Skip to content

Repository navigation

Bump Microsoft.Extensions.Http.Resilience and 15 others - #339

Closed
dependabot[bot] wants to merge 1 commit into
env/stagingfrom
dependabot/nuget/src/v2/back/env/staging/nuget-v2-minor-patch-abbe38abd1
Closed

Bump Microsoft.Extensions.Http.Resilience and 15 others#339
dependabot[bot] wants to merge 1 commit into
env/stagingfrom
dependabot/nuget/src/v2/back/env/staging/nuget-v2-minor-patch-abbe38abd1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Pinned Microsoft.Extensions.Http.Resilience at 10.11.0.

Release notes

Sourced from Microsoft.Extensions.Http.Resilience's releases.

10.11.0

.NET Extensions 10.11.0

This release adds optional scope capture for buffered logs and updates experimental HTTP latency enrichment APIs. It also includes fixes for AI streaming and function invocation, evaluation reports, HybridCache invalidation, and logging.

Experimental API Changes

New Experimental APIs

  • Optional logging-scope capture for global and per-request log buffering through GlobalLogBufferingOptions.IncludeScopes and PerRequestLogBufferingOptions.IncludeScopes (EXTEXP0003) #​7813

Breaking Changes to Experimental APIs

  • Incoming HTTP latency log enrichment: AddHttpLatencyTelemetry is renamed to AddHttpServerLatencyTelemetry and moves from HttpLatencyTelemetryServiceCollectionExtensions to HttpLoggingServiceCollectionExtensions. It remains experimental under EXTEXP0013 in this release. #​7730

What's Changed

AI

  • Yield final image when streaming with HostedImageGenerationTool #​7774 by @​iamAdarshh
  • Make the default tool-rejection message state that the decision is final #​7784 by @​manjunathshiva
  • AI: Remove obsolete OpenAI JsonPatch workaround #​7815 by @​jozkee (co-authored by @​Copilot)
  • Ignore empty model IDs in streaming responses #​7816 by @​valkiara
  • Honor FunctionInvocationContext.Terminate when the function throws #​7801 by @​gjz22
  • Fix ChatResponseUpdate.Clone dropping ContinuationToken #​7699 by @​dfedoryshchev
  • Decode non-base64 data URIs in DataContent to the octets they encode #​7798 by @​Laurianti

AI Evaluation

  • [M.E.AI.Evaluation.Reporting] Fix context and metric interpretation visualization #​7738 by @​grafanaKibana
  • Fix tokenizer attaching punctuation to number tokens #​7766 by @​tahakocal
  • Order iteration results numerically #​7769 by @​tahakocal
  • Score GLEU against the best matching reference #​7768 by @​tahakocal

Telemetry and Observability

  • Optionally preserve logging scopes in buffered log records #​7813 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix OOM from unbounded enumeration of ExtendedLogger tag joiners #​7819 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix log buffering race by removing the rule selector cache #​7803 by @​evgenyfedorov2 (co-authored by @​Copilot)

ASP.NET Core Extensions

  • Rename AddHttpLatencyTelemetry to AddHttpServerLatencyTelemetry (API-approved shape) #​7730 by @​EasyL0ver (co-authored by @​Copilot)
  • Fix ArgumentNullException in per-request log buffering at the end of a request #​7811 by @​evgenyfedorov2 (co-authored by @​Copilot)

AI Project Templates

  • Align aichatweb local vector-store keys with Guid record keys #​7804 by @​jongalloway (co-authored by @​adamsitnik @​Copilot)

Caching

... (truncated)

10.10.1

This release fixes two OpenAI integration issues: a TypeLoadException on tool-carrying Responses API calls and a streaming crash against third-party OpenAI-compatible endpoints, by upgrading the OpenAI SDK to 2.14.0.

Packages in this release

Package Version
Microsoft.Extensions.AI.OpenAI 10.10.1
Microsoft.Extensions.AI.Abstractions 10.10.1

What's Changed

AI

  • Upgrade OpenAI SDK to 2.14.0 #​7761 by @​zxyao145

Acknowledgements

  • @​zxyao145 made their first contribution in #​7761
  • @​zxyao145 submitted issue #​7760 (resolved by #​7761)
  • @​jozkee @​wtgodbe reviewed pull requests

Full Changelog: dotnet/extensions@v10.10.0...v10.10.1

Commits viewable in compare view.

Updated Microsoft.Extensions.TimeProvider.Testing from 10.10.0 to 10.11.0.

Release notes

Sourced from Microsoft.Extensions.TimeProvider.Testing's releases.

10.11.0

.NET Extensions 10.11.0

This release adds optional scope capture for buffered logs and updates experimental HTTP latency enrichment APIs. It also includes fixes for AI streaming and function invocation, evaluation reports, HybridCache invalidation, and logging.

