Skip to content

Bump the minor-and-patch group with 11 updates - #344

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/frameworks/dotnet/aspnet-mvc/dot-config/minor-and-patch-5bc1862677
Open

Bump the minor-and-patch group with 11 updates#344
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/nuget/frameworks/dotnet/aspnet-mvc/dot-config/minor-and-patch-5bc1862677

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 9, 2026

Copy link
Copy Markdown
Contributor

Updated FluentValidation from 12.1.1 to 12.2.0.

Release notes

Sourced from FluentValidation's releases.

12.2.0

Release notes

Please read the upgrade guide if you are moving from 11.x to 12.x

Changes in 12.2.0

  • Add Lithuanian language (#​2350)
  • Add Belarusian language (#​2356)
  • Add GetParentChain() to PropertyChain (#​2358)
  • Fix ArgumentNullException in TestValidationResult when a failure has a null PropertyName (#​2362)
  • Reject an inverted range when the comparer returns a negative other than -1 in RangeValidator (#​2370)
  • Change EnumValidator to work under native AOT (#​2371)
  • Fix PropertyChain.IsChildChainOf for sibling chains that share a name prefix (#​2372)
  • Fix PropertyPath is incorrect in .When() on RuleForEach (#​2363)

Changes in 12.1.0

  • Add Tamil language (#​2334)
  • Add Telugu language (#​2333)
  • Fixes to Japanese translations (#​2340)

Changes in 12.0.0

  • Drops support for netstandard2.0, netstandard2.1, .net 5, .net 6 and .net 7. Minimum supported platform is now .net 8.
  • Add support for dependent rules for custom rules (#​2170)
  • Removes deprecated DI extensions
  • Removes deprecated transform methods (#​2027)
  • Remove the ability to disable the root-model null check (#​2069)
  • Use Zomp.SyncMethodGenerator to clean up internal sync/async code paths and increase performance (#​2136)
  • Add Serbian (Cyrillic) language; rename existing Serbian to Serbian (Latin) (#​2283)

Downloads

Binaries can be downloaded from nuget:

Commits viewable in compare view.

Updated Microsoft.AspNetCore.Mvc.Testing from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.Mvc.Testing's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.AspNetCore.OpenApi from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.AspNetCore.OpenApi's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Extensions.ApiDescription.Server from 10.0.12 to 10.0.14.

Release notes

Sourced from Microsoft.Extensions.ApiDescription.Server's releases.

No release notes found for this version range.

Commits viewable in compare view.

Updated Microsoft.Kiota.Bundle from 2.1.2 to 2.1.6.

Release notes

Sourced from Microsoft.Kiota.Bundle's releases.

2.1.6

2.1.6 (2026-11-02)

Bug Fixes

  • abstractions: implement polymorphic GetValue on UntypedNode (#​842) (f42cef3)
  • http: preserve values when decoding query parameter names (#​825) (52c5654)
  • serialization-json: avoid first-chance exceptions on default timespan parsing and preserve converter precedence (#​839) (2336fab)

2.1.5

2.1.5 (2026-10-13)

Bug Fixes

  • http: honor total UTC delay for Retry-After dates (#​822) (512cddf)

2.1.4

2.1.4 (2026-10-06)

Bug Fixes

2.1.3

2.1.3 (2026-09-28)

Bug Fixes

  • http: validate retry option lower bounds (b0c8412)
  • http: wrap response parsing failures in ApiException with status code, headers, and body (#​808) (0e75f2c)

Commits viewable in compare view.

Updated Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0.

Release notes

Sourced from Microsoft.NET.Test.Sdk's releases.

18.11.0

What's Changed

New Contributors

Full Changelog: microsoft/vstest@v18.10.1...v18.11.0

Commits viewable in compare view.

Updated microsoft.openapi.kiota from 1.35.0 to 1.38.0.

Release notes

Sourced from microsoft.openapi.kiota's releases.

1.38.0

Added

Changed

  • Python: check inherited-model discriminators once before type dispatch to avoid repeated truthiness checks that cause excessive CodeQL extraction work in large factories.

1.37.0

Added

  • Ruby: a deprecated operation, path, model, enum, property or parameter carries a YARD @​deprecated tag with the description's deprecation text, date, removal date and version. Calling a deprecated method or navigating to a deprecated path also warns with category: :deprecated, which Ruby prints when Warning[:deprecated] is on, as it does for its own deprecations. kiota-ruby#​64
  • Ruby: models generated with --backing-store keep their values in the runtime's backing store and send only the values changed since they were read, as the other languages do. Before, --backing-store generated Ruby that failed to load. Requires the runtime gems at 0.25.0. kiota-ruby#​53
  • Ruby: generated clients register the text, form and multipart serializers, so text/plain, application/x-www-form-urlencoded and multipart/form-data bodies work, as in the other languages. Requires the runtime gems at 0.25.0. kiota-ruby#​52, kiota-ruby#​55, kiota-ruby#​57

Changed

  • The accessor to a child path is marked deprecated when that path is deprecated. It used to take the deprecation of its parent path instead, so a deprecated /legacy under a live /api was not flagged, and every child of a deprecated path was.
  • TypeScript: guard union discriminator access and preserve dispatch for identifiable values even when some members lack the property; fall back to serializing all members for unidentified values without referencing nonexistent properties.
  • TypeScript: resolve factory default deserializers in the declared model's namespace, preventing unresolved references to similarly named deserializers in child namespaces. Fixes #​8461.
  • Ruby: kiota info lists the runtime gems at 0.25.0.

1.36.1

Added

Changed

  • Fixed small issues with release pipelines

1.36.0

Added

  • Ruby: an error's message returns the property the description marks with x-ms-primary-error-message, as the other languages do. An error property named message is renamed message_escaped, like MessageEscaped in C#; when it is a string, message still returns it. kiota-ruby#​63

Changed

  • Fixed relative description paths when opening or selecting clients in the VS Code Kiota workspace.

  • Removed the retired lock-search command from the VS Code command palette. Lock-file migration remains available.

  • Preserve inherited properties when a single oneOf or anyOf member defines its properties only through allOf. Fixes #​6778.

  • Python: preserve false, zero, empty strings, and empty collections when parsing and serializing union type wrappers.

  • All language refiners accept a generation logger consistently, retaining configuration-only compatibility constructors hidden from IntelliSense.

  • Reject plugin-manifest file references whose path components become parent-directory traversal after Windows trims trailing spaces or dots.

  • Fixed a stack overflow when generating API plugins from descriptions with cyclic allOf schemas.

  • Dart: omit unsupported schema defaults with a generation warning, preserve supported literal and enum property and parameter defaults (including empty strings), initialize query parameters from schema defaults, and keep constructor initialization valid with or without backing stores.

  • Dart: preserve nullable optional request-builder constructor parameters, including UUIDs and collections, so cloning accepts null arguments without overwriting existing path parameters.

  • Dart: escape URL templates once at final emission to preserve literal dollar signs and backslashes in constructor defaults and method overrides.

  • Dart: preserve schema string defaults named null, including enum wire values, without treating them as JSON-null sentinels.

  • Dart: preserve query-parameter defaults inside single-member allOf wrappers, retaining outer-default precedence and explicit JSON-null defaults.

  • Dart: validate parser-backed date, time, and UUID defaults before emission, omitting unsupported values with a generation warning.

  • Ruby: a union of object types that no discriminator decides, such as a oneOf without a discriminator, now reads the payload into every object member, as TypeScript does, instead of returning an empty wrapper. A union whose discriminator matched no member does the same, and its array member is only read when no other member was picked. Requires the runtime gems at 0.24.0.

  • Ruby: enum members hold their wire value, so a value such as incoming-payment or read is sent and read as the description declares it instead of as IncomingPayment or Read. Enum[:Name] now returns the wire value as a string. Requires the runtime gems at 0.24.0.

  • Go: keep escaped namespace segments lowercase so imports match generated package directories on case-sensitive filesystems. Fixes #​7828.

  • TypeScript: import response enum objects for request builders reached through path parameters. #​6884

  • Resolve enum query parameters wrapped in single-member allOf schemas, including enum array items.

  • Go: cast scalar enum values in union factories and avoid reading an empty discriminator name for undiscriminated unions. Addresses #​7808.

  • Preserve models for multipart properties with default content types when other properties specify an encoding. #​7342

  • Dart: escape enum options named value or values to avoid conflicts with generated and built-in enum members. #​7807

  • Ruby: the client's root module has an eager_load! method that loads every autoloaded model, for servers that preload before forking.

  • Ruby: generated files start with # frozen_string_literal: true, so string default values handed to user code are frozen.

  • Ruby: generated string literals are double quoted, the StandardRB convention.

  • Ruby: namespaces with nothing to autoload no longer get an empty barrel file, and generated files no longer require them (561 fewer files in a GitHub client).

  • Ruby: a client generated with a multi-segment --namespace-name, such as integration_test.client, failed to load because its root file was written one directory too deep.

  • Ruby: namespace barrels register their models and enums with autoload instead of requiring them, so a subclass no longer fails to load when its base class file is required first. Other files require the barrel rather than an individual model file, and models now load on first use. A type no barrel autoloads, such as a model named after its namespace, is now required directly: 1,315 constants referenced by a Meraki client never loaded, and a client generated from the current GitHub description failed to load because it required a file that is never written. #​7956

  • Ruby: model properties are declared with attr_accessor, which removes the thousands of "possibly useless use of a variable" warnings ruby -w printed while loading a client.

  • Ruby: enum hashes are frozen. kiota-ruby#​68

  • C#: escape Unicode line and paragraph separators in generated string literals so generated clients remain valid C# source.

  • External reference allowlist wildcards no longer cross the URI authority boundary, so a wildcard in the scheme or host cannot match text in the path, the user information or the port.

  • Initialize inherited Dart model fields in constructor initializer lists.

  • Replace only unresolved binary types with a native stream type, and translate a resolved model by its definition rather than its name, so a model whose schema is named binary, base64 or base64url keeps its own name across every language instead of being rendered as the native binary type. Generation no longer fails for C# and Java.

  • Avoid redundant parsing branches for equivalent binary alternatives in Dart and PHP composed models.

  • Preserve imports for distinct types from the same namespace when inlining error model inheritance.

  • Dart: qualify model fields named node or deserializerMap during deserialization so local variables do not shadow them; escape override model members to preserve Dart annotations. Fixes #​7822.

  • PHP: disambiguate enum constants that normalize to the same name while preserving wire values and existing constant names.

  • Java: omit unused discriminator-mapping imports for union/intersection wrappers, avoiding imports of nonexistent models while retaining member and inherited-factory imports.

  • Dart: omit unused discriminator-mapping imports for composed wrappers while preserving member and inherited-factory imports. Addresses #​7821.

  • Preserve endpoints whose static path segments collide after name sanitization, such as /v1.1 and /v11. #​7143

  • Ruby: a path with an escaped suffix, such as /domains/{domainName}!quote, generated a request builder method that passed the raw path parameter name where the signature had snake cased it, and referenced the builder class without its namespace. Both raised NameError on first use. #​7956
    ... (truncated)

Commits viewable in compare view.

Updated WolverineFx.Http from 6.41.0 to 6.64.0.

Release notes

Sourced from WolverineFx.Http's releases.

6.64.0

A small release: three fixes, one of them a new observer signal, and a JasperFx and Weasel bump. JasperFx moves from 2.100.1 to 2.102.0 and Weasel from 9.49.0 to 9.50.0; Marten (9.58.0), Polecat (5.49.0) and Fisher (1.28.0) are unchanged. There is no schema change and no breaking API change.

Fixes

  • Native-ack listeners: on a group-partitioned NativeAck endpoint, an envelope settled before it reached a handler (an unknown message type, an unreadable payload) is released from the lease tracker and the in-memory idempotency guard. It used to stay tracked until the lease ceiling and then log a false "unsettled for 00:59:xx" warning, an hour after it was completed (GH-5443).
  • Circuit breakers: IWolverineObserver.CircuitBreakerReset is now raised, once per trip, when a listener the breaker paused accepts messages again. Nothing ever raised it before, so an alert opened on CircuitBreakerTripped could never be closed by Wolverine's own signal. A new overload, CircuitBreakerReset(Endpoint, CircuitBreakerResetReason), says whether the listener came back on its own after PauseTime or through an explicit start or restart. Its default forwards to the existing one-argument member, so existing observers keep working unchanged (GH-5446).
  • Rabbit MQ: ResetResourceState() no longer adds a new wolverine.response.* queue on every call. Each reset had been declaring and purging every reply queue built so far, so a test suite that resets before each test slowed down with every test, and a sender started after a reset could send its replies to a queue nobody listened to, so InvokeAsync<T>() timed out (GH-5452, thanks to @​alesdvorakcz).

Docs

  • The command line runs from a Native AOT binary since JasperFx 2.101.0 (#​5442).
  • The resource setup hosted service migrates message storage regardless of AutoCreate (#​5445).

What's Changed

Full Changelog: JasperFx/wolverine@V6.63.0...V6.64.0

6.63.0

This is a durability release. Most of its fixes were found by the new out-of-process durability chaos rig (src/Testing/DurabilityChaosRig), which kills, stops, pauses and starves producers and workers, then checks a ledger for lost, duplicated and stuck messages. Dependencies are unchanged from 6.62.0 (JasperFx 2.100.1, Weasel 9.49.0, Marten 9.58.0, Polecat 5.49.0, Fisher 1.28.0). Upgrading is a package bump with no breaking API change. The one schema change is a new index on the MySQL inbox table (GH-5428), applied by the usual message storage migration.

Fixes

  • Envelope ids: default envelope ids no longer collide between processes on one machine. Collisions showed up as inbox duplicate-key errors and silently dropped "duplicate" deliveries (#​5399).
  • Stale nodes: a node that resumes after being ejected as stale does not commit work another node already handled (GH-5423), and Oracle's in-transaction mark-as-handled refuses that work too (GH-5429).
  • Ambiguous commits: a commit that applied but reported an error is no longer dead-lettered, and its cascading messages run (GH-5410).
  • Database queues:
    • scheduled retries are atomic on SQL Server, MySQL, Oracle and SQLite (#​5408), and fenced on the inbox row's owner on every store (GH-5426);
    • the outbox-to-queue move is one transaction on MySQL, SQL Server and SQLite (GH-5438);
    • a durable pop skips envelopes the inbox already holds instead of rolling the whole batch back (GH-5411);
    • a backlog drains without waiting a polling interval per batch (GH-5413).
  • SQL Server: the scheduled-message poll never waits on a lock (GH-5412).
  • MySQL: the expired-handled cleanup no longer locks live inbox rows (GH-5428).
  • SQLite: Balanced mode assigns node numbers and reads health checks as UTC (GH-5430).
  • Multi-tenancy: tenant databases with the same name on one host are told apart by port, so each gets its own durability agent (GH-5435).
  • Dead letters: a dead letter marked replayable mid-move is no longer deleted before it reaches the inbox (GH-5395).
  • Interop: CloudEvents and MassTransit interop keep the inbox id of a durable envelope when they read the message id (#​5396, thanks to @​lahma; #​5398).
  • HTTP: span tags are written before anything can short-circuit the request (GH-5406).
  • Testing: a tracked session no longer completes while a handler's cascading messages are still running (#​5400, thanks to new contributor @​haefele-octoja).

Docs

  • Schema management options for message storage, linked to Weasel and the stateful resource model (#​5437).
  • Waiting on a message the broker fans out to several queues (GH-5416).
  • The durability chaos rig has a README covering its roles, CHAOS_* knobs and containers (GH-5409, GH-5414).

What's Changed

6.62.0

This is a minor release on JasperFx 2.100.1, Weasel 9.49.0, Marten 9.58.0, Polecat 5.49.0 and Fisher 1.28.0. Upgrading is a package bump: there is no schema change and no breaking API change. If your projects pin JasperFx.Events.SourceGenerator centrally, pin it to the same version as JasperFx.Events (see the note at the end).

New

  • Sagas: [SagaIsResponseOnly] for an endpoint that returns a saga as its response (GH-5069).
  • PostgreSQL: PublishOnlyToShardedPostgresqlQueues, for publishing to sharded queues with no listeners (GH-5088).
  • EF Core: the transactional middleware's isolation level is configurable (GH-5207).
  • Azure Service Bus: support for externally owned topics (GH-5342).
  • HTTP:
    • a ProblemDetails factory for the 409 conflict mapping (GH-5353);
    • an AggregateException of concurrency failures maps to 409 (GH-5355);
    • OpenAPI describes query, header and form parameters with their data annotations;
    • [DeduplicatedWithResponse] replays ASP.NET Core IResult responses, and reads a replayed Location without per-request reflection (GH-5381).
  • Kafka: the replay group id can be set, with a kafka-replay --group-id option (thanks to new contributor @​Mr444-dev).
  • Testing:
    • WhenTracked sees events an application commits through its own injected IDocumentSession, on Marten, Polecat and Fisher (GH-5385, GH-5390);
    • GenerationRules.ReuseCompiledAssemblies (JasperFx 2.100.0) is documented and tested for many hosts in one process, in Dynamic and Auto modes, the codegen command and HTTP chains (GH-5378, GH-5391).
  • Event Model: EventModelReport prints the decider line beside starts (GH-5379), and scaffold turns a multi-event automation into one handler class (GH-5361).

Fixes

  • Local queues: buffered and durable local queues whose receiving block faulted are rebuilt (GH-5358), and DurableLocalQueue.StartAsync skips an already accepting queue and is serialized (GH-5348).
  • Inbox recovery into an inline endpoint with ListenerCount > 1 no longer recurses forever (GH-5363).
  • Middleware: an OnException returning a tuple generates code that compiles (GH-5356), and OnException handlers for the same exception type merge into one catch clause.
  • CloudEvents: CloudEventsMapper keeps the envelope id on re-read, with a stable id for non-Guid CloudEvent ids (GH-5364).
  • PostgreSQL: the scheduled-message poll gets the index SQL Server already had (GH-5346).
  • Scaffold no longer plans every emitted event as an Apply on every stream (GH-5360, a partial fix; the rest stays open).
  • Build: NU1903 (GHSA-p3jp-9v83-76w9) on Microsoft.DotNet.ILCompiler is cleared (GH-5387).

Pinning JasperFx centrally

Polecat 5.49.0 needs JasperFx 2.100.1. If JasperFx.Events is lifted to 2.100.1 while JasperFx.Events.SourceGenerator stays pinned at 2.100.0, the generator emits nothing and projections fail at run time with "No source-generated dispatcher found". Keep the two on one version (jasperfx#​1138).

What's Changed

6.61.0

This is a minor release. Upgrading is a package bump only: there is no schema change and no breaking API change.

New

  • GH-5320 (#​5326): Recurring schedules can now run as often as every second, and a schedule can skip an occurrence while the previous one is still running.
    • CronSchedule.MinimumCadence is now one second, for six-field cron expressions such as * * * * * *. Anything faster than five seconds always runs on a timer agent, and UseScheduledMessages() refuses it.
    • The new SkipWhileRunning() on a recurring schedule invokes each occurrence instead of publishing it. An occurrence that comes due while the previous one is still running is skipped, and skipped occurrences are not made up later. Skips are logged and counted in the new wolverine-recurring-occurrences-skipped metric.
    • With a local handler, the occurrence runs on the node that owns the schedule's timer agent, so overlap is prevented across the cluster. Because the occurrence is invoked, other subscribers don't receive it, and it has no inbox row, queue error policy or dead letter queue. A failed occurrence is logged and the next one runs on schedule. With a handler on another node, the wait is capped at 5 seconds.
    • A one-second schedule writes about 86,400 deduplication rows a day.
  • GH-5317 (#​5323): PauseThenCatchUpOnAllMartenDaemonActivityAsync() and the tracked-session option PauseThenCatchUpOnAllMartenDaemonActivity() catch up the main Marten store and every ancillary store registered with IntegrateWithWolverine() in one call. A store with no events is skipped.
  • GH-5311 (#​5324): A failed handler attempt now records the OpenTelemetry exception event (exception.type, exception.message, exception.stacktrace) on its span, instead of only the exception's type name. Exception messages can carry application data, so you can turn this off with opts.Tracking.RecordExceptionsOnSpans = false.
  • GH-5339 (#​5341): EntityDescriptor.Ddl now carries each EF Core entity's CREATE TABLE script, with its keys, foreign keys and indexes, the same way DocumentMappingDescriptor.Ddl does for documents. It's generated from the model, so no connection is opened, and it's the model's script rather than the database's. Non-relational providers and view-mapped entities leave it empty. Needs JasperFx 2.99.0.
  • GH-5332 (#​5338): Wolverine HTTP endpoints now tag the request span with http.route and http.request.method, the OpenTelemetry semantic convention names, alongside handler.type. Both are constants in the generated code. Pre-generated code should be regenerated.
  • Dead letter queries can filter their time range on the failure time with the new DeadLetterEnvelopeQuery.RangeOn (DeadLetterTimeField.SentAt or FailedAt) (#​5330). FailedAt falls back to sent_at when failed_at is null, and applies to query, replay, discard and archive. The default stays SentAt. Supported by the PostgreSQL, SQL Server, MySQL, SQLite, Oracle, CosmosDb and RavenDb stores.

Fixes

  • GH-5310 (#​5328): With Marten's TrackConnections turned on, the handler, saga and stream tags (handler.type, message.handler, wolverine.saga.*, wolverine.stream.*) landed on the marten.connection span instead of the message's own span. They now stay on the message span, and on the request span for HTTP endpoints. Pre-generated code should be regenerated.
  • GH-5312 (#​5327): A durable ScheduleRetry(...) lost the link to the attempt that failed, because the stored envelope body wasn't rewritten when the retry was scheduled. Every message store now rewrites the body when it reschedules an envelope.
  • GH-5313 (#​5321): Azure Service Bus queues and subscriptions and Amazon SQS queues now report DeadLetterStorageMode.NativeWithRecovery when EnableDeadLetterQueueRecovery() drains them, so CritterWatch's startup check no longer warns about them.
  • GH-5314 (#​5325): With RabbitMQ's EnableDeadLetterQueueRecovery(), stopping the host could throw AlreadyClosedException when two stops ran at once, as they do under WebApplicationFactory. Stopping the dead letter queue listener is now idempotent and never throws.
  • GH-5315 (#​5322): FindSingleTrackedMessageOfType<T>() now counts envelopes rather than distinct message values, so publishing two equal records fails the check. A message sent to several destinations still counts once. Use tracked.Sent.SingleMessage<T>() for a check per destination.
  • GH-5318 (#​5319): The testing docs now explain that the pause in PauseThenCatchUpOnMartenDaemonActivity waits out the high water agent's current poll tick. The fix is JasperFx/jasperfx#​1100.
  • GH-5331 (#​5336): With runtime code generation, each saga message disappeared from ServiceCapabilities.Sagas once it had been handled, and the saga disappeared once every message had been. The saga report, including each store's GetRegisteredSagasAsync, now reads the same before and after the chains compile.
  • GH-5334 (#​5337): In Balanced mode, lifting a pause on a URI that no agent owns, such as a listening endpoint, waited out AgentRestrictionConfirmationTimeout and then threw AgentRestrictionsNotConfirmedException. It now returns at once. Agent URIs are still confirmed as before.
  • Sessions the application opens itself and enrolls with IPolecatOutbox.Enroll or IFisherOutbox.Enroll never flushed their outgoing messages on commit (#​5309). Durable messages waited until a restart and buffered messages were lost. They now flush on commit, the same as handler sessions, and the incoming envelope is marked handled once instead of twice.

Dependencies

  • JasperFx 2.99.0 (#​5333 took 2.98.0, #​5341 2.99.0).
  • Weasel 9.48.0 and MySqlConnector 2.6.1 (#​5335). MySqlConnector 2.6.1 closes GHSA-473q-m89c-ghf8 for WolverineFx.MySql. On SQL Server, a DateTime parameter in a message store command now goes out as datetime2 instead of datetime. Every envelope time column is datetimeoffset, so no column is converted either way.

Thanks to @​uniquelau for #​5313, #​5314, #​5315, #​5317 and #​5318, and to @​lahma for #​5330.

Full Changelog: JasperFx/wolverine@V6.60.0...V6.61.0

6.60.0

What's Changed

Full Changelog: JasperFx/wolverine@V6.59.1...V6.60.0

6.59.1

This is a patch release with two fixes. Upgrading is a package bump only: there is no schema change and no API change.

SQL Server: the inbox and outbox seek on their indexes again

  • GH-5292 (#​5294): Several of the SQL Server message store's per-envelope statements were scanning the whole envelope table. That cost grows with the size of the inbox and outbox, and those statements run once per message. The cause was how two kinds of value were bound as parameters.
    • Envelope ids went out as sql_variant. The statements that mark envelopes as handled, reassign them, delete them and move them to the dead letter queue all filter on the envelope id. Weasel's generic command builder has no mapping for Guid, so it bound each id as DbType.Object, which SqlClient sends as sql_variant. SQL Server then had to compare CONVERT_IMPLICIT(sql_variant, [id]) on every row, which rules out a seek on the uniqueidentifier primary key. Ids are now bound as uniqueidentifier, so each statement is a primary key seek.
    • Envelope addresses went out as nvarchar. received_at on the inbox and destination on the outbox are varchar(250) columns, but statements that filter on them bound the address as nvarchar. Under a SQL collation such as SQL_Latin1_General_CP1_CI_AS, the default on Azure SQL, that converts the column and defeats the index. The statements affected are the per-envelope updates and deletes, inbox recovery's page load, outbox loads by destination, the scheduled message updates and the duplicate check. They now bind the address as varchar.
    • DateTime parameters kept only the date. The same generic mapping typed DateTime as DbType.Date. The message store now lets SqlClient type both values itself.
    • The new test checks SQL Server's plan cache after running each of these statements. It requires that no plan contains sql_variant and that no plan converts an indexed envelope column. The full SqlServerTests suite passes (721 tests, 2 skipped).
    • PostgreSQL, MySQL, SQLite and Oracle bind exactly as they did before.
    • The underlying Weasel mappings are tracked as JasperFx/weasel#​758 (Guid as sql_variant) and JasperFx/weasel#​759 (DateTime as date). Wolverine works around both on its own, so this release doesn't wait for a Weasel release.

The run command no longer blocks a thread pool thread

  • JasperFx 2.96.2 (JasperFx/jasperfx#​1093, fixes JasperFx/jasperfx#​1092): Wolverine now depends on JasperFx 2.96.2. Before this release, the run command waited for shutdown by blocking a thread pool thread for the whole life of the application. That matters when a container's CPU limit is below one core. ProcessorCount is then 1, so the thread pool's minimum is one thread, and the run command held it. After that, every burst of work had to wait for the pool to add a thread, about 500 ms each time. The reporter saw a 200 ms Task.Delay loop wake up as much as about 950 ms late on Azure Container Apps.
    • The run command now awaits shutdown instead of blocking. It still listens for the same three signals: ApplicationStopping, Ctrl+C, and the assembly load context unloading.
    • When the host is already started (the AutoStartHost / WebApplicationFactory path), RunJasperFxCommands() used to block the calling thread. It now returns a task that completes when the host shuts down.
    • This applies to every application started with RunJasperFxCommands() or RunWolverineCommands(), whatever its persistence or transport.

Full Changelog: JasperFx/wolverine@V6.59.0...V6.59.1

6.59.0

New

  • GH-5288 (#​5289): Scheduled message management now knows about sagas. ScheduledMessageSummary.SagaId reports the saga id carried by each scheduled envelope. The new ScheduledMessageQuery.SagaId limits QueryAsync and CancelAsync to one saga's scheduled messages, such as its pending timeouts.
    • There is no schema change. The filter reads every scheduled message that matches the rest of the query and pages the saga's messages in memory, so PageSize and TotalCount stay exact. On a large scheduled backlog, narrow the query with MessageType or an execution-time window as well.
    • A CancelAsync with a SagaId that matches nothing cancels nothing.
    • Supported by PostgreSQL, SQL Server, MySQL, SQLite, Oracle, RavenDB and CosmosDB. RavenDB and CosmosDB now treat PageSize <= 0 as "read every match", as the RDBMS stores already did.
  • #​5287: WolverineFx.AI's AddLlmCallouts() now works under TypeLoadMode.Static when the application's pre-generated code was written without it. A library can ship its own static codegen and a host can add LLM callouts on top. In Static mode, callouts run on a pre-built handler that needs no generated code. Every other mode is unchanged.
    • New LlmCalloutOptions.ConfigureChain(Action<HandlerChain>) customizes the callout chain in any mode. IHandlerPolicy doesn't reach the pre-built handler.
    • DeduplicateCallouts is refused at startup in Static mode, because deduplication is woven into generated code.

Fixes

  • GH-5286 (#​5290): A send that IHost.StopAsync() cancels mid-flight is no longer logged as a send failure. Azure Service Bus hands the runtime's cancellation token to the SDK, so an orderly shutdown used to produce two Error lines for a batch that was never lost. A durable agent now logs it at Information, because the envelopes stay in the outbox and are recovered on restart. A non-durable agent logs it at Warning, because those messages were not sent. A shutdown cancellation no longer counts toward the circuit breaker or the sending failure policies. A cancellation while the application is still running, or any other exception during shutdown, is still logged at Error.

6.58.0

New

  • GH-5279 (#​5280, #​5282): New opt-in Durability.UseTransactionScopedDurabilityPassLock for PostgreSQL. The serverless durability pass takes a transaction-scoped advisory lock (pg_try_advisory_xact_lock) instead of a session lock. This makes the pass lock safe behind a transaction-mode pooler such as PgBouncer or Supabase's pooler, where a session lock can leak onto a pooled connection or be held by two passes at once. #​5282 hardens it:

    • the lock connection stays out of an ambient TransactionScope
    • an idle_in_transaction_session_timeout can no longer drop the lock in the middle of a pass
    • a lock transaction that ends before the pass does is reported, and its pooled connection is discarded
    • a session unlock that fails is logged as a warning

    Wolverine also logs a one-time warning when the store doesn't support the setting, or when extension steps such as Marten's projection catch-up run under the open lock transaction. That open transaction can stall Marten's gap detection, which is tracked in JasperFx/marten#​5791. See the serverless guide.

Fixes

  • GH-5276 (#​5277, thanks @​3nth): The HTTP transport's batch endpoint now answers 503 when a durable local queue cannot write the batch to its inbox. Before, it answered 200 while the messages were dropped, so a durable outbox deleted messages that were never stored on either side. The sender now keeps the batch and retries it.
  • GH-5278 (#​5281): A durable TCP listener now answers ProcessingFailure instead of Received when its inbox could not store a batch. The sender keeps the batch and retries it, and a late duplicate is deduplicated by id. gRPC listeners can't be durable, so they aren't affected. A guard test now pins that.
  • #​5275 (thanks @​lahma): With Durability.EnableInboxPartitioning, PostgreSQL's durable inbox now refuses a redelivery whose identity was already handled. Before, the kept Handled row sat in a different partition and didn't collide, so the redelivery was handled a second time. This completes the stable-id deduplication from 6.57.0 for partitioned inboxes.

6.57.0

New

  • GH-5244 (#​5272): NServiceBus interop now supports XML. Many NServiceBus systems still use the NServiceBus XmlSerializer, and they no longer have to switch to JSON before a migration to Wolverine can start. Every NServiceBus interop endpoint (Rabbit MQ, Azure Service Bus, Amazon SQS and SNS, and the SQL Server and PostgreSQL NServiceBus transports) now reads both JSON and XML, choosing per message from the NServiceBus.ContentType header. To send XML, use the new NServiceBusXmlSerializer: .UseNServiceBusInterop().DefaultSerializer(new NServiceBusXmlSerializer()). Because one endpoint reads both formats, NServiceBus endpoints can also move from XML to JSON gradually. See XML Serialization with NServiceBus.
  • #​5268 (thanks @​lahma) and #​5273: A durable listener now gives a message from a non-Wolverine producer, which has no Wolverine id, a stable envelope id derived from the broker's own identity for that message. A redelivery is then deduplicated by the durable inbox instead of being handled twice. This covers Kafka (topic, partition and offset), NATS JetStream, Pulsar, Redis Streams, Amazon SQS and GCP Pub/Sub pull subscriptions. On SQS and Pub/Sub it applies in every endpoint mode. #​5273 also makes raw JSON work on durable SQS listeners. A duplicate the durable inbox refuses is now logged at Information instead of as an error.
  • GH-5260 (#​5261): New opt-in WolverineHttpOptions.RejectUnparseableHeaderValues answers 400 with ProblemDetails when a [FromHeader] value can't be parsed.

Fixes

  • GH-5244 (#​5272): NServiceBus replies to Wolverine over Rabbit MQ now go to the queue marked UseForReplies(). Wolverine used to give NServiceBus its own wolverine.response.{guid} system queue as the reply address, which NServiceBus can't reach, so every reply ended up in NServiceBus's error queue.
  • GH-5247 (#​5248): DurabilityAgent.StopAsync() now cancels its in-flight durability command and waits for it to finish. Before, a command still running at shutdown could outlive the host and fail against a disposed data source.
  • GH-5253 (#​5256, thanks @​thomhurst): A leadership lock acquisition cancelled by node shutdown is no longer logged as an error.
  • GH-5254 (#​5265): Shutdown now waits for handlers still running on a buffered local queue.
  • GH-5257 (#​5266): Stopping a listener now interrupts an inline retry cooldown instead of waiting it out, and the retry doesn't run after the stop.
  • GH-5262 (#​5263): Lightweight EF Core handlers now collect domain events before their save, so the events are published atomically with it.
  • #​5245 (thanks @​ahyousif): Managed EF Core tenancy combined with WithDbContextAbstraction now reuses the tenant DbContext, so repository writes, the save and outbox enrollment all use one context. This could previously fail code generation.
  • #​5250 (thanks @​johnkaram02): A request that repeats a [FromHeader] header binds the comma-joined values instead of answering 500.
  • #​5252 (thanks @​johnkaram02) and #​5259: Additional error actions such as AndPauseProcessing() chained after ScheduleRetryIndefinitely() / RequeueIndefinitely() now apply, including to the open-ended attempts after the listed delays.

Dependencies

  • JasperFx 2.96.1 and JasperFx.RuntimeCompiler 5.0.1 (#​5258)
  • Weasel 9.47.1 (#​5269)

Docs and build

  • The Best Practices guide is rewritten (#​5270).
  • New docs for stable envelope ids from non-Wolverine producers, and for deduplicating CloudEvents (#​5273).
  • ./build.sh LocalGate runs every CI suite on one machine (GH-5125, #​5246). The CI suites are rebalanced to stay under the 20 minute job limit (#​5267), and the scaffold tests now pass on Windows (GH-5255, #​5264).

6.56.0

New

  • GH-5238 (#​5242): opts.UseHttpTransport() registers the HTTP transport inside UseWolverine(). http/https URIs then resolve in ListenForMessagesFrom(), PublishMessage<T>().To(uri), and runtime EndpointFor() / ToDestination(). Before this, the transport was only registered by ToHttpEndpoint(), and any other http URI failed with Unknown Transport scheme 'http'. /_wolverine/invoke now answers 415 instead of 500 for a content type with no registered serializer.

Fixes

  • GH-5235 (#​5239): Host shutdown now stops the durability metrics sweeper and waits for any query it has in flight before stores are disposed. Removing a durability agent also waits for its in-flight query. A metrics query could previously outlive IHost.StopAsync() and throw ObjectDisposedException against a disposed NpgsqlDataSource.
  • GH-5236 (#​5240): A Kafka listener with a durable inbox no longer crashes the process with a stack overflow when the inbox database is unavailable. DeferAsync() used to call back into the receiver inline, so the failed inbox write and the defer recursed. A deferred Kafka envelope now goes back to the receiver on its own task after a short pause, and only while the listener is running. After a stop or inbox-recovery pause, its uncommitted offset brings it back. Because Kafka has no native requeue, a Requeue error policy on a Kafka endpoint now redelivers after about one second instead of immediately.
  • GH-5237 (#​5241): A CloudEvents HTTP endpoint now fails a single-envelope send that the receiver rejects. It used to count the send as delivered, so a durable endpoint aimed at /_wolverine/invoke could delete an outgoing envelope that was never received. HTTP transport responses are now disposed.

6.55.1

Fixes

  • GH-5230 (#​5232): A database operation batch cancelled by Wolverine's own shutdown is no longer wrapped in DatabaseBatchCommandException and logged as an Error. Genuine SQL/connection failures are still reported.
  • GH-5231 (#​5233): An HttpEndpoint aimed at /_wolverine/invoke in its default (buffered) mode now delivers by posting each envelope individually, instead of receiving a 415 for every batch and retrying forever. /batch/{queue} and .SendInline() endpoints are unchanged.

6.55.0

Highlights

WolverineFx.Bobcat is out of alpha, on Bobcat 1.0.0 (#​5222, #​5229). Bobcat 1.0.0 shipped tonight, and WolverineFx.Bobcat and WolverineFx.Bobcat.EventModel now publish as stable 6.55.0 instead of -alpha.1. WolverineFx.Bobcat.Http stays 6.55.0-alpha.1 until Alba 9 ships stable, because a stable package cannot depend on Alba 9.0.0-rc.2. A spec project that write-specs generates with no --wolverine-version pins the stable WolverineFx.Bobcat (#​5222, #​5223).

MessageCausedBy names your handler (#​5224, #​5225). IWolverineObserver.MessageCausedBy reported the generated handler class (Internal.Generated.WolverineHandlers.StartTripHandler939323516). It now reports the handler you wrote (TripService.StartTripHandler), the same string as the message.handler span tag, resolved at codegen time. Code generated by an earlier version keeps working through the old overload.

CosmosDB sagas start with a conditional create (#​5221, thanks @​thechucklingatom). A second start message for an existing saga id used to silently overwrite the running saga. It now fails with the SagaConcurrencyException that Marten, Azure Blob and S3 already raise, so one OnException<SagaConcurrencyException>() policy covers every provider.

Fixes

  • GH-5217: ListeningAgent.StartAsync is serialized, and deliveries are deferred to a drained BufferedReceiver (#​5228)
  • GH-5218: an unresolvable tenant is treated as tenant-scoped on the single-envelope inbox write (#​5227)
  • GH-5220: Azure Service Bus listeners join their receive loop before disposing the CancellationTokenSource (#​5226)
  • GH-5215: reserved-word schema names are quoted in the remaining RDBMS and PostgreSQL SQL (#​5216, thanks @​marc-RocketRez)
  • GH-5213: a later pause supersedes an earlier pause's restart (#​5214)
  • GH-5209: the dead letter history table round-trips with no schema drift (#​5212)

Dependencies

  • JasperFx 2.96.0 (jasperfx#​1083: an Observed vs Derived Origin no longer raises a SourceDisagreement)
  • Weasel 9.47.0 (#​5219)
  • Bobcat 1.0.0

Full Changelog: JasperFx/wolverine@V6.54.0...V6.55.0

6.54.0

Highlights

Dead letter failure groups (#​5209, #​5210). Wolverine now fingerprints every message as it moves to dead letter storage, so dead letters can be managed one failure group at a time:

  • The default IDeadLetterFingerprinter hashes the exception type and the first stack frame from application code. Register your own to replace it.
  • DeadLetterEnvelopeQuery gains FailureGroup, ExceptionMessageMatch (Exact / Contains), TenantId and Archived.
  • A new SummarizeAllAsync overload groups by failure group, message type or endpoint, with first and last failure times.
  • ReplayMatchingAsync, DiscardMatchingAsync, ArchiveMatchingAsync and RestoreMatchingAsync report how many dead letters they affected.
  • A message that fails again after a replay reports its ReplayCount, LastReplayedAt and FirstFailedAt.
  • Archived dead letters drop out of summaries, queries and replays until restored, and can be expired separately with DurabilitySettings.ArchivedDeadLetterRetention.
  • IDeadLetters.Capabilities tells you what a store supports.

All changes are additive. The relational stores pick up seven nullable columns on wolverine_dead_letters, an index and a new wolverine_dead_letter_history table through the normal schema migration. See the dead letter storage guide.

Deduplication fixes (#​5205, #​5206, #​5208), and Bobcat 1.0.0-rc.4 dependency pins (#​5211). The WolverineFx.Bobcat* packages remain alpha (6.54.0-alpha.1).

What's Changed

Full Changelog: JasperFx/wolverine@V6.53.0...V6.54.0

6.53.0

What's Changed

New Contributors

Full Changelog: JasperFx/wolverine@V6.52.0...V6.53.0

6.52.0

Wolverine 6.52.0 is a feature release. The headline items are Aspire-style registration by connection-string name for every transport and every message store, timer agents for short-cadence recurring schedules, and the 6.x groundwork for Wolverine 7.0's one-chain-per-handler model. There are no breaking API changes. Two behavior changes are worth knowing about up front: recurring schedules that fire more often than every 15 minutes now run on a timer agent (opt out per schedule with UseScheduledMessages()), and outgoing envelopes a transport cannot map are dead-lettered instead of being logged and deleted.

Many thanks to everyone who reported issues and sent fixes: @​uniquelau, @​johnkaram02, @​erdtsieck, @​ahmetvayhan and @​pritamrao.

Aspire parity: named connections

Messaging and error handling

HTTP

Operability and diagnostics

Documentation

Full Changelog: JasperFx/wolverine@V6.51.3...V6.52.0

6.51.3

Wolverine 6.51.3 is a durability release. Nearly everything in it came out of a run of reports against the durable inbox and outbox, plus a new durable receiver compliance rig (src/Testing/DurableComplianceRig, Bobcat specs across PostgreSQL, SQL Server, Marten and EF Core over local, database, RabbitMQ and SQS endpoints) that turned up the rest. There are no breaking API changes; the one schema addition (a nullable envelope_id column on the deduplication table) is optional and an unmigrated table keeps working.

Many thanks to everyone who reported these with reproductions: @​billshuck, @​dbelinsky-accureference, @​endava-marinela-marchitan, @​devployment, @​kowalczb, @​Patrick2607 and @​ahmetvayhan.

Durable inbox hardening

  • Durable inbox hardening, part 1: transactions, idempotency, deduplication, GH-5123 and the CISqlServer split by @​jeremydmiller in Durable inbox hardening, part 1: transactions, idempotency, deduplication, GH-5123 and the CISqlServer split JasperFx/wolverine#5129
    • A late DbTransaction dispose in MessageContext.ClearState() could kill another handler's Npgsql transaction
    • Eager idempotency now writes its placeholder inside the handler's transaction (Marten, EF Core, Polecat, Fisher), so a requeued failure is no longer dead lettered as a duplicate of itself
    • EF Core marks the inbox row Handled only after its own commit, and inside the tenant transaction for database-per-tenant
    • A handler that calls ReScheduleAsync and then returns normally keeps its retry
    • A [Deduplicated] claim stranded by a crash can be taken over by the same envelope (new nullable envelope_id column, opt-in IEnvelopeAwareDeduplicationStore)
    • Envelope.DeduplicationId now crosses RabbitMQ, the generic EnvelopeMapper brokers and MQTT
    • Two copies of one envelope in a single batch are reported as DuplicateIncomingEnvelopeException instead of pausing the listener or tripping the tenant write brake (PostgreSQL, SQL Server, MySQL, SQLite, Oracle)
    • RabbitMQ quorum queues: opt-in x-delivery-limit (.DeliveryLimit(n), `DeliveryLimitFor...

Description has been truncated

@dependabot
Bump the minor-and-patch group with 11 updates
a4a2fc8 
Bumps FluentValidation from 12.1.1 to 12.2.0
Bumps Microsoft.AspNetCore.Mvc.Testing from 10.0.12 to 10.0.14
Bumps Microsoft.AspNetCore.OpenApi from 10.0.12 to 10.0.14
Bumps Microsoft.Extensions.ApiDescription.Server from 10.0.12 to 10.0.14
Bumps Microsoft.Kiota.Bundle from 2.1.2 to 2.1.6
Bumps Microsoft.NET.Test.Sdk from 18.10.1 to 18.11.0
Bumps microsoft.openapi.kiota from 1.35.0 to 1.38.0
Bumps WolverineFx.Http from 6.41.0 to 6.64.0
Bumps WolverineFx.Http.FluentValidation from 6.41.0 to 6.64.0
Bumps xunit.runner.visualstudio from 4.0.0 to 4.0.1
Bumps xunit.v3 from 4.0.1 to 4.0.3

---
updated-dependencies:
- dependency-name: Microsoft.AspNetCore.Mvc.Testing
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.AspNetCore.OpenApi
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.ApiDescription.Server
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Kiota.Bundle
  dependency-version: 2.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: microsoft.openapi.kiota
  dependency-version: 1.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: FluentValidation
  dependency-version: 12.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.AspNetCore.Mvc.Testing
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.AspNetCore.OpenApi
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.ApiDescription.Server
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Kiota.Bundle
  dependency-version: 2.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: microsoft.openapi.kiota
  dependency-version: 1.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.AspNetCore.Mvc.Testing
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.AspNetCore.OpenApi
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Kiota.Bundle
  dependency-version: 2.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: xunit.v3
  dependency-version: 4.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.AspNetCore.Mvc.Testing
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.AspNetCore.OpenApi
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.ApiDescription.Server
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Kiota.Bundle
  dependency-version: 2.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: microsoft.openapi.kiota
  dependency-version: 1.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: FluentValidation
  dependency-version: 12.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: Microsoft.AspNetCore.Mvc.Testing
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.AspNetCore.OpenApi
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Extensions.ApiDescription.Server
  dependency-version: 10.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.Kiota.Bundle
  dependency-version: 2.1.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: Microsoft.NET.Test.Sdk
  dependency-version: 18.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: microsoft.openapi.kiota
  dependency-version: 1.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: WolverineFx.Http
  dependency-version: 6.64.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: WolverineFx.Http.FluentValidation
  dependency-version: 6.64.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: xunit.runner.visualstudio
  dependency-version: 4.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Nov 9, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Milestone

No milestone

0 participants