Skip to content

Bump Quartz and 2 others - #82

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/quartz-f0104df27f
Closed

dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/nuget/quartz-f0104df27f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 2, 2026 •

Copy link
Copy Markdown
Contributor

Pinned Quartz at 3.19.1.

Release notes

Sourced from Quartz's releases.

3.19.1

Quartz.NET 3.19.1 is a small bug fix release with two targeted fixes: DailyTimeIntervalTrigger no longer gets stuck in an infinite fire loop on DST spring-forward days, and StdSchedulerFactory.GetScheduler(schedName) now creates the scheduler when the name asked for is its own. There are no API or schema changes, so it is a drop-in upgrade from 3.19.0.

Highlights

  • DailyTimeIntervalTrigger no longer spins on DST transition days — GetFireTimeAfter could return a time at or before the one it was given, which makes QuartzSchedulerThread fire the trigger, compute the same next fire time, and fire again — pinning a CPU core and flooding the log. Two independent causes, both on a spring-forward day: the DST correction added for #​1114 was applied to every interval size and in either direction (so every interval of an hour or less was affected, in every DST time zone), and the daily rollover to StartTimeOfDay reused whatever UTC offset the previous fire time carried (so in time zones that move the clock at midnight, such as Chile, StartTimeOfDay 00:00 resolved to an instant before the transition — the same instant that was passed in). Verified across 3024 combinations of 12 time zones, both transitions, 21 intervals and 6 start times: 468 combinations produced non-advancing fire times before, none do now. (#​3190, fixes #​332)
    • Behavior change worth noting: the same fix stops sub-hour triggers silently dropping the last hour of a fall-back day. A 5-minute trigger now fires 300 times through the 25-hour day, ending at 23:55 local, instead of 288 times ending at 22:55.
  • StdSchedulerFactory.GetScheduler(schedName) creates its own scheduler — asking a factory for the scheduler it is configured to produce returned null until somebody had called GetScheduler() first. It now creates it. Any other name stays a pure lookup, so probing for a scheduler somebody else owns still has no side effects, and the name comparison is case-insensitive to match how SchedulerRepository indexes names. The DI factory has behaved this way since #​2845; this brings the property-configured factory in line. (#​3188, reported in #​2786, originally proposed in #​360)

What's Changed

Full Changelog: quartznet/quartznet@v3.19.0...v3.19.1

3.19.0

Quartz.NET 3.19.0 is a feature release: it adds node affinity for clustered scheduling, a fluent cron-expression builder, and richer L/LW day-of-month expressions, plus clock-jump resilience and a modernized build and publishing pipeline. The public API is unchanged (all additions are additive), so it is a drop-in upgrade — with two things to note: the new node-affinity columns are an optional schema migration (the feature degrades gracefully without them), and a handful of previously-broken L/LW/W cron expressions now fire correctly (see below).

Highlights

  • Node affinity for clustered trigger pinning — pin a trigger to a preferred node with TriggerBuilder.WithPreferredNode(...); the node is preferred for acquisition but the trigger is still stolen on failover so it is never stranded if that node goes down. Adds optional PREFERRED_NODE / PREFERRED_NODE_AUTO columns for ADO.NET job stores (database/schema_30_add_preferred_node.sql); when the columns are absent the scheduler logs a warning and behaves exactly as before. (#​3013, #​3144)
  • Fluent CronExpressionBuilder — compose cron expressions programmatically, one field at a time, instead of hand-writing the string — handy when a schedule is assembled from user input such as a scheduling UI. (#​3139)
  • L and LW combinable with other day-of-month values — the day-of-month field now accepts expressions such as 1,15,L and the new LW-n / L-nW grammar. This also corrects several previously-buggy edge cases: 29W/31W no longer silently skip short months, L-30W no longer throws mid-schedule, and 1,15W now applies W to each day rather than only the first. These corrections change the fire times of a few expressions that were previously broken — review any stored L/LW/W day-of-month expressions. (#​2759)
  • Resilience to system clock jumps — the misfire handler and cluster manager now clamp their sleep intervals after the system clock jumps forward or backward, so a clock step no longer causes a busy-spin or an absurdly long sleep. (#​3147, fixes #​1508)
  • Modernized build & publishing — the build orchestrator moved from the unmaintained NUKE to Fallout (#​3163), and packages now publish to nuget.org via GitHub OIDC trusted publishing rather than a stored API key. Dependencies were also refreshed (#​3151).