Experimental API Changes

New Experimental APIs

  • Optional logging-scope capture for global and per-request log buffering through GlobalLogBufferingOptions.IncludeScopes and PerRequestLogBufferingOptions.IncludeScopes (EXTEXP0003) #​7813

Breaking Changes to Experimental APIs

  • Incoming HTTP latency log enrichment: AddHttpLatencyTelemetry is renamed to AddHttpServerLatencyTelemetry and moves from HttpLatencyTelemetryServiceCollectionExtensions to HttpLoggingServiceCollectionExtensions. It remains experimental under EXTEXP0013 in this release. #​7730

What's Changed

AI

  • Yield final image when streaming with HostedImageGenerationTool #​7774 by @​iamAdarshh
  • Make the default tool-rejection message state that the decision is final #​7784 by @​manjunathshiva
  • AI: Remove obsolete OpenAI JsonPatch workaround #​7815 by @​jozkee (co-authored by @​Copilot)
  • Ignore empty model IDs in streaming responses #​7816 by @​valkiara
  • Honor FunctionInvocationContext.Terminate when the function throws #​7801 by @​gjz22
  • Fix ChatResponseUpdate.Clone dropping ContinuationToken #​7699 by @​dfedoryshchev
  • Decode non-base64 data URIs in DataContent to the octets they encode #​7798 by @​Laurianti

AI Evaluation

  • [M.E.AI.Evaluation.Reporting] Fix context and metric interpretation visualization #​7738 by @​grafanaKibana
  • Fix tokenizer attaching punctuation to number tokens #​7766 by @​tahakocal
  • Order iteration results numerically #​7769 by @​tahakocal
  • Score GLEU against the best matching reference #​7768 by @​tahakocal

Telemetry and Observability

  • Optionally preserve logging scopes in buffered log records #​7813 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix OOM from unbounded enumeration of ExtendedLogger tag joiners #​7819 by @​evgenyfedorov2 (co-authored by @​Copilot)
  • Fix log buffering race by removing the rule selector cache #​7803 by @​evgenyfedorov2 (co-authored by @​Copilot)

ASP.NET Core Extensions

  • Rename AddHttpLatencyTelemetry to AddHttpServerLatencyTelemetry (API-approved shape) #​7730 by @​EasyL0ver (co-authored by @​Copilot)
  • Fix ArgumentNullException in per-request log buffering at the end of a request #​7811 by @​evgenyfedorov2 (co-authored by @​Copilot)

AI Project Templates

  • Align aichatweb local vector-store keys with Guid record keys #​7804 by @​jongalloway (co-authored by @​adamsitnik @​Copilot)

Caching

... (truncated)

10.10.1

This release fixes two OpenAI integration issues: a TypeLoadException on tool-carrying Responses API calls and a streaming crash against third-party OpenAI-compatible endpoints, by upgrading the OpenAI SDK to 2.14.0.

Packages in this release

Package Version
Microsoft.Extensions.AI.OpenAI 10.10.1
Microsoft.Extensions.AI.Abstractions 10.10.1

What's Changed

AI

  • Upgrade OpenAI SDK to 2.14.0 #​7761 by @​zxyao145

Acknowledgements

  • @​zxyao145 made their first contribution in #​7761
  • @​zxyao145 submitted issue #​7760 (resolved by #​7761)
  • @​jozkee @​wtgodbe reviewed pull requests

Full Changelog: dotnet/extensions@v10.10.0...v10.10.1

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.11.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.10.1...v18.11.0

Commits viewable in compare view.

Pinned OpenTelemetry.Exporter.OpenTelemetryProtocol at 1.20.0.

Release notes

Sourced from OpenTelemetry.Exporter.OpenTelemetryProtocol's releases.

1.20.0

For highlights and announcements pertaining to this release see: Release Notes > 1.20.0.

The following changes are from the previous release 1.19.1.

  • NuGet: OpenTelemetry v1.20.0

    • Fixed SuppressInstrumentationScope reference counts leaking between inherited asynchronous execution contexts.
      (#​7803)

    • Self-diagnostic features are explicitly disabled on browser-based platforms (e.g. Blazor) and are now non-functional. Previously, attempting to enable self-diagnostics on such platforms would result in an exception at runtime.
      (#​7799)

    • Added TracerProviderBuilder.ConfigureSampler which receives the resolved Sampler whether set programmatically, via OTEL_TRACES_SAMPLER, or by default, and returns a replacement. Intended for library authors who need to influence sampling without overriding a sampler the application has configured.
      (#​7780)

    • Fixed ResourceBuilder.CreateDefault ignoring OTEL_RESOURCE_ATTRIBUTES and OTEL_SERVICE_NAME environment variables when the host IConfiguration does not contain those settings.
      (#​7855)

    • Added improved self-diagnostics logging to improve the support experience. The new SelfDiagnosticsOptions class configures a rolling file sink and a console sink through the standard options pipeline. Sinks are off by default.
      (#​7588)

    • Fixed a race that could incorrectly route a concurrent metric measurement to the overflow point when its tag set was published as the cardinality limit was reached.
      (#​7804)

    • Added OpenTelemetryLoggerOptions.Version and OpenTelemetryLoggerOptions.SchemaUrl options to set an instrumentation library version and schema URL applied to logs emitted via the Microsoft.Extensions.Logging ILogger integration.
      (#​7727)

    • Fixed LogRecord.CategoryName resetting the current Logger's Version to null when set to a new value.
      (#​7727)

    • Bounded the internal cache of Logger scopes keyed by instrumentation to avoid unbounded growth.
      (#​7727)

    • Fixed the MeterProvider and its IServiceProvider being kept alive after the host is disposed when using Microsoft.Extensions.Diagnostics versions prior to 9.0, which never dispose their MetricsSubscriptionManager (and its underlying MeterListener).
      (#​7924)

    • Fixed a race condition between recording a measurement and collecting a histogram with delta temporality that could cause an empty data point (with a count of zero) to be exported in the next collection cycle.
      (#​7923)

    • Improved metric collection performance after metric streams are removed by compacting metric storage during collection.
      (#​7945)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.20.0

    • Added Logger.SchemaUrl and a LoggerProvider.GetLogger overload accepting a schema URL parameter using the new LoggerOptions type.
      (#​7727)

    • Breaking change (pre-release only versions): LoggerProvider's protected TryCreateLogger(string? name, out Logger? logger) extensibility method has been replaced by TryCreateLogger(LoggerOptions options, out Logger? logger). Custom LoggerProvider subclasses that override the previous overload must update to override the new one; the old overload is no longer called.
      ... (truncated)

1.20.0-rc.1

The following changes are from the previous release 1.19.1.

  • NuGet: OpenTelemetry v1.20.0-rc.1

    • Fixed SuppressInstrumentationScope reference counts leaking between inherited asynchronous execution contexts.
      (#​7803)

    • Self-diagnostic features are explicitly disabled on browser-based platforms (e.g. Blazor) and are now non-functional. Previously, attempting to enable self-diagnostics on such platforms would result in an exception at runtime.
      (#​7799)

    • Added TracerProviderBuilder.ConfigureSampler which receives the resolved Sampler whether set programmatically, via OTEL_TRACES_SAMPLER, or by default, and returns a replacement. Intended for library authors who need to influence sampling without overriding a sampler the application has configured.
      (#​7780)

    • Fixed ResourceBuilder.CreateDefault ignoring OTEL_RESOURCE_ATTRIBUTES and OTEL_SERVICE_NAME environment variables when the host IConfiguration does not contain those settings.
      (#​7855)

    • Added improved self-diagnostics logging to improve the support experience. The new SelfDiagnosticsOptions class configures a rolling file sink and a console sink through the standard options pipeline. Sinks are off by default.
      (#​7588)

    • Fixed a race that could incorrectly route a concurrent metric measurement to the overflow point when its tag set was published as the cardinality limit was reached.
      (#​7804)

    • Added OpenTelemetryLoggerOptions.Version and OpenTelemetryLoggerOptions.SchemaUrl options to set an instrumentation library version and schema URL applied to logs emitted via the Microsoft.Extensions.Logging ILogger integration.
      (#​7727)

    • Fixed LogRecord.CategoryName resetting the current Logger's Version to null when set to a new value.
      (#​7727)

    • Bounded the internal cache of Logger scopes keyed by instrumentation to avoid unbounded growth.
      (#​7727)

    • Fixed the MeterProvider and its IServiceProvider being kept alive after the host is disposed when using Microsoft.Extensions.Diagnostics versions prior to 9.0, which never dispose their MetricsSubscriptionManager (and its underlying MeterListener).
      (#​7924)

    • Fixed a race condition between recording a measurement and collecting a histogram with delta temporality that could cause an empty data point (with a count of zero) to be exported in the next collection cycle.
      (#​7923)

    • Improved metric collection performance after metric streams are removed by compacting metric storage during collection.
      (#​7945)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.20.0-rc.1

    • Added Logger.SchemaUrl and a LoggerProvider.GetLogger overload accepting a schema URL parameter using the new LoggerOptions type.
      (#​7727)

    • Breaking change (pre-release only versions): LoggerProvider's protected TryCreateLogger(string? name, out Logger? logger) extensibility method has been replaced by TryCreateLogger(LoggerOptions options, out Logger? logger). Custom LoggerProvider subclasses that override the previous overload must update to override the new one; the old overload is no longer called.
      (#​7727)

... (truncated)

1.20.0-beta.1

The following changes are from the previous release 1.19.1-beta.1.

Commits viewable in compare view.

Pinned OpenTelemetry.Extensions.Hosting at 1.20.0.

Release notes

Sourced from OpenTelemetry.Extensions.Hosting's releases.

1.20.0

For highlights and announcements pertaining to this release see: Release Notes > 1.20.0.

The following changes are from the previous release 1.19.1.

  • NuGet: OpenTelemetry v1.20.0

    • Fixed SuppressInstrumentationScope reference counts leaking between inherited asynchronous execution contexts.
      (#​7803)

    • Self-diagnostic features are explicitly disabled on browser-based platforms (e.g. Blazor) and are now non-functional. Previously, attempting to enable self-diagnostics on such platforms would result in an exception at runtime.
      (#​7799)

    • Added TracerProviderBuilder.ConfigureSampler which receives the resolved Sampler whether set programmatically, via OTEL_TRACES_SAMPLER, or by default, and returns a replacement. Intended for library authors who need to influence sampling without overriding a sampler the application has configured.
      (#​7780)

    • Fixed ResourceBuilder.CreateDefault ignoring OTEL_RESOURCE_ATTRIBUTES and OTEL_SERVICE_NAME environment variables when the host IConfiguration does not contain those settings.
      (#​7855)

    • Added improved self-diagnostics logging to improve the support experience. The new SelfDiagnosticsOptions class configures a rolling file sink and a console sink through the standard options pipeline. Sinks are off by default.
      (#​7588)

    • Fixed a race that could incorrectly route a concurrent metric measurement to the overflow point when its tag set was published as the cardinality limit was reached.
      (#​7804)

    • Added OpenTelemetryLoggerOptions.Version and OpenTelemetryLoggerOptions.SchemaUrl options to set an instrumentation library version and schema URL applied to logs emitted via the Microsoft.Extensions.Logging ILogger integration.
      (#​7727)

    • Fixed LogRecord.CategoryName resetting the current Logger's Version to null when set to a new value.
      (#​7727)

    • Bounded the internal cache of Logger scopes keyed by instrumentation to avoid unbounded growth.
      (#​7727)

    • Fixed the MeterProvider and its IServiceProvider being kept alive after the host is disposed when using Microsoft.Extensions.Diagnostics versions prior to 9.0, which never dispose their MetricsSubscriptionManager (and its underlying MeterListener).
      (#​7924)

    • Fixed a race condition between recording a measurement and collecting a histogram with delta temporality that could cause an empty data point (with a count of zero) to be exported in the next collection cycle.
      (#​7923)

    • Improved metric collection performance after metric streams are removed by compacting metric storage during collection.
      (#​7945)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.20.0

    • Added Logger.SchemaUrl and a LoggerProvider.GetLogger overload accepting a schema URL parameter using the new LoggerOptions type.
      (#​7727)

    • Breaking change (pre-release only versions): LoggerProvider's protected TryCreateLogger(string? name, out Logger? logger) extensibility method has been replaced by TryCreateLogger(LoggerOptions options, out Logger? logger). Custom LoggerProvider subclasses that override the previous overload must update to override the new one; the old overload is no longer called.
      ... (truncated)

1.20.0-rc.1

The following changes are from the previous release 1.19.1.

  • NuGet: OpenTelemetry v1.20.0-rc.1

    • Fixed SuppressInstrumentationScope reference counts leaking between inherited asynchronous execution contexts.
      (#​7803)

    • Self-diagnostic features are explicitly disabled on browser-based platforms (e.g. Blazor) and are now non-functional. Previously, attempting to enable self-diagnostics on such platforms would result in an exception at runtime.
      (#​7799)

    • Added TracerProviderBuilder.ConfigureSampler which receives the resolved Sampler whether set programmatically, via OTEL_TRACES_SAMPLER, or by default, and returns a replacement. Intended for library authors who need to influence sampling without overriding a sampler the application has configured.
      (#​7780)

    • Fixed ResourceBuilder.CreateDefault ignoring OTEL_RESOURCE_ATTRIBUTES and OTEL_SERVICE_NAME environment variables when the host IConfiguration does not contain those settings.
      (#​7855)

    • Added improved self-diagnostics logging to improve the support experience. The new SelfDiagnosticsOptions class configures a rolling file sink and a console sink through the standard options pipeline. Sinks are off by default.
      (#​7588)

    • Fixed a race that could incorrectly route a concurrent metric measurement to the overflow point when its tag set was published as the cardinality limit was reached.
      (#​7804)

    • Added OpenTelemetryLoggerOptions.Version and OpenTelemetryLoggerOptions.SchemaUrl options to set an instrumentation library version and schema URL applied to logs emitted via the Microsoft.Extensions.Logging ILogger integration.
      (#​7727)

    • Fixed LogRecord.CategoryName resetting the current Logger's Version to null when set to a new value.
      (#​7727)

    • Bounded the internal cache of Logger scopes keyed by instrumentation to avoid unbounded growth.
      (#​7727)

    • Fixed the MeterProvider and its IServiceProvider being kept alive after the host is disposed when using Microsoft.Extensions.Diagnostics versions prior to 9.0, which never dispose their MetricsSubscriptionManager (and its underlying MeterListener).
      (#​7924)

    • Fixed a race condition between recording a measurement and collecting a histogram with delta temporality that could cause an empty data point (with a count of zero) to be exported in the next collection cycle.
      (#​7923)

    • Improved metric collection performance after metric streams are removed by compacting metric storage during collection.
      (#​7945)

    See CHANGELOG for details.

  • NuGet: OpenTelemetry.Api v1.20.0-rc.1

    • Added Logger.SchemaUrl and a LoggerProvider.GetLogger overload accepting a schema URL parameter using the new LoggerOptions type.
      (#​7727)

    • Breaking change (pre-release only versions): LoggerProvider's protected TryCreateLogger(string? name, out Logger? logger) extensibility method has been replaced by TryCreateLogger(LoggerOptions options, out Logger? logger). Custom LoggerProvider subclasses that override the previous overload must update to override the new one; the old overload is no longer called.
      (#​7727)

... (truncated)

1.20.0-beta.1

The following changes are from the previous release 1.19.1-beta.1.

Commits viewable in compare view.

Pinned OpenTelemetry.Instrumentation.AspNetCore at 1.20.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.AspNetCore's releases.

1.20.0

1.20.0-rc.1

1.20.0-beta.1

1.20.0-alpha.1

1.19.1

1.19.1-rc.1

1.19.1-beta.2

1.19.1-beta.1

Commits viewable in compare view.

Pinned OpenTelemetry.Instrumentation.Http at 1.20.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.Http's releases.

1.20.0

1.20.0-rc.1

1.20.0-beta.1

1.20.0-alpha.1

1.19.1

1.19.1-rc.1

1.19.1-beta.2

1.19.1-beta.1

Commits viewable in compare view.

Pinned OpenTelemetry.Instrumentation.Runtime at 1.20.0.

