Skip to content

Bump the backend-dependencies group with 3 updates - #43

Merged
kimipsen merged 1 commit into
masterfrom
dependabot/nuget/src/backend/backend-dependencies-e68a01125f
Oct 30, 2026
Merged

Bump the backend-dependencies group with 3 updates#43
kimipsen merged 1 commit into
masterfrom
dependabot/nuget/src/backend/backend-dependencies-e68a01125f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 30, 2026

Copy link
Copy Markdown
Contributor

Updated Marten from 9.54.2 to 9.55.0.

Release notes

Sourced from Marten's releases.

9.55.0

Read before upgrading

Apps running under a Turkish or Azerbaijani culture (tr-TR, az-AZ) with document types whose names contain an uppercase I. Document aliases (#​5778), DdlTemplate lookups and flat-table upsert function names (#​5783) are now lowered with the invariant culture. Before this release, those cultures turned I into a dotless ı, so a document type Invoice was stored in mt_doc_ınvoice. From 9.55.0 it maps to mt_doc_invoice, and Marten will create that table empty. Rename the existing tables (and their upsert functions) to the invariant name before upgrading, or the existing documents will appear to be missing. Apps on any other culture are unaffected: the names they generate are unchanged.

Behaviour change: StoredDocument.Version for projection documents (#​5773). For a mapping that uses UseVersionFromMatchingStream with revisions, the diagnostics version token is now <mt_version>:<mt_last_modified as epoch microseconds> (or an md5 of the document body when last-modified tracking is disabled). It used to be mt_version alone, which did not change when the daemon rewrote the document at the same stream version. Anything that parsed the token as an integer must be updated. Undeleting a projection document through the diagnostics writer also no longer bumps mt_version past the stream's version.

Fixes worth calling out

  • HiLo ids recover after an outage (#​5784). If the first id allocation on a fresh store hit a database outage, every later allocation on that store rethrew the same exception after the database came back. Thanks to @​kentcooper for the report and the reproduction the regression test is built from.
  • Subclass queries use nested duplicated-field columns (#​5777). A query on a subclass now uses the duplicated column for a nested member such as x.Inner.Value, instead of falling back to the JSONB path.
  • Verbose connection tracing (#​5772). With TrackConnections = TrackLevel.Verbose, a marten.append.event activity event is now emitted on every append route, including the Quick routes that are the V9 default. Expect more events per append than before.
  • Weasel 9.47.1 fixes index readback for a DatabaseSchemaName that is a reserved word or contains uppercase. Before, every schema apply after the first failed with 42P07 (weasel#​750, contributed by @​marc-RocketRez).
  • StreamPagedByCursor writes each page's bytes directly and disposes its pooled stream (#​5776, @​chrisbbe).

What's Changed

New Contributors

Full Changelog: JasperFx/marten@v9.54.2...V9.55.0

Commits viewable in compare view.

Updated WolverineFx from 6.56.0 to 6.59.0.

Release notes

Sourced from WolverineFx's releases.

6.59.0

New

  • GH-5288 (#​5289): Scheduled message management now knows about sagas. ScheduledMessageSummary.SagaId reports the saga id carried by each scheduled envelope. The new ScheduledMessageQuery.SagaId limits QueryAsync and CancelAsync to one saga's scheduled messages, such as its pending timeouts.
    • There is no schema change. The filter reads every scheduled message that matches the rest of the query and pages the saga's messages in memory, so PageSize and TotalCount stay exact. On a large scheduled backlog, narrow the query with MessageType or an execution-time window as well.
    • A CancelAsync with a SagaId that matches nothing cancels nothing.
    • Supported by PostgreSQL, SQL Server, MySQL, SQLite, Oracle, RavenDB and CosmosDB. RavenDB and CosmosDB now treat PageSize <= 0 as "read every match", as the RDBMS stores already did.
  • #​5287: WolverineFx.AI's AddLlmCallouts() now works under TypeLoadMode.Static when the application's pre-generated code was written without it. A library can ship its own static codegen and a host can add LLM callouts on top. In Static mode, callouts run on a pre-built handler that needs no generated code. Every other mode is unchanged.
    • New LlmCalloutOptions.ConfigureChain(Action<HandlerChain>) customizes the callout chain in any mode. IHandlerPolicy doesn't reach the pre-built handler.
    • DeduplicateCallouts is refused at startup in Static mode, because deduplication is woven into generated code.

