--- title: Release digest for week of 2026-07-06 to 2026-07-13 --- ## Added - **AuthProxy** ([Release v2.5.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.5.0)): The client-credentials verification endpoint's `2xx` response may now include a `tenant` JSON property. AuthProxy embeds it in the issued token as a `cratis/tenant` claim, which the existing `Claim` tenant-resolution strategy can resolve into the `Tenant-ID` header on proxied requests. - **AuthProxy** ([Release v2.5.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.5.0)): `POST /.cratis/token` now also accepts `grant_type=refresh_token`, exchanging a refresh token for a new access/refresh token pair without recontacting the verification endpoint. Every successful `client_credentials` grant now returns a `refresh_token` alongside the access token. - **Specifications** ([Release v4.0.0](https://github.com/Cratis/Specifications/releases/tag/v4.0.0)): Seven Roslyn analyzers (CRSPEC0001–CRSPEC0007), bundled with `Cratis.Specifications`, `Cratis.Specifications.XUnit` and `Cratis.Specifications.NUnit`, that warn when: - **Specifications** ([Release v4.0.0](https://github.com/Cratis/Specifications/releases/tag/v4.0.0)): a test method inside a specification is not named `should_*` (CRSPEC0001); - **Specifications** ([Release v4.0.0](https://github.com/Cratis/Specifications/releases/tag/v4.0.0)): a file declares more than one specification (CRSPEC0002); - **Specifications** ([Release v4.0.0](https://github.com/Cratis/Specifications/releases/tag/v4.0.0)): a `[Fact]`/`[Test]` is placed on a `given` context, where it never runs (CRSPEC0003); - **Specifications** ([Release v4.0.0](https://github.com/Cratis/Specifications/releases/tag/v4.0.0)): a `should_*` method is missing its test attribute, so it never runs (CRSPEC0004); - **Specifications** ([Release v4.0.0](https://github.com/Cratis/Specifications/releases/tag/v4.0.0)): a specification calls a base lifecycle method (`base.Establish()`/`Because()`/`Destroy()`) explicitly, running it twice (CRSPEC0005); - **Specifications** ([Release v4.0.0](https://github.com/Cratis/Specifications/releases/tag/v4.0.0)): a specification that declares test methods is not `public`, so the runner skips it (CRSPEC0006); - **Specifications** ([Release v4.0.0](https://github.com/Cratis/Specifications/releases/tag/v4.0.0)): the action under test (`Because`) is declared on a reusable `given` context (CRSPEC0007). - **Specifications** ([Release v4.0.0](https://github.com/Cratis/Specifications/releases/tag/v4.0.0)): Both xUnit (`[Fact]`/`[Theory]`) and NUnit (`[Test]`/`[TestCase]`) test attributes are recognized. - **Chronicle** ([Release v15.41.0](https://github.com/Cratis/Chronicle/releases/tag/v15.41.0)): `CHR0034` — error when `[PII]` is applied to a property or record parameter whose type derives from `EventSourceId`. The event source id is the encryption-key lookup identity, so Chronicle throws `PIINotSupportedOnEventSourceId` at runtime; the analyzer turns that into a compile-time error. - **Chronicle** ([Release v15.41.0](https://github.com/Cratis/Chronicle/releases/tag/v15.41.0)): `CHR0035` — error when a `[ReadModel]` declares a property or record parameter named `_subject`, which Chronicle reserves as an internal MongoDB field for compliance-subject tracking. - **Chronicle** ([Release v15.41.0](https://github.com/Cratis/Chronicle/releases/tag/v15.41.0)): `CHR0036` — warning when a reducer declares mutable instance state or injects a storage primitive such as `IMongoCollection`. Reducers must be stateless for deterministic replay; this mirrors `CHR0031`/`CHR0032` for reactors. (#958) - **Chronicle** ([Release v15.41.0](https://github.com/Cratis/Chronicle/releases/tag/v15.41.0)): `CHR0037` — warning when the two generations referenced by an `EventTypeMigration` do not share one explicit `[EventType]` id. Chronicle keys generations by that id, so absent or differing ids mean the migration silently never applies. - **Arc** ([Release v20.54.0](https://github.com/Cratis/Arc/releases/tag/v20.54.0)): New analyzer `ARCCHR0007` warns when a `[Command]` injects `IEventLog` into its `Handle`/`Provide` method. Express appends through the handler return type instead — injecting `IEventLog` bypasses Arc's append pipeline and its correlation and ordering guarantees. - **Arc** ([Release v20.53.0](https://github.com/Cratis/Arc/releases/tag/v20.53.0)): New analyzer `ARCCHR0006` warns when a reactor handler invokes `ICommandPipeline.Execute` but is not marked `[OnceOnly]`. Without it, replay operations (redaction, revision, observer rewind) re-run the handler and re-execute the command, duplicating the side effect — the analyzer catches this at build time and points you to mark the handler `[OnceOnly]`. - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): **CHR0024** — model-bound read model property has no mapping source (no mapping attribute and no subscribed event carries a same-named property for AutoMap to bind). - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): **CHR0025** — a property set explicitly (e.g. `[SetFrom]`) may be overwritten by AutoMap from another referenced event that carries an identically named property. Informational (not a warning), because the collision can be intentional; the message presents both resolutions (add `[NoAutoMap]`, or accept the update). - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): **CHR0026** — `[Key]`/`[Subject]` placed on a property whose type derives from `EventSourceId`. - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): **CHR0027** — a command both implements `ICanProvideEventStreamId` and carries a non-null `[EventStreamId]`. - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): **CHR0028** — redundant `.AutoMap()` call (already the default). - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): **CHR0029** — redundant `.Set(x => x.P).To(e => e.P)` with matching names. - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): **CHR0030** — reactor invokes `ICommandPipeline.Execute` without `[OnceOnly]`. - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): **CHR0031** — reactor declares mutable instance state. - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): **CHR0032** — reactor injects a storage primitive (e.g. `IMongoCollection`) directly. - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): **CHR0033** — model-bound `[ChildrenFrom]` child collection property has no matching event property and no explicit mapping, so AutoMap fills it from nothing. - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): Code fixes for several of the above (remove `[Key]`/`[Subject]`, remove a redundant `.AutoMap()` / `.Set().To()`). - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): A projection build-time warning when a collection read-model property auto-maps to nothing — the runtime companion to CHR0033, covering both model-bound and fluent projections. - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): Model-bound projection value expressions now fail loud on unsupported accessors (method calls, arithmetic, conditionals, string interpolation, constants, or accessors that ignore the lambda parameter) instead of silently producing an empty or partial property path. - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): `ReadModelScenario` can opt out of strict event subscription, so a seeded stream may carry events the read model does not subscribe to. - **Arc** ([Release v20.52.0](https://github.com/Cratis/Arc/releases/tag/v20.52.0)): Analyzer (ARC0010) that flags a `[Command]` `Handle()` returning `Task`/`Task` without awaiting anything — including the `Task.FromResult`/`Task.CompletedTask` wrapper shape the compiler's own CS1998 does not catch — with a code fix that unwraps it to the synchronous return shape the command pipeline already accepts. - **Arc** ([Release v20.52.0](https://github.com/Cratis/Arc/releases/tag/v20.52.0)): Analyzer (ARC0011) that flags a `[Roles(...)]` string-literal argument, with a code fix that rewrites it to `nameof(.)` so a role rename becomes a compile error instead of a silent authorization failure. - **Arc** ([Release v20.52.0](https://github.com/Cratis/Arc/releases/tag/v20.52.0)): Analyzer (ARC0012) that flags built-in exception types (`Exception`, `InvalidOperationException`, `ArgumentException`, and the like) thrown from Arc artifacts — command `Handle()` methods, `CommandValidator`/`ConceptValidator` validators, and reactor handlers — steering domain failures toward domain-named exception types. - **Arc** ([Release v20.51.0](https://github.com/Cratis/Arc/releases/tag/v20.51.0)): Analyzer (ARC0010) that flags a `[Command]` `Handle()` returning `Task`/`Task` without awaiting anything — including the `Task.FromResult`/`Task.CompletedTask` wrapper shape the compiler's own CS1998 does not catch — with a code fix that unwraps it to the synchronous return shape the command pipeline already accepts. - **Arc** ([Release v20.51.0](https://github.com/Cratis/Arc/releases/tag/v20.51.0)): Analyzer (ARC0011) that flags a `[Roles(...)]` string-literal argument, with a code fix that rewrites it to `nameof(.)` so a role rename becomes a compile error instead of a silent authorization failure. - **Arc** ([Release v20.51.0](https://github.com/Cratis/Arc/releases/tag/v20.51.0)): Analyzer (ARC0012) that flags built-in exception types (`Exception`, `InvalidOperationException`, `ArgumentException`, and the like) thrown from Arc artifacts — command `Handle()` methods, `CommandValidator`/`ConceptValidator` validators, and reactor handlers — steering domain failures toward domain-named exception types. - **Components** ([Release v2.5.0](https://github.com/Cratis/Components/releases/tag/v2.5.0)): `onBeforeExecute` on `CommandDialog`, `StepperCommandDialog`, and `CommandStepper` now accepts an async callback returning `Promise`. - **Components** ([Release v2.5.0](https://github.com/Cratis/Components/releases/tag/v2.5.0)): `@cratis/eslint-plugin-components` rule `onbeforeexecute-must-return`, flagging an `onBeforeExecute` callback that can complete without returning the command values. - **Components** ([Release v2.5.0](https://github.com/Cratis/Components/releases/tag/v2.5.0)): `@cratis/eslint-plugin-components` rule `no-hooks-in-view-model`, flagging React hooks and Arc proxy `.use()` calls inside a view model class. - **Arc** ([Release v20.50.0](https://github.com/Cratis/Arc/releases/tag/v20.50.0)): Reactors can return a `[Command]` (or a collection of commands) from a handler method and Arc executes them automatically through the command pipeline — no need to inject `ICommandPipeline` for simple follow-up actions. - **Arc** ([Release v20.50.0](https://github.com/Cratis/Arc/releases/tag/v20.50.0)): Returned commands run sequentially within a dedicated service scope and go through full validation, authorization, and `Handle()`. - **Arc** ([Release v20.50.0](https://github.com/Cratis/Arc/releases/tag/v20.50.0)): Execution stops at the first command that fails; the reactor then fails and Chronicle pauses the partition for retry — consistent with the built-in event side-effect handlers. - **Arc** ([Release v20.50.0](https://github.com/Cratis/Arc/releases/tag/v20.50.0)): Returning multiple commands is a convenience, not a transaction: there is no rollback, so events appended by earlier commands remain if a later one fails. For all-or-nothing semantics, model it as a single command. - **Chronicle** ([Release v15.39.0](https://github.com/Cratis/Chronicle/releases/tag/v15.39.0)): Property-level `[NoAutoMap]` — apply `[NoAutoMap]` to a single read model property (or record parameter) instead of the whole read model, to exclude just that property from AutoMap while every other property keeps mapping. Use it when an event you subscribe to for a specific value (`[SetFrom]`) or a `[Join]` happens to carry an identically named property that would otherwise overwrite your explicitly sourced value (#3444) ## Changed - **cli** ([Release v2.0.2](https://github.com/Cratis/cli/releases/tag/v2.0.2)): `cratis update` now shows a progress spinner while checking for and installing updates, and displays the target version up front when known - **cli** ([Release v2.0.0](https://github.com/Cratis/cli/releases/tag/v2.0.0)): The default connection string no longer disables TLS. The CLI connects over TLS by default and automatically trusts the Chronicle server's self-signed development certificate, so local setups need no manual TLS configuration. - **cli** ([Release v2.0.0](https://github.com/Cratis/cli/releases/tag/v2.0.0)): Bumped `Cratis.Chronicle.Connections`, `Cratis.Chronicle.Contracts`, and `Cratis.Chronicle.XUnit.Integration` to `16.0.1` (first release with the single-port client APIs), and `Testcontainers` to `4.13.0` to satisfy its new minimum version requirement. - **cli** ([Release v2.0.0](https://github.com/Cratis/cli/releases/tag/v2.0.0)): [x] `dotnet build` (Cli, Cli.Specs, Integration/Chronicle) — 0 warnings, 0 errors in Release - **cli** ([Release v2.0.0](https://github.com/Cratis/cli/releases/tag/v2.0.0)): [x] `dotnet test` on `Cli.Specs` — 142/142 passed - **cli** ([Release v2.0.0](https://github.com/Cratis/cli/releases/tag/v2.0.0)): [x] `dotnet test` on `Integration/Chronicle` against a locally built single-port Chronicle dev image — 161/161 passed (auth/login, connection errors, and every command group) - **cli** ([Release v2.0.0](https://github.com/Cratis/cli/releases/tag/v2.0.0)): [x] Manually ran `cratis get-started` with no config to verify the onboarding panel renders correctly with the new connection string - **Narrator** ([Release v2.0.0](https://github.com/Cratis/Narrator/releases/tag/v2.0.0)): The extension now requests OAuth tokens from the same host:port as the gRPC connection, matching Chronicle's consolidated single-port Kernel (gRPC and OAuth/API traffic now share port 35000 via TLS ALPN). - **Narrator** ([Release v2.0.0](https://github.com/Cratis/Narrator/releases/tag/v2.0.0)): Local development connections now use TLS by default, since TLS is mandatory on the consolidated port. Explicit `disableTls=true` in the connection string is still supported for callers who need a plaintext connection. - **Narrator** ([Release v2.0.0](https://github.com/Cratis/Narrator/releases/tag/v2.0.0)): The extension now trusts the Kernel's self-signed development certificate on the gRPC channel (previously only the OAuth HTTP request did), so local `chronicle://localhost:35000` connections work out of the box. - **Chronicle.Kotlin** ([Release v2.0.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v2.0.0)): The client now connects to the Chronicle Kernel over a single port (`35000`) instead of a separate gRPC port plus a management HTTP port (`8080`). The OAuth token endpoint is derived from the connection's own host and port. - **Chronicle.Kotlin** ([Release v2.0.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v2.0.0)): TLS is now enabled by default for local development — the Kernel's consolidated port requires TLS to multiplex gRPC and OAuth/API traffic, so the development connection string and `ChronicleOptions.development()` no longer disable it. The client automatically trusts the Kernel's auto-generated self-signed development certificate. - **AuthProxy** ([Release v2.5.0](https://github.com/Cratis/AuthProxy/releases/tag/v2.5.0)): Documented the new tenant-propagation and refresh-token behavior in `authentication.md`, `services.md`, and `tenancy.md`. - **Chronicle.Elixir** ([Release v2.0.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v2.0.0)): The client now derives the OAuth token endpoint from the same host and port as the gRPC connection instead of a hardcoded management port (`8080`), matching the Chronicle Kernel's consolidation onto a single port (`35000`). - **Chronicle.Elixir** ([Release v2.0.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v2.0.0)): TLS is now required for every connection, including local development. The gRPC channel trusts the Kernel's auto-generated self-signed development certificate automatically, with no configuration needed. - **Chronicle.Elixir** ([Release v2.0.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v2.0.0)): The default local-development connection string is now `chronicle://localhost:35000` (TLS implicit) instead of appending `?disableTls=true`. The `disableTls` option is still supported for callers connecting through something that terminates TLS for them (e.g. a plaintext-terminating proxy). - **Chronicle.TypeScript** ([Release v2.0.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v2.0.0)): The client now obtains OAuth tokens from the same consolidated port as the gRPC connection (default `35000`), matching the Chronicle Kernel's single-port consolidation. - **Chronicle.TypeScript** ([Release v2.0.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v2.0.0)): `ChronicleOptions.development()` now connects over TLS by default. The Kernel multiplexes gRPC and OAuth/API traffic on its single port via TLS ALPN negotiation, so plaintext connections — including local development — are no longer supported. - **Chronicle.TypeScript** ([Release v2.0.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v2.0.0)): TLS connections without an explicitly pinned certificate now accept the Kernel's self-signed development certificate, so local development requires no extra certificate setup. - **Chronicle** ([Release v16.0.0](https://github.com/Cratis/Chronicle/releases/tag/v16.0.0)): Chronicle Server serves gRPC (HTTP/2) together with the Workbench, REST API, OAuth flows and health checks (HTTP/1.1) on the single port `35000`, multiplexed over TLS. The Workbench is now reached at `https://localhost:35000`. (#3372) - **Chronicle** ([Release v16.0.0](https://github.com/Cratis/Chronicle/releases/tag/v16.0.0)): The Chronicle port now always uses TLS. In development a self-signed certificate is generated automatically when none is configured, and clients accept it without any setup; a certificate is required in production. (#3372) - **Specifications** ([Release v4.0.0](https://github.com/Cratis/Specifications/releases/tag/v4.0.0)): The packages now target `net8.0`, `net9.0` and `net10.0`, matching Arc and Chronicle. - **Specifications** ([Release v4.0.0](https://github.com/Cratis/Specifications/releases/tag/v4.0.0)): Updated `nunit` to 4.6.1, `Microsoft.NET.Test.Sdk` to 18.7.0, and `Microsoft.SourceLink.GitHub` to 10.0.300. - **Arc** ([Release v20.52.0](https://github.com/Cratis/Arc/releases/tag/v20.52.0)): `useDialog` infers the dialog component's input type directly, so a component typed as `(props: TInput) => JSX.Element` (reading `closeDialog` from `useDialogContext`) is accepted without an `as unknown as ComponentType` cast, and a component whose input type does not match is now a compile error. - **Components** ([Release v2.5.0](https://github.com/Cratis/Components/releases/tag/v2.5.0)): `IconDisplay` now repairs a lone PrimeIcons class missing its base class (`pi-home` → `pi pi-home`) so it renders, and warns in development when given a bare icon name (e.g. `plus`) that is not a CSS class. - **Chronicle** ([Release v15.39.0](https://github.com/Cratis/Chronicle/releases/tag/v15.39.0)): AutoMap no longer copies the other properties of an event a read model subscribes to **only to aggregate** (`[Count]`/`[Increment]`/`[Decrement]`/`[Add]`/`[Subtract]`). Previously, aggregating an event also name-mapped its unrelated properties onto the read model, which could silently overwrite explicitly sourced values; aggregating an event now contributes only the aggregate (#3444) ## Fixed - **Chronicle** ([Release v16.0.2](https://github.com/Cratis/Chronicle/releases/tag/v16.0.2)): Cross-store outbox subscriptions now deliver to every subscribing event store. Previously, when multiple event stores subscribed to the same source store's outbox, only the first to subscribe received events. - **cli** ([Release v2.0.2](https://github.com/Cratis/cli/releases/tag/v2.0.2)): `cratis update` now verifies the actually installed version with the package manager after running, instead of trusting a pre-update NuGet availability check that could be stale or time out — fixing cases where it reported "already at the latest version" right after installing a newer one (#34) - **cli** ([Release v2.0.2](https://github.com/Cratis/cli/releases/tag/v2.0.2)): The "update available" hint shown after commands now reliably appears instead of only surfacing when the background check happened to finish before the command did - **cli** ([Release v2.0.1](https://github.com/Cratis/cli/releases/tag/v2.0.1)): Fixed a build failure in the Publish workflow caused by Meziantou.Analyzer's MA0206 rule flagging empty `{ }` bodies on CLI branch marker classes; these now use the semicolon-bodied type declaration form. - **Chronicle** ([Release v16.0.1](https://github.com/Cratis/Chronicle/releases/tag/v16.0.1)): Fixed a read model's `[PII]` property intermittently failing to decrypt (`rsa routines::padding check failed`, or rendering as ciphertext) when the same subject also carried PII in a sibling read model. Subject encryption keys are now provisioned atomically and exactly once, even under concurrent appends, multiple silos, or a replica that has not yet caught up. - **Specifications** ([Release v4.0.0](https://github.com/Cratis/Specifications/releases/tag/v4.0.0)): The build workflow now installs the .NET 8/9/10 SDKs (it previously pinned an SDK that could not satisfy the repository's .NET 10 requirement) and runs the analyzer specs in CI. - **Chronicle** ([Release v15.41.0](https://github.com/Cratis/Chronicle/releases/tag/v15.41.0)): `ReadModelScenario` now backfills the joined value for a root-level `[Join]` whose join-source event is keyed by a string concept, matching the parity a `Guid`-keyed join already had. - **Arc** ([Release v20.53.1](https://github.com/Cratis/Arc/releases/tag/v20.53.1)): Reactor command side-effect failures now build against latest Chronicle, which added a required `TargetEventSourceIds` parameter to `AppendFailure` - **Arc** ([Release v20.53.0](https://github.com/Cratis/Arc/releases/tag/v20.53.0)): Update dependencies - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): Model-bound join `On` property names are normalized to serialized naming, so a model-bound `[Join]` resolves consistently. - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): A `[Join]` whose source event is keyed by a string concept (e.g. an organization number) no longer force-converts the key to a Guid-keyed read model's identifier and crash the projection — the read model materializes and stays spec-able (the joined value is enriched by the real engine). - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): Reactor side-effect append failures now report the target event source ids that failed to append. - **Chronicle** ([Release v15.40.0](https://github.com/Cratis/Chronicle/releases/tag/v15.40.0)): `[SetFromContext]` on a child parameter now honors its generic event type. - **Components** ([Release v2.5.0](https://github.com/Cratis/Components/releases/tag/v2.5.0)): `onBeforeExecute` no longer executes the command with `undefined` values when a callback returns nothing — the current values are kept and a warning is logged. - **Chronicle** ([Release v15.39.1](https://github.com/Cratis/Chronicle/releases/tag/v15.39.1)): `ReadModelScenario` no longer throws `MissingKeyResolverForEventType` when a projection's event source is seeded with an event the projection does not subscribe to; such events are ignored, matching the production projection engine's subscribed-type filtering. - **Chronicle** ([Release v15.39.0](https://github.com/Cratis/Chronicle/releases/tag/v15.39.0)): `ReadModelScenario` no longer throws (`The number of generic arguments provided doesn't equal the arity of the generic type definition`) on the first access to `Instance`/`Instances` when the read model under test is projected by a standalone `IProjectionFor` class ## Removed - **cli** ([Release v2.0.0](https://github.com/Cratis/cli/releases/tag/v2.0.0)): `--management-port` flag, `CHRONICLE_MANAGEMENT_PORT` environment variable, and the `management-port` context key. The OAuth token endpoint is now derived from the connection string's server address instead of a separately configured port. - **Narrator** ([Release v2.0.0](https://github.com/Cratis/Narrator/releases/tag/v2.0.0)): The `managementPort` context option and its "Management port" prompts in the Add/Edit Context flows — Chronicle no longer exposes a separate management HTTP port. - **Chronicle.Kotlin** ([Release v2.0.0](https://github.com/Cratis/Chronicle.Kotlin/releases/tag/v2.0.0)): `ChronicleConnectionString.managementPort` (and its `8080` default) — no longer needed now that OAuth is served on the same port as gRPC. - **Chronicle.Elixir** ([Release v2.0.0](https://github.com/Cratis/Chronicle.Elixir/releases/tag/v2.0.0)): Removed the `-p 8080:8080` port mapping from the root README's docker run command and the console sample's `docker-compose.yml` — the management port no longer exists on the Kernel. - **Chronicle.TypeScript** ([Release v2.0.0](https://github.com/Cratis/Chronicle.TypeScript/releases/tag/v2.0.0)): The `managementPort` connection option has been removed — the Chronicle Kernel no longer exposes a separate management port for authentication. - **Chronicle** ([Release v16.0.0](https://github.com/Cratis/Chronicle/releases/tag/v16.0.0)): The `managementPort` server configuration option and the client `ManagementPort` option — all traffic uses the single port. (#3372) - **Chronicle** ([Release v16.0.0](https://github.com/Cratis/Chronicle/releases/tag/v16.0.0)): The separate Workbench TLS configuration (`workbench.tls`); the single port uses the top-level `tls` certificate. (#3372) - **Chronicle** ([Release v16.0.0](https://github.com/Cratis/Chronicle/releases/tag/v16.0.0)): The Aspire `ChronicleResource` management endpoint (`DefaultManagementPort` and the `management` endpoint); a single `grpc` endpoint now serves everything. (#3372) - **Specifications** ([Release v4.0.0](https://github.com/Cratis/Specifications/releases/tag/v4.0.0)): Dropped the `net48` target framework. Consumers on .NET Framework should remain on the previous release. ## Security - No updates ## Deprecated - No updates