chore(deps): #87 held-back bump wave — OpenIddict 7.6, OTel 1.17, System.Reactive 7, Marten 9.11/Wolverine 6.16

[windischb]

Works through the held-back items from the #87 dependency report (the ones the
earlier risk-averse wave in #156 explicitly deferred to "their own careful PRs").
dotnet list package --vulnerable reports zero vulnerabilities across the
graph, so this is pure hygiene — no security-driven urgency.

Four bumps, one commit each, each gated locally by a full build + unit +
integration run, and the combined result re-gated as a whole.

OpenIddict 7.5.0 → 7.6.0

7.6.0 is a small release: an EF-store EntityState-restore fix (we use custom
Marten stores, no EF), OpenIddict.Client.WebIntegration adds Vercel + ID
Austria (we don't use WebIntegration), and dependency refreshes. Nothing touches
the server token pipeline, DPoP, or reference tokens.

OpenTelemetry SDK line 1.15 → 1.17

The whole SDK line moved together: Extensions.Hosting,
Instrumentation.AspNetCore / .Http / .Runtime, and
Exporter.OpenTelemetryProtocol to 1.17.0; Exporter.Prometheus.AspNetCore to
1.17.0-beta.1 (still officially beta upstream). Npgsql.OpenTelemetry and
Serilog.Sinks.OpenTelemetry are separate lines and are untouched.

The test host disables the Prometheus + OTLP exporters, so those two packages
aren't covered by the suite. They were smoke-tested separately by booting the
real app and scraping /metrics: HTTP 200, telemetry_sdk_version=1.17.0, 58
metric families rendered in Prometheus text format, with the aspnetcore /
http_server / kestrel / dotnet instrumentation all emitting.

System.Reactive 6.1.0 → 7.0.0

Rx 7's only breaking change that reaches us is the discontinuation of the facade
packages — System.Reactive.Linq has no 7.x release; all operators now ship in
the single System.Reactive package. So BuildingBlocks.EventDispatcher now
references System.Reactive (its System.Reactive.Linq / .Subjects
namespaces live there), and the facade's package version is dropped.

The UI-framework split that actually drove the major (WPF/WinForms/UWP out of the
compile-time API) does not affect us: our usage is core Rx only — ReplaySubject,
Observable.*, Concat, SelectMany, Catch, Unit — in
BuildingBlocks.Helper/ObservableExtensions.cs and
BuildingBlocks.EventDispatcher/DataEventDispatcher.cs.

Marten 9.8 → 9.11, Wolverine 6.9 → 6.16 (partial — deliberately not 9.16)

A partial Critter-Stack bump that stays below the 9.12 regression.

Marten 9.12 broke async-projection catch-up under MasterTableTenancy — which
modgud uses (one physical DB per realm) — so identity read-models never
materialize. It came in with the JasperFx.Events 2.18 "DI-projection
partial-class dispatch" refactor. This is documented in the sibling AppTemplate
fork (bisected there: 9.11.0 green, 9.12.0 red, Wolverine-independent).

It is still unfixed in 9.16.1. Verified here before falling back: the full
bump to Marten 9.16.1 / Wolverine 6.20 puts the integration suite at 41
failures / 476 passed, with runtime ballooning from ~7 to 14m33s on
projection-catch-up timeouts. The failures are localized to the identity
read-models — Person, produced by the polymorphic ModgudPrincipalProjection
(Person : Principal, Inline), comes back null immediately after user creation
and fails even in a solo run, while plain-document Inline projections (the OAuth
state projections) are unaffected. SecurityAuditWave4 is the clean canary: red
under 9.16, green under 9.11.

WolverineFx.Marten 6.16 is the last 6.x that pins Marten 9.11 (6.17 already
jumps to 9.14, past the regression).

Not included, and why: Microsoft.OpenApi 2.7.5 → 3.x is blocked. .NET 10's
Microsoft.AspNetCore.OpenApi requires Microsoft.OpenApi 2.x; 3.x breaks the
source generator (CS0200, IOpenApiMediaType.Example is read-only). The
existing 2.7.5 transitive-CVE pin stays correct until a future ASP.NET Core.

Verification

Each bump was gated on its own branch, and the combined branch was re-gated:

• build clean (no CS0101/CS0111 source-generator duplication)
• unit 1395/1395
• integration 517/517, runtime back to normal (~7 min)
• /metrics live smoke for the OTel exporters the suite doesn't cover

Follow-up

Marten past 9.11 stays blocked. The regression is unfixed through 9.16.1 and, for
MasterTableTenancy specifically, is not yet reported upstream — a minimal
repro + a JasperFx/marten issue is the way to unblock it for good. Until then:
re-run the integration suite on every new Marten release; it is the gate that
catches this.

🤖 Generated with Claude Code