[dependabot]

Updated Marten from 9.55.0 to 9.57.0.

Release notes

Sourced from Marten's releases.

9.57.0

Highlights

• Compaction no longer deletes the history of a stream that folds to null. A stream deleted by its own aggregate, through ShouldDelete or DeleteEvent<T>, used to lose its whole history to an empty snapshot. Compaction now leaves it alone and logs an information line. (#​5797)
• Event data masking now reaches archived and skipped events. IncludeStream and IncludeEvents used to leave those rows in plain text and report success. (#​5797)
• opts.Events.AutoDiscoverTagTypes turns off automatic DCB tag type registration, for stores that use strong-typed identifiers but not DCB. It's on by default, and explicit RegisterTagType<T>() calls work either way. Thanks to @​gschuager for the report and the design. (#​5806)
• EventStoreUsage reports the event store's TenancyStyle, so a console can tell conjoined events from conjoined documents. (#​5805)
• JasperFx 2.98.0 and Weasel 9.48.0.

Action needed after upgrading

If you rely on masking for archived or skipped events: run the same ApplyEventDataMasking call again. Data that was archived or skipped when you last ran it is still in plain text until you do.

That call runs your rules again over everything the first pass reached. If a rule isn't safe to run twice, such as one that draws a new pseudonym, add x.IsArchived to an IncludeEvents filter that still names the same subject:

x.IncludeEvents(e => e.StreamId == streamId && e.IsArchived)

Never use x.IsArchived as the whole filter, because that masks every archived event in the store.

If you compact streams: the deleted events can't be rebuilt from Marten. To find affected streams, replace <schema> and run this, then restore those streams from a backup or from wherever an archiver copied them:

select stream_id, version, tenant_id
from <schema>.mt_events
where mt_dotnet_type like 'JasperFx.Events.Compacted%'
  and 'null'::jsonb in (data->'Snapshot', data->'snapshot');

An archiver closed over IDocumentSession was never called for past compactions, so that copy won't exist.

Behaviour changes

• IncludeEvents now includes archived events. A masking filter that needs only live events should add !x.IsArchived.
• An events archiver closed over anything other than IDocumentOperations or IDocumentSession now throws InvalidOperationException before anything is queued. It used to be skipped silently, with the events deleted anyway. An archiver closed over IDocumentSession is now called.
• Weasel 9.48.0: ToParameterType now throws for an unmapped type where it used to return a character catch-all. An enum resolves through its underlying type, so a long-backed enum gives Bigint. Marten's own call sites are not affected.

What's Changed

• JasperFx 2.98.0 by @​jeremydmiller in JasperFx 2.98.0 JasperFx/marten#5801
• Bump fast-uri by @​dependabot[bot] in Bump fast-uri JasperFx/marten#5796
• Keep a stream that folds to null, and mask archived and skipped events by @​jeremydmiller in Keep a stream that folds to null, and mask archived and skipped events JasperFx/marten#5797
• Weasel 9.48.0 by @​jeremydmiller in Weasel 9.48.0 JasperFx/marten#5802
• Add opts.Events.AutoDiscoverTagTypes to turn off DCB tag type discovery by @​jeremydmiller in Add opts.Events.AutoDiscoverTagTypes to turn off DCB tag type discovery JasperFx/marten#5806
• Report the event store's TenancyStyle on EventStoreUsage by @​jeremydmiller in Report the event store's TenancyStyle on EventStoreUsage JasperFx/marten#5805
• Bump follow-redirects from 1.16.1 to 1.16.2 by @​dependabot[bot] in Bump follow-redirects from 1.16.1 to 1.16.2 JasperFx/marten#5804
• Bump node-forge from 1.4.0 to 1.4.2 by @​dependabot[bot] in Bump node-forge from 1.4.0 to 1.4.2 JasperFx/marten#5803
• Bump version to 9.57.0 by @​jeremydmiller in Bump version to 9.57.0 JasperFx/marten#5807

Full Changelog: JasperFx/marten@v9.56.0...V9.57.0
... (truncated)

9.56.0

What's Changed

• JasperFx 2.97.0 by @​jeremydmiller in JasperFx 2.97.0 JasperFx/marten#5793
• Implement IReadOnlyEventStore.QueryRawEvents (IQueryable) by @​jeremydmiller in Implement IReadOnlyEventStore.QueryRawEvents (IQueryable<IEvent>) JasperFx/marten#5794
• Bump version to 9.56.0 by @​jeremydmiller in Bump version to 9.56.0 JasperFx/marten#5795

Full Changelog: JasperFx/marten@V9.55.0...v9.56.0

Commits viewable in compare view.

Updated ModelContextProtocol from 2.3.0 to 2.3.1.

Release notes

Sourced from ModelContextProtocol's releases.

2.3.1

This patch release includes a security fix for authenticated stateful sessions.

What's Changed

• Harden authenticated stateful MCP sessions (commit bfbd893) by @​halter73 (co-authored by @​Copilot @​jeffhandley @​tarekgh)

Repository Infrastructure Updates

• Align docs publishing with shared orchestration #​1981 by @​jeffhandley (co-authored by @​Copilot)
• Fix Markdown link-check warnings and outdated Skills specification link #​1979 by @​jeffhandley (co-authored by @​Copilot)

Full Changelog: modelcontextprotocol/csharp-sdk@v2.3.0...v2.3.1

[!NOTE]
These release notes were drafted with GitHub Copilot.

Commits viewable in compare view.

Updated ModelContextProtocol.AspNetCore from 2.3.0 to 2.3.1.

Updated Supabase.Gotrue from 8.6.0 to 8.8.0.

Release notes

Sourced from Supabase.Gotrue's releases.

8.8.0

8.8.0 (2026-11-02)

Features

• auth: generate the signed-in user's MFA recovery codes (#​626) (0772b24)
• auth: verify an MFA recovery code to reach aal2 (#​627) (d01c630)

Bug Fixes

• realtime: keep presence when one of several connections leaves (#​620) (5002b2e)
• supabase: don't propagate the Authorization header on the Realtime client (#​622) (f9bf4a3)

8.7.0

8.7.0 (2026-10-30)

Features

• auth: fetch a custom OAuth/OIDC provider as an admin (#​591) (f5cd18a)
• auth: list custom OAuth/OIDC providers as an admin (#​599) (2a9534d)
• auth: list the identities linked to the signed-in user (#​606) (eba25d5)
• auth: read how many MFA recovery codes the signed-in user has left (#​610) (ab86bc3)
• auth: register a custom OAuth/OIDC provider as an admin (#​590) (4c11610)
• auth: remove the signed-in user's MFA recovery codes (#​611) (d4ea5eb)
• auth: sign a user out from their access token as an admin (#​594) (540e40f)
• auth: update a custom OAuth/OIDC provider as an admin (#​600) (16a3d2a)
• auth: update a user's MFA factor as an admin (#​609) (37bfcf9)

Bug Fixes

• quality-gate: stop baselines from loosening (#​615) (d333a89)

Commits viewable in compare view.

Updated Supabase.Storage from 8.6.0 to 8.8.0.

Release notes

Sourced from Supabase.Storage's releases.

8.8.0

8.8.0 (2026-11-02)

Features

• auth: generate the signed-in user's MFA recovery codes (#​626) (0772b24)
• auth: verify an MFA recovery code to reach aal2 (#​627) (d01c630)

Bug Fixes

• realtime: keep presence when one of several connections leaves (#​620) (5002b2e)
• supabase: don't propagate the Authorization header on the Realtime client (#​622) (f9bf4a3)

8.7.0

8.7.0 (2026-10-30)

Features

• auth: fetch a custom OAuth/OIDC provider as an admin (#​591) (f5cd18a)
• auth: list custom OAuth/OIDC providers as an admin (#​599) (2a9534d)
• auth: list the identities linked to the signed-in user (#​606) (eba25d5)
• auth: read how many MFA recovery codes the signed-in user has left (#​610) (ab86bc3)
• auth: register a custom OAuth/OIDC provider as an admin (#​590) (4c11610)
• auth: remove the signed-in user's MFA recovery codes (#​611) (d4ea5eb)
• auth: sign a user out from their access token as an admin (#​594) (540e40f)
• auth: update a custom OAuth/OIDC provider as an admin (#​600) (16a3d2a)
• auth: update a user's MFA factor as an admin (#​609) (37bfcf9)

Bug Fixes

• quality-gate: stop baselines from loosening (#​615) (d333a89)

Commits viewable in compare view.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions