Skip to content

Bump the wolverine group with 7 updates - #246

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/wolverine-19657124d0
Open

Bump the wolverine group with 7 updates#246
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/wolverine-19657124d0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor

Updated WolverineFx from 6.21.0 to 6.39.1.

Release notes

Sourced from WolverineFx's releases.

6.39.1

A bug fix release. If you use codegen test as a CI gate, run dead letter queues on any broker, or persist with Oracle, there's something in here for you.

codegen test works again

Since 6.37.0, dotnet run -- codegen test has failed on a clean checkout for any application that has message handlers, with one CS0234 per handler:

CS0234: The type or namespace name 'CreateInvoiceHandler2048194527' does not
exist in the namespace 'Internal.Generated.WolverineHandlers'

A lot of you use codegen test as the PR gate on pre-generated code, so this has been quietly breaking builds for two releases. codegen write followed by dotnet build was unaffected, and so was running in TypeLoadMode.Static, which is why it took a while to surface.

Two changes collided. codegen test compiles each generated file into its own assembly so it can enforce service-location rules per file, and 6.37.0 taught the handler registry to root every generated handler by name for native AOT. Compiled in isolation, those names point at types in other in-memory assemblies. HTTP-only applications never saw it, because their rooting only names the registry itself.

The fix is in JasperFx 2.73.2, which this release picks up. Wolverine's CI now runs codegen test against a project with message handlers, which nothing here did before -- the drift gate runs codegen write and the AOT smoke tests run publish, so this whole path had no coverage at all. (#​4486)

Thanks to @​andrevlins, who bisected it across four versions, found the root cause, wrote the upstream fix and validated it against four of his own services.

Dead lettering settles the message exactly once

MoveToErrorQueue always calls CompleteAsync() right after moving a message to the dead letter queue, and it has to: on SQS and Google Pub/Sub the dead letter move only sends a copy, so that trailing call is the only thing that ever settles the original. On Azure Service Bus and RabbitMQ the move is itself a settle, and the second one is redundant.

Azure Service Bus never said which it was doing. On a normal queue the redundant settle came back as "the lock supplied is invalid" and was swallowed -- harmless and invisible. On a session-enabled queue it comes back as SessionLockLost, which forces the AMQP management link closed and reopened before the next session can be accepted. The message always reached the dead letter queue; you paid for it in latency on whatever picked up that queue next. (#​4481)

Two more in the same area:

  • A message dead lettered from a session-specific listener now carries the failure diagnostics that the other three Azure Service Bus listeners attach. That listener was the only one not stamping them. (#​4481)
  • SQS was deleting a message twice when a requeue was retried. The guard meant to prevent it read a flag that nothing ever set, so it had never once fired. Deleting twice is harmless on SQS, but the flag is also how SQS reports whether it settled anything, which the next fix needs. (#​4489)
  • If you set MaximumBrokerRedeliveries, an over-delivered duplicate on SQS or Google Pub/Sub was dead lettered and then left unsettled, so the broker redelivered it and it was dead lettered again -- one copy per redelivery, in the very branch that exists to break that loop. (#​4488)

Oracle can recover incoming messages again

The durability agent threw on every cycle:

System.InvalidCastException: Unable to cast object of type 'System.Decimal' to type 'System.Int32'

Oracle returns count(*) as a NUMBER, which ODP.NET surfaces as decimal or Int64, and GetFieldValueAsync<int>() is a cast rather than a conversion -- it throws on anything but Int32. Recovery of incoming messages was dead for Oracle users. (#​4480)

This is the second time the same provider mapping has broken a durability operation, so the conversion now lives in one place rather than being fixed at each call site as it turns up. Thanks to @​Trasvi for the report, the bisect and the fix.

EF Core DbContext abstractions compile

If you registered an abstraction with WithDbContextAbstraction<IBillingDbContext, BillingDbContext>(), the generated handler came out as:

if (billingDbContext is not BillingDbContext billingDbContext) throw ...

... (truncated)

6.39.0

Two themes in this release: multi-tenancy correctness and modular monolith ergonomics, plus a health-signal fix that will quiet a lot of false alerts.

Declare a module's ancillary store once

Modular monoliths on ancillary stores had to repeat [Storage(typeof(IOrdersStore))] on every handler, endpoint and service in a module -- restating on each type a fact that belongs to the module, where missing one meant quietly committing to the wrong database.

opts.Policies.UseAncillaryStorageFromAssemblyContaining<OrdersModule>(typeof(IOrdersStore));

That covers message handlers, HTTP endpoints and gRPC services in that assembly, for Marten, Polecat and Fisher alike. An explicit [Storage] on a type still wins, so one handler can opt out of its module's default.

For gRPC this is not an ergonomic win but the only thing that works: the gRPC chains never apply chain-modifying attributes, so [Storage] on a gRPC service compiles, looks right, and does nothing. (#​4477)

The stuck-poller health check was mostly crying wolf

This was for CritterWatch

The scheduled-job "poller is stuck" signal counted every scheduled envelope, whether or not it was due yet. A queue holding messages that are not due is a queue doing its job -- so any deliberate delay longer than the check window reported the poller as stuck, and stayed that way. Ordinary retry scheduling has the same shape, which means the signal grew with correct usage.

Measured on a production fleet of 512 sharded message databases: 254 of 271 active alerts -- 94% -- were this one check, across 265 databases. 114 of those were "degraded" over a single envelope scheduled 15 minutes out by an application deliberately waiting for a quiet period.

PersistedCounts.ScheduledDue now counts only envelopes already past their execution time, and the health signal reads that instead. It is an int?, and null means not measured rather than zero: a store that does not report it makes the signal stand down rather than falling back to the undifferentiated count, because falling back is the defect. PostgreSQL implements it as a FILTER on the existing scan, so the due count costs no extra query; the other providers report null and are simply silent here for now. (#​4476)

Tenant message stores were sharing an identity

IMessageStore.Name is a tenant routing cache key, so two tenant stores answering to the same name send one tenant's messages to the other tenant's database.

  • PostgreSQL (#​4468): the sticky queue listener agents resolve their database by tenant id instead of falling through to the default store.
  • SQL Server (#​4471): tenant message stores are named after their database.
  • MySQL (#​4472): tenant stores registered by data source are named, and the queue keeps its sender.

If you run multi-tenanted durable messaging on any of these three, this release is worth taking.

