Bump WolverineFx and WolverineFx.FluentValidation - #115
Open
dependabot[bot] wants to merge 1 commit into
Open
Conversation
Bumps WolverineFx from 6.23.0 to 6.24.2 Bumps WolverineFx.FluentValidation from 6.23.0 to 6.24.2 --- updated-dependencies: - dependency-name: WolverineFx dependency-version: 6.24.2 dependency-type: direct:production update-type: version-update:semver-minor - dependency-name: WolverineFx.FluentValidation dependency-version: 6.24.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
This was referenced Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated WolverineFx from 6.23.0 to 6.24.2.
Release notes
Sourced from WolverineFx's releases.
6.24.2
What's Changed
Full Changelog: JasperFx/wolverine@V6.24.1...V6.24.2
6.24.1
Patch release. Four reported issues, all with reproductions from production clusters.
Fixes
#3701 —
wolverine_node_recordsgrows without bound (#3734)A reporting cluster reached 36,135,221 rows / 16 GB in five days on a diagnostic table nothing on the hot path reads. Three distinct defects:
INodeAgentPersistence.DeleteOldNodeRecordsAsyncwas implemented for every relational store and never invoked outside tests.NodeEventRecordExpirationTime, 5 days), which is no ceiling at all at high write rates — every one of those 36M rows was inside the window.CS0649suppression on it said so), so a full-table delete went out on every recovery cycle — every 5 seconds by default.New
Durability.NodeRecordRetention(default 10,000 rows) andDurability.NodeRecordPruningPeriod(default hourly).MultiTenantedMessageStorenow delegates the trim to the main store instead of inheriting a no-op default, and Sqlite, MySQL and Oracle gained implementations they had also been missing.#3697 — no supported force-catch-up under Wolverine-managed event subscription distribution (#3735)
Wolverine already implemented the coordinator-driven catch-up path, but only exposed it as a
TrackActivity()stage. Adds the standalone entry point onIHostandIServiceProvider, plus<T>ancillary-store variants:It never calls
IProjectionDaemon.CatchUpAsync— doing so under a live coordinator is what produces theProgressionProgressOutOfOrderExceptionandpk_mt_event_progressionduplicate-key errors suites have been retrying around. Resuming the agents that already own the shards means there is only ever one writer.#3733 — a comma in an agent Uri voided a whole batch confirmation (#3736)
AgentsStarted,StartAgents,AgentsStoppedandStopAgentsjoined theirUri[]on a comma, which RFC 3986 permits unescaped in a path segment. Agent URIs embed tenant ids and projection names, so one comma shattered an agent into fragments — and because the read side built the array in a single projection, the resulting throw took out the confirmation for the entire batch. Newline is the delimiter now, and entries are parsed individually so a bad one names itself.The comma remains the default on the wire for payloads that do not contain one, so rolling upgrades keep working in both directions.
#3706 — RabbitMQ acks were cumulative (#3737)
Every ack went out as
BasicAckAsync(tag, multiple: true), acknowledging every lower delivery tag on the channel. That is only correct when completions happen in delivery order, and they do not withConsumerDispatchConcurrency > 1— acking one message silently acknowledged deliveries whose handlers were still running, and a crash at that moment lost them.Acks are now per message. Two dead-letter paths that relied on the cumulative sweep settle themselves, most importantly the un-mappable-message branch in
WorkerQueueMessageConsumer, which dead-lettered and returned without touching the delivery at all. This unblocks the planned native-ack parallel endpoint mode.Also included
6.24.0
Two data-loss fixes — but for unusual usages
This release closes two bugs that silently destroyed data rather than failing loudly. Both are worth reading before you skip the rest of these notes.
Durable inbox rows were orphaned when a circuit breaker tripped (#3680).
DurableReceiverchecked its latched flag before callingMarkReceived. The latched path still persists each envelope to the inbox as a safety net — but on an envelope that never went throughMarkReceived,Statusis the enum default (Outgoing) andDestinationis null. Both are filter columns for inbox recovery, so the rows were written in a state no recovery sweep on any node could ever see. The nullListeneralso skipped the nack back to the broker, and the broker's redelivery after restart hitDuplicateIncomingEnvelopeException— which acks and drops. Net result: genuine message loss under a durable inbox any time a circuit breaker trip latched the receiver mid-flight. Measured on the circuit-breaker suite, 9 of 1,200 messages were lost per run.Dropping one tenant from a shared partition bucket destroyed its co-tenants' data (#3686). Found alongside #3683. Tenant bucketing — registering several small tenants against one partition suffix so they share a physical partition — is documented and exposed through
PartitionPerTenant(p => p.AllowPartitionSharing = true), and it did not work on either engine. It had no test coverage, because the doc sample demonstrating it is compile-only and never executed.Global partitioning
Part of the GlobalPartitioning epic (#3482).
