Skip to content

Wolverine 6.50.1

Choose a tag to compare

View all tags
@jeremydmiller jeremydmiller released this 14 Oct 15:23
V6.50.1
01eee07

Patch release with a memory-leak fix and two security dependency updates.

Fixes

  • WolverineRuntime now disposes its Meter (#5012, #5013). The runtime's System.Diagnostics.Metrics.Meter used to stay in the process-wide static Meter registry after the host was disposed. The durable persistence gauges on it hold callbacks back into the runtime, so every disposed host stayed reachable for the life of the process. Test suites that build many WebApplicationFactory or Host instances with durable persistence saw the heap grow without bound. Thanks to @AndriiKononenko3 for the detailed report and the retention path.

Security dependency updates

  • CVE-2026-84008 / GHSA-846f-f764-76mx (System.Security.Cryptography.Pkcs, high-severity denial of service). The package arrived transitively at vulnerable versions through Microsoft.Data.SqlClient, Oracle.ManagedDataAccess.Core and Polecat. WolverineFx.SqlServer, WolverineFx.Oracle and WolverineFx.ClaimCheck.SqlServer now reference the patched version directly: 9.0.21 on net9.0 and 10.0.13 on net10.0. Every package built on them, including WolverineFx.Polecat and WolverineFx.Http.Polecat, picks up the fix.
  • CVE-2026-70159 / GHSA-334f-vvp4-7g6p (Microsoft.AspNetCore.SignalR.Common, high-severity denial of service). WolverineFx.SignalR now depends on Microsoft.AspNetCore.SignalR.Client 9.0.21 on net9.0 and 10.0.13 on net10.0, up from 9.0.8.

Contributors

AndriiKononenko3
Assets 2
Loading