[QUERY] Dependencies mayhem

[svrooij]

Library name and version

Azure.Core 1.35.0

Query/Question

I think the dependencies for this project can be cleaned up at least for .net core 3 and up.

These packages are not needed they are only needed on .netstandard and everything before .net core 3:

[Microsoft.Bcl.AsyncInterfaces](https://www.nuget.org/packages/Microsoft.Bcl.AsyncInterfaces/) (>= 1.1.1)
[System.Diagnostics.DiagnosticSource](https://www.nuget.org/packages/System.Diagnostics.DiagnosticSource/) (>= 6.0.1)
[System.Memory.Data](https://www.nuget.org/packages/System.Memory.Data/) (>= 1.0.2)
[System.Numerics.Vectors](https://www.nuget.org/packages/System.Numerics.Vectors/) (>= 4.5.0)
[System.Text.Encodings.Web](https://www.nuget.org/packages/System.Text.Encodings.Web/) (>= 4.7.2)
[System.Text.Json](https://www.nuget.org/packages/System.Text.Json/) (>= 4.7.2)
[System.Threading.Tasks.Extensions](https://www.nuget.org/packages/System.Threading.Tasks.Extensions/) (>= 4.5.4)

Provides the IAsyncEnumerable and IAsyncDisposable interfaces and helper types for .NET Standard 2.0. This package is not required starting with .NET Standard 2.1 and .NET Core 3.0.
Microsoft.Bcl.AsyncInterfaces

Some of the packages you're forcing for everybody are like 7 years old.

Environment

.NET SDK:
Version: 7.0.308
Commit: f6a2f50f2d

Runtime Environment:
OS Name: Windows
OS Version: 10.0.22621
OS Platform: Windows
RID: win10-x64
Base Path: C:\Program Files\dotnet\sdk\7.0.308\

Host:
Version: 7.0.11
Architecture: x64
Commit: ecb34f85ec

.NET SDKs installed:
6.0.414 [C:\Program Files\dotnet\sdk]
7.0.111 [C:\Program Files\dotnet\sdk]
7.0.302 [C:\Program Files\dotnet\sdk]
7.0.308 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
Microsoft.AspNetCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 6.0.16 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 6.0.22 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 7.0.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 7.0.11 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.16 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.22 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.11 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 6.0.16 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 6.0.22 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 7.0.5 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 7.0.11 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Drop support for end-of-life targets

And maybe even start considering dropping support for all those versions that are out off support for years, according to your own support policy:

• .NET Core 2.1 ended support Augustus 21th 2021 which is over 2 years ago.
• .NET5 ended support May 10th 2022 which is also over 16 months ago
• .NET 4.6.1 ended support on April 26th 2022 according to this page which is 17 months ago.

Remove high severity vulnerabilities

Packages.Data.props seem to be forcing <PackageReference Update="Newtonsoft.Json" Version="10.0.3" /> which according to nuget has at least 1 high severity vulnerability

Check PR #38885 for more comments

[jsquire]

Hi @svrooij. Thank you for your feedback. The majority of the Azure SDK ecosystem uses a netstandard2.0 target only and relies on Azure.Core for these dependencies. We're currently in the process of formalizing a policy around managing targets as the .NET platform continues to evolve. I agree this would be a good area for us to revisit as part of those efforts and consider whether or not we continue to need these as blanket references or we can move them to conditional based on target.

//fyi: @KrzysztofCwalina, @annelo-msft

[svrooij]

I've tried fixing it here, but it resulted in an even bigger mess.
The Azure.Core package is building, but some others fail.

#38885

I also stated that you might want to remove end-of-life targets.

[m-redding]

Resolved by #46637

[github-actions]

Hi @svrooij. Thank you for opening this issue and giving us the opportunity to assist. We believe that this has been addressed. If you feel that further discussion is needed, please add a comment with the text "/unresolve" to remove the "issue-addressed" label and continue the conversation.

[svrooij]

/unresolve

I just updated the Azure.Core package to version 1.44.1 only to find out that even the net6.0 version still requires Microsoft.Bcl.AsyncInterfaces..... This package is no longer needed for anything above netcore 3.1. Stop including it!
This will probably also count for System.Memory.Data, System.Diagnostics.DiagnosticSource and System.Numerics.Vectors

[jsquire]

@svrooij: Apologies for the confusion, but this is expected. The implementation for trimming was done as part of the work to add a net8.0 target to packages in the pull request that was linked above. That has not yet been released and is scheduled for our January window. At that time, and going forward, Azure SDK packages will include the new target and will be trimming the known safe set of polyfill packages.

[github-actions]

Hi @svrooij. Thank you for opening this issue and giving us the opportunity to assist. We believe that this has been addressed. If you feel that further discussion is needed, please add a comment with the text "/unresolve" to remove the "issue-addressed" label and continue the conversation.

[github-actions]

Hi @svrooij, since you haven’t asked that we /unresolve the issue, we’ll close this out. If you believe further discussion is needed, please add a comment /unresolve to reopen the issue.