Note for CronScheduleBuilder users: AtHourAndMinuteOnGivenDaysOfWeek / WeeklyOnDayAndHourAndMinute now emit textual day-of-week names (e.g. MON,WED rather than 2,4). The schedules are identical, but the generated CRON_EXPRESSION string differs — relevant only if you compare stored cron strings byte-for-byte.

What's Changed

Full Changelog: quartznet/quartznet@v3.18.2...v3.19.0

3.18.2

Quartz.NET 3.18.2 is a maintenance release that stabilizes the dashboard introduced in 3.18.0, fixes several scheduling correctness bugs, and speeds up cron next-fire-time computation. It is a drop-in upgrade from earlier 3.18.x releases — no breaking changes and no database schema migrations.

Highlights

  • Type-load failures no longer stall the whole scheduler — a trigger or job whose type failed to load could throw inside AcquireNextTrigger and block acquisition of every other trigger. The faulting trigger is now isolated so the rest keep firing. (#​3108)
  • "Reschedule next" misfire policies no longer fire immediately — after a misfire, the reschedule-next policies could fire once right away instead of waiting for the next scheduled time. (#​3100)
  • Named-scheduler JSON config is honored — schedules defined under the root Quartz configuration section were not loaded for named schedulers. (#​3113)
  • Dashboard fixes — authorization policy no longer leaks to host-app endpoints (#​3067); static assets and a custom DashboardPath work under a fail-closed FallbackPolicy, and the Blazor circuit is allowed anonymous access under the same policy (#​3098, #​3120); trigger and calendar JSON deserialization is fixed (#​3102); and JobDataMap and SimpleSchedule trigger details now display correctly (#​3132).
  • MySQL FORCE INDEX fix — schema-qualified table prefixes produced a malformed FORCE INDEX hint. (#​3086)
  • Faster cron scheduling — cron next-fire-time computation gains a bitmask fast path and avoids needless DateTimeOffset churn in the hot loop. (#​3126, #​3129)
  • Smaller enhancements — health-check tags can now be passed to AddQuartzServer (#​3112), and new public helpers make plugin configuration extensible (#​3104).

What's Changed

Full Changelog: quartznet/quartznet@v3.18.1...v3.18.2

3.18.1

Quartz.NET 3.18.1 is a maintenance release that addresses a timezone-related bug, security advisories on transitive dependencies, and an issue that prevented the new Redis distributed-lock package from publishing to nuget.org.

Highlights

  • Fix GetTimeBefore for positive-offset timezones — CronExpression.GetTimeBefore could throw ArgumentOutOfRangeException for cron expressions evaluated against timezones with positive UTC offsets (e.g. Europe/Helsinki, Asia/Tokyo). Backported from main.
  • Redis package renamed to Quartz.Extensions.Redis — the original Quartz.Redis package id from 3.18.0 collided with an unrelated v1.0.0 already on nuget.org and could not be published. The 3.18.0 release was shipped with IsPackable=false as a workaround; 3.18.1 picks the umbrella id Quartz.Extensions.Redis (matching Quartz.Extensions.DependencyInjection / Quartz.Extensions.Hosting) and re-enables publication. There are no consumers to migrate — the original id was never on nuget.org.
  • Vulnerable transitive dependency bumps — addresses moderate advisories that were blocking restore on the 3.x CI pipeline.

What's Changed

Full Changelog: quartznet/quartznet@v3.18.0...v3.18.1

Commits viewable in compare view.

Pinned Quartz.Extensions.DependencyInjection at 3.19.1.

Release notes

Sourced from Quartz.Extensions.DependencyInjection's releases.

3.19.1

Quartz.NET 3.19.1 is a small bug fix release with two targeted fixes: DailyTimeIntervalTrigger no longer gets stuck in an infinite fire loop on DST spring-forward days, and StdSchedulerFactory.GetScheduler(schedName) now creates the scheduler when the name asked for is its own. There are no API or schema changes, so it is a drop-in upgrade from 3.19.0.

Highlights

  • DailyTimeIntervalTrigger no longer spins on DST transition days — GetFireTimeAfter could return a time at or before the one it was given, which makes QuartzSchedulerThread fire the trigger, compute the same next fire time, and fire again — pinning a CPU core and flooding the log. Two independent causes, both on a spring-forward day: the DST correction added for #​1114 was applied to every interval size and in either direction (so every interval of an hour or less was affected, in every DST time zone), and the daily rollover to StartTimeOfDay reused whatever UTC offset the previous fire time carried (so in time zones that move the clock at midnight, such as Chile, StartTimeOfDay 00:00 resolved to an instant before the transition — the same instant that was passed in). Verified across 3024 combinations of 12 time zones, both transitions, 21 intervals and 6 start times: 468 combinations produced non-advancing fire times before, none do now. (#​3190, fixes #​332)
    • Behavior change worth noting: the same fix stops sub-hour triggers silently dropping the last hour of a fall-back day. A 5-minute trigger now fires 300 times through the 25-hour day, ending at 23:55 local, instead of 288 times ending at 22:55.
  • StdSchedulerFactory.GetScheduler(schedName) creates its own scheduler — asking a factory for the scheduler it is configured to produce returned null until somebody had called GetScheduler() first. It now creates it. Any other name stays a pure lookup, so probing for a scheduler somebody else owns still has no side effects, and the name comparison is case-insensitive to match how SchedulerRepository indexes names. The DI factory has behaved this way since #​2845; this brings the property-configured factory in line. (#​3188, reported in #​2786, originally proposed in #​360)

What's Changed

Full Changelog: quartznet/quartznet@v3.19.0...v3.19.1

3.19.0

Quartz.NET 3.19.0 is a feature release: it adds node affinity for clustered scheduling, a fluent cron-expression builder, and richer L/LW day-of-month expressions, plus clock-jump resilience and a modernized build and publishing pipeline. The public API is unchanged (all additions are additive), so it is a drop-in upgrade — with two things to note: the new node-affinity columns are an optional schema migration (the feature degrades gracefully without them), and a handful of previously-broken L/LW/W cron expressions now fire correctly (see below).

Highlights

  • Node affinity for clustered trigger pinning — pin a trigger to a preferred node with TriggerBuilder.WithPreferredNode(...); the node is preferred for acquisition but the trigger is still stolen on failover so it is never stranded if that node goes down. Adds optional PREFERRED_NODE / PREFERRED_NODE_AUTO columns for ADO.NET job stores (database/schema_30_add_preferred_node.sql); when the columns are absent the scheduler logs a warning and behaves exactly as before. (#​3013, #​3144)
  • Fluent CronExpressionBuilder — compose cron expressions programmatically, one field at a time, instead of hand-writing the string — handy when a schedule is assembled from user input such as a scheduling UI. (#​3139)
  • L and LW combinable with other day-of-month values — the day-of-month field now accepts expressions such as 1,15,L and the new LW-n / L-nW grammar. This also corrects several previously-buggy edge cases: 29W/31W no longer silently skip short months, L-30W no longer throws mid-schedule, and 1,15W now applies W to each day rather than only the first. These corrections change the fire times of a few expressions that were previously broken — review any stored L/LW/W day-of-month expressions. (#​2759)
  • Resilience to system clock jumps — the misfire handler and cluster manager now clamp their sleep intervals after the system clock jumps forward or backward, so a clock step no longer causes a busy-spin or an absurdly long sleep. (#​3147, fixes #​1508)
  • Modernized build & publishing — the build orchestrator moved from the unmaintained NUKE to Fallout (#​3163), and packages now publish to nuget.org via GitHub OIDC trusted publishing rather than a stored API key. Dependencies were also refreshed (#​3151).

Note for CronScheduleBuilder users: AtHourAndMinuteOnGivenDaysOfWeek / WeeklyOnDayAndHourAndMinute now emit textual day-of-week names (e.g. MON,WED rather than 2,4). The schedules are identical, but the generated CRON_EXPRESSION string differs — relevant only if you compare stored cron strings byte-for-byte.

What's Changed

Full Changelog: quartznet/quartznet@v3.18.2...v3.19.0

3.18.2

Quartz.NET 3.18.2 is a maintenance release that stabilizes the dashboard introduced in 3.18.0, fixes several scheduling correctness bugs, and speeds up cron next-fire-time computation. It is a drop-in upgrade from earlier 3.18.x releases — no breaking changes and no database schema migrations.

Highlights

  • Type-load failures no longer stall the whole scheduler — a trigger or job whose type failed to load could throw inside AcquireNextTrigger and block acquisition of every other trigger. The faulting trigger is now isolated so the rest keep firing. (#​3108)
  • "Reschedule next" misfire policies no longer fire immediately — after a misfire, the reschedule-next policies could fire once right away instead of waiting for the next scheduled time. (#​3100)
  • Named-scheduler JSON config is honored — schedules defined under the root Quartz configuration section were not loaded for named schedulers. (#​3113)
  • Dashboard fixes — authorization policy no longer leaks to host-app endpoints (#​3067); static assets and a custom DashboardPath work under a fail-closed FallbackPolicy, and the Blazor circuit is allowed anonymous access under the same policy (#​3098, #​3120); trigger and calendar JSON deserialization is fixed (#​3102); and JobDataMap and SimpleSchedule trigger details now display correctly (#​3132).
  • MySQL FORCE INDEX fix — schema-qualified table prefixes produced a malformed FORCE INDEX hint. (#​3086)
  • Faster cron scheduling — cron next-fire-time computation gains a bitmask fast path and avoids needless DateTimeOffset churn in the hot loop. (#​3126, #​3129)
  • Smaller enhancements — health-check tags can now be passed to AddQuartzServer (#​3112), and new public helpers make plugin configuration extensible (#​3104).

What's Changed

Full Changelog: quartznet/quartznet@v3.18.1...v3.18.2

3.18.1

Quartz.NET 3.18.1 is a maintenance release that addresses a timezone-related bug, security advisories on transitive dependencies, and an issue that prevented the new Redis distributed-lock package from publishing to nuget.org.

Highlights

  • Fix GetTimeBefore for positive-offset timezones — CronExpression.GetTimeBefore could throw ArgumentOutOfRangeException for cron expressions evaluated against timezones with positive UTC offsets (e.g. Europe/Helsinki, Asia/Tokyo). Backported from main.
  • Redis package renamed to Quartz.Extensions.Redis — the original Quartz.Redis package id from 3.18.0 collided with an unrelated v1.0.0 already on nuget.org and could not be published. The 3.18.0 release was shipped with IsPackable=false as a workaround; 3.18.1 picks the umbrella id Quartz.Extensions.Redis (matching Quartz.Extensions.DependencyInjection / Quartz.Extensions.Hosting) and re-enables publication. There are no consumers to migrate — the original id was never on nuget.org.
  • Vulnerable transitive dependency bumps — addresses moderate advisories that were blocking restore on the 3.x CI pipeline.

What's Changed

Full Changelog: quartznet/quartznet@v3.18.0...v3.18.1

Commits viewable in compare view.

Pinned Quartz.Extensions.Hosting at 3.19.1.

Release notes

Sourced from Quartz.Extensions.Hosting's releases.

3.19.1

Quartz.NET 3.19.1 is a small bug fix release with two targeted fixes: DailyTimeIntervalTrigger no longer gets stuck in an infinite fire loop on DST spring-forward days, and StdSchedulerFactory.GetScheduler(schedName) now creates the scheduler when the name asked for is its own. There are no API or schema changes, so it is a drop-in upgrade from 3.19.0.

Highlights

  • DailyTimeIntervalTrigger no longer spins on DST transition days — GetFireTimeAfter could return a time at or before the one it was given, which makes QuartzSchedulerThread fire the trigger, compute the same next fire time, and fire again — pinning a CPU core and flooding the log. Two independent causes, both on a spring-forward day: the DST correction added for #​1114 was applied to every interval size and in either direction (so every interval of an hour or less was affected, in every DST time zone), and the daily rollover to StartTimeOfDay reused whatever UTC offset the previous fire time carried (so in time zones that move the clock at midnight, such as Chile, StartTimeOfDay 00:00 resolved to an instant before the transition — the same instant that was passed in). Verified across 3024 combinations of 12 time zones, both transitions, 21 intervals and 6 start times: 468 combinations produced non-advancing fire times before, none do now. (#​3190, fixes #​332)
    • Behavior change worth noting: the same fix stops sub-hour triggers silently dropping the last hour of a fall-back day. A 5-minute trigger now fires 300 times through the 25-hour day, ending at 23:55 local, instead of 288 times ending at 22:55.
  • StdSchedulerFactory.GetScheduler(schedName) creates its own scheduler — asking a factory for the scheduler it is configured to produce returned null until somebody had called GetScheduler() first. It now creates it. Any other name stays a pure lookup, so probing for a scheduler somebody else owns still has no side effects, and the name comparison is case-insensitive to match how SchedulerRepository indexes names. The DI factory has behaved this way since #​2845; this brings the property-configured factory in line. (#​3188, reported in #​2786, originally proposed in #​360)

What's Changed

Full Changelog: quartznet/quartznet@v3.19.0...v3.19.1

3.19.0

Quartz.NET 3.19.0 is a feature release: it adds node affinity for clustered scheduling, a fluent cron-expression builder, and richer L/LW day-of-month expressions, plus clock-jump resilience and a modernized build and publishing pipeline. The public API is unchanged (all additions are additive), so it is a drop-in upgrade — with two things to note: the new node-affinity columns are an optional schema migration (the feature degrades gracefully without them), and a handful of previously-broken L/LW/W cron expressions now fire correctly (see below).

Highlights

  • Node affinity for clustered trigger pinning — pin a trigger to a preferred node with TriggerBuilder.WithPreferredNode(...); the node is preferred for acquisition but the trigger is still stolen on failover so it is never stranded if that node goes down. Adds optional PREFERRED_NODE / PREFERRED_NODE_AUTO columns for ADO.NET job stores (database/schema_30_add_preferred_node.sql); when the columns are absent the scheduler logs a warning and behaves exactly as before. (#​3013, #​3144)
  • Fluent CronExpressionBuilder — compose cron expressions programmatically, one field at a time, instead of hand-writing the string — handy when a schedule is assembled from user input such as a scheduling UI. (#​3139)
  • L and LW combinable with other day-of-month values — the day-of-month field now accepts expressions such as 1,15,L and the new LW-n / L-nW grammar. This also corrects several previously-buggy edge cases: 29W/31W no longer silently skip short months, L-30W no longer throws mid-schedule, and 1,15W now applies W to each day rather than only the first. These corrections change the fire times of a few expressions that were previously broken — review any stored L/LW/W day-of-month expressions. (#​2759)
  • Resilience to system clock jumps — the misfire handler and cluster manager now clamp their sleep intervals after the system clock jumps forward or backward, so a clock step no longer causes a busy-spin or an absurdly long sleep. (#​3147, fixes #​1508)
  • Modernized build & publishing — the build orchestrator moved from the unmaintained NUKE to Fallout (#​3163), and packages now publish to nuget.org via GitHub OIDC trusted publishing rather than a stored API key. Dependencies were also refreshed (#​3151).

Note for CronScheduleBuilder users: AtHourAndMinuteOnGivenDaysOfWeek / WeeklyOnDayAndHourAndMinute now emit textual day-of-week names (e.g. MON,WED rather than 2,4). The schedules are identical, but the generated CRON_EXPRESSION string differs — relevant only if you compare stored cron strings byte-for-byte.

What's Changed

Full Changelog: quartznet/quartznet@v3.18.2...v3.19.0

3.18.2

Quartz.NET 3.18.2 is a maintenance release that stabilizes the dashboard introduced in 3.18.0, fixes several scheduling correctness bugs, and speeds up cron next-fire-time computation. It is a drop-in upgrade from earlier 3.18.x releases — no breaking changes and no database schema migrations.

Highlights

  • Type-load failures no longer stall the whole scheduler — a trigger or job whose type failed to load could throw inside AcquireNextTrigger and block acquisition of every other trigger. The faulting trigger is now isolated so the rest keep firing. (#​3108)
  • "Reschedule next" misfire policies no longer fire immediately — after a misfire, the reschedule-next policies could fire once right away instead of waiting for the next scheduled time. (#​3100)
  • Named-scheduler JSON config is honored — schedules defined under the root Quartz configuration section were not loaded for named schedulers. (#​3113)
  • Dashboard fixes — authorization policy no longer leaks to host-app endpoints (#​3067); static assets and a custom DashboardPath work under a fail-closed FallbackPolicy, and the Blazor circuit is allowed anonymous access under the same policy (#​3098, #​3120); trigger and calendar JSON deserialization is fixed (#​3102); and JobDataMap and SimpleSchedule trigger details now display correctly (#​3132).
  • MySQL FORCE INDEX fix — schema-qualified table prefixes produced a malformed FORCE INDEX hint. (#​3086)
  • Faster cron scheduling — cron next-fire-time computation gains a bitmask fast path and avoids needless DateTimeOffset churn in the hot loop. (#​3126, #​3129)
  • Smaller enhancements — health-check tags can now be passed to AddQuartzServer (#​3112), and new public helpers make plugin configuration extensible (#​3104).

What's Changed

Full Changelog: quartznet/quartznet@v3.18.1...v3.18.2

3.18.1

Quartz.NET 3.18.1 is a maintenance release that addresses a timezone-related bug, security advisories on transitive dependencies, and an issue that prevented the new Redis distributed-lock package from publishing to nuget.org.

Highlights

  • Fix GetTimeBefore for positive-offset timezones — CronExpression.GetTimeBefore could throw ArgumentOutOfRangeException for cron expressions evaluated against timezones with positive UTC offsets (e.g. Europe/Helsinki, Asia/Tokyo). Backported from main.
  • Redis package renamed to Quartz.Extensions.Redis — the original Quartz.Redis package id from 3.18.0 collided with an unrelated v1.0.0 already on nuget.org and could not be published. The 3.18.0 release was shipped with IsPackable=false as a workaround; 3.18.1 picks the umbrella id Quartz.Extensions.Redis (matching Quartz.Extensions.DependencyInjection / Quartz.Extensions.Hosting) and re-enables publication. There are no consumers to migrate — the original id was never on nuget.org.
  • Vulnerable transitive dependency bumps — addresses moderate advisories that were blocking restore on the 3.x CI pipeline.

What's Changed

Full Changelog: quartznet/quartznet@v3.18.0...v3.18.1

Commits viewable in compare view.

@dependabot dependabot Bot added .NET Pull requests that update .NET code dependencies Pull requests that update a dependency file labels Aug 2, 2026
@dependabot dependabot Bot changed the title Bump the quartz group with 3 updates Bump Quartz and 2 others Aug 10, 2026
@dependabot
dependabot Bot force-pushed the dependabot/nuget/quartz-f0104df27f branch from fef7269 to 9636152 Compare August 10, 2026 12:03
Bumps Quartz from 3.18.0 to 3.19.1
Bumps Quartz.Extensions.DependencyInjection from 3.18.0 to 3.19.1
Bumps Quartz.Extensions.Hosting from 3.18.0 to 3.19.1

---
updated-dependencies:
- dependency-name: Quartz
  dependency-version: 3.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: quartz
- dependency-name: Quartz.Extensions.DependencyInjection
  dependency-version: 3.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: quartz
- dependency-name: Quartz.Extensions.Hosting
  dependency-version: 3.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: quartz
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/nuget/quartz-f0104df27f branch from 9636152 to f7d4472 Compare August 24, 2026 12:03
@dependabot @github

dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 31, 2026
@dependabot
dependabot Bot deleted the dependabot/nuget/quartz-f0104df27f branch August 31, 2026 12:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file .NET Pull requests that update .NET code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants