Skip to content

Bump Marten to 8.37.0 to address GHSA-vmw2-qwm8-x84c - #9777

Merged
glen-84 merged 3 commits into
mainfrom
gai/bump-marten-vulnerability-fix
May 26, 2026
Merged

glen-84 merged 3 commits into
mainfrom
gai/bump-marten-vulnerability-fix

Conversation

@glen-84

@glen-84 glen-84 commented May 26, 2026

Copy link
Copy Markdown
Member

Summary

  • Bumps Marten from 8.0.0 to 8.37.0 in HotChocolate.Data.Marten to address GHSA-vmw2-qwm8-x84c (NU1904).
  • Updates the two NullableBooleanNotEqual_Expression snapshots to reflect Marten 8.10.1's revised != SQL on nullable booleans (JasperFx/marten#3953): the WHERE clause now includes an IS NULL OR ... branch, so neq results include rows where the column is NULL.
  • Documents the user-visible filter behavior change in the v15→v16 migration guide, flagged as landing in 16.0.10.

Test plan

  • dotnet restore src/All.slnx (no NU1904 reported for Marten).
  • dotnet build src/HotChocolate/Marten (0 warnings / 0 errors across net8.0/net9.0/net10.0).
  • dotnet test src/HotChocolate/Marten: 82/82 filters + 24/24 sorting passing on net8.0/net9.0/net10.0 with the updated snapshots.

Copilot AI review requested due to automatic review settings May 26, 2026 10:38
@github-actions github-actions Bot added 📚 documentation This issue is about working on our documentation. 🌶️ hot chocolate labels May 26, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request updates the HotChocolate.Data.Marten integration to use Marten 8.37.0 in order to remediate advisory GHSA-vmw2-qwm8-x84c, and aligns tests/docs with the resulting user-visible behavior change for neq filtering on nullable booleans.

Changes:

  • Bump Marten from 8.0.0 to 8.37.0 via central package management.
  • Update nullable-boolean neq filter snapshots to reflect Marten’s updated SQL semantics (nulls now match).
  • Document the behavior change in the v15→v16 migration guide (noted as landing in 16.0.10).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File Description
website/src/docs/hotchocolate/v16/migrating/migrate-from-15-to-16.md Adds migration note describing the nullable-boolean neq behavior change and its cause.
src/HotChocolate/Marten/test/Data.Marten.Filters.Tests/snapshots/QueryableFilterVisitorExecutableTests.Create_NullableBooleanNotEqual_Expression.snap Updates expected results for executable-based nullable boolean neq filtering to include null rows.
src/HotChocolate/Marten/test/Data.Marten.Filters.Tests/snapshots/QueryableFilterVisitorBooleanTests.Create_NullableBooleanNotEqual_Expression.snap Updates expected results and SQL snapshot for nullable boolean neq filtering under Marten 8.37.0.
src/Directory.Packages.props Central package version bump for Marten to 8.37.0.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@glen-84
glen-84 merged commit 8070bdc into main May 26, 2026
144 checks passed
@glen-84
glen-84 deleted the gai/bump-marten-vulnerability-fix branch May 26, 2026 13:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

📚 documentation This issue is about working on our documentation. 🌶️ hot chocolate

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants