Release digest: June 15 - 22, 2026 (Week 25)

Added

• Arc (Release v20.47.0): New Cratis.CodeAnalysis package that bundles the full set of Cratis Arc lint analyzers (ARC* and ARCCHR*). A single Cratis.CodeAnalysis reference enables them all; the individual Cratis.Arc.Core.CodeAnalysis and Cratis.Arc.Chronicle.CodeAnalysis packages remain available for à-la-carte use. The lint analyzers are still not bundled into the functional packages, so referencing Cratis.Arc.Core (or the Cratis meta package) does not force them on you.
• Arc (Release v20.46.0): Exported observer from @cratis/arc.react.mvvm so a child component that reads view model observables directly can be given its own observer boundary, with guidance in the React MVVM documentation.
• Arc (Release v20.46.0): Added a no-direct-mobx-react-import ESLint rule that flags direct imports from mobx-react / mobx-react-lite and points consumers to @cratis/arc.react.mvvm instead.
• Arc (Release v20.45.0): Exported observer from @cratis/arc.react.mvvm so a child component that reads view model observables directly can be given its own observer boundary, with guidance in the React MVVM documentation.
• Arc (Release v20.45.0): Added a no-direct-mobx-react-import ESLint rule that flags direct imports from mobx-react / mobx-react-lite and points consumers to @cratis/arc.react.mvvm instead.
• Arc (Release v20.44.0): ARC0007 analyzer — warns when a [Command] is declared as a class instead of a record.
• Arc (Release v20.44.0): ARC0008 analyzer — warns when a [ReadModel] is declared as a class instead of a record.
• Arc (Release v20.44.0): ARC0009 analyzer — warns when a ConceptAs<T> is declared as a class instead of a record.
• Arc (Release v20.44.0): ARCCHR0002 analyzer — warns when a [Command] has multiple event source id candidates (EventSourceId, EventSourceId<T>, a type with an implicit conversion to EventSourceId, or [Key]) but does not implement ICanProvideEventSourceId; exempt when Handle returns only EventForEventSourceId.
• Arc (Release v20.44.0): ARCCHR0003 analyzer — warns when a reactor injects IEventLog instead of returning side-effect events.
• Arc (Release v20.44.0): ARCCHR0004 analyzer — warns when [EventType] specifies an explicit id (the type name is the identifier); generation stays allowed.
• Chronicle (Release v15.35.0): Reactor handler methods can take dependencies beyond the event and EventContext: read models (materialized strongly consistent from their reducer or projection) and services from the service provider. (#3358)
• Chronicle (Release v15.35.0): ICanResolveReadModelKey lets a reactor choose which key its read model dependencies are materialized with; it defaults to the triggering event’s EventSourceId. (#3358)
• Arc (Release v20.43.0): Added CancellationToken injection for model-bound command Provide() and Handle() methods.
• Arc (Release v20.43.0): Added cancellation-aware command pipeline overloads for programmatic command execution.
• Arc (Release v20.42.2): Added nullable-aware dependency resolution for command validators, Provide, and Handle so nullable read model parameters can receive null when the command-scoped read model does not exist.
• Arc (Release v20.42.2): Added ARC0006 analyzer guidance for non-nullable command-scoped read model parameters in validators, Provide, and Handle, including read models discovered through Chronicle IProjectionFor projections. The rule now frames this as an explicit design choice: nullable when the command handles absence, non-nullable when the projection is required.
• Arc (Release v20.42.2): Added documentation for Chronicle read model dependency semantics, validator existence checks, Provide / Handle consistency, and ARC0006.
• Arc (Release v20.42.0): Commands can define a Provide() method that supplies Handle()’s arguments — fetched or computed, with its own parameters resolved from dependency injection — without registering those values in the container. Single, tuple, Result<,>, and async (Task/ValueTask) return shapes are all supported.
• Arc (Release v20.42.0): New analyzer rule ARC0005 warns when a value produced by Provide() is not consumed by any Handle() parameter.

Changed

• Arc (Release v20.46.0): Raised the minimum required Cratis.Chronicle to 15.35.0.
• Arc (Release v20.46.0): The Cratis meta package no longer bundles the Cratis analyzers; the ARC*/ARCCHR* analyzers now flow through the individual packages. A project referencing only Cratis still gets full runtime and proxy generation, but receives the analyzers only when a sub-package such as Cratis.Arc.Core or Cratis.Arc.MongoDB is referenced.
• Arc (Release v20.46.0): Realigned the net8/net9 framework dependency versions to their target-framework major (8.x / 9.x), so building for net8 or net9 no longer resolves 10.x Microsoft.Extensions.* packages.
• Arc (Release v20.46.0): The recommended Cratis Arc ESLint config now reports direct mobx-react / mobx-react-lite imports as errors.
• Arc (Release v20.45.0): The recommended Cratis Arc ESLint config now reports direct mobx-react / mobx-react-lite imports as errors.
• Arc (Release v20.44.2): Raised the minimum required Cratis.Chronicle to 15.35.0.
• Arc (Release v20.44.0): The Cratis meta package now bundles every Cratis analyzer (Arc, Arc.Chronicle, the Arc source generator, the Fundamentals type discovery generator, and the Metrics analyzer), so installing Cratis enables all analyzers without referencing the sub-packages directly.
• Chronicle (Release v15.35.0): The reactor method analyzer (CHR0004) now allows dependency parameters and only flags parameters that can never be resolved (primitives, value types, or string). (#3358)
• Arc (Release v20.43.7): Clarified CommandForm validation docs to distinguish required field metadata from explicit empty-string validation rules. (#2307)
• Arc (Release v20.43.0): Command validation now receives the command execution cancellation token.
• Arc (Release v20.42.2): Registered discoverable validators are still resolved from DI first, while unregistered validators are constructed through the shared nullable-aware parameter resolver.
• Arc (Release v20.42.2): Non-nullable command and validator dependencies now report that the dependency could not be resolved or resolved to null, with guidance to make read models nullable when absence is valid or keep them non-nullable when absence should fail as required state.
• Arc (Release v20.42.1): Documentation: corrected Result<,> type-parameter order to Result<TSuccess, TError> across the command, validation, authorization, and scenario examples.
• Arc (Release v20.41.3): Arc React Storybook page now fills the entire content area with Storybook’s navigation and panels visible, matching the Components Storybook page layout.

Fixed

• Arc (Release v20.46.0): Referencing the Cratis meta package alongside a package that transitively brings Cratis.Arc.Core (such as Cratis.Arc.MongoDB) no longer fails the build with CS0101 'Cratis.Arc.Generated.GeneratedMarker'.
• Arc (Release v20.46.0): Arc no longer throws MissingMethodException at runtime against released Chronicle. The Chronicle floor now matches the AppendMany/Append overloads Arc actually calls, so an incompatible Chronicle version fails dotnet restore instead of crashing at runtime.
• Arc (Release v20.46.0): The ARCCHR0002 analyzer no longer reports an ambiguous command event source id when the command’s Handle supplies the event source explicitly through a tuple return — including new-stream-create commands that return a generated id deriving from EventSourceId<T>.
• Arc (Release v20.44.2): Building a project that references the Cratis meta package together with a package that transitively brings Cratis.Arc.Core (such as Cratis.Arc.MongoDB) no longer fails with CS0101 'Cratis.Arc.Generated.GeneratedMarker' caused by the Arc source generator being loaded and run twice.
• Arc (Release v20.44.2): Arc no longer throws MissingMethodException at runtime against released Chronicle. The Chronicle floor now matches the AppendMany/Append overloads Arc actually calls, so an incompatible Chronicle version fails dotnet restore instead of crashing at runtime.
• Arc (Release v20.44.2): The ARCCHR0002 analyzer no longer reports an ambiguous command event source id when the command’s Handle supplies the event source explicitly through a tuple return — including new-stream-create commands that return a generated id deriving from EventSourceId<T>.
• Chronicle (Release v15.35.1): ReadModelScenario<T> now correctly round-trips read-model properties typed as a collection of bare concepts (e.g. IReadOnlyList<MyConcept> where MyConcept : ConceptAs<T>). Previously such a property threw a JsonException (“Cannot get the value of a token type ‘StartObject’ as a string”) when the projected instance was materialized, because the projection harness serialized the state without the concept-aware serializer options while deserializing with them. Scalar concept properties round-trip the same way.
• Arc (Release v20.44.1): Commands with a property holding a cyclic or arbitrary object graph (for example System.Text.Json.Nodes.JsonObject, whose child nodes back-reference their parent) no longer crash command execution with a stack overflow / HTTP 500. Nested validator behavior is unchanged.
• Fundamentals (Release v7.16.2): JsonSerializer now preserves the _derivedTypeId discriminator through both deserialization and serialization. Previously, deserializing a polymorphic value whose concrete type could not be resolved (e.g. its derived type was not yet registered) dropped the discriminator, so the value could never be re-resolved or round-tripped and serialized back with no type information. The discriminator now flows transparently in both directions.
• Chronicle (Release v15.34.13): Fixed projection replay for deep joined or child-stream read models so nested children are rebuilt consistently instead of depending on partition scheduling. (#3345)
• Chronicle (Release v15.34.12): Read-model properties typed as a collection of concepts (e.g. IReadOnlyList<MyConcept> where MyConcept : ConceptAs<string>) are no longer silently persisted as an empty/missing array. Such a property now stores the unwrapped underlying values, the same way a scalar concept already did. A scalar concept and a collection of records in the same read model were always persisted correctly; only collections of bare concepts were affected.
• Arc (Release v20.43.7): Fixed command required-property validation to treat only null and undefined as missing, letting explicit validators decide whether empty strings are invalid. (#2307)
• Arc (Release v20.43.7): Fixed currentValues and useCommand value syncing so explicit null and undefined values clear command properties instead of leaving stale values. (#2307)
• Fundamentals (Release v7.16.1): JsonSerializer now populates fields inherited from base types when deserializing a derived (polymorphic) type. Previously getFieldsForType only read a type’s own field metadata, so a resolved derived type came back with its inherited properties unset.
• Chronicle (Release v15.34.11): Fixed passive read model projections dropping child element updates.
• Chronicle (Release v15.34.11): Fixed MongoDB sink conflicts when a child add and child identifier update appear in the same changeset.
• Chronicle (Release v15.34.10): Fixed MongoDB read-model sink updates for reducer-owned child collections when an existing child element field changes.
• Arc (Release v20.43.4): Injecting a reducer-backed (IReducerFor<T>) read model into a command’s CommandValidator<>, Provide(), or Handle() no longer fails at runtime. Reducer-backed read models are now registered for command-scope resolution and resolve by key just like projection-backed and model-bound read models, including the nullable “does not exist” behavior.
• Chronicle (Release v15.34.9): [RemovedWith<T>] on a child collection type now actually removes the item from the collection. Its key expression was stored verbatim (e.g. RoleId) while the projection’s other keys are camelCased, so it never matched the serialized event content and no removal was produced. (#135)
• Chronicle (Release v15.34.9): In-memory read models now apply child removals — the in-memory sink silently ignored ChildRemoved changes (the MongoDB and SQL sinks already handled them).
• Arc (Release v20.43.3): ConceptAs<T> values now deserialize from MongoDB regardless of the stored BSON numeric type. Numeric concepts (for example an int-backed concept) read with a representation-specific reader previously threw ReadInt32 can only be called when CurrentBsonType is Int32, not when CurrentBsonType is Double when the stored value had a different numeric representation — which happens when integral values flow through JSON-based pipelines (such as Chronicle projections that materialize event content via ExpandoObject) and are persisted as Double. The value is now read according to its actual stored BSON type and converted to the concept’s underlying type.
• Arc (Release v20.43.2): Fixes the MongoDB derived type handling so that if a type is already its concrete type, it uses it.
• Arc (Release v20.43.1): Command and query validation no longer throws Parameter count mismatch when the parameter graph contains a type with an indexer (for example a JsonElement held in an object-typed property). The recursive fluent validation filters now skip indexer properties.
• Chronicle (Release v15.34.7): Event properties typed as a [DerivedType] base (abstract/interface with derived types) now round-trip with their discriminator and concrete subtype properties intact. Previously the type discriminator and all subtype-specific properties were stripped on append, causing read-side deserialization to fail with “Cannot create an instance of <abstract type>”.
• Chronicle (Release v15.34.7): The JSON schema generator now emits an open object schema for base types that have registered derivatives, so the schema-driven storage conversion preserves the full payload instead of stripping it to the base type’s properties.
• Chronicle (Release v15.34.7): The client event serializer now ensures the derived-type converter is present in its options, so the discriminator and concrete properties are actually written into the event content.
• Arc (Release v20.42.2): Fixed missing Chronicle read models resolving through command scopes by returning null instead of trying to release a null read model.
• Arc (Release v20.42.2): Fixed nullable read model injection for CommandValidator, Provide, and Handle, which now supports validators and command methods that explicitly handle missing read model state without IReadModels lookups.
• Arc (Release v20.42.2): Fixed non-nullable command-scoped read model parameters failing with generic DI construction errors by throwing clear CannotResolveCommandDependency or CannotResolveValidatorDependency exceptions.
• cli (Release v1.6.3): Update command now queries available version before updating and reports that version on success, avoiding false “already at latest” messages (#34)
• cli (Release v1.6.3): Added user guidance that new version takes effect on next CLI invocation (#34)
• Arc (Release v20.42.1): Read-model–dependent command validators now resolve through the command pipeline instead of failing with “No service for type … has been registered”. A CommandValidator can take a read model, projection, or other service as a constructor dependency — resolved for the command’s event source id — exactly like the command handler and Provide method.
• Arc (Release v20.41.4): A CommandValidator<> can now take a read model as a constructor dependency, resolved for the command’s event source id — the same way a command’s Handle() method receives it. Validators are now resolved from the command scope, so this no longer fails as it did when they were resolved from the root provider (throwing under scope validation or returning a stale instance).
• Arc (Release v20.41.4): Using a read-model validator on the MVC controller path now raises a clear ReadModelValidatorRequiresCommandPipeline error pointing to the command pipeline, instead of an opaque dependency-resolution failure.

Removed

• Arc (Release v20.47.0): The Cratis.Arc.Core.Generators package is no longer published. That source generator ships inside Cratis.Arc.Core (it emits AOT query metadata into the consuming assembly), so a standalone copy was redundant and referencing both at once failed the build with CS0101.

Security

• Chronicle (Release v15.34.12): Pin the native SQLite library (SQLitePCLRaw.lib.e_sqlite3) to the patched 3.50.3 build, addressing a known high-severity vulnerability (GHSA-2m69-gcr7-jv3q) bundled in the 2.1.11 version pulled in transitively by EF Core Sqlite.

Deprecated

• No updates