Fixes

  • GH-5286 (#​5290): A send that IHost.StopAsync() cancels mid-flight is no longer logged as a send failure. Azure Service Bus hands the runtime's cancellation token to the SDK, so an orderly shutdown used to produce two Error lines for a batch that was never lost. A durable agent now logs it at Information, because the envelopes stay in the outbox and are recovered on restart. A non-durable agent logs it at Warning, because those messages were not sent. A shutdown cancellation no longer counts toward the circuit breaker or the sending failure policies. A cancellation while the application is still running, or any other exception during shutdown, is still logged at Error.

6.58.0

New

  • GH-5279 (#​5280, #​5282): New opt-in Durability.UseTransactionScopedDurabilityPassLock for PostgreSQL. The serverless durability pass takes a transaction-scoped advisory lock (pg_try_advisory_xact_lock) instead of a session lock. This makes the pass lock safe behind a transaction-mode pooler such as PgBouncer or Supabase's pooler, where a session lock can leak onto a pooled connection or be held by two passes at once. #​5282 hardens it:

    • the lock connection stays out of an ambient TransactionScope
    • an idle_in_transaction_session_timeout can no longer drop the lock in the middle of a pass
    • a lock transaction that ends before the pass does is reported, and its pooled connection is discarded
    • a session unlock that fails is logged as a warning

    Wolverine also logs a one-time warning when the store doesn't support the setting, or when extension steps such as Marten's projection catch-up run under the open lock transaction. That open transaction can stall Marten's gap detection, which is tracked in JasperFx/marten#​5791. See the serverless guide.

Fixes

  • GH-5276 (#​5277, thanks @​3nth): The HTTP transport's batch endpoint now answers 503 when a durable local queue cannot write the batch to its inbox. Before, it answered 200 while the messages were dropped, so a durable outbox deleted messages that were never stored on either side. The sender now keeps the batch and retries it.
  • GH-5278 (#​5281): A durable TCP listener now answers ProcessingFailure instead of Received when its inbox could not store a batch. The sender keeps the batch and retries it, and a late duplicate is deduplicated by id. gRPC listeners can't be durable, so they aren't affected. A guard test now pins that.
  • #​5275 (thanks @​lahma): With Durability.EnableInboxPartitioning, PostgreSQL's durable inbox now refuses a redelivery whose identity was already handled. Before, the kept Handled row sat in a different partition and didn't collide, so the redelivery was handled a second time. This completes the stable-id deduplication from 6.57.0 for partitioned inboxes.

6.57.0

New

  • GH-5244 (#​5272): NServiceBus interop now supports XML. Many NServiceBus systems still use the NServiceBus XmlSerializer, and they no longer have to switch to JSON before a migration to Wolverine can start. Every NServiceBus interop endpoint (Rabbit MQ, Azure Service Bus, Amazon SQS and SNS, and the SQL Server and PostgreSQL NServiceBus transports) now reads both JSON and XML, choosing per message from the NServiceBus.ContentType header. To send XML, use the new NServiceBusXmlSerializer: .UseNServiceBusInterop().DefaultSerializer(new NServiceBusXmlSerializer()). Because one endpoint reads both formats, NServiceBus endpoints can also move from XML to JSON gradually. See XML Serialization with NServiceBus.
  • #​5268 (thanks @​lahma) and #​5273: A durable listener now gives a message from a non-Wolverine producer, which has no Wolverine id, a stable envelope id derived from the broker's own identity for that message. A redelivery is then deduplicated by the durable inbox instead of being handled twice. This covers Kafka (topic, partition and offset), NATS JetStream, Pulsar, Redis Streams, Amazon SQS and GCP Pub/Sub pull subscriptions. On SQS and Pub/Sub it applies in every endpoint mode. #​5273 also makes raw JSON work on durable SQS listeners. A duplicate the durable inbox refuses is now logged at Information instead of as an error.
  • GH-5260 (#​5261): New opt-in WolverineHttpOptions.RejectUnparseableHeaderValues answers 400 with ProblemDetails when a [FromHeader] value can't be parsed.

Fixes

  • GH-5244 (#​5272): NServiceBus replies to Wolverine over Rabbit MQ now go to the queue marked UseForReplies(). Wolverine used to give NServiceBus its own wolverine.response.{guid} system queue as the reply address, which NServiceBus can't reach, so every reply ended up in NServiceBus's error queue.
  • GH-5247 (#​5248): DurabilityAgent.StopAsync() now cancels its in-flight durability command and waits for it to finish. Before, a command still running at shutdown could outlive the host and fail against a disposed data source.
  • GH-5253 (#​5256, thanks @​thomhurst): A leadership lock acquisition cancelled by node shutdown is no longer logged as an error.
  • GH-5254 (#​5265): Shutdown now waits for handlers still running on a buffered local queue.
  • GH-5257 (#​5266): Stopping a listener now interrupts an inline retry cooldown instead of waiting it out, and the retry doesn't run after the stop.
  • GH-5262 (#​5263): Lightweight EF Core handlers now collect domain events before their save, so the events are published atomically with it.
  • #​5245 (thanks @​ahyousif): Managed EF Core tenancy combined with WithDbContextAbstraction now reuses the tenant DbContext, so repository writes, the save and outbox enrollment all use one context. This could previously fail code generation.
  • #​5250 (thanks @​johnkaram02): A request that repeats a [FromHeader] header binds the comma-joined values instead of answering 500.
  • #​5252 (thanks @​johnkaram02) and #​5259: Additional error actions such as AndPauseProcessing() chained after ScheduleRetryIndefinitely() / RequeueIndefinitely() now apply, including to the open-ended attempts after the listed delays.

Dependencies

  • JasperFx 2.96.1 and JasperFx.RuntimeCompiler 5.0.1 (#​5258)
  • Weasel 9.47.1 (#​5269)

Docs and build

  • The Best Practices guide is rewritten (#​5270).
  • New docs for stable envelope ids from non-Wolverine producers, and for deduplicating CloudEvents (#​5273).
  • ./build.sh LocalGate runs every CI suite on one machine (GH-5125, #​5246). The CI suites are rebalanced to stay under the 20 minute job limit (#​5267), and the scaffold tests now pass on Windows (GH-5255, #​5264).

Commits viewable in compare view.

Updated WolverineFx.RuntimeCompilation from 6.56.0 to 6.59.0.

Release notes

Sourced from WolverineFx.RuntimeCompilation's releases.

6.59.0

New

  • GH-5288 (#​5289): Scheduled message management now knows about sagas. ScheduledMessageSummary.SagaId reports the saga id carried by each scheduled envelope. The new ScheduledMessageQuery.SagaId limits QueryAsync and CancelAsync to one saga's scheduled messages, such as its pending timeouts.
    • There is no schema change. The filter reads every scheduled message that matches the rest of the query and pages the saga's messages in memory, so PageSize and TotalCount stay exact. On a large scheduled backlog, narrow the query with MessageType or an execution-time window as well.
    • A CancelAsync with a SagaId that matches nothing cancels nothing.
    • Supported by PostgreSQL, SQL Server, MySQL, SQLite, Oracle, RavenDB and CosmosDB. RavenDB and CosmosDB now treat PageSize <= 0 as "read every match", as the RDBMS stores already did.
  • #​5287: WolverineFx.AI's AddLlmCallouts() now works under TypeLoadMode.Static when the application's pre-generated code was written without it. A library can ship its own static codegen and a host can add LLM callouts on top. In Static mode, callouts run on a pre-built handler that needs no generated code. Every other mode is unchanged.
    • New LlmCalloutOptions.ConfigureChain(Action<HandlerChain>) customizes the callout chain in any mode. IHandlerPolicy doesn't reach the pre-built handler.
    • DeduplicateCallouts is refused at startup in Static mode, because deduplication is woven into generated code.

Fixes

  • GH-5286 (#​5290): A send that IHost.StopAsync() cancels mid-flight is no longer logged as a send failure. Azure Service Bus hands the runtime's cancellation token to the SDK, so an orderly shutdown used to produce two Error lines for a batch that was never lost. A durable agent now logs it at Information, because the envelopes stay in the outbox and are recovered on restart. A non-durable agent logs it at Warning, because those messages were not sent. A shutdown cancellation no longer counts toward the circuit breaker or the sending failure policies. A cancellation while the application is still running, or any other exception during shutdown, is still logged at Error.

6.58.0

New

  • GH-5279 (#​5280, #​5282): New opt-in Durability.UseTransactionScopedDurabilityPassLock for PostgreSQL. The serverless durability pass takes a transaction-scoped advisory lock (pg_try_advisory_xact_lock) instead of a session lock. This makes the pass lock safe behind a transaction-mode pooler such as PgBouncer or Supabase's pooler, where a session lock can leak onto a pooled connection or be held by two passes at once. #​5282 hardens it:

    • the lock connection stays out of an ambient TransactionScope
    • an idle_in_transaction_session_timeout can no longer drop the lock in the middle of a pass
    • a lock transaction that ends before the pass does is reported, and its pooled connection is discarded
    • a session unlock that fails is logged as a warning

    Wolverine also logs a one-time warning when the store doesn't support the setting, or when extension steps such as Marten's projection catch-up run under the open lock transaction. That open transaction can stall Marten's gap detection, which is tracked in JasperFx/marten#​5791. See the serverless guide.

Fixes

  • GH-5276 (#​5277, thanks @​3nth): The HTTP transport's batch endpoint now answers 503 when a durable local queue cannot write the batch to its inbox. Before, it answered 200 while the messages were dropped, so a durable outbox deleted messages that were never stored on either side. The sender now keeps the batch and retries it.
  • GH-5278 (#​5281): A durable TCP listener now answers ProcessingFailure instead of Received when its inbox could not store a batch. The sender keeps the batch and retries it, and a late duplicate is deduplicated by id. gRPC listeners can't be durable, so they aren't affected. A guard test now pins that.
  • #​5275 (thanks @​lahma): With Durability.EnableInboxPartitioning, PostgreSQL's durable inbox now refuses a redelivery whose identity was already handled. Before, the kept Handled row sat in a different partition and didn't collide, so the redelivery was handled a second time. This completes the stable-id deduplication from 6.57.0 for partitioned inboxes.

6.57.0

New

  • GH-5244 (#​5272): NServiceBus interop now supports XML. Many NServiceBus systems still use the NServiceBus XmlSerializer, and they no longer have to switch to JSON before a migration to Wolverine can start. Every NServiceBus interop endpoint (Rabbit MQ, Azure Service Bus, Amazon SQS and SNS, and the SQL Server and PostgreSQL NServiceBus transports) now reads both JSON and XML, choosing per message from the NServiceBus.ContentType header. To send XML, use the new NServiceBusXmlSerializer: .UseNServiceBusInterop().DefaultSerializer(new NServiceBusXmlSerializer()). Because one endpoint reads both formats, NServiceBus endpoints can also move from XML to JSON gradually. See XML Serialization with NServiceBus.
  • #​5268 (thanks @​lahma) and #​5273: A durable listener now gives a message from a non-Wolverine producer, which has no Wolverine id, a stable envelope id derived from the broker's own identity for that message. A redelivery is then deduplicated by the durable inbox instead of being handled twice. This covers Kafka (topic, partition and offset), NATS JetStream, Pulsar, Redis Streams, Amazon SQS and GCP Pub/Sub pull subscriptions. On SQS and Pub/Sub it applies in every endpoint mode. #​5273 also makes raw JSON work on durable SQS listeners. A duplicate the durable inbox refuses is now logged at Information instead of as an error.
  • GH-5260 (#​5261): New opt-in WolverineHttpOptions.RejectUnparseableHeaderValues answers 400 with ProblemDetails when a [FromHeader] value can't be parsed.

Fixes

  • GH-5244 (#​5272): NServiceBus replies to Wolverine over Rabbit MQ now go to the queue marked UseForReplies(). Wolverine used to give NServiceBus its own wolverine.response.{guid} system queue as the reply address, which NServiceBus can't reach, so every reply ended up in NServiceBus's error queue.
  • GH-5247 (#​5248): DurabilityAgent.StopAsync() now cancels its in-flight durability command and waits for it to finish. Before, a command still running at shutdown could outlive the host and fail against a disposed data source.
  • GH-5253 (#​5256, thanks @​thomhurst): A leadership lock acquisition cancelled by node shutdown is no longer logged as an error.
  • GH-5254 (#​5265): Shutdown now waits for handlers still running on a buffered local queue.
  • GH-5257 (#​5266): Stopping a listener now interrupts an inline retry cooldown instead of waiting it out, and the retry doesn't run after the stop.
  • GH-5262 (#​5263): Lightweight EF Core handlers now collect domain events before their save, so the events are published atomically with it.
  • #​5245 (thanks @​ahyousif): Managed EF Core tenancy combined with WithDbContextAbstraction now reuses the tenant DbContext, so repository writes, the save and outbox enrollment all use one context. This could previously fail code generation.
  • #​5250 (thanks @​johnkaram02): A request that repeats a [FromHeader] header binds the comma-joined values instead of answering 500.
  • #​5252 (thanks @​johnkaram02) and #​5259: Additional error actions such as AndPauseProcessing() chained after ScheduleRetryIndefinitely() / RequeueIndefinitely() now apply, including to the open-ended attempts after the listed delays.

Dependencies

  • JasperFx 2.96.1 and JasperFx.RuntimeCompiler 5.0.1 (#​5258)
  • Weasel 9.47.1 (#​5269)

Docs and build

  • The Best Practices guide is rewritten (#​5270).
  • New docs for stable envelope ids from non-Wolverine producers, and for deduplicating CloudEvents (#​5273).
  • ./build.sh LocalGate runs every CI suite on one machine (GH-5125, #​5246). The CI suites are rebalanced to stay under the 20 minute job limit (#​5267), and the scaffold tests now pass on Windows (GH-5255, #​5264).

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the backend-dependencies group with 3 updates
ddaa949 
Bumps Marten from 9.54.2 to 9.55.0
Bumps WolverineFx from 6.56.0 to 6.59.0
Bumps WolverineFx.RuntimeCompilation from 6.56.0 to 6.59.0

---
updated-dependencies:
- dependency-name: Marten
  dependency-version: 9.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: WolverineFx
  dependency-version: 6.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: WolverineFx.RuntimeCompilation
  dependency-version: 6.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the .NET Pull requests that update .NET code label Oct 30, 2026
@dependabot
dependabot Bot requested a review from kimipsen as a code owner October 30, 2026 05:16
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 30, 2026
@coderabbitai

coderabbitai Bot commented Oct 30, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: b58d4eef-55e2-44f0-8757-054c88e5ce51

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@sonarqubecloud

sonarqubecloud Bot commented Oct 30, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@github-actions

github-actions Bot commented Oct 30, 2026

Copy link
Copy Markdown

Backend coverage

Lines Branches
93.2% (22948/24611) 76.7% (6117/7979)

Full report: the coverage artifact of this run.

@kimipsen
kimipsen merged commit 3829059 into master Oct 30, 2026
14 of 15 checks passed
@kimipsen
kimipsen deleted the dependabot/nuget/src/backend/backend-dependencies-e68a01125f branch October 30, 2026 07:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kimipsen kimipsen kimipsen approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@kimipsen