Bump WolverineFx from 6.49.0 to 6.51.1

[dependabot]

Updated WolverineFx from 6.49.0 to 6.51.1.

Release notes

Sourced from WolverineFx's releases.

6.51.1

Bug fix release, and some doc updates too

What's Changed

• GH-5070 A new leader keeps its own persisted leader row after a crash takeover by @​jeremydmiller in GH-5070 A new leader keeps its own persisted leader row after a crash takeover JasperFx/wolverine#5071
• Leadership-election compliance on Bobcat, with agent-assignment telemetry on failure by @​jeremydmiller in Leadership-election compliance on Bobcat, with agent-assignment telemetry on failure JasperFx/wolverine#5074
• Bobcat 1.0.0-rc.1 by @​jeremydmiller in Bobcat 1.0.0-rc.1 JasperFx/wolverine#5079
• GH-5080 CloudEvents carries lower case Envelope.Headers as extension attributes by @​jeremydmiller in GH-5080 CloudEvents carries lower case Envelope.Headers as extension attributes JasperFx/wolverine#5084
• GH-5085 Serverless docs: reword the 15 DRAFT comments into the page by @​jeremydmiller in GH-5085 Serverless docs: reword the 15 DRAFT comments into the page JasperFx/wolverine#5086
• GH-5073 Atomic, deadlock-free inbox recovery claims on every store (supersedes #​5075) by @​jeremydmiller in GH-5073 Atomic, deadlock-free inbox recovery claims on every store (supersedes #5075) JasperFx/wolverine#5081

Full Changelog: JasperFx/wolverine@V6.51.0...v6.51.1

6.51.0

Everything since 6.50.1.

Highlights

• Warm-up nodes for blue/green deployments (#​4569, #​5024). Set opts.Durability.NodeRole = NodeRole.Warmup and a node joins the serving cluster but does none of the serving nodes' messaging. Its only job is to run the new release's projection shards in Rebuild mode, so the new projection versions are caught up before you cut over. The role is opt-in; the default is NodeRole.Serving, and no schema change is needed. Docs: Marten · Polecat
• DurabilityMode.ServerlessWithOutbox (#​5016, #​5044). The lean Serverless runtime, but with the transactional outbox kept:
  • Outgoing messages are persisted with the handler's transaction.
  • They are sent inline before the request completes.
  • Anything that couldn't be sent is recovered by a durability pass.
  • Follow-ups are in #​5058 (#​5046–#​5057), #​5060 (#​5059) and #​5065 (#​5038).
  • Docs: Serverless with the Transactional Outbox
• Wolverine.HTTP JSON options (#​5042, #​5064). HTTP handlers mapped directly now use ASP.NET Core's JsonOptions without needing MapWolverineEndpoints(). Two new properties, HttpChain.JsonSerializerOptions and HttpHandler.JsonSerializerOptions, give a single endpoint its own JSON options.
• Failure log level (#​5043, #​5064). Set it with chain.FailureLogLevel, opts.Policies.MessageFailureLogLevel(...) or [WolverineLogging(FailureLogLevel = ...)]. The default is still Error.

Durability fixes

• Durable database queue pops (#​5015, #​5020 by @​jcd1991, #​5021). A failed or lost pop no longer strands envelopes on a live node, on PostgreSQL, SQL Server, MySQL and Oracle. Thanks to @​dbelinsky-accureference for the report.
• InboxStaleTime (#​5022, #​5025, #​5039):
  • Its clock now measures the time since a node claimed the message, not since the message was first written.
  • It leaves scheduled rows alone.
  • A node keeps the clock running for the messages it still holds, so a long handler is no longer started a second time.
• Projection daemon self-healing (#​4986 by @​erdtsieck). A shard the daemon paused on a transient failure, such as connection pool exhaustion, is restarted with a capped backoff instead of staying paused until the pods restart.
• Serverless startup with RavenDB (#​5030, #​5041 by @​jcd1991). Plain Serverless mode no longer fails at startup with RavenDB persistence.
• Messages replayed on every restart (#​5040, #​5045, #​5062). A handled message is now marked handled in the store that holds its inbox row. This affected two setups:
  • a durable PostgreSQL queue with a DbContext enrolled in an ancillary store
  • Fisher or Polecat with an AddMessageHandler handler committing an ancillary session
• PostgreSQL transport schema (#​5062). The transport takes its storage schema from the store it is bound to, not from the last PostgreSQL store registered.
• More #​5038 follow-ups (#​5065):
  • Outside ServerlessWithOutbox, a failed inline send is retried by the destination's sending agent.
  • RavenDB and Cosmos DB take one durability pass lock per database or container.
  • EF Core and RavenDB write the same outgoing owner id as the other stores.
  • Plain Serverless warns about durable endpoints downgraded after startup.

Dependencies

• 6.50.2 (#​5018): Weasel 9.45.1, Polecat 5.40.2 and Marten 9.50.2, for the System.Security.Cryptography.Pkcs advisory GHSA-846f-f764-76mx.
• 6.51.0 (#​5063): JasperFx 2.90.1, Marten 9.50.3, Polecat 5.42.0 and Fisher 1.21.1.

6.50.2

A dependency patch release. No configuration or code changes needed.

Dependencies

This moves Wolverine onto the Critter Stack releases that fix CVE-2026-84008 / GHSA-846f-f764-76mx (System.Security.Cryptography.Pkcs, high-severity denial of service) (#​5018):

• Weasel 9.45.1: Weasel.SqlServer and Weasel.Oracle now reference the patched Pkcs directly.
• Polecat 5.40.2 (up from 5.38.0): Polecat now references the patched Pkcs directly. This also brings in Polecat 5.39 and 5.40.
• Marten 9.50.2 (up from 9.49.0) for Marten, Marten.AspNetCore and Marten.Newtonsoft. Marten was never affected by the advisory.

Wolverine 6.50.1 already pinned the patched Pkcs in WolverineFx.SqlServer, WolverineFx.Oracle and WolverineFx.ClaimCheck.SqlServer, so applications on 6.50.1 were already protected. Those pins stay, because Wolverine references Microsoft.Data.SqlClient and Oracle.ManagedDataAccess.Core directly. 6.50.2 means the upstream libraries carry the fix too, so a NuGet audit comes back clean whichever of them your application references directly.

6.50.1

Patch release with a memory-leak fix and two security dependency updates.

Fixes

• WolverineRuntime now disposes its Meter (#​5012, #​5013). The runtime's System.Diagnostics.Metrics.Meter used to stay in the process-wide static Meter registry after the host was disposed. The durable persistence gauges on it hold callbacks back into the runtime, so every disposed host stayed reachable for the life of the process. Test suites that build many WebApplicationFactory or Host instances with durable persistence saw the heap grow without bound. Thanks to @​AndriiKononenko3 for the detailed report and the retention path.

Security dependency updates

• CVE-2026-84008 / GHSA-846f-f764-76mx (System.Security.Cryptography.Pkcs, high-severity denial of service). The package arrived transitively at vulnerable versions through Microsoft.Data.SqlClient, Oracle.ManagedDataAccess.Core and Polecat. WolverineFx.SqlServer, WolverineFx.Oracle and WolverineFx.ClaimCheck.SqlServer now reference the patched version directly: 9.0.21 on net9.0 and 10.0.13 on net10.0. Every package built on them, including WolverineFx.Polecat and WolverineFx.Http.Polecat, picks up the fix.
• CVE-2026-70159 / GHSA-334f-vvp4-7g6p (Microsoft.AspNetCore.SignalR.Common, high-severity denial of service). WolverineFx.SignalR now depends on Microsoft.AspNetCore.SignalR.Client 9.0.21 on net9.0 and 10.0.13 on net10.0, up from 9.0.8.

6.50.0

Wolverine 6.50.0 is a feature release. The headline is a new way to send a message to every node in your cluster. Just as much of this release came from the community, though: five community pull requests landed, and several issue reports led straight to fixes.

The two Bobcat packages, WolverineFx.Bobcat and WolverineFx.Bobcat.Http, ship as 6.50.0-alpha.1 and are still pre-release.

Broadcast a message to every node in the cluster

• BroadcastToAllNodesAsync() (#​4993, closes #​4988). Wolverine's normal delivery is competing consumers, where exactly one node handles a message. Sometimes you want every node to hear about something instead: a cache to invalidate, a configuration change to pick up, some node-local state to reset. Now you can just do this:

  await bus.BroadcastToAllNodesAsync(new InvalidateCache("products"));

  Every running node, including the one that sent it, handles the message exactly once with its own handler. The sending node gets the message on the local routes its type already has, or on local://default, and it's never forwarded to the external routes PublishAsync() would use. Every other node gets a copy on its node control endpoint, which is the broker control queue if you've configured one and the database control queue otherwise. Nodes that have gone stale are skipped, using the same rule the leader applies before ejecting a node. A broadcast from inside a handler goes through the outbox like any other outgoing message, and correlation ids are stamped as usual. In Solo and Serverless durability modes the message is delivered to this node only, and MediatorOnly refuses it just like PublishAsync(). It's an extension method on IMessageBus, so no other IMessageBus implementation breaks, and TestMessageContext records broadcasts in a new BroadcastToAllNodes list for your unit tests. See the new Broadcast Messages to Every Node guide.

