Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Deprecate Microsoft.AspNetCore.All #3418

Closed
natemcmaster opened this issue Aug 10, 2018 · 8 comments

Comments

@natemcmaster
Copy link
Contributor

commented Aug 10, 2018

Earlier this year, we announced the Microsoft.AspNetCore.App metapackage (see aspnet/Announcements#287). That announcement said:

The existing Microsoft.AspNetCore.All meta-package will continue to be made available throughout the 2.x lifecycle, but we recommend customers move to the new Microsoft.AspNetCore.App meta-package and then add individual references to any of the removed packages if their app requires it.

See our documentation for details on how to migrate from Microsoft.AspNetCore.All to .App.

We have begun working on ASP.NET Core 3.0, and as a part of that, we will stop producing the Microsoft.AspNetCore.All metapackage and the matching Microsoft.AspNetCore.All shared framework.

This package will still be available in ASP.NET Core 2.2 and will continue to receive servicing updates in ASP.NET Core 2.1.

@gldraphael

This comment has been minimized.

Copy link

commented Aug 10, 2018

Could you elaborate on the rationale please?

EDIT: See aspnet/MetaPackages#255 (comment)

@VictorioBerra

This comment has been minimized.

Copy link
Contributor

commented Aug 10, 2018

@gldraphael

I think the announcement sums it up pretty well. They want to reduce the number of dependencies of packages not owned or supported by the ASP.NET or .NET teams to just those deemed necessary to ensure the major frameworks features function..

Many people don't need Redis, DataProtection.AzureStorage, ApplicationInsights etc. Not only that, but some of those have transitive dependencies like StackExchange.Redis. If you get enough of those, the core teams have to spend their time managing all sorts of packages they do not own or support.

@PeteX

This comment has been minimized.

Copy link

commented Aug 10, 2018

Would it be possible to address NuGet/Home#2867—especially the security aspects—before this change goes into the released product? The more dependencies a project has, the more difficult it is to make sure none of them have outstanding security advisories, so not being able to use AspNetCore.All will add to end users' maintenance workloads.

NPM have really raised the bar on this by implementing npm audit, which automates the process of checking for vulnerable dependencies. It would be fantastic to see something similar in Nuget.

@khellang

This comment has been minimized.

Copy link
Contributor

commented Aug 10, 2018

The more dependencies a project has, the more difficult it is to make sure none of them have outstanding security advisories, so not being able to use AspNetCore.All will add to end users' maintenance workloads.

You do realize that using Microsoft.AspNetCore.App instead of Microsoft.AspNetCore.All gives you fewer dependencies, right?

It would be fantastic to see something similar in Nuget.

The feature is being worked on; https://github.com/NuGet/Home/wiki/Deprecate-packages

@johnkors

This comment has been minimized.

Copy link

commented Aug 10, 2018

@PeteX I asked for that tool a year ago, but nothing has really happened so far. Created https://github.com/retirenet/dotnet-retire meanwhile.

@ikourfaln

This comment has been minimized.

Copy link

commented Aug 10, 2018

Hi, can we use Microsoft.AspNetCore.App meta-package targeting Full .NET?

means to ha a csprojet look like that:

<Project Sdk="Microsoft.NET.Sdk.Web">

  <PropertyGroup>
    <TargetFramework>net472</TargetFramework>
    <DebugType>full</DebugType>
    <UserSecretsId>aspnet-TestApp-4265477E-A059-46D4-5678-E56D6G5J9DCE</UserSecretsId>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.App" Version="2.1.2" />
    <PackageReference Include="Microsoft.VisualStudio.Web.CodeGeneration.Design" Version="2.1.1" PrivateAssets="All" />
  </ItemGroup>

</Project>
@poke

This comment has been minimized.

Copy link
Contributor

commented Aug 10, 2018

@ikourfaln No, the meta packages only work with .NET Core. You will have to add all dependencies explicitly with the .NET Framework.

@PeteX

This comment has been minimized.

Copy link

commented Aug 10, 2018

It's great news that deprecation in Nuget is being worked on!

@khellang, you're right of course! What I meant was that you get fewer explicit dependencies. I trust Microsoft to make sure the dependencies of Microsoft.AspNetCore.All are sufficiently up to date to be free of known security issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
8 participants
You can’t perform that action at this time.