Wolverine 6.51.0

Everything since 6.50.1.

Highlights

• Warm-up nodes for blue/green deployments (#4569, #5024). Set opts.Durability.NodeRole = NodeRole.Warmup and a node joins the serving cluster but does none of the serving nodes' messaging. Its only job is to run the new release's projection shards in Rebuild mode, so the new projection versions are caught up before you cut over. The role is opt-in; the default is NodeRole.Serving, and no schema change is needed. Docs: Marten · Polecat
• DurabilityMode.ServerlessWithOutbox (#5016, #5044). The lean Serverless runtime, but with the transactional outbox kept:
  • Outgoing messages are persisted with the handler's transaction.
  • They are sent inline before the request completes.
  • Anything that couldn't be sent is recovered by a durability pass.
  • Follow-ups are in #5058 (#5046–#5057), #5060 (#5059) and #5065 (#5038).
  • Docs: Serverless with the Transactional Outbox
• Wolverine.HTTP JSON options (#5042, #5064). HTTP handlers mapped directly now use ASP.NET Core's JsonOptions without needing MapWolverineEndpoints(). Two new properties, HttpChain.JsonSerializerOptions and HttpHandler.JsonSerializerOptions, give a single endpoint its own JSON options.
• Failure log level (#5043, #5064). Set it with chain.FailureLogLevel, opts.Policies.MessageFailureLogLevel(...) or [WolverineLogging(FailureLogLevel = ...)]. The default is still Error.

Durability fixes

• Durable database queue pops (#5015, #5020 by @jcd1991, #5021). A failed or lost pop no longer strands envelopes on a live node, on PostgreSQL, SQL Server, MySQL and Oracle. Thanks to @dbelinsky-accureference for the report.
• InboxStaleTime (#5022, #5025, #5039):
  • Its clock now measures the time since a node claimed the message, not since the message was first written.
  • It leaves scheduled rows alone.
  • A node keeps the clock running for the messages it still holds, so a long handler is no longer started a second time.
• Projection daemon self-healing (#4986 by @erdtsieck). A shard the daemon paused on a transient failure, such as connection pool exhaustion, is restarted with a capped backoff instead of staying paused until the pods restart.
• Serverless startup with RavenDB (#5030, #5041 by @jcd1991). Plain Serverless mode no longer fails at startup with RavenDB persistence.
• Messages replayed on every restart (#5040, #5045, #5062). A handled message is now marked handled in the store that holds its inbox row. This affected two setups:
  • a durable PostgreSQL queue with a DbContext enrolled in an ancillary store
  • Fisher or Polecat with an AddMessageHandler handler committing an ancillary session
• PostgreSQL transport schema (#5062). The transport takes its storage schema from the store it is bound to, not from the last PostgreSQL store registered.
• More #5038 follow-ups (#5065):
  • Outside ServerlessWithOutbox, a failed inline send is retried by the destination's sending agent.
  • RavenDB and Cosmos DB take one durability pass lock per database or container.
  • EF Core and RavenDB write the same outgoing owner id as the other stores.
  • Plain Serverless warns about durable endpoints downgraded after startup.

Dependencies

• 6.50.2 (#5018): Weasel 9.45.1, Polecat 5.40.2 and Marten 9.50.2, for the System.Security.Cryptography.Pkcs advisory GHSA-846f-f764-76mx.
• 6.51.0 (#5063): JasperFx 2.90.1, Marten 9.50.3, Polecat 5.42.0 and Fisher 1.21.1.