Azure / Azure/azure-functions-host
Create auto-upgrade process for Microsoft.IdentityModel.Tokens dependency
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 36
Description
We need to update the version of [Microsoft.IdentityModel.Tokens](https://www.nuget.org/packages/Microsoft.IdentityModel.Tokens) referenced by the host whenever a new version of the package is released. At the very least, any release of ours should also upgrade the version referenced by the host to the current latest. But we should also identify when a new version has been released and line up the appropriate changes out of band. Some coordination with the owners of https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet may be appropriate.
**Please note that the intent for this is separate from CVE response. We already have processes in place for taking security updates here.**
This is an assembly which frequently is referenced by user code, but it is removed during the build under the assumption that the host will be providing it. This means that if a project updates to a newer version than what the host references, an error will occur. See https://github.com/Azure/azure-functions-host/issues/7878. There is a workaround to that using `_FunctionsSkipCleanOutput` and `FunctionsPreservedDependencies`. With this work, we would reduce the encounter rate for that issue, and it should only appear if the application is referencing one version higher than what the host has, and only while a release is rolling with the newer version.
Contributor guide
Research direction
No files, tests, or entry points are named. Start by locating where Microsoft.IdentityModel.Tokens is referenced and how host releases update dependencies, then review the existing non-CVE dependency process. Done means new package releases are detected and the host dependency is updated by the next release, with coordination clarified if needed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- build-system, devops
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100