property (#​1096) (thanks @​partnerRuiSilva)
• Add CC reviews (#​1092)

Full Changelog: nats-io/nats.net@v2.7.3...v2.8.0-preview.1

2.7.3

Announcing a new version of NATS .NET client library covering various fixes and a security update on one dependency for NETStandard targets (#​1089) even though the vulnerable API is not used by our library.

A big thank you to all NATS contributors and community members who helped make this release possible ❤️

Breaking Changes

NakAsync Signature Change (#​1081)

The TimeSpan delay parameter has been removed from INatsJSMsg<T>.NakAsync(). The delay must now be passed via AckOpts.NakDelay.

Before (v2.7.2):

await msg.NakAsync(delay: TimeSpan.FromSeconds(5));
await msg.NakAsync(opts, TimeSpan.FromSeconds(5));

After (v2.7.3):

// Option 1: Use the new extension method
await msg.NakAsync(TimeSpan.FromSeconds(5));

// Option 2: Use AckOpts with NakDelay
await msg.NakAsync(new AckOpts { NakDelay = TimeSpan.FromSeconds(5) });

Note: because we also have an extension method, recompiling your project is enough.

AckTerminateAsync TermWithReason (#​1048, #​1081)

AckTerminateAsync now supports an optional termination reason. A new overload and a new TerminateReason property on AckOpts have been added to INatsJSMsg<T>. Implementors of this interface must add the new method.

// New overload
await msg.AckTerminateAsync("processing failed permanently");

// Or via AckOpts
await msg.AckTerminateAsync(new AckOpts { TerminateReason = "processing failed permanently" });

// Extension method shorthand
await msg.AckTerminateAsync("reason", cancellationToken);

Requires NATS Server 2.10.4+.

PinnedClient Validation (#​1063)

Calling NextAsync(), FetchAsync(), or FetchNoWaitAsync() on a consumer with PriorityPolicy.PinnedClient now throws NatsJSException. Use ConsumeAsync() instead.

// This now throws NatsJSException:
 ... (truncated)

Commits viewable in [compare view](https://github.com/nats-io/nats.net/compare/v2.7.2...v2.8.2).
</details>

Updated [NATS.Client.JetStream](https://github.com/nats-io/nats.net) from 2.7.2 to 2.8.2.

<details>
<summary>Release notes</summary>

_Sourced from [NATS.Client.JetStream's releases](https://github.com/nats-io/nats.net/releases)._

## 2.8.2

[![NuGet](https://img.shields.io/badge/NuGet-2.8.2-blue)](https://www.nuget.org/packages/NATS.Net/2.8.2)

Patch release on the 2.8 line. Fixes ordered push consumer subscription teardown. Thanks to @​haoguanjun for the fix.

## What's Changed
* Bump MessagePack from 3.1.1 to 3.1.7  https://github.com/nats-io/nats.net/pull/1183
* Clarify DI package descriptions https://github.com/nats-io/nats.net/pull/1163
* Fix ordered push consumer subscription leak on teardown https://github.com/nats-io/nats.net/pull/1188
* Simplify ordered push consumer sub teardown https://github.com/nats-io/nats.net/pull/1191
* Release 2.8.2 https://github.com/nats-io/nats.net/pull/1189


**Full Changelog**: https://github.com/nats-io/nats.net/compare/v2.8.1...v2.8.2

## 2.8.1

[![NuGet](https://img.shields.io/badge/NuGet-2.8.1-blue)](https://www.nuget.org/packages/NATS.Net/2.8.1)

Patch release on the 2.8 line. Bug fixes across JetStream, KV, subscriptions, and connection logging, plus a small Services helper for handling error responses on the requester side.

## What's Changed

* Add helpers to detect Nats-Service-Error on responses (#​1152)
* Fix durable consumer create when only DurableName is set (#​1150)
* kv: cap duplicate_window at max_age (#​1149)
* Quiet recoverable server-error logs (#​1148) (thanks @​garrett-sutton)
* Fix subscription timeout overflow (#​1134) (thanks @​Prochy)
* test: fix Windows CI flaps (#​1147)
* docs: add JetStream basic example (#​1138)

## New Services Extensions

### Detect service errors on responses (#​1152)

Services signal failures using `Nats-Service-Error` / `Nats-Service-Error-Code` response headers. The requester side previously had to read those headers by hand. New extensions on `NatsMsg<T>` (in the `NATS.Net` namespace) cover the common patterns:

```csharp
var reply = await nats.RequestAsync<MyReq, MyResp>("svc.echo", req);

if (reply.IsServiceSuccess())
{
    // use reply.Data
}

// or throw on error
reply.EnsureServiceSuccess();

// or inspect the status
var status = reply.GetServiceStatus();
// status.IsSuccess, status.Code, status.Message, status.HasNoResponders

Full Changelog: nats-io/nats.net@v2.8.0...v2.8.1

Download from NuGet at https://www.nuget.org/packages/NATS.Net/2.8.1

2.8.0

Happy to announce the NATS .NET 2.8.0 stable release of the 2.8 line. It picks up the NATS Server v2.14 client surface (consumer reset, $JS.FC.* flow-control replies, Consumer field on stream source/mirror, AllowBatchPublish on stream config), ships two breaking changes that landed in the preview cycle, and fixes in-flight message loss on consumer/connection dispose behind an opt-in drain.

A big thank you to all NATS contributors and community members who helped make this release possible. <3

NATS Server v2.14 Features

• ResetConsumerAsync on INatsJSContext and INatsJSConsumer (ADR-60), to reset a pinned consumer's state (#​1126).
• $JS.FC.* flow-control replies are parsed by the JS metadata layer, for streams that publish with the js_ack_fc_v2 flag (#​1127).
• Consumer field on StreamSource and stream mirror config, for pre-created mirror/source consumers (#​1128).
• AllowBatchPublish on StreamConfig (JSON allow_batched), required by streams that opt into fast-ingest batch publishing per ADR-50 (#​1120). The fast-ingest publisher itself lives in orbit.net alongside the existing atomic batch publisher.

Breaking Changes

Subject Validation On By Default (#​1093)

Subjects containing whitespace (space, tab, CR, LF) now throw NatsException. This closes a class of CRLF injection issues from malformed subjects.

Opt out if you rely on legacy subjects that contain whitespace:

var opts = NatsOpts.Default with { SkipSubjectValidation = true };

NKeyPair Removed From NATS.Client.Core (#​1101)

NATS.Client.Core.NKeys and NKeyPair are removed. Signing now goes through the NATS.NKeys package, which lets the nkey/Ed25519 code be versioned independently of the client.

For typical users this is transparent: keep using NatsAuthOpts.NKeyFile, CredsFile, Jwt + Seed, or AuthCredCallback and the client wires up the new signer automatically.

Only direct callers of NATS.Client.Core.NKeyPair need to switch:

// Before
using NATS.Client.Core;
var kp = NKeyPair.FromSeed(seed);
var sig = kp.Sign(nonce);

// After
using NATS.NKeys;
var kp = KeyPair.FromSeed(seed);
var sig = kp.Sign(nonce);

Other Notable Changes

• Server error event (#​745): a new event on NatsConnection surfaces server-side errors to client code.
• Message loss on consumer dispose (#​1085): opt-in drain keeps in-flight messages from being dropped when a consumer or connection is disposed. Enable with:

... (truncated)

2.8.0-preview.3

Third preview of NATS .NET 2.8 completes the nats-server v2.14 feature set for the client. See PRs below for specifics.

This release also includes a fix for in-flight message loss on consumer/connection dispose. The new drain path is opt-in, so defaults preserve current behavior. The dispose ordering refactor touches a hot path though, so please give your workloads a once-over and report anything that looks off.

Opt in:

var opts = NatsOpts.Default with
{
    DrainSubscriptionsOnDispose = true,
    ConsumerDrainOnDisposeTimeout = TimeSpan.FromSeconds(10),
};

Changes:

• Add consumer reset API (#​1126)
• Add $JS.FC support to JS metadata parser (#​1127)
• Add consumer field on stream source/mirror (#​1128)
• Fix message loss on consumer dispose (#​1085)

Full Changelog: nats-io/nats.net@v2.8.0-preview.2...v2.8.0-preview.3

2.8.0-preview.2

Second preview of NATS .NET 2.8 ships nats-server v2.14 support: streams that opt into fast-ingest batch publishing per ADR-50 can now set the new AllowBatchPublish field on StreamConfig (the fast-ingest publisher itself will live in orbit.net alongside the existing atomic batch publisher). Also picks up a Pin ID handling fix for duplicate status headers, the new flat README intro, and assorted CI and test flake fixes.

Changes:

• Add AllowBatchPublish stream config field (#​1120)
• Bump OpenTelemetry and OpenTelemetry.Exporter.OpenTelemetryProtocol (#​1121)
• Fix setting wrong pin id from status header (#​1116) (thanks @​colprog)
• Fix slow-consumer test first-ping RTT flap (#​1115)
• Fix net481 TLS test flakes (#​1111)
• Rewrite README intro (#​1114)

Full Changelog: nats-io/nats.net@v2.8.0-preview.1...v2.8.0-preview.2

2.8.0-preview.1

Happy to ship the first preview of NATS .NET 2.8. The theme of this release is tightening the protocol layer and shrinking the core API surface, so this preview carries two breaking changes. Please try it and report anything odd before we cut the stable.

Package on NuGet: https://www.nuget.org/packages/NATS.Net

Breaking changes:

• Subject validation is on by default. Subjects containing whitespace (space, tab, CR, LF) now throw. This closes a class of CRLF injection issues from malformed subjects. Opt out with SkipSubjectValidation = true on NatsOpts.
• NATS.Client.Core.NKeys and NKeyPair are removed. Signing now goes through the NATS.NKeys package (https://www.nuget.org/packages/NATS.NKeys), which lets the nkey/Ed25519 code be versioned independently of the client.

Also includes protocol size checks (64MB incoming payload cap, in line with nats.js), KV watcher cancellation fix, credential loading state reset on failure, and Pin ID handling improvements.

Thanks to the NATS community who contributed PRs, reviews, and bug reports on this one ❤️

• auth: sign nonce regardless of auth_required (#​1109) (thanks @​Lionel-Zieminski)
• auth: use NATS.NKeys package for nkey signing (#​1101) [breaking]
• conn: reset state on credential loading failure (#​1107) (thanks @​Prochy)
• Improve package metadata and README (#​1103)
• tests: fix TlsPreferTest flap on net481 (#​1108)
• Fix release workflow (#​1106)
• Fix test flaps (#​1083)
• ci: add contents and actions read permissions to Claude workflow (#​1102)
• tls: document Prefer mode plaintext behavior (#​1094)
• tests: increase NuidTests thread join timeouts (#​1100)
• Improve Pin ID handling (#​1099) (thanks @​colprog)
• Fix KV watcher cancellation behavior (#​1084)
• Clear ArrayPool buffers before returning to pool (#​1097)
• Enable subject validation by default (#​1093) [breaking]
• Add protocol size checks (#​1095)
• Fix Range attribute for MaxBytes property (#​1096) (thanks @​partnerRuiSilva)
• Add CC reviews (#​1092)

Full Changelog: nats-io/nats.net@v2.7.3...v2.8.0-preview.1

2.7.3

Announcing a new version of NATS .NET client library covering various fixes and a security update on one dependency for NETStandard targets (#​1089) even though the vulnerable API is not used by our library.

A big thank you to all NATS contributors and community members who helped make this release possible ❤️

Breaking Changes

NakAsync Signature Change (#​1081)

The TimeSpan delay parameter has been removed from INatsJSMsg<T>.NakAsync(). The delay must now be passed via AckOpts.NakDelay.

Before (v2.7.2):

await msg.NakAsync(delay: TimeSpan.FromSeconds(5));
await msg.NakAsync(opts, TimeSpan.FromSeconds(5));

After (v2.7.3):

// Option 1: Use the new extension method
await msg.NakAsync(TimeSpan.FromSeconds(5));

// Option 2: Use AckOpts with NakDelay
await msg.NakAsync(new AckOpts { NakDelay = TimeSpan.FromSeconds(5) });

Note: because we also have an extension method, recompiling your project is enough.

AckTerminateAsync TermWithReason (#​1048, #​1081)

AckTerminateAsync now supports an optional termination reason. A new overload and a new TerminateReason property on AckOpts have been added to INatsJSMsg<T>. Implementors of this interface must add the new method.

// New overload
await msg.AckTerminateAsync("processing failed permanently");

// Or via AckOpts
await msg.AckTerminateAsync(new AckOpts { TerminateReason = "processing failed permanently" });

// Extension method shorthand
await msg.AckTerminateAsync("reason", cancellationToken);

Requires NATS Server 2.10.4+.

PinnedClient Validation (#​1063)

Calling NextAsync(), FetchAsync(), or FetchNoWaitAsync() on a consumer with PriorityPolicy.PinnedClient now throws NatsJSException. Use ConsumeAsync() instead.

// This now throws NatsJSException:
 ... (truncated)

Commits viewable in [compare view](https://github.com/nats-io/nats.net/compare/v2.7.2...v2.8.2).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>