Upgrade Microsoft .Net to 6.0.33 and remove .Net 7.0.* to fix security vunlerabilities.

[LokeshNagireddy]

Hi Team,

There is a security vulnerability with .Net core 6.0.32 and .Net core 7.0.* was end of life.

Can you please perform the update to avoid the security issues?
more info in the below links.
https://dotnet.microsoft.com/en-us/download/dotnet/6.0
https://endoflife.date/dotnet

i look forward for your response.

[nebuk89]

Our plans to remove .net6 are here: https://github.blog/changelog/2024-08-19-notice-of-upcoming-deprecations-and-breaking-changes-in-github-actions-runners/ :)

[GennrichJ]

What about .NET 7? It's not mentioned in the referenced changelog, but .NET 7 went out of support 5 months ago back in May 2024 (7 is not an LTS version).

I see it was only just recently removed from the macOS image:
#10659

But it's still present in the Windows Server images:
https://github.com/actions/runner-images/blob/main/images/windows/toolsets/toolset-2022.json#L318
https://github.com/actions/runner-images/blob/main/images/windows/toolsets/toolset-2019.json#L411

If the .NET policy is the "2 latest LTS versions and 1 latest version" then I'd interpret that as .NET 6 and .NET 8 currently, as those are the two latest LTS versions (with 8 also being the 1 latest version).

Here's a PR removing it from the Windows images:
#10731

[GennrichJ]

@nebuk89 the linked blog post says .NET 6 will be removed in October 2024 (posted in August 2024) but it still looks present in the latest Windows 2022 images:

• runner-images/images/windows/toolsets/toolset-2022.json

  Line 321 in c4f5865

  "6.0",

• https://github.com/actions/runner-images/blob/main/images/windows/Windows2022-Readme.md#:~:text=NET%20Core%20SDK%3A%206.0.136%2C%206.0.203%2C%206.0.321%2C%206.0.428%2C

[nebuk89]

What I shared :) as the changelog states is that the 'runner' would no longer use this :)
Our runner VM images are a separate set of tools which are broadly available and support a range of users, including some who need access to legacy software.

We have a standard review cycle and process for removing old version, which this will eventually get picked up in :)

as per @vidyasagarnimmagaddi 's comment, we have announced some of these changes. I would refer to these going forward for updates on the images

[vidyasagarnimmagaddi]

Hi all,

We do have plans to deprecate .Net 7.x for Windows Os'es ,Announcement has already been raised .

[lakshminarayana02]

Hi
NET 7.x will be removed from the images on January 17,2025