RabbitMQ virtual-host tenants never got publisher confirms

ConfigureChannelCreation(...) reached only the parent transport's channels. Every virtual-host tenant created its channels with PublisherConfirmationsEnabled and PublisherConfirmationTrackingEnabled false regardless, with no public way to set them per tenant.

That matters more than a missing option: without confirmation tracking, BasicPublishAsync returns before the broker can refuse the publish, so the sending agent counts it successful and deletes the envelope from the durable outbox. A refused publish -- an ACCESS_REFUSED after a vhost user loses write permission, say -- silently drops a message whose enrolling transaction has already committed.

Behaviour change worth knowing about: if you call ConfigureChannelCreation and have tenants configured, your tenant channels now get confirms and ConsumerDispatchConcurrency where they previously got neither. Publishing to tenant vhosts gets slower, correctly so.

Thanks to @​outofrange-consulting for a report that arrived with a measurement table and the fix already located. (#​4473)

Ancillary-only hosts picked the wrong persistence strategy

A host registering only an ancillary store through IntegrateWithWolverine<T> registered no codegen extension, so [Entity] and storage-action code silently read an empty in-memory dictionary. Fixed for Marten (#​4464), Polecat (#​4465) and Fisher (#​4466).

Scheduled messages promoted from RavenDb and CosmosDb lost their store

... (truncated)

6.38.0

Eight issues, no breaking changes.

This is a correctness and operability release. Most of it is one shape of bug — something resolved against the wrong scope, which looked right only because two defaults usually coincide — plus the two remaining halves of recurring-schedule operability.

Multi-store and multi-tenancy

  • The multi-tenanted message store no longer swallows batch failures (#​4435). A durable batch spanning several tenants was split across stores, but RetryBlock never rethrows — so a store that refused its share failed silently while the receiver acknowledged the whole batch. Messages no store had accepted were acked and lost. The batch is now split by the resolved store and a failure propagates.

  • Natural keys resolve through the store the chain is routed to (#​4439).

  • Identity types resolve through the store the chain is routed to (#​4441).

    These two are a matched pair: a saga's natural key and its identity type are facts about the store, not about the application. A modular monolith with an ancillary store per module resolved both against the main store, so a saga in module B was looked up with module A's rules.

  • A Wolverine service name reaches JasperFx, so the Event Model canvas stays whole (#​4448). WolverineOptions.ServiceName and JasperFxOptions.ServiceName both name the one running service, but the value only ever travelled one way — so the documented way to name a Wolverine service left the JasperFx side on its default, the entry assembly name. The visible damage was an Event Model canvas splitting in two: Wolverine's source named its model one thing, a store's source named it another, and neither canvas held both halves. It only ever looked correct when a host's assembly name and service name happened to coincide, which is exactly why no test caught it.

Recurring schedules

The remaining core operability gaps from #​4437, which is closed by these two. (Durable last-run state, #​4447, stays closed as not-planned: run state lives in OpenTelemetry, and the operability view belongs in CritterWatch.)

  • Non-UTC recurring schedules now record their tracking row (#​4436). Cronos returns each occurrence carrying the schedule's offset, and Npgsql's timestamptz binder refuses any non-zero offset — so every tick of every zoned schedule threw on the bookkeeping write. Delivery was never affected; only the tracking row was missing. Normalizing in RecurringMessageRecord's init accessors fixes it in one place for all four relational providers.

  • Occurrences carry their schedule and their firing instant (#​4445). The schedule name already reached the handler span. The occurrence instant did not: ScheduledTime is cleared by the scheduled machinery at fire time, so a handler could only learn which firing it was serving by string-parsing the deduplication id. Occurrences now carry a recurring-occurrence header, surfaced as the wolverine.schedule.occurrence trace tag.

    Metrics also gained a schedule.name tag, so the success, failure and effective-time counters can finally be sliced per cron job. It is read off the envelope header rather than set locally, because the metric tag list is never serialized — an occurrence published on one node and handled on another would otherwise reach the counters with no attribution at all. The occurrence instant is deliberately trace-only: one distinct value per firing would make those series unbounded in cardinality.

  • IRecurringScheduleControl.TriggerAsync runs a schedule once, on demand (#​4446). Previously an operator's only option was hand-publishing the message type out of band, which bypasses the occurrence and deduplication machinery entirely. The request is recorded on the schedule's durable tracking row and the agent publishes one occurrence for it on its next pass, so it works from any node — the same reason pause already goes through the store.

    A manual run carries its own deduplication id, so a "run now" issued in the same instant as a scheduled firing is never silently collapsed into it. Triggering a paused schedule is refused: pausing says the schedule must not fire. A trigger is extra rather than a replacement — it leaves the cron cadence and the pending occurrence untouched, and it fires even for a fixed-date schedule whose occurrences have run out.

gRPC

  • A code-first gRPC contract can be registered without [WolverineGrpcService] on the interface (#​4396). A contract you do not own — or one carrying only [ServiceContract] — could not be registered at all. AddWolverineGrpc(grpc => grpc.IncludeCodeFirstContract<IMyService>()) now registers it explicitly. Thanks to @​erikshafer for the PR.

6.37.0

Eight issues, one of them breaking.

⚠️ Breaking change

ServiceCapabilities.EventModel is now an EventModelSetDescriptor rather than a single EventModelDescriptor (#​4424). A host can legitimately assemble several Event Models — each store names its own through StoreOptions.EventModelName, and a modular monolith registers an ancillary store per module — and the export used to fold them all into one named for the service, losing a model's name outright and reporting nothing.

This is a compile break for anything reading that property, and the capabilities wire shape changes with it. A consumer that can only render one model asks .Sole, or folds explicitly with .Collapse() and gets a ModelCollapse hotspot recording what it lost. CritterWatch consumes this shape and has the equivalent fold still to follow.

Everything else in the public surface is additive.

Event Modeling

  • The Automation rule is derived from the model's own links (#​4419). FinishModel carried a private copy of the cross-slice join; it is re-based on EventModelDescriptor.Links, so the pattern Wolverine derives and the arrow a viewer draws cannot disagree. A slice triggered by another slice's event through TriggerType — not only CommandType — is now classified too.
  • ReadsFrom is split out of ReadModelTypes (#​4419). [ReadModel] and [Entity] parameters are things a slice reads; IStorageAction<T> returns are what it produces. They shared one list, which meant the Automation input edge — Event → Read Model → ⚙ Command — could not be drawn at all.
  • Each derived source stamps its own Origin (#​4425). Wolverine registers two sources on the Derived rung, so a disagreement between them used to render as Derived claims X; Derived claims Y, naming neither file. It now reads event-model://wolverine against event-model://wolverine-http.

Native AOT

  • codegen write emits its own [DynamicDependency] rooting (#​4426). Every Native AOT application had to hand-write a rooting block covering the generated registry, every generated handler, every handler class, every message type, and MessageRouter<T>/EmptyMessageRouter<T> closed over each one. Codegen now emits an AotRoots companion anchored by [ModuleInitializer] — an unconditional ILC root — so there is no app-side code at all. Verified by a real PublishAot binary booting and dispatching with the hand-written roots deleted.

Bug fixes

  • An outgoing envelope recovered from an ancillary store is acknowledged there (#​4417). Envelope.Store does not survive persistence, so the acknowledgement fell back to the main store — the ancillary row survived, and the message was recovered, sent and handled again on every restart. Thanks to @​raypet-visma for the diagnosis and the fix sketch.
  • Kafka consumer teardown is bounded (#​4422). _consumer.Close() is a synchronous P/Invoke that can block forever against a degraded broker, so IHost.StopAsync never completed — observed wedged 20+ minutes, past both DrainTimeout and ShutdownTimeout. It now runs under the drain budget on a dedicated thread, and an abandoned teardown suppresses the consumer Dispose rather than destroying a handle another thread still owns.
  • A handler-class OnException returning OutgoingMessages compiles again (#​4416). It failed code generation with "Frame chain is being re-arranged" while the same method on a middleware class worked. Thanks to @​uniquelau for the report and for locating the exact divergence. The error-handling docs gained an example of using the hook to publish messages when the original message fails.

Build & dependencies

  • JasperFx 2.69.3, with Marten 9.35.0, Polecat 5.29.0, Fisher 1.10.0 and Weasel 9.32.0 on that line (#​4421). The committed codegen write output is regenerated and a CICodegenDrift gate now guards it — meaningful only now that the emitted statement order is deterministic. Regenerating surfaced real staleness rather than the expected reordering: six orphaned handler files and four missing registry files.

6.36.0

Heads up when upgrading

  • CircuitBreaker() on a buffered local queue now stops the host from starting with an InvalidListenerConfigurationException (#​4410, #​4412). A buffered local queue can't pause, so the circuit breaker used to be accepted and then silently ignored. Add UseDurableInbox() to the queue, or opts.Policies.UseDurableLocalQueues(), or remove the circuit breaker. Durable local queues and external listeners are unaffected. If you use WolverineFx.AI with DurableQueue = false plus a circuit breaker on the callout queue, this applies to you too.
  • In the Event Model, a message handler forwarded from a gRPC RPC now always derives SlicePattern.Command (#​4413).

New

  • [SlicePattern] declares the Event Model slice pattern of a message handler whose message has no producer in the model, such as a message from another service or a hosted service (#​4395, #​4413). It only fills the gap: an HTTP route, gRPC RPC, schedule or inbound external system still decides the pattern.
  • A Wolverine gRPC client can be injected into a handler (#​4403, #​4409).
  • Each retry attempt's trace span links to the failed attempt before it with an ActivityLink (#​4398, #​4405).

Fixes

  • Agent assignment: each node now checks its assigned agents against the ones actually running and fixes any mismatch (#​3987, #​4404). The follow-up makes assignment deletes owner-scoped, adds claim-if-absent, and hardens the sweep (#​4407, #​4408).
  • Batching: the per-pipeline pending count now counts every batched message, not just listener arrivals (#​4397, #​4406).
  • Security: System.Security.Cryptography.Xml is now 10.0.12, clearing a high-severity advisory (#​4401).

Docs

  • Local queues and buffered endpoints use System.Threading.Channels, not TPL Dataflow (#​4411).
  • Removed the nonexistent EnableNodeAgentSupport() from the exclusive node processing page (#​4414).

6.35.0

Store operation side effects, everywhere

MartenOps covered store / insert / update / delete plus StartStream; anything else meant taking an
IDocumentSession and giving up on the handler being a pure function. All three stores now cover
what their own session API supports.

Op Marten Polecat Fisher
HardDelete, HardDeleteWhere, UndoDeleteWhere ✅ ✅ ✅
UpdateExpectedVersion ✅ ✅ —
UpdateRevision ✅ ✅ ✅
TryUpdateRevision ✅ — ✅
Patch, PatchWhere ✅ — ✅
QueueSqlCommand ✅ ✅ ✅
InsertObjects, DeleteObjects ✅ — —
Append, ArchiveStream ✅ ✅ ✅
UnArchiveStream, TombstoneStream — ✅ —

The gaps are deliberate: each set was checked against that store's own session API rather than copied
across, and an op whose Execute could only throw is worse than the absence of one. Polecat's last
row is the reverse case — two operations Marten has no counterpart for.

Every op also implements ITenantedMartenOp / ITenantedPolecatOp / ITenantedFisherOp, so one
extension scopes any of them while preserving the concrete return type:

MartenOps.ArchiveStream(command.OrderId).ForTenant(command.TenantId);
PolecatOps.StoreMany(items).ForTenant(tenantId).With(oneMore);

Thanks to @​erdtsieck for the Marten half, which is where this started.

Event Modeling: a declared model and the code now meet

Three findings from one comparison of a curated Event Model against the application built from it
(#​4385, #​4386, #​4387):

  • Slices join on handler type. Slice names are the merge key, and a board names a slice for the
    behaviour (ConfirmAppointment) while a derived source names it for the message type or the route.
    An eleven-slice application assembled as twenty-two with no disagreements — not because the sources
    agreed, but because they never met.
  • [Emits(typeof(...))] lets a handler name the events its signature cannot carry. EventsToAppend
    and StartStream erase the element types, so the more idiomatically event-modelled an application
    was, the emptier its derived model got.
  • Pattern is left unclaimed for a message handler. A handler cannot tell a Command from an
    Automation, so a declaration wins the role instead of losing to a guess.

⚠️ Behaviour change: a plain message-handler slice no longer reports pattern: "Command" in
event-model output or the ServiceCapabilities snapshot. Pattern is still derived wherever the
code answers the question — HTTP routes, gRPC RPCs, schedules, external systems, and any slice whose
... (truncated)

6.34.0

Seventy commits since 6.33.0. The bulk of it is a sustained performance wave on the durability
and message-execution paths, alongside a new recurring-schedule feature, Native AOT support that
now boots end to end, and a long run of clustering and transport fixes.

New

  • Recurring cron-scheduled messages. opts.Schedules registers messages to be published on a
    cron expression, coordinated across the cluster so exactly one node fires each occurrence. (#​4307)
  • Azure Service Bus takes a configurable prefix for the system queues it names for itself, plus
    a transport-wide default dead letter queue name. Note the migration hazard called out in the docs
    if you adopt the prefix on an existing deployment. (#​4263, #​4281)
  • Amazon SQS takes the same kind of configurable prefix for the queues it names for itself. (#​4292)
  • The HTTP transport now answers to plain http:// destinations, not just https://.
    ITransport.AdditionalProtocols is the general mechanism, so any transport with legitimately
    multi-scheme addresses can opt in. (#​4200 / #​4379)
  • Broker resource setup honors ResourceMigrationFailureMode. FailFast stays the default and
    keeps resources setup strict; ContinueOnFailures lets a host whose broker topology is
    externally owned log the failures and start. (#​4119 / #​4380)

Performance

The GH-4316 wave, measured on the multi-transport perf rig rather than by inspection. Highlights:

  • Recovery poll and handled-cleanup get indexes they can actually use — three partial indexes on
    PostgreSQL and SQL Server, 37ms down to 0.04ms on the measured query. (#​4336)
  • Batched outbox stores for Oracle, RavenDB and Cosmos DB — 13.1x on Oracle, 61.4x on
    RavenDB. (#​4369 / #​4370)
  • Insert-side coalescing of the last un-batched per-message durability round trips: +24.5%
    throughput and 26% lower publish latency where the application publishes concurrently. (#​4319 / #​4368)
  • Fixed-arity batched inserts on PostgreSQL (1.35x) and pooled Envelope bodies above the LOH
    threshold     (13.5x at 100KB, with Gen1/Gen2 collections gone). (#​4320, #​4333)
  • Batched durability commands are chunked under each provider's parameter ceiling, so a large
    transaction no longer trips SQL Server's 2100-parameter limit. (#​4375 / #​4376)
  • Per-message allocation and lookup trims across routing, the send path, the execution pipeline,
    header handling, and metric accumulation. DateTimeOffset.Now is gone from the per-message paths.
    (#​4322, #​4323, #​4324, #​4325, #​4326, #​4328, #​4335)
  • Idle polling stops hammering (#​4321); the database queue transports drop their per-poll temp
    tables (#​4334); SQL Server metrics counts come from index metadata instead of three full scans
    (#​4318); Redis Streams gains batched durable arrival, measured at +159% (#​4329).

Two changes measured negative on the rig and were reverted rather than shipped — the Azure Service
Bus prefetch default and the coalescer's Queue shape. Both are recorded so they are not revisited.

Native AOT

A Wolverine application now completes a Native AOT publish and boots through its own bootstrap.
(#​4287, #​4298, #​4301, #​4305). A Native AOT app with any external transport used to die building its
first route — fixed in #​4232 / #​4378. The AOT publish smoke test hard-asserts a full boot.

Clustering, agents and durability

... (truncated)

6.33.0

The headline is a new package. WolverineFx.AI makes a one shot LLM call an ordinary Wolverine message: durable, outbox enrolled, retried by the same rules as everything else, and testable without a model anywhere in sight.

WolverineFx.AI (new package)

An LlmCallout is a message. Return one from a handler next to your storage action and it is enrolled in that handler's outbox, so a callout cannot fire for a transaction that did not commit and cannot be lost to a restart in between. The model's answer comes back as an ordinary cascading message, with an ordinary handler, an ordinary retry policy, and its own place in the correlation chain. (closes #​4227)

  • Spend guardrails as middleware on the callout queue. LlmBudget.MaximumPromptCharacters refuses a runaway prompt before your provider is ever called; MaximumTokensPerWindow refuses callouts once the node has burned its allowance. Both dead letter rather than retry, and so does an answer that cannot be parsed into the response type you asked for -- retrying either is the runaway spend the budget exists to stop.
  • A scripted IChatClient for testing. StubChatClient exercises a callout's whole round trip with no key, no network and no model.
  • Trim and AOT clean, guarded by a Wolverine.AI.AotSmoke project under TrimMode=full that CI runs. (closes #​4230)
  • Documentation for tuning it, new in this release: how to control parallelism against your provider, why the answer has its own queue with its own settings, and how to bring your own error handling on both sides.

The package references only the Microsoft.Extensions.AI abstractions, never a vendor SDK. The provider -- Anthropic, OpenAI, Azure, Ollama -- and any middleware over it stay your choice.

Fixes

  • A node no longer sweeps up its own in-flight stop as a wedged shard. An event-subscription agent could end up running on two nodes at once while wolverine_nodes credited only one, so nothing in the system could ever stop the extra copy. (closes #​4240)
  • Node record descriptions no longer overflow the column and fail the insert. An AssignmentChanged description carries an agent URI, a schema name and a destination node, which on a real cluster overran the description column and failed the whole AgentCommand batch behind it. MySQL was worst hit at VARCHAR(255). (closes #​4246)
  • DataAnnotations validation works with ServiceLocationPolicy.NotAllowed -- on HTTP endpoints and, now, on message handlers. Under the Wolverine 6 default this made the validation middleware unusable and threw at bootstrap. (closes #​4238)
  • A failed EF Core rollback no longer displaces the exception that caused it. (closes #​4239)
  • Wolverine parameter attributes work on gRPC before/after hooks -- [Entity], [All], [Queryable], [WriteAggregate] and the rest. (closes #​3935)
  • An application-wide default duplicate status code via opts.DefaultDuplicateStatusCode, and deduplication refusals now advertise their problem document in OpenAPI.
  • Concurrent IHost.StopAsync no longer tears the agents down twice.

Upgrade note

6.33.0 requires Weasel 9.30.0, and that raises the GH-4246 fix from "new databases only" to "existing ones too": the schema differ now compares character lengths, so a widened varchar is no longer invisible to it and an existing table is corrected in place by an ALTER TABLE ... MODIFY that keeps its rows.

Worth knowing before you upgrade: that comparison runs in both directions. Width drift that was previously invisible now generates ALTERs, and a model narrower than an existing column will emit a narrowing ALTER that can fail on real data. Sizes that are not character lengths -- a MySQL int(11) display width, a decimal precision, a datetime fsp -- are still ignored.

Dependencies

JasperFx 2.60.0, Marten 9.30.0, Polecat 5.21.1, Fisher 1.0.6, Weasel 9.30.0.

6.32.0

See CHANGELOG.md for the full entries.

New packages

WolverineFx.AmazonS3 and WolverineFx.AzureBlobStorage carry document and saga persistence plus the claim check store that used to ship separately. Registration is explicit per type — Store<T>() and Saga<T>() are separate calls and each refuses the other's type — and saga writes are guarded by conditional requests, surfacing as SagaConcurrencyException so one OnException<ConcurrencyException> policy still covers every store. (#​4160, originally #​4165 by Anne Erdtsieck.)

WolverineFx.ClaimCheck.AmazonS3 is deprecated. The namespace is unchanged, so migration is a package reference swap — but keeping both referenced produces ambiguous-type errors.

Redis document and saga persistence folds into the existing WolverineFx.Redis rather than a new package, with saga concurrency implemented as a Lua compare-and-swap.

Fixes

  • A shutting-down node no longer dead-letters work whose handler never ran (#​4213). Core, so every transport.
  • Scheduled promotion matches the whole message identity on SQLite, SQL Server, MySQL and Oracle rather than PostgreSQL alone (#​4216) — including a not-yet-due scheduled message being promoted and executed early.
  • A redelivered inbox row can be retired when its identity is already handled under EnableInboxPartitioning (#​4216); previously it could not be retired at all.
  • A listener whose broker entity was deleted underneath it now heals instead of retrying once a second forever (#​4215).
  • Terminal settle failures are classified on the retry block, closing a gap where two of four Azure Service Bus listeners had no classification at all (#​4012).
  • Scope priming no longer manufactures a Marten session for every handler that service-locates anything (#​4198). Requires JasperFx 2.58.0 or later.
  • A duplicated scheduled identity no longer wedges promotion on a partitioned PostgreSQL inbox (#​4202).
  • AddStopConditionIfNull accepts the null identity its signature declares (#​4161).

Diagnostics

  • NativeAck and partitioned listeners report ceilings, per-lane depth and duplicate-suppression counts (#​4199). BufferLimit is now null on the modes that never enforced it, with the broker's prefetch window reported as InFlightLimit.
  • MaximumBrokerRedeliveries is documented as the delivery count it actually is (#​4216). Behaviour unchanged.

Event model

  • A stream-appending handler's return value is reported as a reply rather than an emitted event (#​4204).
  • A generic message type's slice reads the way source spells it, which also stops two relays with different payloads colliding on one slice (#​4205).

Also

  • Explicit per-provider entity attributes, starting with [FromMarten] and [FromEfCore] (#​4214).
  • RabbitMQ documentation for AddResourceSetupOnStartup and AutoProvision (#​4223).

6.31.0

Logical message deduplication

Envelope.Id identifies one delivery. That is the right identity for "the broker handed me this twice" and the wrong one for "the operator clicked Rebuild twice" — those are different deliveries of the same intent, so each carries a different Envelope.Id and every one gets through.

6.31.0 promotes Envelope.DeduplicationId into a first-class logical id, with storage, enforcement, and a retention policy behind it.

opts.Durability.EnableMessageDeduplication = true;   // provisions wolverine_deduplication
opts.Durability.DeduplicationWindow = 24.Hours();    // this IS the guarantee

[Deduplicated]
public static void Handle(RebuildProjection command) { }

It is opt-in throughout — leaving it off means no schema change at all on upgrade. Storage is a separate wolverine_deduplication table rather than a column on the inbox, because under EnableInboxPartitioning the inbox is PARTITION BY LIST (status) and marking an envelope handled moves the row between partitions, which would let one logical id exist as both Incoming and Handled — silently, and only for users who enabled partitioning. Claiming is an INSERT that either succeeds or trips the primary key, never a SELECT-then-INSERT.

Refusals differ per chain type: a message handler discards and acks, HTTP returns 409 with ProblemDetails (configurable to 2xx where a replay is benign), gRPC returns AlreadyExists / InvalidArgument per AIP-193. Storage on PostgreSQL, SQL Server, MySQL and SQLite.

Deriving the id from the message

The publishing side does not have to remember DeliveryOptions.DeduplicationId at every call site. A message type declares its own logical identity once, the way it already declares a topic name with [Topic] or a saga id with [SagaIdentity]:

public record ArchiveInvoice([property: DeduplicationIdentity] string InvoiceNumber, DateOnly AsOf);

[DeduplicationIdentity(nameof(ReceiveShipment.ShipmentId))]   // a contract whose members you cannot decorate
public record ReceiveShipment(Guid ShipmentId, string Warehouse);

// or configured, for composed ids and generated message types
opts.MessageDeduplication.ByMessage<RebuildProjection>(x => $"{x.ProjectionName}|{x.OccurrenceUtc:O}");
opts.MessageDeduplication.ByMemberNamed("IdempotencyKey", "DeduplicationId");
opts.Policies.ForMessagesOfType<CreateOrder>().DeduplicateBy(x => $"{x.Sku}|{x.Quantity}");

These are IEnvelopeRule at the message type level, resolved once when the route is built rather than per message. An explicit DeliveryOptions.DeduplicationId always wins, then configured rules, then the attribute.

Fixes

  • Broker startup is bounded by a clock. A host starting against a dead broker took 21m38s to fail — long enough to look like a hang and to blow past any orchestrator's startup probe. (#​4116)
  • ListeningAgent sees past its receiver wrappers. ReceiverWithRules — installed by a bare endpoint-level MessageType or TenantId — is unconditionally an ILocalQueue, so a wrapped NativeAck or Inline receiver took the wrong branch and threw on the durability agent's re-entry path. The same blindness meant a terminally faulted receiver reported healthy forever on exactly the endpoints most likely to be non-trivially configured. (#​4188, #​4191)
  • A locally-owned shard that stopped with nothing to report is restarted. It was invisible to both recovery paths because each deferred to the other; the status was correct, the assignment was correct, and nothing joined the two. Reached through the console's Rebuild, which completed, acked success, and left the shard dead. (#​4193)
  • A NativeAck or Inline listener reports its real queue depth and last receipt instead of 0. (#​4186)
  • Event Model derivation stops claiming TriggerLabel, which was beating overlay declarations and minting a SourceDisagreement hotspot per labelled route; and a collection response now reads its element type instead of reporting an assembly-qualified CLR string as a canvas node. (#​4181, #​4182)
  • An agent command is never forwarded to the node it is already on. (#​4184)

Dependencies

  • JasperFx, JasperFx.Events and the two source generator packages to 2.57.2.

Full changelog: JasperFx/wolverine@V6.30.3...V6.31.0
... (truncated)

6.30.3

Patch release. Requires JasperFx 2.57.1, which ships the code-generation half of two of these fixes.

Several of these failed silently — a host that started clean, passed health checks, and did less than it appeared to. Worth a look if any of the shapes below match your application.

Code generation and service location

  • ServiceProviderSource.IsolatedAndScoped is now honored by Wolverine.HTTP (#​4171). An endpoint or middleware asking for an IServiceProvider always received httpContext.RequestServices, whatever you configured. Note the consequence: asking for an IServiceProvider in an endpoint is service location and now registers as such, so under ServiceLocationPolicy.NotAllowed those endpoints will throw where they previously slipped past the policy unnoticed. Message handlers have always behaved this way.

  • Scope priming now fires for every chain that service-locates, not only those naming an IServiceProvider (#​4171). If a chain reached service location solely through an opaque scoped/transient registration, its child scope was never primed — so a service-located IMessageContext, IMessageBus, or Marten IDocumentSession was a second, un-enrolled instance rather than the one the handler already owned. Handlers and HTTP endpoints are both covered now.

  • Lazy<T> dependencies resolve through their registration (#​4159). An open-generic registration such as TryAddScoped(typeof(Lazy<>), typeof(LazyResolver<>)) was ignored whenever the closed type was itself concrete, and new Lazy<IFoo>() was emitted instead. That compiles and can never work — the first .Value throws MissingMemberException for any service without a public parameterless constructor. Relatedly, AlwaysUseServiceLocationFor(typeof(Lazy<>)) accepted an open generic and then matched nothing; it now matches that generic's closed forms.

Sagas

  • ResequencerSaga advances LastSequence when a message is handled, not when it is published (#​4172). A replayed message could let a queue backlog walk past the ordering guard while it was still in flight, reordering the handled sequence.

  • An already-sequenced arrival is observable and overridable (#​4175). A message whose order the saga had already passed was handled again in silence. The new shouldHandleAlreadySequenced hook logs a warning by default — behavior is unchanged — and can be overridden to discard, raise a metric, or throw.

Startup

  • AutoCreate.None no longer pays for a full schema diff at startup (#​4166).

Full changelog: JasperFx/wolverine@V6.30.2...V6.30.3

6.30.2

This addresses an issue encountered by a JasperFx client hitting a sudden crunch of messages being enqueued into local queues. Not something we expect to be common at all, but now we're better anyway!

What's Changed

Full Changelog: JasperFx/wolverine@V6.30.1...V6.30.2

6.30.1

There's some CritterWatch related functionality smuggled in here for our forthcoming Event Modeling visualization. Otherwise, this is mostly a ton of fine grained improvements for CI or message broker usage problems detected by dogfooding and some "Mr. AI tool, go try to identify potential problems" action

What's Changed

Full Changelog: JasperFx/wolverine@V6.30.0...V6.30.1

6.30.0

Wolverine 6.30.0 is a large release built around one headline feature — a new endpoint mode — plus the usual crop of transport fixes, and a couple of long-standing multi-tenancy and HTTP gaps closed.

EndpointMode.NativeAck

The main event. Buffered's throughput and partitioning with Inline's no-loss guarantee, and no database required.

A broker delivery is held unacknowledged while the envelope flows through an in-memory, optionally group-partitioned execution block, and is settled natively when the handler pipeline terminates. Nothing is acknowledged ahead of its handler, so work parked in a lane when a node goes away comes back rather than vanishing.

opts.ListenToRabbitQueue("orders")
    .ProcessInParallelWithNativeAcks();

The guarantee, stated exactly: no two messages sharing a group id execute concurrently. Ordering is per-slot best-effort, not per-group guaranteed; redelivery may reorder. Anything needing strict order under failure keeps the durable inbox.

Transport support is opt-in and default-closed — a transport must explicitly claim the mode, because most settlement models cannot express out-of-order completion. Adopted by RabbitMQ, Amazon SQS, Azure Service Bus, NATS JetStream, Redis Streams, Pulsar and GCP Pub/Sub (#​3708, #​4046, #​4047, #​4050, #​4051, #​4052, #​4053).

Supporting work in the same wave:

  • Lease renewal for queued envelopes on clocked transports — SQS, ASB, JetStream and Pub/Sub run a clock on an unsettled delivery, and the risk window is lane queue time plus handler time (#​4048).
  • In-memory idempotency guard, an opt-in duplicate filter for a mode with no inbox row to deduplicate against (#​3710).
  • Global partitioning across sharded queues (#​3709).
  • Listener mode coherence validation, which caught that RabbitMQ queues default to Inline — so sharded topologies were silently unpartitioned without an explicit BufferedInMemory() (#​3712, #​4022).
  • A five-node chaos reproduction under webhook flood, measuring the real duplicate rate on abrupt node loss (#​3713).

Multi-tenancy

  • Conjoined EF Core tenancy now works when Marten owns the message store via IntegrateWithWolverine(). Marten hands Wolverine an NpgsqlDataSource rather than a connection string, and NpgsqlDataSource.ConnectionString deliberately omits the password — so there is a new DbDataSource overload of AddDbContextWithWolverineManagedConjoinedTenancy that carries credentials through intact. A second defect on the same path is fixed too: IntegrateWithWolverine() never registered the tenant partitioning provider, so PartitionPerTenant() failed (#​4044).

HTTP and event sourcing

  • [StreamState] and [StreamEvents] — new parameter attributes for handlers whose read is the raw stream rather than the folded aggregate, for timeline and audit shaped endpoints that [ReadModel] cannot express. Store-agnostic across Marten, Polecat and Fisher; Marten batches both fetches into a single round trip (#​3627).
  • Marten concurrency conflicts as 409 — a documented, tested recipe for mapping optimistic-concurrency failures on [WriteAggregate] endpoints to ProblemDetails instead of an unhandled 500. Note that StreamLockedException derives from MartenException, not ConcurrencyException, so catching only the latter silently leaves FetchForExclusiveWriting returning 500s (#​3764).
  • Event Model slices per route — HttpChainDescriptor and GrpcRpcDescriptor now carry the slice the route is, so a consumer walking endpoint by endpoint sees it next to the route rather than only through the assembled model (#​4000).

Transport fixes

  • Pulsar: requeue, scheduled retry and dead-letter routing implemented (#​3797). A global failure rule was silently disabling every user error policy application-wide (#​4075). Hot-tail listeners silently dropped deferred messages in every mode (#​4060).
  • GCP Pub/Sub: listener shutdown could hang on in-flight callbacks (#​4065); exhausting MaxTotalAckExtension silently delivered a concurrent duplicate rather than reporting anything (#​4066); effective listener concurrency was not what the configuration implied, and the flow-control bound is global per SubscriberClient rather than per inner client (#​4067). PubsubTopicOptions.OrderBy gained a configuration surface (#​4087).
  • Redis: DeleteStreamEntryOnAck silently never acked on Redis < 8.2, where XACKDEL is unsupported (#​4058).
  • Ack reliability: a shared ack-attempt budget across stacked retry blocks, and terminal-failure classification for Azure Service Bus and SQS so a permanent settle failure stops rather than burning the whole budget (#​4012).

Upgrading

Additive. EndpointMode.NativeAck is opt-in per endpoint and default-closed per transport, and MaximumBrokerRedeliveries defaults to off. Requires JasperFx 2.55.0.

6.29.2

A fix release. Four changes, three of them reported bugs.

RavenDB users should take this one

ClearAllAsync deleted node records by tracked entity from a session that had never loaded them, so a Solo-mode start after a Balanced-mode run threw InvalidOperationException: WolverineNode is not associated with the session on every stale node and the application could not start at all. The workaround of clearing WolverineNodes by hand in RavenDB Studio is no longer needed. (#​3993, closes #​3986)

The compliance coverage written for that fix caught a second provider: SQLite orphaned every agent assignment row, because its assignment table has no ON DELETE CASCADE (PostgreSQL, Sql Server and Oracle do). The orphans stay invisible until a node re-registers under the same id — the GH-3604 ejection path — where it returns owning agents it was never reassigned. The underlying gap was that NodePersistenceCompliance never exercised ClearAllAsync at all, which is how two providers shipped it broken. It does now.

Agents no longer stall on a node that cannot build them

When IAgentFamily.BuildAgentAsync threw, the leader saw only an unconfirmed agent — which it deliberately does not treat as a failure — so the assignment stood and the same agent was requested on the same failing node forever. Reported as a 54-minute fleet-wide projection stall on a blue/green cluster with disjoint projection versions. Consecutive failed starts are now counted on the node that catches them and feed into the existing GH-3888 release path. New DurabilitySettings.MaxAgentStartFailuresBeforeRelease (default 3); set it to 0 for the previous behaviour. (#​3994, closes #​3970)

The orphaned-message sweep no longer dominates database load

Reported against a 466-shard PostgreSQL deployment. The sweep's predicate could not use an index, so it full-scanned the whole inbox per database every five seconds to find nothing; the update was unbounded, so one node loss became a single ~910,000-row rewrite across the fleet; and it ran inside the shared recovery transaction, blocking inbox inserts. All three are fixed, with a new OrphanedMessageReleaseBatchSize and a dedicated OrphanedMessageSweepPollingTime. (#​3995, closes #​3971)

Upgrade note. This ships a partial index on owner_id, so PostgreSQL and Sql Server users will see one index applied on the next schema migration.

HTTP endpoints can take immutable request types

A Before / BeforeAsync method on an endpoint class that accepts the request type and returns it now replaces the request body for the rest of the chain, exactly as it has on the handler side since GH-516. Use it to stamp server-supplied values onto an immutable record request before the endpoint runs. (#​3984)

Full detail for every item is in CHANGELOG.md.

What's Changed

New Contributors

Full Changelog: JasperFx/wolverine@V6.29.1...V6.29.2

6.29.1

This bumps the Fisher dependency to 1.0. We needed this for the CritterWatch 1.0 release.

What's Changed

New Contributors

Full Changelog: JasperFx/wolverine@V6.29.0...V6.29.1

6.29.0

A feature release. Three of the five items fix silent failure modes — work that acted on a write which could still roll back, a convention mirror that installed a relay over a real handler, and two concurrent writers to one entity — so the notes below say what the old behaviour looked like, not just what changed.

AfterCommit — run work after the transactional commit

After reads like a post-handler hook that runs at the end. It does not run after the commit (#​3976, closes #​3975).

The commit is itself a postprocessor contributed by the persistence provider, and After methods are inserted at the front of that list. So an After method observing a write is observing one that is not durable yet and may still roll back — and there was no supported way to ask for the other side of it, even though Wolverine uses that position itself for the outbox flush.

public static class RaiseAlertHandler
{
    public static void Handle(RaiseAlert command, IDocumentSession session)
        => session.Events.Append(command.Id, new AlertRaised(command.Reason));

    // Only runs if the append above actually committed
    public static void AfterCommit(AlertLatch latch, RaiseAlert command)
        => latch.MarkRaised(command.Id);
}

Use the AfterCommit / AfterCommitAsync convention or [WolverineAfterCommit], on message handlers, sagas and HTTP endpoints. Parameters bind exactly as After already does.

The position is structural, not positional — frames go into a new IChain.PostCommitPostprocessors list concatenated after every postprocessor at frame-assembly time, rather than being appended from a policy sequenced after the persistence policy. Getting the position right by luck of policy ordering is precisely what breaks silently later.

Two behaviours worth knowing:

  • They do not run when the commit throws. Frames are concatenated without a try/finally, so the exception unwinds straight past them. That is the point — the reason to want "after the commit" is usually that the side effect must not happen for a write that did not land.
  • They run after the outbox flush as well, so a message cascaded from an after-commit method is not atomic with the write. Cascade from the handler if it has to be.

After's pre-commit position is unchanged and stays that way. Verified per provider: Marten, Polecat, Fisher, EF Core, RavenDb and CosmosDb each have a codegen test asserting the emitted call lands after that provider's own commit frame.

A store-agnostic EventsToAppend return type

Wolverine.Marten.Events, Wolverine.Polecat.Events and Wolverine.Fisher.Events are identical but store-named, so a handler that wanted to be store-agnostic could not name any of them (#​3969, closes #​3941).

The store-agnostic path did exist — a bare IEnumerable<object> return is picked up by a fallback — but that fallback is positional. IEnumerable<T> is covariant, so every reference-typed collection in a return tuple is a candidate and the first one wins. Nothing failed at codegen and nothing failed at runtime; the wrong collection simply became the appended events.

The type is EventsToAppend, not Events. Naming it Events would have been a source-breaking collision (CS0104) for any handler importing both the core event-sourcing namespace and a store integration — that is, on the very declaration the feature exists for.

Ask what will be handled, and how a batch is shaped

Discovery materializes after options time, so an extension installing fallback handlers could not ask "will this message type have a handler?" and had to hand-roll a mirror of Wolverine's own discovery convention (#​3977, closes #​3974).

Such a mirror drifts, and it drifts silently: one that scanned a single assembly stopped seeing handlers that moved to a second, and installed a bare relay over a real handler — the exact defect the guard existed to prevent, with every codegen test still passing.

opts.OnHandlersDiscovered(handlers =>
{
    if (!handlers.Handles<ServiceUpdates>())
    {
 ... (truncated)

## 6.28.2

A bug fix release, with one new opt-in on the RabbitMQ listener contributed by the community.

## Store agnostic document sessions

A handler can now take the `JasperFx.Events.Documents` contracts — `IDocumentSessionOperations`, `IDocumentWriteOperations`, `IDocumentReadOperations` — straight as parameters, and they bind *and commit* on Marten, Polecat and Fisher alike ([#​3962](https://github.com/JasperFx/wolverine/pull/3962), closes [#​3956](https://github.com/JasperFx/wolverine/issues/3956)):

```csharp
// Valid against all three stores -- nothing store specific is named
public static void Handle(RecordNote command, IDocumentSessionOperations session)
    => session.Store(new Note { Id = command.Id, Text = command.Text });

These are the document side counterparts to the IEventOperations contracts Wolverine already understood, and they are the only way store agnostic source can take a session without naming a concrete store type.

Before this, such a handler failed codegen outright on a stock host. Once bound, its writes were queued into the session's unit of work and silently discarded — no exception. Both halves are fixed.

⚠️ Importing the JasperFx.Events.Documents namespace makes ToListAsync() ambiguous with each store's own queryable extensions (CS0121). Alias the individual contracts rather than importing the namespace.

Durability agents no longer assigned to nodes that cannot run them

A node started with Durability.DurabilityAgentEnabled = false never registers the durability agent family, so it threw Unrecognized agent scheme 'wolverinedb' the moment the leader handed it one. The leader re-issued the identical assignment every five minutes indefinitely, no durability agent ran anywhere for that store, and owner_id = 0 outgoing envelopes were never recovered (#​3963, closes #​3954).

The failure was silent in both directions — every queue table read zero while the backlog grew. Nodes now publish a marker capability when the family is actually registered, the leader skips nodes that have not, and when no node in the cluster is capable a warning names the condition and the setting.

If you run a Balanced cluster with DurabilityAgentEnabled = false on any node, this release is worth taking.

Ancillary store transaction ownership

Ancillary store inference scanned chain.ServiceDependencies(), which walks constructor graphs recursively — so a dependency that merely held an ancillary store matched. A read only store injected two hops down counted the same as an injected DbContext, and a tenant Marten handler had its inbox and dead letters stolen by the wrong store (#​3957, closes #​3953).

That inference was only ever correct for EF Core. There is a new default null IPersistenceFrameProvider.TryDetermineTransactionOwnerType for it, implemented only by EF Core.

RabbitMQ

  • Wait for prefetched messages on drain (#​3796) — contributed by @​benjamin-alexander-simplisafe. Opt in with ListenToRabbitQueue("orders").DrainWaitForPrefetch() to let already prefetched messages finish rather than letting the broker requeue them.
  • The prefetch drain is safe for a non terminal stop (#​3960) — StopAsync is not always terminal, and a BatchingChannel silently discards a post after completion, so a delivery landing between the drain and the dispose latch vanished and was redelivered.
  • A rejected settle quiesces the channel the broker already closed (#​3964, addresses #​3950) — feeding a channel that is being torn down is what makes RabbitMQ.Client race itself and escalate a dead channel into a close of the **entire conne...

Description has been truncated

@dependabot
Bump the wolverine group with 7 updates
20ab84a 
Bumps WolverineFx from 6.21.0 to 6.39.1
Bumps WolverineFx.EntityFrameworkCore from 6.21.0 to 6.39.1
Bumps WolverineFx.FluentValidation from 6.21.0 to 6.39.1
Bumps WolverineFx.Postgresql from 6.21.0 to 6.39.1
Bumps WolverineFx.RabbitMQ from 6.21.0 to 6.39.1
Bumps WolverineFx.RuntimeCompilation from 6.21.0 to 6.39.1
Bumps WolverineFx.SqlServer from 6.21.0 to 6.39.1

---
updated-dependencies:
- dependency-name: WolverineFx
  dependency-version: 6.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: wolverine
- dependency-name: WolverineFx.EntityFrameworkCore
  dependency-version: 6.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: wolverine
- dependency-name: WolverineFx.FluentValidation
  dependency-version: 6.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: wolverine
- dependency-name: WolverineFx.Postgresql
  dependency-version: 6.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: wolverine
- dependency-name: WolverineFx.RabbitMQ
  dependency-version: 6.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: wolverine
- dependency-name: WolverineFx.RuntimeCompilation
  dependency-version: 6.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: wolverine
- dependency-name: WolverineFx.SqlServer
  dependency-version: 6.39.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: wolverine
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file nuget Pull requests that update NuGet packages labels Sep 21, 2026
@dependabot
dependabot Bot requested a review from emeraldleaf as a code owner September 21, 2026 23:49
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file nuget Pull requests that update NuGet packages labels Sep 21, 2026
@coderabbitai

coderabbitai Bot commented Sep 21, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: emeraldleaf/NextAurora/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 5a1434c1-3847-49f6-9c45-9308ab05f233

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Sep 21, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@emeraldleaf emeraldleaf Awaiting requested review from emeraldleaf emeraldleaf is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file nuget Pull requests that update NuGet packages

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

A failed BuildAgentAsync start is never released to a capable node Leader assigns the wolverinedb durability agent to nodes with DurabilityAgentEnabled = false — assignment never converges and outgoing recovery never runs Recursive ancillary-store inference misclassifies tenant Marten handlers with read-only ancillary dependencies Promote a store-agnostic Events return type to core — the IEnumerable<object> fallback is positional and can silently pick the wrong collection Wolverine parameter attributes ([Entity], [All], [Queryable], ...) are not supported on gRPC service methods
Orphaned-message release sweep: non-indexable predicate + unbatched update dominate DB load at scale Let an options-time extension ask which message types will be handled — and expose the batcher's element/batch-message mapping No declarative way to run work AFTER the transactional commit — After methods insert at the front, so they run before it RavenDbMessageStore.ClearAllAsync crashes with InvalidOperationException when stale nodes exist — deletes entity loaded in different session WolverineFx.AI: LLM callouts as durable messages on Microsoft.Extensions.AI

0 participants