Skip to content

chore: Bump FastEndpoints and FastEndpoints.Swagger - #8

Closed
dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/nuget/multi-f5356af26a
Closed

dependabot[bot] wants to merge 3 commits into
mainfrom
dependabot/nuget/multi-f5356af26a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jan 19, 2026

Copy link
Copy Markdown
Contributor

Updated FastEndpoints from 7.1.1 to 7.2.0.

Release notes

Sourced from FastEndpoints's releases.

7.2


⚠️ Sponsorship Level Critically Low ⚠️

Due to low financial backing by the community, FastEndpoints will soon be going into "Bugfix Only" mode until the situation improves. Please join the discussion here and help out if you can.


New 🎉

Standalone package for Event/Command Bus functionality

The in-process Event Bus and Command Bus features have been liberated from the clutches of the FastEndpoints main library. A new, independent FastEndpoints.Messaging package has been created. This package can be used in any .NET 8+ application, even with Blazor WASM. Simply install the nuget package and register it with the IOC container like so:

builder.Services.AddMessaging();
var host = builder.Build();
host.Services.UseMessaging();

There's no setup (nor code changes) needed for projects using FastEndpoints main library. The above is only for when you want to use the messaging functionality in projects that don't have FastEndpoints.

Standalone package for Job Queues functionality

The job queuing functionality has also been extracted out to a separate package FastEndpoints.JobQueues which can be used independently of the main FE library. No code changes are needed for existing FE projects.

Aspire Testing support for routeless test helpers

You can now use the routeless test helpers such as .GETAsync<MyEndpoint>() with Aspire DistributedApplication testing like so:

[Fact]
public async Task Endpoint_Returns_Ok_Response()
{
    // Arrange
    var ct = TestContext.Current.CancellationToken;
    var appHost = await DistributedApplicationTestingBuilder.CreateAsync<Projects.AspireApp_AppHost>(ct);
    await using var app = await appHost.BuildAsync(ct).WaitAsync(_defaultTimeout, ct);
    await app.StartAsync(ct).WaitAsync(_defaultTimeout, ct);
    await app.ResourceNotifications.WaitForResourceHealthyAsync("apiservice", ct).WaitAsync(_defaultTimeout, ct);

    // Act
    var httpClient = app.CreateHttpClient("apiservice");
    var (response, _) = await httpClient.GETAsync<HelloEndpoint, EmptyResponse>();
 ... (truncated)

Commits viewable in [compare view](https://github.com/FastEndpoints/FastEndpoints/compare/v7.1.1...v7.2).
</details>

Updated [FastEndpoints.Swagger](https://github.com/FastEndpoints/FastEndpoints) from 7.1.1 to 7.2.0.

<details>
<summary>Release notes</summary>

_Sourced from [FastEndpoints.Swagger's releases](https://github.com/FastEndpoints/FastEndpoints/releases)._

## 7.2

---

## ⚠️ Sponsorship Level Critically Low ⚠️

Due to low financial backing by the community, FastEndpoints will soon be going into "Bugfix Only" mode until the situation improves. Please [join the discussion here](https://github.com/FastEndpoints/FastEndpoints/issues/1042) and help out if you can.

---

[//]: # (<details><summary>title text</summary></details>)

## New 🎉

<details><summary>Standalone package for Event/Command Bus functionality</summary>