Wolverine.ComplianceTests.Partitioning.ShardedProcessing, so a new transport costs one small test classThe new suites immediately found two real bugs:
EndpointMode.Durableon every slot, and aNatsEndpointonly supportsDurablewhen JetStream-backed — so everyUseShardedNatsSubjects()call threw at configuration time. The topology now enables JetStream on its own endpoints and declares a work-queue stream per shard, without which the listener died at startup onstream not foundglobal-persistent://public/default/orders1. They now use the topic's short name, matching every other transportMulti-tenancy and persistence
ITenantedentity — had no partition for any tenant registered before that table existed.IConjoinedTenantPartitions<T>.MigrateTenantPartitionsAsync()reconciles every partitioned table against the full registered tenant set, with per-tableTenantPartitionResultreportingTransports
NullReferenceExceptionFilterSubjectwas only assigned whenConsumerNamewas empty, so every durable consumer on a stream received every message. The fix needs aFilterSubjectsmulti-filter — a single filter cannot cover both{subject}and{subject}.scheduled, and a work-queue stream discards an uncovered control message"OAUTH2-JWT". Azure Event Grid's custom JWT authentication requiresCUSTOM-JWT, so those brokers could not be reached through Wolverine's authentication support at all. You could already set the method by hand throughMqttClientOptionsBuilder.WithAuthentication(), but that gave up Wolverine's token refresh loop — the whole reason to useMqttJwtAuthenticationOptions. You no longer have to chooseWolverineHttpTransportClientused the endpoint'sOutboundUripurely as anIHttpClientFactoryclient name, then posted to that client'sBaseAddress— so operator commands sent back over the HTTP transport failed withAn invalid request URI was providedPerformance
RabbitMQ consumer dispatch concurrency is now per-endpoint (#3492). The client default of 1 was the bottleneck. Simulated handler, 2,000 msg/s offered load, 30s measured window:
ConsumerDispatchConcurrencyThe 5.1x and 12.2x multiples understate it — at 1 and 5 the listener never catches up at all.
Amazon SQS batches message deletions and chunks outgoing batches on the 256KB request size limit (#3493)
Azure Service Bus session listeners are no longer quadratic — the n² session loops are now n.
MaxConcurrentCallsis surfaced, and a batched defer settles the original message (#3494)HTTP and gRPC
... (truncated)
6.23.1
Agent distribution
TL;DR: if you pause a projection from CritterWatch on 6.23.0, restarting it appears to do nothing for a full minute. This fixes that.
A paused projection or subscription agent now resumes immediately when you restart it (#3663). On 6.23.0 the restart was accepted, the pause restriction was cleared, and then nothing happened until the pending-assignment ledger's TTL expired — 2 ×
CheckAssignmentPeriod, so 60 seconds with the defaults. Long enough that an operator reasonably concludes the agent is never coming back.The ledger introduced in 6.23.0 (#3622) only counted an assignment as confirmed if a later evaluation saw the agent running and still assigned to the same node. A pause makes those two conditions mutually exclusive: the first evaluation that can observe the delivered assignment is the same one that detaches the agent. The entry was never confirmed, nothing on the stop path cleared it, and the restart's
AssignAgentwas suppressed as a duplicate still in flight. Delivery alone now confirms the entry, which is the only question the ledger was ever asking.Pausing an agent no longer briefly starts it first (#3666).
ApplyRestrictionsAsynckickstarted a health check before persisting the operator's restriction change, so that evaluation ran against the old restrictions and could act against the very intent being applied — for a pause, re-assigning and starting the agent one beat before the merged evaluation stopped it again. Besides the wasted daemon start/stop cycle, this is what armed the stale ledger entry behind #3663.PostgreSQL
Advisory-lock sessions stay invisible to Marten's async-daemon gap detection (#3664). Marten 9.16.1+ will not skip a stale event-sequence gap while any session whose open transaction predates that gap is still alive (marten#4953). A session parked in an open transaction for the life of the process therefore reads as a permanent "possible reserver" and can hold the high-water mark — and every async projection — behind a gap that is genuinely dead.
Wolverine's long-held locks were already shaped correctly: leader election and node coordination hold session-scoped advisory locks on a dedicated connection with no transaction, so they show up as
state='idle'with a NULLxact_start. Those sessions are now also taggedapplication_name = 'wolverine-advisory-lock:<database>', which turns apg_stat_activityinvestigation from guesswork into something you can read at a glance. The constraints are pinned in tests and in the Postgres durability docs, including the trap worth knowing in your own code: never add a keepalive query inside a long-lived open transaction — it bumpsstate_change, makes the session look active, and re-promotes it to candidate reserver.Note for combined Marten + Wolverine deployments: older guidance suggested Postgres's
idle_in_transaction_session_timeoutas a dead-gap backstop. Prefer upgrading Marten and usingSkipStaleGapsDespiteLiveTransactionsAfterinstead.Commits viewable in compare view.
Updated WolverineFx.FluentValidation from 6.23.0 to 6.24.2.
Release notes
Sourced from WolverineFx.FluentValidation's releases.
6.24.2
What's Changed
Full Changelog: JasperFx/wolverine@V6.24.1...V6.24.2
6.24.1
Patch release. Four reported issues, all with reproductions from production clusters.
Fixes
#3701 —
wolverine_node_recordsgrows without bound (#3734)A reporting cluster reached 36,135,221 rows / 16 GB in five days on a diagnostic table nothing on the hot path reads. Three distinct defects:
INodeAgentPersistence.DeleteOldNodeRecordsAsyncwas implemented for every relational store and never invoked outside tests.NodeEventRecordExpirationTime, 5 days), which is no ceiling at all at high write rates — every one of those 36M rows was inside the window.CS0649suppression on it said so), so a full-table delete went out on every recovery cycle — every 5 seconds by default.New
Durability.NodeRecordRetention(default 10,000 rows) andDurability.NodeRecordPruningPeriod(default hourly).MultiTenantedMessageStorenow delegates the trim to the main store instead of inheriting a no-op default, and Sqlite, MySQL and Oracle gained implementations they had also been missing.#3697 — no supported force-catch-up under Wolverine-managed event subscription distribution (#3735)
Wolverine already implemented the coordinator-driven catch-up path, but only exposed it as a
TrackActivity()stage. Adds the standalone entry point onIHostandIServiceProvider, plus<T>ancillary-store variants:It never calls
IProjectionDaemon.CatchUpAsync— doing so under a live coordinator is what produces theProgressionProgressOutOfOrderExceptionandpk_mt_event_progressionduplicate-key errors suites have been retrying around. Resuming the agents that already own the shards means there is only ever one writer.#3733 — a comma in an agent Uri voided a whole batch confirmation (#3736)
AgentsStarted,StartAgents,AgentsStoppedandStopAgentsjoined theirUri[]on a comma, which RFC 3986 permits unescaped in a path segment. Agent URIs embed tenant ids and projection names, so one comma shattered an agent into fragments — and because the read side built the array in a single projection, the resulting throw took out the confirmation for the entire batch. Newline is the delimiter now, and entries are parsed individually so a bad one names itself.The comma remains the default on the wire for payloads that do not contain one, so rolling upgrades keep working in both directions.
#3706 — RabbitMQ acks were cumulative (#3737)
Every ack went out as
BasicAckAsync(tag, multiple: true), acknowledging every lower delivery tag on the channel. That is only correct when completions happen in delivery order, and they do not withConsumerDispatchConcurrency > 1— acking one message silently acknowledged deliveries whose handlers were still running, and a crash at that moment lost them.Acks are now per message. Two dead-letter paths that relied on the cumulative sweep settle themselves, most importantly the un-mappable-message branch in
WorkerQueueMessageConsumer, which dead-lettered and returned without touching the delivery at all. This unblocks the planned native-ack parallel endpoint mode.Also included
6.24.0
Two data-loss fixes — but for unusual usages
This release closes two bugs that silently destroyed data rather than failing loudly. Both are worth reading before you skip the rest of these notes.
Durable inbox rows were orphaned when a circuit breaker tripped (#3680).
DurableReceiverchecked its latched flag before callingMarkReceived. The latched path still persists each envelope to the inbox as a safety net — but on an envelope that never went throughMarkReceived,Statusis the enum default (Outgoing) andDestinationis null. Both are filter columns for inbox recovery, so the rows were written in a state no recovery sweep on any node could ever see. The nullListeneralso skipped the nack back to the broker, and the broker's redelivery after restart hitDuplicateIncomingEnvelopeException— which acks and drops. Net result: genuine message loss under a durable inbox any time a circuit breaker trip latched the receiver mid-flight. Measured on the circuit-breaker suite, 9 of 1,200 messages were lost per run.Dropping one tenant from a shared partition bucket destroyed its co-tenants' data (#3686). Found alongside #3683. Tenant bucketing — registering several small tenants against one partition suffix so they share a physical partition — is documented and exposed through
PartitionPerTenant(p => p.AllowPartitionSharing = true), and it did not work on either engine. It had no test coverage, because the doc sample demonstrating it is compile-only and never executed.Global partitioning
Part of the GlobalPartitioning epic (#3482).
Wolverine.ComplianceTests.Partitioning.ShardedProcessing, so a new transport costs one small test classThe new suites immediately found two real bugs:
EndpointMode.Durableon every slot, and aNatsEndpointonly supportsDurablewhen JetStream-backed — so everyUseShardedNatsSubjects()call threw at configuration time. The topology now enables JetStream on its own endpoints and declares a work-queue stream per shard, without which the listener died at startup onstream not foundglobal-persistent://public/default/orders1. They now use the topic's short name, matching every other transportMulti-tenancy and persistence
ITenantedentity — had no partition for any tenant registered before that table existed.IConjoinedTenantPartitions<T>.MigrateTenantPartitionsAsync()reconciles every partitioned table against the full registered tenant set, with per-tableTenantPartitionResultreportingTransports
NullReferenceExceptionFilterSubjectwas only assigned whenConsumerNamewas empty, so every durable consumer on a stream received every message. The fix needs aFilterSubjectsmulti-filter — a single filter cannot cover both{subject}and{subject}.scheduled, and a work-queue stream discards an uncovered control message"OAUTH2-JWT". Azure Event Grid's custom JWT authentication requiresCUSTOM-JWT, so those brokers could not be reached through Wolverine's authentication support at all. You could already set the method by hand throughMqttClientOptionsBuilder.WithAuthentication(), but that gave up Wolverine's token refresh loop — the whole reason to useMqttJwtAuthenticationOptions. You no longer have to chooseWolverineHttpTransportClientused the endpoint'sOutboundUripurely as anIHttpClientFactoryclient name, then posted to that client'sBaseAddress— so operator commands sent back over the HTTP transport failed withAn invalid request URI was providedPerformance
RabbitMQ consumer dispatch concurrency is now per-endpoint (#3492). The client default of 1 was the bottleneck. Simulated handler, 2,000 msg/s offered load, 30s measured window:
ConsumerDispatchConcurrencyThe 5.1x and 12.2x multiples understate it — at 1 and 5 the listener never catches up at all.
Amazon SQS batches message deletions and chunks outgoing batches on the 256KB request size limit (#3493)
Azure Service Bus session listeners are no longer quadratic — the n² session loops are now n.
MaxConcurrentCallsis surfaced, and a batched defer settles the original message (#3494)HTTP and gRPC
... (truncated)
6.23.1
Agent distribution
TL;DR: if you pause a projection from CritterWatch on 6.23.0, restarting it appears to do nothing for a full minute. This fixes that.
A paused projection or subscription agent now resumes immediately when you restart it (#3663). On 6.23.0 the restart was accepted, the pause restriction was cleared, and then nothing happened until the pending-assignment ledger's TTL expired — 2 ×
CheckAssignmentPeriod, so 60 seconds with the defaults. Long enough that an operator reasonably concludes the agent is never coming back.The ledger introduced in 6.23.0 (#3622) only counted an assignment as confirmed if a later evaluation saw the agent running and still assigned to the same node. A pause makes those two conditions mutually exclusive: the first evaluation that can observe the delivered assignment is the same one that detaches the agent. The entry was never confirmed, nothing on the stop path cleared it, and the restart's
AssignAgentwas suppressed as a duplicate still in flight. Delivery alone now confirms the entry, which is the only question the ledger was ever asking.Pausing an agent no longer briefly starts it first (#3666).
ApplyRestrictionsAsynckickstarted a health check before persisting the operator's restriction change, so that evaluation ran against the old restrictions and could act against the very intent being applied — for a pause, re-assigning and starting the agent one beat before the merged evaluation stopped it again. Besides the wasted daemon start/stop cycle, this is what armed the stale ledger entry behind #3663.PostgreSQL
Advisory-lock sessions stay invisible to Marten's async-daemon gap detection (#3664). Marten 9.16.1+ will not skip a stale event-sequence gap while any session whose open transaction predates that gap is still alive (marten#4953). A session parked in an open transaction for the life of the process therefore reads as a permanent "possible reserver" and can hold the high-water mark — and every async projection — behind a gap that is genuinely dead.
Wolverine's long-held locks were already shaped correctly: leader election and node coordination hold session-scoped advisory locks on a dedicated connection with no transaction, so they show up as
state='idle'with a NULLxact_start. Those sessions are now also taggedapplication_name = 'wolverine-advisory-lock:<database>', which turns apg_stat_activityinvestigation from guesswork into something you can read at a glance. The constraints are pinned in tests and in the Postgres durability docs, including the trap worth knowing in your own code: never add a keepalive query inside a long-lived open transaction — it bumpsstate_change, makes the session look active, and re-promotes it to candidate reserver.Note for combined Marten + Wolverine deployments: older guidance suggested Postgres's
idle_in_transaction_session_timeoutas a dead-gap backstop. Prefer upgrading Marten and usingSkipStaleGapsDespiteLiveTransactionsAfterinstead.Commits viewable in compare view.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)