From the community

A big thank you to everyone who sent pull requests and reports for this release:

• @​jcd1991 contributed two PostgreSQL transport features:

  • Opt-in LISTEN/NOTIFY wakeups for PostgreSQL queues (#​4998, closes #​3480). With EnableQueueNotifications(), an idle queue listener is woken as soon as a message is written instead of waiting out its polling interval. In local benchmarks the median delivery time on an idle queue dropped from about 650ms to under 3ms. It's off by default because it holds one extra, long-lived database connection per database per running process. Read the trade-offs in the new Queue Notifications with LISTEN/NOTIFY section before you turn it on.
  • FIFO ordering for sharded PostgreSQL queue batches (#​4970, closes #​4862, reported by @​alexandrefresnais). Messages for one group id that went through a PostgreSQL shard queue could run out of order. EnableDeterministicQueueOrdering() now preserves their order, and it was followed up for SQL Server, MySQL, Oracle and SQLite in #​4987.

• @​jcd1991 also fixed Wolverine.HTTP treating a container-registered service as the JSON request body on POST and PUT endpoints (#​5010, closes #​3863, reported by @​erdtsieck). The same parameter on a GET endpoint was correctly injected, but on a POST or PUT every call failed with a 500. An explicitly registered, non-keyed concrete type is now resolved from the container on every endpoint. This is a behavior change: if you register a type in the container and post it as a request body without [FromBody], add [FromBody] to keep binding it from the request.

• @​erdtsieck found and fixed a ping-pong in agent assignment during blue/green warm-ups (#​5000, closes #​4999). Projection partitions that could only run on the previous version's nodes moved between those nodes on every evaluation, which showed up in production as 1,000 to 3,000 ReassignAgent commands a minute. A partition that fits nowhere now stays where it is unless another node is strictly lighter. The follow-up in #​5001 makes it settle in one move.

• @​PascalEschbach contributed a big round of NATS follow-ups (#​4976, closes #​4973), with tests for every change:

  • one schedule subject per message, with listeners that skip schedule control messages;
  • resources setup provisioning declared streams once per connection;
  • per-tenant connection configuration, tenant subject mappers, and a new TrustTenantIdHeader setting;
  • safer dead letter forwarding that only terminates the original after a confirmed forward;
  • a deadline on every JetStream publish;
  • named consumers for dotted subjects;
  • NATS logging through the host's ILoggerFactory;
  • a health check that reports a failed listener start.

  #​4985 followed up on the core side.

• @​Maflend reported that the static handler registry ignored custom discovery rules once conventional discovery was disabled (#​4984), a regression since 6.44.0. It's fixed in #​4992.

• @​uniquelau's report in marten#​5652 led to #​5011, below: the leader no longer builds every event store's full usage descriptor on every heartbeat.

Agents and event subscriptions

• The leader's heartbeat no longer builds the full event store descriptor (#​5011, closes #​5002). Assigning event subscription agents only needs each store's async shard names and its database topology. Wolverine now reads those through JasperFx 2.87.1's IEventStore.RegisteredShardNames() and the new IEventStore.TryDescribeDatabasesAsync(), instead of a full TryCreateUsage() that also read the highest event sequence and described every projection, subscription and event type, for every store, every 10 seconds. To get the full saving, also take Marten 9.50.1, Polecat 5.40.1 or Fisher 1.20.2, which answer TryDescribeDatabasesAsync() straight from their tenancy.
• A projection rebuild always hands its shard back to continuous execution (#​5008, closes #​5003). A rebuild that threw used to leave the shard stopped, for good if it had already paused on a transient failure. The registered-projection rebuild path that CritterWatch uses never resumed the shard at all. Both paths now resume it whether the rebuild succeeded or failed. The health-check sweep also leaves a shard alone while its projection is being rebuilt, using JasperFx's new IProjectionDaemon.IsRebuilding(), so it can no longer start a second copy of the shard on top of a running rebuild.

Transports and persistence

• SQL Server queue tables can switch between the default layout and OptimizeQueueThroughput() (#​4991, closes #​4989).
• EnableDeterministicQueueOrdering() for SQL Server, MySQL, Oracle and SQLite (#​4987).

HTTP

• Wolverine.Http binds single-Value strong-typed id wrappers, such as record struct OrderId(Guid Value), without a TryParse (#​4995, closes #​4978).
  ... (truncated)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: NosCoreIO/NosCore/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6f24b1e4-4ce0-45e7-9808-740e8ba348e9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Superseded by #2516.