The in-process Event Bus and Command Bus features have been liberated from the clutches of the FastEndpoints main library. A new, independent `FastEndpoints.Messaging` package has been created. This package can be used in any .NET 8+ application, even with Blazor WASM. Simply install the nuget package and register it with the IOC container like so:

```csharp
builder.Services.AddMessaging();
var host = builder.Build();
host.Services.UseMessaging();

There's no setup (nor code changes) needed for projects using FastEndpoints main library. The above is only for when you want to use the messaging functionality in projects that don't have FastEndpoints.

Standalone package for Job Queues functionality

The job queuing functionality has also been extracted out to a separate package FastEndpoints.JobQueues which can be used independently of the main FE library. No code changes are needed for existing FE projects.

Aspire Testing support for routeless test helpers

You can now use the routeless test helpers such as .GETAsync<MyEndpoint>() with Aspire DistributedApplication testing like so:

[Fact]
public async Task Endpoint_Returns_Ok_Response()
{
    // Arrange
    var ct = TestContext.Current.CancellationToken;
    var appHost = await DistributedApplicationTestingBuilder.CreateAsync<Projects.AspireApp_AppHost>(ct);
    await using var app = await appHost.BuildAsync(ct).WaitAsync(_defaultTimeout, ct);
    await app.StartAsync(ct).WaitAsync(_defaultTimeout, ct);
    await app.ResourceNotifications.WaitForResourceHealthyAsync("apiservice", ct).WaitAsync(_defaultTimeout, ct);

    // Act
    var httpClient = app.CreateHttpClient("apiservice");
    var (response, _) = await httpClient.GETAsync<HelloEndpoint, EmptyResponse>();
 ... (truncated)

Commits viewable in [compare view](https://github.com/FastEndpoints/FastEndpoints/compare/v7.1.1...v7.2).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

Bumps FastEndpoints from 7.1.1 to 7.2.0
Bumps FastEndpoints.Swagger from 7.1.1 to 7.2.0

---
updated-dependencies:
- dependency-name: FastEndpoints
  dependency-version: 7.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
- dependency-name: FastEndpoints.Swagger
  dependency-version: 7.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jan 19, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: dependencies, nuget. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@philcarbone
philcarbone self-requested a review as a code owner January 19, 2026 17:03
@codecov

codecov Bot commented Jan 19, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

philcarbone added a commit that referenced this pull request Jan 19, 2026
NuGet Package Updates:
- FastEndpoints: 7.1.1 -> 7.2.0
- FastEndpoints.Swagger: 7.1.1 -> 7.2.0
- HotChocolate.AspNetCore: 15.1.11 -> 15.1.12
- HotChocolate.Data: 15.1.11 -> 15.1.12
- Microsoft.AspNetCore.OpenApi: 10.0.1 -> 10.0.2
- Microsoft.Data.SqlClient: 6.1.3 -> 6.1.4
- Microsoft.Data.Sqlite: 10.0.1 -> 10.0.2
- Microsoft.EntityFrameworkCore: 10.0.1 -> 10.0.2
- Microsoft.EntityFrameworkCore.InMemory: 10.0.1 -> 10.0.2
- Microsoft.EntityFrameworkCore.Relational: 10.0.1 -> 10.0.2
- Microsoft.EntityFrameworkCore.Tasks: 10.0.1 -> 10.0.2
- Microsoft.AspNetCore.Mvc.Testing: 10.0.0-rc.2.25502.107 -> 10.0.2

GitHub Actions Updates:
- actions/checkout: v4.2.2 -> v6.0.1
- actions/setup-dotnet: v4.3.1 -> v5.1.0
- actions/upload-artifact: v4.6.2 -> v6.0.0
- codecov/codecov-action: af2ee03 -> 671740a
- dawidd6/action-download-artifact: v7 -> v12

Closes #2, #3, #4, #5, #6, #8, #9, #10, #11, #12, #13, #14, #16, #17
@philcarbone

Copy link
Copy Markdown
Contributor

Closed in favor of combined PR #24

@dependabot @github

dependabot Bot commented on behalf of github Jan 19, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/nuget/multi-f5356af26a branch January 19, 2026 19:56
philcarbone added a commit that referenced this pull request Jan 20, 2026
* chore: Combined Dependabot updates - NuGet packages and GitHub Actions

NuGet Package Updates:
- FastEndpoints: 7.1.1 -> 7.2.0
- FastEndpoints.Swagger: 7.1.1 -> 7.2.0
- HotChocolate.AspNetCore: 15.1.11 -> 15.1.12
- HotChocolate.Data: 15.1.11 -> 15.1.12
- Microsoft.AspNetCore.OpenApi: 10.0.1 -> 10.0.2
- Microsoft.Data.SqlClient: 6.1.3 -> 6.1.4
- Microsoft.Data.Sqlite: 10.0.1 -> 10.0.2
- Microsoft.EntityFrameworkCore: 10.0.1 -> 10.0.2
- Microsoft.EntityFrameworkCore.InMemory: 10.0.1 -> 10.0.2
- Microsoft.EntityFrameworkCore.Relational: 10.0.1 -> 10.0.2
- Microsoft.EntityFrameworkCore.Tasks: 10.0.1 -> 10.0.2
- Microsoft.AspNetCore.Mvc.Testing: 10.0.0-rc.2.25502.107 -> 10.0.2

GitHub Actions Updates:
- actions/checkout: v4.2.2 -> v6.0.1
- actions/setup-dotnet: v4.3.1 -> v5.1.0
- actions/upload-artifact: v4.6.2 -> v6.0.0
- codecov/codecov-action: af2ee03 -> 671740a
- dawidd6/action-download-artifact: v7 -> v12

Closes #2, #3, #4, #5, #6, #8, #9, #10, #11, #12, #13, #14, #16, #17

* fix: Correct GitHub Actions SHAs for v6.0.1 and v6.0.0

- actions/checkout@v6.0.1: 8e8c483db84b4bee98b60c0593521ed34d9990e8
- actions/upload-artifact@v6.0.0: b7c566a772e6b6bfb58ed0dc250532a479d7789f

* fix: Correct setup-dotnet SHA for v5.1.0

- actions/setup-dotnet@v5.1.0: baa11fbfe1d6520db94683bd5c7a3818018e4309

* Fix race condition in Azure Service Bus integration test perspective waiter

Root Cause:
CountingPerspectiveReceptor used ConcurrentBag with Contains() + Add() pattern,
which is NOT atomic. Under concurrent execution, multiple threads could pass
the Contains() check before any Add() completes, resulting in duplicate counting
or missed counts, causing tests to timeout or complete prematurely.

Race Condition Example:
1. Thread A: !Contains(key) → true
2. Thread B: !Contains(key) → true (before A adds)
3. Thread A: Add(key), Increment(count)  // count = 1
4. Thread B: Add(key), Increment(count)  // count = 2 (DUPLICATE!)
5. Result: Same perspective counted twice OR waiter never reaches expected count

Fix:
- Replace ConcurrentBag<string> with ConcurrentDictionary<string, byte>
- Replace Contains() + Add() with atomic TryAdd()
- TryAdd() returns true only for first caller, preventing race

Files Changed:
- CountingPerspectiveReceptor.cs: Use ConcurrentDictionary + TryAdd()
- PerspectiveCompletionWaiter.cs: Create ConcurrentDictionary instead of ConcurrentBag
- ServiceBusIntegrationFixture.cs: Same fix for WaitForPerspectiveCompletionAsync

This explains why RabbitMQ tests aren't flaky - they use PerspectiveCompletionWaiter
from TestUtilities which now has the fix, while Service Bus tests had duplicate code.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Fix InMemory integration test fixture to use ConcurrentDictionary

Missed updating InMemoryIntegrationFixture when fixing the race condition
in CountingPerspectiveReceptor. Changed ConcurrentBag to ConcurrentDictionary
to match the updated receptor signature.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Fix SonarCloud coverage merge by building before merge

Problem: ReportGenerator was trying to merge coverage reports that referenced
source-generated files (.whizbang-generated/**/*.g.cs) before those files existed,
causing 'File does not exist (any more)' errors.

Root Cause: Coverage artifacts from test workflows reference source-generated files
from their builds. When SonarCloud workflow tried to merge these coverage reports,
the files were missing because the project hadn't been built yet in this workflow.

Solution: Build project BEFORE merging coverage reports to ensure all source-generated
files exist. Then build again inside SonarScanner block for code analysis.

Workflow order (fixed):
1. Download coverage artifacts from all test workflows
2. Build project (generates all .whizbang-generated files)
3. Merge coverage with ReportGenerator (files now exist)
4. SonarScanner begin
5. Build again (SonarScanner analyzes code during build)
6. SonarScanner end (uploads analysis + merged coverage)

This adds one extra build but eliminates the coverage merge failures.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* Fix SonarCloud security hotspot: use full commit SHA for nuget/login action

SonarCloud flagged githubactions:S7637 - using tag instead of full commit SHA
reduces supply chain security.

Changed: nuget/login@v1 → NuGet/login@d22cc5f

This ensures precise, verifiable dependency tracking and prevents accidental
or malicious reference to unintended commits.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix(security): remove overly permissive workflow permissions

Remove `permissions: read-all` from security-scorecard.yml and use
job-level least-privilege permissions instead. This resolves the
SonarCloud vulnerability (githubactions:S8234) that was blocking
the quality gate.

The analysis job already had specific permissions defined, so the
workflow-level read-all was both unnecessary and overly permissive.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
philcarbone added a commit that referenced this pull request Apr 23, 2026
Four regression guards covering the class of bug fixed by the FlushAsync
split:

1. FlushApiSourceInvariantTests (unit) — reads Whizbang.Core source text:
   - Dispatcher.cs contains zero strategy.FlushAndGetBatchAsync() calls
     (all five cascade/publish/send sites must be fire-and-forget)
   - ServiceBusConsumerWorker + TransportConsumerWorker each have at
     least one FlushAndGetBatchAsync (the inbox dedup sites that consume
     the returned WorkBatch)
   - Every IWorkFlusher.FlushAsync impl delegates to FlushAndGetBatchAsync
     (end-of-request middleware cannot defer)
   - Zero FlushMode references anywhere in src/ (enum is gone)

2. CascadeToOutboxIntegrationTests.IntervalStrategy_CascadedEvents_BatchUntilForceFlush
   (Postgres integration) — dispatches 20 cascading commands with an
   Interval strategy singleton, asserts wh_outbox is empty before the
   force flush, 20 rows present after. Passes against real Postgres in
   ~10s.

Covers plan tasks #7 (Dispatcher call-site pinning), #8 (worker
call-site pinning), #9 (Interval integration), and #10 (FlushMode-removal
guard) with two files instead of several dozen behavior tests — the
source-text check is more durable against future refactors that update
mocks in sync with call sites.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant