Update target framework to 4.8

[Jetski5822]

By doing this you allow us to use the majority of the netstandard packages.

[sebastienros]

We need to know what is the minimum version installed by Windows Update. Right now we use 4.5.2 as we are sure it's pushed by WU.

[carlwoodhouse]

i think 4.5.2 is the minimum req version by wu still. though 2016/win10+ come with 4.6.1 pre-installed.

that been said, give 4.6.2 so i can use the http2 features ;p

[BenedekFarkas]

@sebastienros I'd like to circle back to the choice of upgrading to 4.6.1 as discussed on the PR: I think the argument for 4.6.1 was mainly about whether it's included in Windows Update. Based what I found in the version and dependency table, here's my take on the issue:

Orchard 1.10 shipped in March of 2016 with .NET 4.5.2 (which was released almost 2 years earlier), but .NET 4.5.2 is not included in any OS versions by default, so at some point you had to install it manually (I'm not sure if it was automatic with Windows Update, but it might've been).

.NET versions above 4.6.1 offer a lot of improvements in different areas (many are unrelated though), but some of them can still be significant performance, security, and/or quality of life improvements for Orchard-based development. In the meanwhile, we're also looking at NuGet package updates in #7998, so I think it's a good chance to give Orchard a nice refresh.

.NET 4.8 is not yet supported by Azure App Service for example, so I'd recommend 4.7.2: It has basically the same compatibility as 4.5.2 and is included in Windows 10 and Server versions older than a year now (Windows 10/Server 1803).

[sebastienros]

You are the boss

[sebastienros]

.NET 4.8 is not yet supported by Azure App Service for example, so I'd recommend 4.7.2

Since yesterday 4.8 is on Windows Update so I assume all machines should have it. even App Service

[BenedekFarkas]

Nice, that's even better! I don't see it yet in the configuration for an App Service (still 4.7), but I guess it's just a matter of time. AWS Elastic Beanstalk seems to support 4.8 already.

[mwentz]

With TLS 1.0 being deprecated and TLS 1.2 becoming the required standard, this ticket should be prioritized. It is recommended that applications use at least 4.7:
https://docs.microsoft.com/en-us/dotnet/framework/network-programming/tls#if-your-app-targets-a-net-framework-version-earlier-than-47

[BenedekFarkas]

Thanks @mwentz that's a very good point. @sebastienros this issue is assigned to 1.11 - what do you think about a minor version (1.10.4) instead to implement this?

[sebastienros]

fine

[HermesSbicego-Laser]

Anyone is working or is plannning to work on this upgrade? The goal is to target fw 4.8 for 1.10.4, right?

[sebastienros]

@HermesSbicego-Laser correct, you want to take it over

[dpomt]

@HermesSbicego-Laser: thanks for this!
@sebastienros: any idea when this pull request #8444 will be merged in 1.10.x?

[sebastienros]

It's merged.

What about updating the libraries also, at least MVC/Razor. I assume there were security patches.

[HermesSbicego-Laser]

We would like to update libraries too, yes.
MVC/Razor it's a good starting point, but we would like to upgrade the other ones too. Which ones, it depends on their compliance with current ones and the effort involved...
BTW I will open a new issue for that.
Any help will be appreciated @dpomt @Jetski5822 @BenedekFarkas @carlwoodhouse

[njones57]

Is there any sort of timeline on when the .NET 4.8 update would be available? I would love to update our site to this.

[HermesSbicego-Laser]

With PRs #8444 we updated to framework 4.8. That PR is merged in 1.10.x so I think we could close this issue.
@njones57, is it possible for you to updgrade your site to 1.10.x branch?

[njones57]

@HermesSbicego-Laser I'm not sure if we would be allowed to use a non-release branch as this is for a production system but I can check. Thanks for the info!

[sebastienros]

@HermesSbicego-Laser do you think we could ship a new minor release?

[HermesSbicego-Laser]

I think we could and we should.
We are currently provisioning 1.10.x (+ some cherrypicks of dev) in our production environment, serving more or less 60 tenants (3 of which are e-commerce) so the 1.10.x is pretty stable from what we see.
Definitely we think 1.10.x is ready to be released as 1.10.4
@sebastienros @BenedekFarkas

[mwentz]

@sebastienros is there an expected timeline on the proposed 1.10.4 release? Like others, I don't think we can use non-release branches on production systems. Thanks!

[BenedekFarkas]

I can't promise anything, but it looks like I'll have some time freeing up soon to dive back into contribs (including reviewing PRs and working on a release).

[BenedekFarkas]

Fixed in #8444 to 1.10.x and it was merged into dev too.