Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create auto-upgrade process for Microsoft.IdentityModel.Tokens dependency #8888

Open
mattchenderson opened this issue Nov 4, 2022 · 1 comment

Comments

@mattchenderson
Copy link
Contributor

We need to update the version of Microsoft.IdentityModel.Tokens referenced by the host whenever a new version of the package is released. At the very least, any release of ours should also upgrade the version referenced by the host to the current latest. But we should also identify when a new version has been released and line up the appropriate changes out of band. Some coordination with the owners of https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet may be appropriate.

Please note that the intent for this is separate from CVE response. We already have processes in place for taking security updates here.

This is an assembly which frequently is referenced by user code, but it is removed during the build under the assumption that the host will be providing it. This means that if a project updates to a newer version than what the host references, an error will occur. See #7878. There is a workaround to that using _FunctionsSkipCleanOutput and FunctionsPreservedDependencies. With this work, we would reduce the encounter rate for that issue, and it should only appear if the application is referencing one version higher than what the host has, and only while a release is rolling with the newer version.

@fowl2
Copy link

fowl2 commented Nov 7, 2022

Would this process also apply to functions V1?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants