Bump the nuget-minor-patch group with 15 updates by dependabot[bot] · Pull Request #246 · andregoepel/finance-app

Patch release for Aspire 13.5 that fixes Kafka health-check resource leaks, DevTunnel errors with automatically selected regions, misleading Azure emulator dashboard entries, and unintended changes to generated starter apps, plus Homebrew compatibility and Radius API diagnostic updates.

🐛 Fixes

📨 Kafka health checks leaked producers and polling threads — Each AppHost health-check execution created a new Kafka producer without disposing it, accumulating background threads over time. Health checks now reuse a producer per Kafka resource and dispose it with the AppHost, while keeping multiple Kafka resources independently configured. Fixes #20091. (#20094, backport of #20092, @davidfowl)
🌐 DevTunnels could fail when the region was selected automatically — Tunnel setup and health checks now use the cluster-qualified tunnel ID returned by the DevTunnel CLI for port operations and access queries. This fixes failures when a bare tunnel ID cannot be resolved for those operations. Regression introduced in 13.3. Fixes #18790. (#19853, backport of #19230, @Vladipz)
☁️ Emulator-only AppHosts showed an unused Azure environment — The dashboard now hides the azure-environment resource when no Azure resources require cloud provisioning, instead of leaving it visible in Not started. It remains visible for apps that combine local emulators with resources requiring Azure provisioning. No AppHost changes are needed. Fixes #19617. (#19998, backport of #19843, @eerhardt)
🧩 Starter app generation could alter unrelated JavaScript values — Dynamic port replacement could also replace matching numeric literals in bundled JavaScript, including Bootstrap timing values. Port substitutions are now restricted to localhost: URLs, preserving the original library files while still configuring the requested ports. Fixes #20030. (#20110, backport of #20031, @bart-vmware, @JamesNK)
🍎 Updated the Aspire Homebrew cask for Homebrew 6.x — Replaced deprecated cask URL and post-install syntax with the supported equivalents, resolving compatibility issues with current Homebrew while preserving install-channel metadata. (#20119, backport of #19965, @askpt, @joperezr)
🧪 Radius cloud-provider callback interfaces now carry the experimental diagnostic — IAwsRadiusProviderBuilder and IAzureRadiusProviderBuilder are now marked with ASPIRERADIUS003, matching the existing WithAwsProvider and WithAzureProvider methods. Code referencing these interfaces directly must now acknowledge the same experimental API diagnostic. (#19874, @sebastienros)

Full Changelog: v13.5.3...v13.5.4

Full commit: 9c1b401dd67746739044f68959cbf4d3d7af93a6

Commits viewable in compare view.

Updated Aspire.Hosting.PostgreSQL from 13.5.3 to 13.5.4.

Release notes

Sourced from Aspire.Hosting.PostgreSQL's releases.

13.5.4 What's New in Aspire 13.5.4

Patch release for Aspire 13.5 that fixes Kafka health-check resource leaks, DevTunnel errors with automatically selected regions, misleading Azure emulator dashboard entries, and unintended changes to generated starter apps, plus Homebrew compatibility and Radius API diagnostic updates.

🐛 Fixes

📨 Kafka health checks leaked producers and polling threads — Each AppHost health-check execution created a new Kafka producer without disposing it, accumulating background threads over time. Health checks now reuse a producer per Kafka resource and dispose it with the AppHost, while keeping multiple Kafka resources independently configured. Fixes #20091. (#20094, backport of #20092, @davidfowl)
🌐 DevTunnels could fail when the region was selected automatically — Tunnel setup and health checks now use the cluster-qualified tunnel ID returned by the DevTunnel CLI for port operations and access queries. This fixes failures when a bare tunnel ID cannot be resolved for those operations. Regression introduced in 13.3. Fixes #18790. (#19853, backport of #19230, @Vladipz)
☁️ Emulator-only AppHosts showed an unused Azure environment — The dashboard now hides the azure-environment resource when no Azure resources require cloud provisioning, instead of leaving it visible in Not started. It remains visible for apps that combine local emulators with resources requiring Azure provisioning. No AppHost changes are needed. Fixes #19617. (#19998, backport of #19843, @eerhardt)
🧩 Starter app generation could alter unrelated JavaScript values — Dynamic port replacement could also replace matching numeric literals in bundled JavaScript, including Bootstrap timing values. Port substitutions are now restricted to localhost: URLs, preserving the original library files while still configuring the requested ports. Fixes #20030. (#20110, backport of #20031, @bart-vmware, @JamesNK)
🍎 Updated the Aspire Homebrew cask for Homebrew 6.x — Replaced deprecated cask URL and post-install syntax with the supported equivalents, resolving compatibility issues with current Homebrew while preserving install-channel metadata. (#20119, backport of #19965, @askpt, @joperezr)
🧪 Radius cloud-provider callback interfaces now carry the experimental diagnostic — IAwsRadiusProviderBuilder and IAzureRadiusProviderBuilder are now marked with ASPIRERADIUS003, matching the existing WithAwsProvider and WithAzureProvider methods. Code referencing these interfaces directly must now acknowledge the same experimental API diagnostic. (#19874, @sebastienros)

Full Changelog: v13.5.3...v13.5.4

Full commit: 9c1b401dd67746739044f68959cbf4d3d7af93a6

Commits viewable in compare view.

Updated Aspire.Hosting.Testing from 13.5.3 to 13.5.4.

Release notes

Sourced from Aspire.Hosting.Testing's releases.

13.5.4 What's New in Aspire 13.5.4

Patch release for Aspire 13.5 that fixes Kafka health-check resource leaks, DevTunnel errors with automatically selected regions, misleading Azure emulator dashboard entries, and unintended changes to generated starter apps, plus Homebrew compatibility and Radius API diagnostic updates.

🐛 Fixes

📨 Kafka health checks leaked producers and polling threads — Each AppHost health-check execution created a new Kafka producer without disposing it, accumulating background threads over time. Health checks now reuse a producer per Kafka resource and dispose it with the AppHost, while keeping multiple Kafka resources independently configured. Fixes #20091. (#20094, backport of #20092, @davidfowl)
🌐 DevTunnels could fail when the region was selected automatically — Tunnel setup and health checks now use the cluster-qualified tunnel ID returned by the DevTunnel CLI for port operations and access queries. This fixes failures when a bare tunnel ID cannot be resolved for those operations. Regression introduced in 13.3. Fixes #18790. (#19853, backport of #19230, @Vladipz)
☁️ Emulator-only AppHosts showed an unused Azure environment — The dashboard now hides the azure-environment resource when no Azure resources require cloud provisioning, instead of leaving it visible in Not started. It remains visible for apps that combine local emulators with resources requiring Azure provisioning. No AppHost changes are needed. Fixes #19617. (#19998, backport of #19843, @eerhardt)
🧩 Starter app generation could alter unrelated JavaScript values — Dynamic port replacement could also replace matching numeric literals in bundled JavaScript, including Bootstrap timing values. Port substitutions are now restricted to localhost: URLs, preserving the original library files while still configuring the requested ports. Fixes #20030. (#20110, backport of #20031, @bart-vmware, @JamesNK)
🍎 Updated the Aspire Homebrew cask for Homebrew 6.x — Replaced deprecated cask URL and post-install syntax with the supported equivalents, resolving compatibility issues with current Homebrew while preserving install-channel metadata. (#20119, backport of #19965, @askpt, @joperezr)
🧪 Radius cloud-provider callback interfaces now carry the experimental diagnostic — IAwsRadiusProviderBuilder and IAzureRadiusProviderBuilder are now marked with ASPIRERADIUS003, matching the existing WithAwsProvider and WithAzureProvider methods. Code referencing these interfaces directly must now acknowledge the same experimental API diagnostic. (#19874, @sebastienros)

Full Changelog: v13.5.3...v13.5.4

Full commit: 9c1b401dd67746739044f68959cbf4d3d7af93a6

Commits viewable in compare view.

Updated bunit from 2.10.3 to 2.11.3.

Release notes

Sourced from bunit's releases.

2.11.3

Fixed

InvokeOnSpacerBeforeVisible now uses 4 parameters on .NET 11.0. Reported by @vnbaaij in #1915. Fixed by @vnbaaij in #1919.
A JSInterop timeout elapsing while a result was set could crash the test host with InvalidOperationException: Nullable object must have a value. Reported by @calebcwells in #1920. Fixed by @linkdotnet.

Commits viewable in compare view.

Updated Marten from 9.33.0 to 9.37.0.

Release notes

Sourced from Marten's releases.

9.37.0

Eighteen commits, and almost all of them are Marten.PgVector correctness — found by auditing the search surface 9.36.0 had just shipped. Every one of these was silent: a plausible answer, in a plausible order, that was wrong.

Vector and hybrid search returned the wrong rows


#5427	Searches skipped Marten's default filters — soft-deleted rows returned, no subclass discriminator, and the tenant filter keyed on the store rather than the document
#5428	Distance defaulted to `Cosine` rather than the metric the index declared, so an `L2` index was searched by cosine and silently fell back to a sequential scan
#5419	An indexed search was capped by `hnsw.ef_search` (default 40) — so it under-returned however large the `limit`
#5440	Rows over a document hierarchy came back deserialized as `T`, never the concrete subtype
#5433	A wrong-length query vector was cast to its own length rather than refused, so it errored in Postgres' words or answered empty
#5425	Full text silently fell back to an unindexed whole-document `to_tsvector` when no index matched the `regConfig`

`VectorProjection` wrote the wrong rows


#5420	Ignored conjoined tenancy — one table keyed on `id`, so the later tenant's write replaced the earlier one's
#5439	An inline projection wrote every event under the outer session's tenant, so `ForTenant(...)` appends landed in the wrong tenant
#5424	Guid-only, collapsing to `Guid.Empty` on string-identified streams
#5422	Page folding — a write and a retraction of one id in a single page left the row in the index

Searches now run through the session (#5421, #5423)

The session's connection, transaction, command timeout, resilience pipeline and IMartenSessionLogger. A search on a session inside a caller-managed transaction now sees that session's uncommitted writes, the way Query<T>() does.

⚠️ #5438's HNSW scan settings are preserved, not weakened. They ride the same batch as the search rather than a transaction of their own — Postgres runs a batch's statements in an implicit transaction, so SET LOCAL still cannot leak onto a pooled connection.

VectorSearchAsync, VectorSearchWithScoresAsync and VectorProjectionSearchAsync gain CancellationToken overloads. Overloads rather than defaulted parameters: an optional argument is compiled into the caller, so widening a shipped signature breaks every assembly that has not been rebuilt.

`ColumnWeights` is refused, not ignored (#5446)

HybridSearchOptions gained per-column weights for the text leg (jasperfx#854, JasperFx 2.72.0). Marten weights at index time through WeightedFullTextIndex, so there is nothing a per-call weight could apply to — and it is refused by name rather than ignored, because a caller who weights a title column and silently gets an unweighted ranking has no way to find out.

Timestamps and the explorer

#5379 — mt_last_modified no longer jumps by the server's UTC offset when a document is patched. now() at time zone 'utc' strips the offset, and the naive result is re-read in the session's TimeZone: on a UTC+2 database the stored instant was two hours in the past. ⚠️ Only patching was affected — an ordinary Store/SaveChanges takes the column default, which was always correct.

#5430 (thanks @erikshafer) covers the event half of the same defect, reached through stream compaction, which #5445 fixed and left untested — and its assertions run over two time zones in both directions, where a one-sided bound passes against a negative offset.

#5383 — database-scoped explorer reads, honest store-global reads, and two tenant-scoping defects.

On JasperFx 2.72.0.

9.36.0

Backfilled. This release shipped to NuGet on 2026-09-14 but was never tagged or released here; the notes below were written afterwards from the commits it contains.

Takes Marten.PgVector from a vector search that could not be indexed and could not be called portably, to one that shares the JasperFx.Events.Vectors contracts with Fisher and Polecat, can be served by an HNSW index, returns scores, and fuses with full text.


#5413	Marten.PgVector on the store-neutral vector contracts, with scored search
#5414	`VectorIndex` — declare an HNSW index for a vector search
#5415	Hybrid search: reciprocal rank fusion over the `ts_rank` leg and the vector leg
#5417	Keep the pre-9.36 API working alongside the shared contracts

⚠️ Breaking for Marten.PgVector, and a minor bump anyway

#5413 deleted that package's own IEmbeddingProvider and DistanceFunction in favour of the shared ones, and removed the dead VectorOn / PgVectorOptions registry, which had no references anywhere including the tests. The Pgvector.Vector overload of VectorSearchAsync was kept and forwards, so the common call site is source-compatible.

Minor rather than major because the whole package family shares one version and Marten itself has no break in this range — a major bump would move every other package for an extension package's API.

⚠️ Read 9.37.0 before adopting this one

The search surface shipped here was audited immediately afterwards, and ten silent defects came out of it — searches that skipped Marten's default filters and returned soft-deleted rows, a distance metric that defaulted to Cosine rather than the one the index declared, an indexed search capped at 40 rows by hnsw.ef_search, a VectorProjection that ignored conjoined tenancy, and more. Every one of them returned a plausible answer in a plausible order.

All of them are fixed in 9.37.0. If you are picking up Marten.PgVector for the first time, start there rather than here.

On the tag. This points at daeb27b5, not at the "Release 9.36.0" commit baf1fc3f. The publish dispatch from the release commit was cancelled, and the run that actually pushed the packages went from daeb27b5 — one commit later, carrying #5417. The tag names what shipped.

9.35.0

Marten 9.35.0 — Event Model naming, store identity, and idempotent archiving.

⚠️ Behaviour changes

Three, all deliberate. None require a code change to adopt, but each changes what an existing application observes.

1. A store's derived Event Model is now named after your service, not "EventModel" (#5408).

The store-derived Event Model source fell back to the literal "EventModel" — the one default guaranteed to be wrong for every host. Wolverine names its derived model after JasperFxOptions.ServiceName, and so does Bobcat's spec assembly, so the common case (Wolverine + one Marten store) assembled two models out of the box and had to restate a name it had already declared.

The fallback is now the service name. An explicit name still wins:

services.AddMarten(opts =>
{
    opts.Connection(connectionString);
    opts.EventModelName = "Ledgers";   // optional; defaults to JasperFxOptions.ServiceName
});

If you were relying on the model being called EventModel, set opts.EventModelName = "EventModel" explicitly.

2. The primary store's Subject now follows StoreName (#5409).

Subject was a literal marten://main that ignored StoreOptions.StoreName, while Identity had always been built from it — so naming a primary store moved one and left the other behind, and Subject is the one consumers key on. Both are now built from StoreName. Tooling that keys on store.Subject (CritterWatch's explorer reads and shard progression ids among them) will see marten://{storename} for a named store where it previously saw marten://main.

A store name is user-supplied text and a uri host is not, so names are sanitized: My Store would otherwise throw UriFormatException and a/b would silently parse its tail as a path. Ordinary names are unchanged.

3. Archiving an already-archived stream is a no-op instead of an error (#5403).

Under UseArchivedStreamPartitioning, a second archive of the same stream raised 23505 on mt_streams_archived_pkey. This also stalled async single-stream projections with IncludeArchivedEvents = true when they processed an Archived marker after an inline snapshot had already archived the stream. Repeated archiving now succeeds and does nothing.

A genuine collision is still reported: a different active stream reusing an archived stream id still fails, rather than being silently swallowed and losing its metadata.

Fixes and improvements

#5405 / #5407 — StoreOptions.EventModelName. A host that called AddEventModel("Something", …) assembled two models: its own, and one the store contributed under the default name. The name is configured on StoreOptions and read lazily when the model is assembled, so AddEventModel may be called before or after AddMarten.
#5409 — an ancillary store keeps a name it was given. BuildStoreOptions assigned StoreName both before and after the IConfigureMarten<T> chain, so a contribution that named the store was silently reverted to the marker type's name.
#5403 — partitioned archiving performance. Because is_archived is the list partition key on both mt_streams and mt_events, the archive function's new predicates also let PostgreSQL prune to the active partition, where the previous statements had to consider both.
JasperFx 2.69.3. Codegen output is now deterministic (jasperfx#832) — an ImHashMap keyed by Frame, which does not override GetHashCode, meant statement order followed identity hash codes and varied per process. Every Event Model slice also now carries the store it came from, so two stores projecting a document of the same simple name leave a recorded disagreement rather than one silently winning (jasperfx#836).

Compatibility

Binary compatible with 9.34.0. The public AddMarten / AddMartenStore<T> surface is unchanged — verified by diffing the extracted signature list against the 9.34.0 tag. New configuration is additive on StoreOptions.

9.34.0

Native AOT support for event-sourced applications, and a round of integrity fixes to the diagnostics and monitoring surface — including one deliberate behaviour change worth reading before upgrading.

Native AOT

Event-sourced applications now run under Native AOT.

#5375 — Closes four generics where the compiler can emit them, so an event-sourced app runs under Native AOT rather than failing at runtime on a construction the trimmer removed.
#5377 — The jsonb containment payload is written by Marten with Utf8JsonWriter instead of round-tripping through the consumer's serializer, removing a reflection-dependent path from AOT reads.

Diagnostics and monitoring

Three fixes to the event store explorer and projection-status APIs. All three are cases where a monitoring read returned something misleading, or changed the system it was observing.

#5400 — Behaviour change. The four explorer read APIs no longer provision anything. They resolved their database through ITenancy.FindOrCreateDatabase, and two tenancy models take the "or create" half literally: ShardedTenancy assigned an unknown tenant to a shard and ran partition + per-tenant sequence DDL for it, and SingleServerMultiTenancy issued CREATE DATABASE for a database named after the id. A console polling a retired or mistyped tenant id therefore brought that tenant — or a whole database — into existence.

An unrecognized tenant id now throws UnknownTenantIdException, which is what StaticMultiTenancy and MasterTableTenancy already did, so the explorer answers the same way across every tenancy model. Adds the public ITenancy.TryFindDatabase, a read-only counterpart to FindOrCreateDatabase; it is a default interface member, so custom ITenancy implementations keep working unchanged. FindOrCreateDatabase itself is untouched — create-on-demand remains its documented job for real tenant traffic.

If you call GetRecentStreamsAsync, ReadStreamAsync, QueryByTagsAsync or GetProjectionStatusesAsync with a tenant id that may not exist, it now throws where it previously succeeded.
#5382 — GetProjectionStatusesAsync(ct) threw NotSupportedException on a database-per-tenant store, because a tenant-less call has no default tenant to open a session against. It now answers from the projection registry, so "is this projection still registered?" — the only store-agnostic way to ask, and what orphan detection is built on — works on the store shape that most needs it.

Note the original issue reported that both overloads threw. Only the tenant-less one did; passing a tenant id or a database identifier from AllDatabases() has always worked and reads real per-database progression.
#5396 — ShardStatus.State reports the state of a reachable daemon instead of always answering Unknown. Unknown now means what it is documented to mean: there is no daemon here to ask.

Correctness

#5386 — The expected version for optimistic concurrency is seeded from a mapped version/revision member, not just the IVersioned marker interface. Thanks to @JurJean for the report and the original fix.
#5389 — Enum member renames are resolved by asking the serializer, so [JsonStringEnumMemberName] / [EnumMember] names are honored in LINQ translation rather than the CLR member name being assumed.
#5390 — The jsonb containment payload writer handles nested dictionary keys and byte[], and its limits are documented. Thanks to @erdtsieck.

Event modeling

#5397 — ProjectionEventModelSource is registered from AddMarten and AddMartenStore<T>, so Event Model views resolve from a Marten store without manual wiring.

pgvector

#5399 — Four defects the pgvector import left behind.

Docs and internals

#5381 — Documents PrefixSearch and the session-level full-text search shortcuts.
#5391 — The PostgreSQL setup docs described a Marten that no longer exists (stale PLV8 instructions, a non-functional image override, and an invented build matrix).
#5395 — Enrolls GuidOptimisticConcurrencyCompliance in the shared compliance suite.
#5370, #5371 — Takes Bobcat's shipped runner adapter and its interceptor opt-in.

Dependencies

JasperFx 2.69.1
Weasel 9.32.0
... (truncated)

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.10.0 to 18.10.1.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.10.1 What's Changed

Isolate code coverage files in published output by @azat-msft in [rel/18.10] Isolate code coverage files in published output microsoft/vstest#16476

Full Changelog: microsoft/vstest@v18.10.0...v18.10.1

Commits viewable in compare view.

Updated Quartz.Extensions.Hosting from 3.21.0 to 3.22.0.

Release notes

Sourced from Quartz.Extensions.Hosting's releases.

3.22.0

Quartz.NET 3.22.0 carries three fixes to the persistent store's recovery and clustering paths, each found on the 4.0 line and ported here. One of them adds a setting the store never had — a timeout on the statements it issues — which is the public-surface addition that makes this a minor rather than a patch. The schema is 3.20's. Two of the changes alter behaviour, each marked Behavior change worth noting below.

dotnet add package Quartz --version 3.22.0

What changed

A job that requested recovery is recovered after a hard kill when the application declares its jobs and triggers through AddJob/AddTrigger and the store already holds them. The declared trigger was applied as a reschedule, which went through ReplaceTrigger and deleted every fired-trigger row of the key — before Start(), so by the time the first cluster check-in or the non-clustered sweep looked for the interrupted execution, its row was gone. A replacement is not a removal: ReplaceTrigger now deletes the trigger row only, and unscheduling still takes the fired rows with it. The replacement of a trigger whose job disallows concurrent execution is stored BLOCKED behind an execution still in flight, as any trigger of that job is, where it used to be stored WAITING and could fire alongside. A fast restart under a stable instance id had a second defect: on its first check-in a node handed its own state row to recovery, and the deferral grace period judged that row by its old timestamp, so the EXECUTING row of a serial job was preserved for a second detection that never came — the node's own record is never deferred now. (#3759, port of e60bd26eeb)
- Behavior change worth noting: replacing a trigger keeps its fired-trigger rows, and the replacement of a non-concurrent job's trigger is stored BLOCKED while an execution is in flight.
quartz.jobStore.commandTimeout bounds every statement the store issues, the lock statement included. A row lock belongs to the database session that took it, so a node that loses its network without the server noticing keeps TRIGGER_ACCESS locked, and every other node's next lock statement queues behind that dead session — and nothing on this branch bounded the wait: the statement never failed, so the lock handler's retries, DbRetryInterval back-off and the SchedulerError notification never ran, and the cluster stopped firing without logging anything (#3763). The setting is a millisecond count like every other duration on the store; 0 means the provider's own default (30 seconds for most), a negative value is refused where it is configured, and a value past what ADO.NET can hold in whole seconds is refused for the same reason. It is rounded up to whole seconds, because rounding down would turn a sub-second value into "wait forever". It reaches the driver delegate through DelegateInitializationArgs and the lock handler through DBSemaphore.CommandTimeout, which the store writes once its handler is known — so a handler named by quartz.jobStore.lockHandler.type is bounded too. An unconfigured store imposes nothing. SchedulerBuilder's persistent-store options set it fluently. The troubleshooting page gains the dead-session case: how to tell it apart in each database, why killing a process does not reproduce it, and the server-side settings that are the only thing that frees the lock. 4.x has the same setting as JobStore:CommandTimeout. (#3764, #3765)
A failed check-in is retried inside the window its peers give it. A peer writes a node off once interval + threshold has passed since the row it last wrote — 15 s on the defaults — and the cluster manager's sleep after a failed check-in was floored at DbRetryInterval, also 15 s, so a check-in that failed at 7.5 s was next attempted after the peers had already recovered the node: its fired-trigger rows deleted, its recovering jobs fired again, [DisallowConcurrentExecution] no longer holding. Java Quartz sleeps the same way, so this is inherited rather than a regression. While the window is still open a failed check-in is now retried inside it — half of what is left each time, never later than DbRetryInterval, never sooner than the loop's pause — and only once it has closed does the ordinary back-off apply. The manager times the window from its own record of the last check-in that reached the database, not from the store's LastCheckin, which a failed read also stamps. Defaults and the 15-second failover latency are unchanged, and threshold >= DbRetryInterval is no longer a relation an operator has to know about. The configuration reference's clusterCheckinInterval default (7500, not 15000) and the missing clusterCheckinMisfireThreshold row were fixed on the way. (port of a5b2197e5d)
- Behavior change worth noting: after a failed check-in the next attempt comes sooner than DbRetryInterval while the peers' window is still open.

Public API — additive only

JobStoreSupport.CommandTimeout, DBSemaphore.CommandTimeout, AdoUtil.CommandTimeout, DelegateInitializationArgs.CommandTimeout, SchedulerBuilder.PersistentStoreOptions.CommandTimeout — the one setting, wherever a statement is prepared.

Upgrading

dotnet add package Quartz --version 3.22.0. Nothing to migrate; the schema is unchanged. The 4.x line is the current major and carries all three fixes as well; the 4.x migration guide is the way there.

Full changelog: quartznet/quartznet@v3.21.0...v3.22.0

Commits viewable in compare view.

Updated Radzen.Blazor from 11.3.2 to 11.4.1.

Release notes

Sourced from Radzen.Blazor's releases.

11.4.1

11.4.1 - 2026-09-17

Improvements

Spreadsheet adds Workbook.SaveToStreamAsync(Stream, IAsyncEnumerable<CellData?[]>, CancellationToken) to append rows from an asynchronous source to the workbook's only sheet as it saves, so bulk exports no longer build a Cell for every value. Built cells are written first, tables extend to the last written row, and an overload with useInlineStrings avoids retaining distinct text from appended rows. Demonstrated with a Northwind EF export (#2723). Thanks to @pianomanjh!
Spreadsheet buffers keys typed before the cell editor is focused and drains them into the editor, so fast type-to-edit over a slow circuit no longer restarts the edit for every key and keeps only the last one.
DataGrid sends one virtualized scroll update at a time, re-reading the live scroll position when the previous one completes, so a long-polling circuit no longer queues a request per scroll event and lags seconds behind the scrollbar.
Premium themes updated.

Fixes

Carousel scrolls to its initial SelectedIndex when the items are added after the index is set. The first render consumed the deferred scroll while the carousel had no items yet, so an index assigned before the items loaded showed the first slide with the pager on the selected one.
DataGrid no longer re-renders on keydown for keys it does not handle (Shift, Control, letters) once its keyboard flags are cleared, so holding Shift while scrolling a wide grid no longer stutters (#1361). Thanks to @RizgarOzan!
DataGrid simple filter menu operator buttons inherit the text color so the menu is readable in dark themes (#2726).
DropZone keeps the can-drop class while dragging over its own items. dragleave bubbles from the items, so the class was cleared and set again on every move and any styling tied to it flickered; enters are now counted against leaves and the class is cleared only when the drag really leaves the zone (#1857). Thanks to @RizgarOzan!
Spreadsheet keeps the format of a cell that has no value on save and on load, so a shaded, bordered or quote-prefixed empty cell round-trips through xlsx, and a covered cell of a merge keeps its own format instead of the anchor's placeholder (#2720). Thanks to @pianomanjh!

11.4.0

11.4.0 - 2026-09-14

Improvements

HtmlEditor resizes a selected image by dragging its handles: corner handles keep the aspect ratio (Shift releases it), side handles change one axis, a badge shows the size during the drag, Esc cancels it and Ctrl+Z reverts it. The size is written to the width and height attributes so the insert-image dialog reports it (#2703). Thanks to @MaurycyBartczak!
RangeNavigator shows an opt-in hover tooltip with the nearest point's category and value via ShowTooltip and TooltipFormatString (#2717). Thanks to @pianomanjh!
Spreadsheet supports the & text concatenation operator, workbook defined names in formulas and xlsx files, and the NA() function. IF ignores errors in the branch it does not return, unary plus returns its operand unchanged, a formula whose result is an empty cell displays 0, MATCH and XMATCH return #N/A for an empty lookup value and skip error cells, and numeric text is coerced in arithmetic while empty cells compare as empty text, zero or FALSE, matching Excel.
Spreadsheet xlsx export allocates 12 MB instead of 442 MB over 550,000 cells and runs faster than ClosedXML: cells are written to the stream in one sorted pass instead of a tree per row, references and numbers are formatted into spans, the shared string table lives in rented arrays and formats are read without being created. The shared string table and cell styles are now numbered in document order so identical workbooks serialize identically. Thanks to @pianomanjh!
Spreadsheet adds CellStore.SetValues for filling a block in bulk, shares one CellData for every empty cell and skips the dependency graph for cells nothing depends on, cutting fill allocations by 47%. Thanks to @pianomanjh!
DropDown, DropDownDataGrid, ListBox and AutoComplete hide the decorative trigger icon from screen readers, which announced "arrow_drop_down" (#2714). Thanks to @RizgarOzan!
Demos upload endpoint only writes image files. Thanks to @pianomanjh!
Premium themes updated.

Fixes

Spreadsheet no longer hangs while loading files with mutually referencing ranges. Each formula cell is evaluated once per recalculation instead of exponentially many times and the xlsx reader batches evaluation instead of recalculating after every formula it sets (#2719).
Spreadsheet pasting from Excel no longer clears the cell below the pasted range; a trailing CRLF ends the last row instead of starting an empty one (#2707).
Spreadsheet reads inline string cells (t="inlineStr") instead of loading them as empty, reads a rich-text shared string as one entry instead of one per run so later cells no longer show fragments of other cells, keeps shared, inline, str and quote-prefixed cells as text so "05" and "007" no longer load as numbers, and reads boolean cells back as booleans. Thanks to @pianomanjh!
Spreadsheet shared formulas expanded while loading xlsx no longer throw on & or drop parentheses and unary operators, and cross-sheet references resolve on load because sheets are evaluated only after all of them are added.
Spreadsheet saving a workbook whose merge covers a populated cell outside the sheet bounds no longer throws, and saving no longer inserts an unpopulated merge anchor into the store. Thanks to @pianomanjh!
RangeNavigator recomputes its scales and refreshes when the series data changes without a new domain (#2713). Thanks to @pianomanjh!
DataGrid a resize drag in an outer grid no longer pins a nested grid's frozen columns to the outer grid's offsets; frozen cell lookups are scoped to the grid's own table and rows. Thanks to @pianomanjh!
DataGrid Reset reads the declared OrderIndex again instead of keeping the saved column order. Thanks to @pianomanjh!
Carousel honors an initial SelectedIndex. The scroll ran before the child items existed and threw, leaving the first slide visible while the pager showed the selected one, and changing the index during prerendering failed the request. The scroll now runs after render: instant on first render, animated for later changes.
DropDown, DropDownDataGrid and ListBox omit the option aria-label instead of exposing the .NET type name when TextProperty is missing, and DropDownDataGrid announces the selected item by its text (#2715).
HtmlEditor no longer clones the whole document on every input while an image is selected when reading the value.
Mask honors an explicit id attribute when Name is also set; since 10.4.6 Name replaced the id so locators such as #x timed out, and TextBox, TextArea and Password now pass the same id to JS interop that they render (#2701).

Commits viewable in compare view.

Updated WolverineFx.Marten from 6.36.0 to 6.39.0.

Release notes

Sourced from WolverineFx.Marten's releases.

6.39.0

Two themes in this release: multi-tenancy correctness and modular monolith ergonomics, plus a health-signal fix that will quiet a lot of false alerts.

Declare a module's ancillary store once

Modular monoliths on ancillary stores had to repeat [Storage(typeof(IOrdersStore))] on every handler, endpoint and service in a module -- restating on each type a fact that belongs to the module, where missing one meant quietly committing to the wrong database.

opts.Policies.UseAncillaryStorageFromAssemblyContaining<OrdersModule>(typeof(IOrdersStore));

That covers message handlers, HTTP endpoints and gRPC services in that assembly, for Marten, Polecat and Fisher alike. An explicit [Storage] on a type still wins, so one handler can opt out of its module's default.

For gRPC this is not an ergonomic win but the only thing that works: the gRPC chains never apply chain-modifying attributes, so [Storage] on a gRPC service compiles, looks right, and does nothing. (#4477)

The stuck-poller health check was mostly crying wolf

This was for CritterWatch

The scheduled-job "poller is stuck" signal counted every scheduled envelope, whether or not it was due yet. A queue holding messages that are not due is a queue doing its job -- so any deliberate delay longer than the check window reported the poller as stuck, and stayed that way. Ordinary retry scheduling has the same shape, which means the signal grew with correct usage.

Measured on a production fleet of 512 sharded message databases: 254 of 271 active alerts -- 94% -- were this one check, across 265 databases. 114 of those were "degraded" over a single envelope scheduled 15 minutes out by an application deliberately waiting for a quiet period.

PersistedCounts.ScheduledDue now counts only envelopes already past their execution time, and the health signal reads that instead. It is an int?, and null means not measured rather than zero: a store that does not report it makes the signal stand down rather than falling back to the undifferentiated count, because falling back is the defect. PostgreSQL implements it as a FILTER on the existing scan, so the due count costs no extra query; the other providers report null and are simply silent here for now. (#4476)

Tenant message stores were sharing an identity

IMessageStore.Name is a tenant routing cache key, so two tenant stores answering to the same name send one tenant's messages to the other tenant's database.

PostgreSQL (#4468): the sticky queue listener agents resolve their database by tenant id instead of falling through to the default store.
SQL Server (#4471): tenant message stores are named after their database.
MySQL (#4472): tenant stores registered by data source are named, and the queue keeps its sender.

If you run multi-tenanted durable messaging on any of these three, this release is worth taking.

RabbitMQ virtual-host tenants never got publisher confirms

ConfigureChannelCreation(...) reached only the parent transport's channels. Every virtual-host tenant created its channels with PublisherConfirmationsEnabled and PublisherConfirmationTrackingEnabled false regardless, with no public way to set them per tenant.

That matters more than a missing option: without confirmation tracking, BasicPublishAsync returns before the broker can refuse the publish, so the sending agent counts it successful and deletes the envelope from the durable outbox. A refused publish -- an ACCESS_REFUSED after a vhost user loses write permission, say -- silently drops a message whose enrolling transaction has already committed.

Behaviour change worth knowing about: if you call ConfigureChannelCreation and have tenants configured, your tenant channels now get confirms and ConsumerDispatchConcurrency where they previously got neither. Publishing to tenant vhosts gets slower, correctly so.

Thanks to @outofrange-consulting for a report that arrived with a measurement table and the fix already located. (#4473)

Ancillary-only hosts picked the wrong persistence strategy

A host registering only an ancillary store through IntegrateWithWolverine<T> registered no codegen extension, so [Entity] and storage-action code silently read an empty in-memory dictionary. Fixed for Marten (#4464), Polecat (#4465) and Fisher (#4466).

Scheduled messages promoted from RavenDb and CosmosDb lost their store

... (truncated)

6.38.0

Eight issues, no breaking changes.

This is a correctness and operability release. Most of it is one shape of bug — something resolved against the wrong scope, which looked right only because two defaults usually coincide — plus the two remaining halves of recurring-schedule operability.

Multi-store and multi-tenancy

The multi-tenanted message store no longer swallows batch failures (#4435). A durable batch spanning several tenants was split across stores, but RetryBlock never rethrows — so a store that refused its share failed silently while the receiver acknowledged the whole batch. Messages no store had accepted were acked and lost. The batch is now split by the resolved store and a failure propagates.
Natural keys resolve through the store the chain is routed to (#4439).
Identity types resolve through the store the chain is routed to (#4441).

These two are a matched pair: a saga's natural key and its identity type are facts about the store, not about the application. A modular monolith with an ancillary store per module resolved both against the main store, so a saga in module B was looked up with module A's rules.
A Wolverine service name reaches JasperFx, so the Event Model canvas stays whole (#4448). WolverineOptions.ServiceName and JasperFxOptions.ServiceName both name the one running service, but the value only ever travelled one way — so the documented way to name a Wolverine service left the JasperFx side on its default, the entry assembly name. The visible damage was an Event Model canvas splitting in two: Wolverine's source named its model one thing, a store's source named it another, and neither canvas held both halves. It only ever looked correct when a host's assembly name and service name happened to coincide, which is exactly why no test caught it.

Recurring schedules

The remaining core operability gaps from #4437, which is closed by these two. (Durable last-run state, #4447, stays closed as not-planned: run state lives in OpenTelemetry, and the operability view belongs in CritterWatch.)

Non-UTC recurring schedules now record their tracking row (#4436). Cronos returns each occurrence carrying the schedule's offset, and Npgsql's timestamptz binder refuses any non-zero offset — so every tick of every zoned schedule threw on the bookkeeping write. Delivery was never affected; only the tracking row was missing. Normalizing in RecurringMessageRecord's init accessors fixes it in one place for all four relational providers.
Occurrences carry their schedule and their firing instant (#4445). The schedule name already reached the handler span. The occurrence instant did not: ScheduledTime is cleared by the scheduled machinery at fire time, so a handler could only learn which firing it was serving by string-parsing the deduplication id. Occurrences now carry a recurring-occurrence header, surfaced as the wolverine.schedule.occurrence trace tag.

Metrics also gained a schedule.name tag, so the success, failure and effective-time counters can finally be sliced per cron job. It is read off the envelope header rather than set locally, because the metric tag list is never serialized — an occurrence published on one node and handled on another would otherwise reach the counters with no attribution at all. The occurrence instant is deliberately trace-only: one distinct value per firing would make those series unbounded in cardinality.
IRecurringScheduleControl.TriggerAsync runs a schedule once, on demand (#4446). Previously an operator's only option was hand-publishing the message type out of band, which bypasses the occurrence and deduplication machinery entirely. The request is recorded on the schedule's durable tracking row and the agent publishes one occurrence for it on its next pass, so it works from any node — the same reason pause already goes through the store.

A manual run carries its own deduplication id, so a "run now" issued in the same instant as a scheduled firing is never silently collapsed into it. Triggering a paused schedule is refused: pausing says the schedule must not fire. A trigger is extra rather than a replacement — it leaves the cron cadence and the pending occurrence untouched, and it fires even for a fixed-date schedule whose occurrences have run out.

gRPC

A code-first gRPC contract can be registered without [WolverineGrpcService] on the interface (#4396). A contract you do not own — or one carrying only [ServiceContract] — could not be registered at all. AddWolverineGrpc(grpc => grpc.IncludeCodeFirstContract<IMyService>()) now registers it explicitly. Thanks to @erikshafer for the PR.

6.37.0

Eight issues, one of them breaking.

⚠️ Breaking change

ServiceCapabilities.EventModel is now an EventModelSetDescriptor rather than a single EventModelDescriptor (#4424). A host can legitimately assemble several Event Models — each store names its own through StoreOptions.EventModelName, and a modular monolith registers an ancillary store per module — and the export used to fold them all into one named for the service, losing a model's name outright and reporting nothing.

This is a compile break for anything reading that property, and the capabilities wire shape changes with it. A consumer that can only render one model asks .Sole, or folds explicitly with .Collapse() and gets a ModelCollapse hotspot recording what it lost. CritterWatch consumes this shape and has the equivalent fold still to follow.

Everything else in the public surface is additive.

Event Modeling

The Automation rule is derived from the model's own links (#4419). FinishModel carried a private copy of the cross-slice join; it is re-based on EventModelDescriptor.Links, so the pattern Wolverine derives and the arrow a viewer draws cannot disagree. A slice triggered by another slice's event through TriggerType — not only CommandType — is now classified too.
ReadsFrom is split out of ReadModelTypes (#4419). [ReadModel] and [Entity] parameters are things a slice reads; IStorageAction<T> returns are what it produces. They shared one list, which meant the Automation input edge — Event → Read Model → ⚙ Command — could not be drawn at all.
Each derived source stamps its own Origin (#4425). Wolverine registers two sources on the Derived rung, so a disagreement between them used to render as Derived claims X; Derived claims Y, naming neither file. It now reads event-model://wolverine against event-model://wolverine-http.

Native AOT

codegen write emits its own [DynamicDependency] rooting (#4426). Every Native AOT application had to hand-write a rooting block covering the generated registry, every generated handler, every handler class, every message type, and MessageRouter<T>/EmptyMessageRouter<T> closed over each one. Codegen now emits an AotRoots companion anchored by [ModuleInitializer] — an unconditional ILC root — so there is no app-side code at all. Verified by a real PublishAot binary booting and dispatching with the hand-written roots deleted.

Bug fixes

An outgoing envelope recovered from an ancillary store is acknowledged there (#4417). Envelope.Store does not survive persistence, so the acknowledgement fell back to the main store — the ancillary row survived, and the message was recovered, sent and handled again on every restart. Thanks to @raypet-visma for the diagnosis and the fix sketch.
Kafka consumer teardown is bounded (#4422). _consumer.Close() is a synchronous P/Invoke that can block forever against a degraded broker, so IHost.StopAsync never completed — observed wedged 20+ minutes, past both DrainTimeout and ShutdownTimeout. It now runs under the drain budget on a dedicated thread, and an abandoned teardown suppresses the consumer Dispose rather than destroying a handle another thread still owns.
A handler-class OnException returning OutgoingMessages compiles again (#4416). It failed code generation with "Frame chain is being re-arranged" while the same method on a middleware class worked. Thanks to @uniquelau for the report and for locating the exact divergence. The error-handling docs gained an example of using the hook to publish messages when the original message fails.

Build & dependencies

JasperFx 2.69.3, with Marten 9.35.0, Polecat 5.29.0, Fisher 1.10.0 and Weasel 9.32.0 on that line (#4421). The committed codegen write output is regenerated and a CICodegenDrift gate now guards it — meaningful only now that the emitted statement order is deterministic. Regenerating surfaced real staleness rather than the expected reordering: six orphaned handler files and four missing registry files.

Commits viewable in compare view.

Updated xunit.v3 from 4.0.0 to 4.0.1.

Release notes

Sourced from xunit.v3's releases.

No release notes found for this version range.

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps AndreGoepel.Marten.Configuration from 1.2.3 to 1.2.4 Bumps AndreGoepel.Marten.Identity.Blazor from 2.0.2 to 2.1.0 Bumps AndreGoepel.Marten.Testing from 1.2.2 to 1.2.3 Bumps AndreGoepel.Testing.Bunit from 1.3.1 to 1.3.2 Bumps AndreGoepel.Testing.E2E from 1.3.1 to 1.3.2 Bumps Aspire.Hosting.Docker from 13.5.3 to 13.5.4 Bumps Aspire.Hosting.PostgreSQL from 13.5.3 to 13.5.4 Bumps Aspire.Hosting.Testing from 13.5.3 to 13.5.4 Bumps bunit from 2.10.3 to 2.11.3 Bumps Marten from 9.33.0 to 9.37.0 Bumps Microsoft.NET.Test.Sdk from 18.10.0 to 18.10.1 Bumps Quartz.Extensions.Hosting from 3.21.0 to 3.22.0 Bumps Radzen.Blazor from 11.3.2 to 11.4.1 Bumps WolverineFx.Marten from 6.36.0 to 6.39.0 Bumps xunit.v3 from 4.0.0 to 4.0.1 --- updated-dependencies: - dependency-name: AndreGoepel.Marten.Configuration dependency-version: 1.2.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: AndreGoepel.Marten.Identity.Blazor dependency-version: 2.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: AndreGoepel.Marten.Testing dependency-version: 1.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: AndreGoepel.Testing.Bunit dependency-version: 1.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: AndreGoepel.Testing.E2E dependency-version: 1.3.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Aspire.Hosting.Docker dependency-version: 13.5.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Aspire.Hosting.PostgreSQL dependency-version: 13.5.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Aspire.Hosting.Testing dependency-version: 13.5.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: bunit dependency-version: 2.11.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Marten dependency-version: 9.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Microsoft.NET.Test.Sdk dependency-version: 18.10.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch - dependency-name: Quartz.Extensions.Hosting dependency-version: 3.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: Radzen.Blazor dependency-version: 11.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: WolverineFx.Marten dependency-version: 6.39.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: nuget-minor-patch - dependency-name: xunit.v3 dependency-version: 4.0.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: nuget-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Sep 18, 2026

Navigation Menu

Bump the nuget-minor-patch group with 15 updates - #246

Bump the nuget-minor-patch group with 15 updates#246
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/nuget-minor-patch-82ddd8d47f

dependabot Bot commented on behalf of github Sep 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 18, 2026

1.2.4

What's Changed

2.1.0

What's Changed

1.2.3

What's Changed

1.3.2

What's Changed

1.3.2

What's Changed

13.5.4

What's New in Aspire 13.5.4

🐛 Fixes

13.5.4

What's New in Aspire 13.5.4

🐛 Fixes

13.5.4

What's New in Aspire 13.5.4

🐛 Fixes

2.11.3

Fixed

9.37.0

Vector and hybrid search returned the wrong rows

VectorProjection wrote the wrong rows

Searches now run through the session (#​5421, #​5423)

ColumnWeights is refused, not ignored (#​5446)

Timestamps and the explorer

9.36.0

⚠️ Breaking for Marten.PgVector, and a minor bump anyway

⚠️ Read 9.37.0 before adopting this one

9.35.0

⚠️ Behaviour changes

Fixes and improvements

Compatibility

9.34.0

Native AOT

Diagnostics and monitoring

Correctness

Event modeling

pgvector

Docs and internals

Dependencies

18.10.1

What's Changed

3.22.0

What changed

Public API — additive only

Upgrading

11.4.1

11.4.1 - 2026-09-17

Improvements

Fixes

11.4.0

11.4.0 - 2026-09-14

Improvements

Fixes

6.39.0

Declare a module's ancillary store once

The stuck-poller health check was mostly crying wolf

Tenant message stores were sharing an identity

RabbitMQ virtual-host tenants never got publisher confirms

Ancillary-only hosts picked the wrong persistence strategy

Scheduled messages promoted from RavenDb and CosmosDb lost their store

6.38.0

Multi-store and multi-tenancy

Recurring schedules

gRPC

6.37.0

⚠️ Breaking change

Event Modeling

Native AOT

Bug fixes

Build & dependencies

Uh oh!

Reviewers

Assignees

Labels

Projects

`VectorProjection` wrote the wrong rows

Searches now run through the session (#5421, #5423)

`ColumnWeights` is refused, not ignored (#5446)