Azure / Azure/azure-functions-host

Create auto-upgrade process for Microsoft.IdentityModel.Tokens dependency

Open
#8,888 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 10h
Merged PRs (30d)
36

Description

We need to update the version of [Microsoft.IdentityModel.Tokens](https://www.nuget.org/packages/Microsoft.IdentityModel.Tokens) referenced by the host whenever a new version of the package is released. At the very least, any release of ours should also upgrade the version referenced by the host to the current latest. But we should also identify when a new version has been released and line up the appropriate changes out of band. Some coordination with the owners of https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet may be appropriate.

**Please note that the intent for this is separate from CVE response. We already have processes in place for taking security updates here.**

This is an assembly which frequently is referenced by user code, but it is removed during the build under the assumption that the host will be providing it. This means that if a project updates to a newer version than what the host references, an error will occur. See https://github.com/Azure/azure-functions-host/issues/7878. There is a workaround to that using `_FunctionsSkipCleanOutput` and `FunctionsPreservedDependencies`. With this work, we would reduce the encounter rate for that issue, and it should only appear if the application is referencing one version higher than what the host has, and only while a release is rolling with the newer version.

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. Start by locating where Microsoft.IdentityModel.Tokens is referenced and how host releases update dependencies, then review the existing non-CVE dependency process. Done means new package releases are detected and the host dependency is updated by the next release, with coordination clarified if needed.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
build-system, devops
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.