Dependency conflicts with Microsoft.Bot .Builder package

[dprothero]

Version: 5.3.0

Customer reported issue on Twitter:
https://twitter.com/dprothero/status/859788762116751360

Microsoft.Bot .Builder package requires System.IdentityModel.Tokens.Jwt <5.0.0. Twilio requires >=5.1.2. This means they cannot be used in the same project together.

Not sure on the solve here. Would seem to make the most sense for Microsoft to update their Bot framework. Mainly just wanted to add some tracking and visibility to the issue.

Workarounds for now:

1. Could use the older C# Twilio v4.7.2 package. No conflicts there, but means you're using a library that will be unsupported at the end of May 2017.

2. Make direct HTTP REST calls to Twilio (don't use helper library) using System.Net.HttpClient. Not a great experience, but would work.

3. Create a microservice (Web API or ASP.NET Core) that wraps up your Twilio functionality. This project could utilize the latest Twilio package. Then, in your project that uses the Bot framework, you could call your microservice over HTTP.

None of the workarounds are ideal, so hopefully, this situation will have a good resolution soon (hint, hint, Microsoft).

[TSHSmith]

Thanks for logging this. Here's to hoping Microsoft update it soon!

I'm using the micro service option right now. It works, but risks malicious usage if publicly accessible and not secured properly.

[alexsorokoletov]

+1, in our case conflict is with Identity Server. Upgrading IS to support JWT 5.x is not available, since we have to go to .NET Core.

[jmctwilio]

@dprothero Is this issue still an ongoing concern?

[dprothero]

@alexsorokoletov I don't understand why JWT 5.x support with .NET Core would be a problem. Can you elaborate? It appears the JWT 5.x library is .NET Standard 1.4 compatible (one of the reasons we selected it).

[dprothero]

@jmctwilio Yes, it is still an issue. Some popular Microsoft packages don't work with v5.x of the JWT library, yet. Uncertain as to why they have made that choice at this point. The workarounds in the initial issue report remain.

If Twilio were to try to address the issue, our options would be:

1. Downgrade to the v4.x version of the JWT library. Uncertain whether this would cause incompatibilities with other libraries. Perhaps it would be possible to support v4.x thru v5.x?

2. Pull out the token generation routines into a separate package. Then this issue affects only those customers creating tokens for the client SDK's. It would not affect the larger population of developers just making calls to the Twilio REST API's.

[dsghi]

Bot Builder 3.14/3.15/3.16 have been updated, System.IdentityModel.Tokens.Jwt (>= 5.1.4), so based on this conversation, it's not an issue any longer.
Also Bot Builder 4.x.x preview no longer has a dependency on JWT at all, so won't be an issue going forward: https://www.nuget.org/packages/Microsoft.Bot.Builder/4.0.1-preview

[Mwalima]

still having the same issue
Severity Code Description Project File Line Suppression State
Error CS0433 The type 'ITurnContext' exists in both 'Microsoft.Bot.Builder.Core, Version=4.0.0.46, Culture=neutral, PublicKeyToken=31bf3856ad364e35' and 'Microsoft.Bot.Builder, Version=4.1.5.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' chatbot-luca2 C:\Users\Mwalima\Source\Repos\chatbot-luca2\chatbot-luca2\EchoWithCounterBot.cs 60 Active

[hmzgni]

+1, in our case conflict is with Identity Server. Upgrading IS to support JWT 5.x is not available, since we have to go to .NET Core.

hi, did you find solution for this issue ? thanks

[childish-sambino]

Resolving as the bot builder has been updated. Please open a new issue for any other questions.