Release notes

Sourced from OpenTelemetry.Instrumentation.Runtime's releases.

1.20.0

1.20.0-rc.1

1.20.0-beta.1

1.20.0-alpha.1

1.19.1

1.19.1-rc.1

1.19.1-beta.2

1.19.1-beta.1

Commits viewable in compare view.

Updated Testcontainers.PostgreSql from 4.15.0 to 4.16.0.

Release notes

Sourced from Testcontainers.PostgreSql's releases.

4.16.0

What's Changed

Huge thanks to everyone for your contributions and feedback 🧡.

The NuGet packages for this release have been attested for supply chain security using actions/attest. This confirms the integrity and provenance of the artifacts and helps ensure they can be trusted: #​54051351.

🚀 Features

  • feat: Add common WithSsl builder API and support it in Azurite (#​1788) @​aleksandarMilev, @​HofmeisterAn
  • feat: Add BuildKit support for image builds via sidecar container (#​1761) @​george-petrakis, @​HofmeisterAn
  • feat(Elasticsearch): Add OTLP and certificate support (#​1774) @​HofmeisterAn

🐛 Bug Fixes

  • fix(PostgreSql): Support SSL with Alpine images and non-root users (#​1790) @​HofmeisterAn
  • fix: Do not pull base image with unresolved platform variable (#​1787) @​HofmeisterAn
  • fix(Kafka): Default to KRaft for Confluent Platform 8.x images (#​1775) @​arnelirobles, @​HofmeisterAn
  • fix(Kafka): Drop the trailing comma from advertised listeners (#​1772) @​arnelirobles, @​HofmeisterAn
  • fix: Prevent Docker ignore patterns from matching path prefixes (#​1768) @​Benziza, @​HofmeisterAn

📖 Documentation

  • docs: Complete builder API tables and align heading casing (#​1778) @​HofmeisterAn
  • docs: Explain how builder configurations combine (#​1770) @​arnelirobles, @​HofmeisterAn

🧹 Housekeeping

  • fix: Regenerate expired test certificates (#​1786) @​zcsizmadia
  • chore: Resolve Sonar findings (#​1776) @​HofmeisterAn
  • chore: Remove Minio module (#​1769) @​HofmeisterAn
  • chore: Publish NuGet packages with Trusted Publishing (OIDC) (#​1763) @​HofmeisterAn
  • feat: Prepare next release cycle (4.16.0) (#​1762) @​HofmeisterAn

📦 Dependency Updates

Commits viewable in compare view.

Pinned WolverineFx.EntityFrameworkCore at 6.51.0.

Release notes

Sourced from WolverineFx.EntityFrameworkCore's releases.

6.51.0

Everything since 6.50.1.

Highlights

  • Warm-up nodes for blue/green deployments (#​4569, #​5024). Set opts.Durability.NodeRole = NodeRole.Warmup and a node joins the serving cluster but does none of the serving nodes' messaging. Its only job is to run the new release's projection shards in Rebuild mode, so the new projection versions are caught up before you cut over. The role is opt-in; the default is NodeRole.Serving, and no schema change is needed. Docs: Marten · Polecat
  • DurabilityMode.ServerlessWithOutbox (#​5016, #​5044). The lean Serverless runtime, but with the transactional outbox kept:
    • Outgoing messages are persisted with the handler's transaction.
    • They are sent inline before the request completes.
    • Anything that couldn't be sent is recovered by a durability pass.
    • Follow-ups are in #​5058 (#​5046–#​5057), #​5060 (#​5059) and #​5065 (#​5038).
    • Docs: Serverless with the Transactional Outbox
  • Wolverine.HTTP JSON options (#​5042, #​5064). HTTP handlers mapped directly now use ASP.NET Core's JsonOptions without needing MapWolverineEndpoints(). Two new properties, HttpChain.JsonSerializerOptions and HttpHandler.JsonSerializerOptions, give a single endpoint its own JSON options.
  • Failure log level (#​5043, #​5064). Set it with chain.FailureLogLevel, opts.Policies.MessageFailureLogLevel(...) or [WolverineLogging(FailureLogLevel = ...)]. The default is still Error.

Durability fixes

  • Durable database queue pops (#​5015, #​5020 by @​jcd1991, #​5021). A failed or lost pop no longer strands envelopes on a live node, on PostgreSQL, SQL Server, MySQL and Oracle. Thanks to @​dbelinsky-accureference for the report.
  • InboxStaleTime (#​5022, #​5025, #​5039):
    • Its clock now measures the time since a node claimed the message, not since the message was first written.
    • It leaves scheduled rows alone.
    • A node keeps the clock running for the messages it still holds, so a long handler is no longer started a second time.
  • Projection daemon self-healing (#​4986 by @​erdtsieck). A shard the daemon paused on a transient failure, such as connection pool exhaustion, is restarted with a capped backoff instead of staying paused until the pods restart.
  • Serverless startup with RavenDB (#​5030, #​5041 by @​jcd1991). Plain Serverless mode no longer fails at startup with RavenDB persistence.
  • Messages replayed on every restart (#​5040, #​5045, #​5062). A handled message is now marked handled in the store that holds its inbox row. This affected two setups:
    • a durable PostgreSQL queue with a DbContext enrolled in an ancillary store
    • Fisher or Polecat with an AddMessageHandler handler committing an ancillary session
  • PostgreSQL transport schema (#​5062). The transport takes its storage schema from the store it is bound to, not from the last PostgreSQL store registered.
  • More #​5038 follow-ups (#​5065):
    • Outside ServerlessWithOutbox, a failed inline send is retried by the destination's sending agent.
    • RavenDB and Cosmos DB take one durability pass lock per database or container.
    • EF Core and RavenDB write the same outgoing owner id as the other stores.
    • Plain Serverless warns about durable endpoints downgraded after startup.

Dependencies

  • 6.50.2 (#​5018): Weasel 9.45.1, Polecat 5.40.2 and Marten 9.50.2, for the System.Security.Cryptography.Pkcs advisory GHSA-846f-f764-76mx.
  • 6.51.0 (#​5063): JasperFx 2.90.1, Marten 9.50.3, Polecat 5.42.0 and Fisher 1.21.1.

6.50.2

A dependency patch release. No configuration or code changes needed.

Dependencies

This moves Wolverine onto the Critter Stack releases that fix CVE-2026-84008 / GHSA-846f-f764-76mx (System.Security.Cryptography.Pkcs, high-severity denial of service) (#​5018):

  • Weasel 9.45.1: Weasel.SqlServer and Weasel.Oracle now reference the patched Pkcs directly.
  • Polecat 5.40.2 (up from 5.38.0): Polecat now references the patched Pkcs directly. This also brings in Polecat 5.39 and 5.40.
  • Marten 9.50.2 (up from 9.49.0) for Marten, Marten.AspNetCore and Marten.Newtonsoft. Marten was never affected by the advisory.

Wolverine 6.50.1 already pinned the patched Pkcs in WolverineFx.SqlServer, WolverineFx.Oracle and WolverineFx.ClaimCheck.SqlServer, so applications on 6.50.1 were already protected. Those pins stay, because Wolverine references Microsoft.Data.SqlClient and Oracle.ManagedDataAccess.Core directly. 6.50.2 means the upstream libraries carry the fix too, so a NuGet audit comes back clean whichever of them your application references directly.

6.50.1

Patch release with a memory-leak fix and two security dependency updates.

Fixes

  • WolverineRuntime now disposes its Meter (#​5012, #​5013). The runtime's System.Diagnostics.Metrics.Meter used to stay in the process-wide static Meter registry after the host was disposed. The durable persistence gauges on it hold callbacks back into the runtime, so every disposed host stayed reachable for the life of the process. Test suites that build many WebApplicationFactory or Host instances with durable persistence saw the heap grow without bound. Thanks to @​AndriiKononenko3 for the detailed report and the retention path.

Security dependency updates

  • CVE-2026-84008 / GHSA-846f-f764-76mx (System.Security.Cryptography.Pkcs, high-severity denial of service). The package arrived transitively at vulnerable versions through Microsoft.Data.SqlClient, Oracle.ManagedDataAccess.Core and Polecat. WolverineFx.SqlServer, WolverineFx.Oracle and WolverineFx.ClaimCheck.SqlServer now reference the patched version directly: 9.0.21 on net9.0 and 10.0.13 on net10.0. Every package built on them, including WolverineFx.Polecat and WolverineFx.Http.Polecat, picks up the fix.
  • CVE-2026-70159 / GHSA-334f-vvp4-7g6p (Microsoft.AspNetCore.SignalR.Common, high-severity denial of service). WolverineFx.SignalR now depends on Microsoft.AspNetCore.SignalR.Client 9.0.21 on net9.0 and 10.0.13 on net10.0, up from 9.0.8.

6.50.0

Wolverine 6.50.0 is a feature release. The headline is a new way to send a message to every node in your cluster. Just as much of this release came from the community, though: five community pull requests landed, and several issue reports led straight to fixes.

The two Bobcat packages, WolverineFx.Bobcat and WolverineFx.Bobcat.Http, ship as 6.50.0-alpha.1 and are still pre-release.

Broadcast a message to every node in the cluster

  • BroadcastToAllNodesAsync() (#​4993, closes #​4988). Wolverine's normal delivery is competing consumers, where exactly one node handles a message. Sometimes you want every node to hear about something instead: a cache to invalidate, a configuration change to pick up, some node-local state to reset. Now you can just do this:

    await bus.BroadcastToAllNodesAsync(new InvalidateCache("products"));

    Every running node, including the one that sent it, handles the message exactly once with its own handler. The sending node gets the message on the local routes its type already has, or on local://default, and it's never forwarded to the external routes PublishAsync() would use. Every other node gets a copy on its node control endpoint, which is the broker control queue if you've configured one and the database control queue otherwise. Nodes that have gone stale are skipped, using the same rule the leader applies before ejecting a node. A broadcast from inside a handler goes through the outbox like any other outgoing message, and correlation ids are stamped as usual. In Solo and Serverless durability modes the message is delivered to this node only, and MediatorOnly refuses it just like PublishAsync(). It's an extension method on IMessageBus, so no other IMessageBus implementation breaks, and TestMessageContext records broadcasts in a new BroadcastToAllNodes list for your unit tests. See the new Broadcast Messages to Every Node guide.

From the community

A big thank you to everyone who sent pull requests and reports for this release:

  • @​jcd1991 contributed two PostgreSQL transport features:

    • Opt-in LISTEN/NOTIFY wakeups for PostgreSQL queues (#​4998, closes #​3480). With EnableQueueNotifications(), an idle queue listener is woken as soon as a message is written instead of waiting out its polling interval. In local benchmarks the median delivery time on an idle queue dropped from about 650ms to under 3ms. It's off by default because it holds one extra, long-lived database connection per database per running process. Read the trade-offs in the new Queue Notifications with LISTEN/NOTIFY section before you turn it on.
    • FIFO ordering for sharded PostgreSQL queue batches (#​4970, closes #​4862, reported by @​alexandrefresnais). Messages for one group id that went through a PostgreSQL shard queue could run out of order. EnableDeterministicQueueOrdering() now preserves their order, and it was followed up for SQL Server, MySQL, Oracle and SQLite in #​4987.

  • @​jcd1991 also fixed Wolverine.HTTP treating a container-registered service as the JSON request body on POST and PUT endpoints (#​5010, closes #​3863, reported by @​erdtsieck). The same parameter on a GET endpoint was correctly injected, but on a POST or PUT every call failed with a 500. An explicitly registered, non-keyed concrete type is now resolved from the container on every endpoint. This is a behavior change: if you register a type in the container and post it as a request body without [FromBody], add [FromBody] to keep binding it from the request.

  • @​erdtsieck found and fixed a ping-pong in agent assignment during blue/green warm-ups (#​5000, closes #​4999). Projection partitions that could only run on the previous version's nodes moved between those nodes on every evaluation, which showed up in production as 1,000 to 3,000 ReassignAgent commands a minute. A partition that fits nowhere now stays where it is unless another node is strictly lighter. The follow-up in #​5001 makes it settle in one move.

  • @​PascalEschbach contributed a big round of NATS follow-ups (#​4976, closes #​4973), with tests for every change:

    • one schedule subject per message, with listeners that skip schedule control messages;
    • resources setup provisioning declared streams once per connection;
    • per-tenant connection configuration, tenant subject mappers, and a new TrustTenantIdHeader setting;
    • safer dead letter forwarding that only terminates the original after a confirmed forward;
    • a deadline on every JetStream publish;
    • named consumers for dotted subjects;
    • NATS logging through the host's ILoggerFactory;
    • a health check that reports a failed listener start.

    #​4985 followed up on the core side.

  • @​Maflend reported that the static handler registry ignored custom discovery rules once conventional discovery was disabled (#​4984), a regression since 6.44.0. It's fixed in #​4992.

  • @​uniquelau's report in marten#​5652 led to #​5011, below: the leader no longer builds every event store's full usage descriptor on every heartbeat.

Agents and event subscriptions

  • The leader's heartbeat no longer builds the full event store descriptor (#​5011, closes #​5002). Assigning event subscription agents only needs each store's async shard names and its database topology. Wolverine now reads those through JasperFx 2.87.1's IEventStore.RegisteredShardNames() and the new IEventStore.TryDescribeDatabasesAsync(), instead of a full TryCreateUsage() that also read the highest event sequence and described every projection, subscription and event type, for every store, every 10 seconds. To get the full saving, also take Marten 9.50.1, Polecat 5.40.1 or Fisher 1.20.2, which answer TryDescribeDatabasesAsync() straight from their tenancy.
  • A projection rebuild always hands its shard back to continuous execution (#​5008, closes #​5003). A rebuild that threw used to leave the shard stopped, for good if it had already paused on a transient failure. The registered-projection rebuild path that CritterWatch uses never resumed the shard at all. Both paths now resume it whether the rebuild succeeded or failed. The health-check sweep also leaves a shard alone while its projection is being rebuilt, using JasperFx's new IProjectionDaemon.IsRebuilding(), so it can no longer start a second copy of the shard on top of a running rebuild.

Transports and persistence

  • SQL Server queue tables can switch between the default layout and OptimizeQueueThroughput() (#​4991, closes #​4989).
  • EnableDeterministicQueueOrdering() for SQL Server, MySQL, Oracle and SQLite (#​4987).

HTTP

  • Wolverine.Http binds single-Value strong-typed id wrappers, such as record struct OrderId(Guid Value), without a TryParse (#​4995, closes #​4978).
    ... (truncated)

6.49.0

Wolverine 6.49.0 is a feature release. The big themes are optimized envelope ids for SQL Server, additive per-message topic routing across NATS, RabbitMQ and MQTT, a long list of NATS hardening, and a big round of Event Modeling and Bobcat work. Thank you to @​knotekbr, @​me-azlam-kp, @​faustodc, @​luisarellano09 and @​alesdvorakcz, whose reports, tests and pull requests are all over this one.

The two Bobcat packages, WolverineFx.Bobcat and WolverineFx.Bobcat.Http, ship as 6.49.0-alpha.3 and are still pre-release.

SQL Server

  • Optimized envelope ids for SQL Server, automatically (#​4967, closes #​4902, analysis and measurements by @​alesdvorakcz). Wolverine's default envelope ids sort in time order the way .NET and PostgreSQL compare GUIDs, but SQL Server compares a uniqueidentifier starting from its last six bytes, so to SQL Server those ids arrive in random order and fragment the clustered inbox, outbox and dead letter tables. One production inbox was measured at 99% fragmented with its pages half full. The new EnvelopeIdGeneration.NewIdSqlServerOrder uses the same NewId algorithm with the timestamp where SQL Server sorts on it. Wolverine now switches to it on its own at startup when every message store in the application is SQL Server -- plain SQL Server persistence, the SQL Server transport, EF Core on SQL Server, or Polecat -- and you haven't set EnvelopeIdGeneration yourself. There's no schema change. If a SQL Server-only application sends messages to Wolverine services that store their envelopes in PostgreSQL, opt out, because the receiving service uses the same id as its inbox key and PostgreSQL indexes these ids worse than random GUIDs. Either set opts.EnvelopeIdGeneration = EnvelopeIdGeneration.NewId or use the new optimizeEnvelopeIdsForSqlServer: false overloads of PersistMessagesWithSqlServer(), UseSqlServerPersistenceAndTransport() and Polecat's IntegrateWithWolverine(). Behind it, IMessageStore gains a PreferredEnvelopeIdGeneration member with a default implementation, so existing stores are unaffected.

Routing

  • Publish to a broker topic and to a local queue at the same time (#​4960 and #​4966, superseding #​4930 from @​luisarellano09). A per-message topic rule -- PublishMessagesToNatsSubject<T>(), PublishMessagesToRabbitMqExchange<T>() or PublishMessagesToMqttTopic<T>() -- used to silently switch off an explicit PublishMessage<T>().ToLocalQueue() rule, local routing to a handler, and broker conventions for the same message type. Each of those now has an overload that takes additive: true, so the other routing rules still apply. The original overloads ar...

Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file refonte-v2 labels Oct 16, 2026
@dependabot
Bump Microsoft.Extensions.Http.Resilience and 15 others
b82f24b 
Bumps Microsoft.Extensions.Http.Resilience from 10.10.0 to 10.11.0
Bumps Microsoft.Extensions.TimeProvider.Testing from 10.10.0 to 10.11.0
Bumps Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0
Bumps OpenTelemetry.Exporter.OpenTelemetryProtocol from 1.19.1 to 1.20.0
Bumps OpenTelemetry.Extensions.Hosting from 1.19.1 to 1.20.0
Bumps OpenTelemetry.Instrumentation.AspNetCore from 1.19.0 to 1.20.0
Bumps OpenTelemetry.Instrumentation.Http from 1.19.0 to 1.20.0
Bumps OpenTelemetry.Instrumentation.Runtime from 1.19.0 to 1.20.0
Bumps Testcontainers.PostgreSql from 4.15.0 to 4.16.0
Bumps WolverineFx.EntityFrameworkCore from 6.43.0 to 6.51.0
Bumps WolverineFx.Http from 6.43.0 to 6.51.0
Bumps WolverineFx.Http.FluentValidation from 6.43.0 to 6.51.0
Bumps WolverineFx.Postgresql from 6.43.0 to 6.51.0
Bumps WolverineFx.RuntimeCompilation from 6.43.0 to 6.51.0
Bumps xunit.runner.visualstudio from 4.0.0 to 4.0.1
Bumps xunit.v3 from 4.0.1 to 4.0.2

---
updated-dependencies:
- dependency-name: Microsoft.Extensions.Http.Resilience
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-v2-minor-patch
- dependency-name: Microsoft.Extensions.TimeProvider.Testing
  dependency-version: 10.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-v2-minor-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-v2-minor-patch
- dependency-name: OpenTelemetry.Exporter.OpenTelemetryProtocol
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-v2-minor-patch
- dependency-name: OpenTelemetry.Extensions.Hosting
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-v2-minor-patch
- dependency-name: OpenTelemetry.Instrumentation.AspNetCore
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-v2-minor-patch
- dependency-name: OpenTelemetry.Instrumentation.Http
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-v2-minor-patch
- dependency-name: OpenTelemetry.Instrumentation.Runtime
  dependency-version: 1.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-v2-minor-patch
- dependency-name: Testcontainers.PostgreSql
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-v2-minor-patch
- dependency-name: WolverineFx.EntityFrameworkCore
  dependency-version: 6.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-v2-minor-patch
- dependency-name: WolverineFx.Http
  dependency-version: 6.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-v2-minor-patch
- dependency-name: WolverineFx.Http.FluentValidation
  dependency-version: 6.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-v2-minor-patch
- dependency-name: WolverineFx.Postgresql
  dependency-version: 6.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-v2-minor-patch
- dependency-name: WolverineFx.RuntimeCompilation
  dependency-version: 6.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: nuget-v2-minor-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-v2-minor-patch
- dependency-name: xunit.v3
  dependency-version: 4.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: nuget-v2-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot changed the title Bump the nuget-v2-minor-patch group with 16 updates Bump Microsoft.Extensions.Http.Resilience and 15 others Oct 16, 2026
@dependabot
dependabot Bot force-pushed the dependabot/nuget/src/v2/back/env/staging/nuget-v2-minor-patch-abbe38abd1 branch from c0dca3c to b82f24b Compare October 16, 2026 12:59
@sonarqubecloud

sonarqubecloud Bot commented Oct 16, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@dependabot @github

dependabot Bot commented on behalf of github Oct 16, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are no longer updatable, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 16, 2026
@dependabot
dependabot Bot deleted the dependabot/nuget/src/v2/back/env/staging/nuget-v2-minor-patch-abbe38abd1 branch October 16, 2026 13:30
@Oasis35 Oasis35 mentioned this pull request Oct 16, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file refonte-v2

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants