[QUERY] Dependencies mayhem

[svrooij]

Library name and version

Azure.Core 1.35.0

Query/Question

I think the dependencies for this project can be cleaned up at least for .net core 3 and up.

These packages are not needed they are only needed on .netstandard and everything before .net core 3:

[Microsoft.Bcl.AsyncInterfaces](https://www.nuget.org/packages/Microsoft.Bcl.AsyncInterfaces/) (>= 1.1.1)
[System.Diagnostics.DiagnosticSource](https://www.nuget.org/packages/System.Diagnostics.DiagnosticSource/) (>= 6.0.1)
[System.Memory.Data](https://www.nuget.org/packages/System.Memory.Data/) (>= 1.0.2)
[System.Numerics.Vectors](https://www.nuget.org/packages/System.Numerics.Vectors/) (>= 4.5.0)
[System.Text.Encodings.Web](https://www.nuget.org/packages/System.Text.Encodings.Web/) (>= 4.7.2)
[System.Text.Json](https://www.nuget.org/packages/System.Text.Json/) (>= 4.7.2)
[System.Threading.Tasks.Extensions](https://www.nuget.org/packages/System.Threading.Tasks.Extensions/) (>= 4.5.4)

Provides the IAsyncEnumerable and IAsyncDisposable interfaces and helper types for .NET Standard 2.0. This package is not required starting with .NET Standard 2.1 and .NET Core 3.0.
Microsoft.Bcl.AsyncInterfaces

Some of the packages you're forcing for everybody are like 7 years old.

Environment

.NET SDK:
Version: 7.0.308
Commit: f6a2f50f2d

Runtime Environment:
OS Name: Windows
OS Version: 10.0.22621
OS Platform: Windows
RID: win10-x64
Base Path: C:\Program Files\dotnet\sdk\7.0.308\

Host:
Version: 7.0.11
Architecture: x64
Commit: ecb34f85ec

.NET SDKs installed:
6.0.414 [C:\Program Files\dotnet\sdk]
7.0.111 [C:\Program Files\dotnet\sdk]
7.0.302 [C:\Program Files\dotnet\sdk]
7.0.308 [C:\Program Files\dotnet\sdk]

.NET runtimes installed:
Microsoft.AspNetCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 6.0.16 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 6.0.22 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 7.0.5 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 7.0.11 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
Microsoft.NETCore.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.16 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.22 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.5 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.11 [C:\Program Files\dotnet\shared\Microsoft.NETCore.App]
Microsoft.WindowsDesktop.App 3.1.32 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 6.0.16 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 6.0.22 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 7.0.5 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
Microsoft.WindowsDesktop.App 7.0.11 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]

Drop support for end-of-life targets

And maybe even start considering dropping support for all those versions that are out off support for years, according to your own support policy:

• .NET Core 2.1 ended support Augustus 21th 2021 which is over 2 years ago.
• .NET5 ended support May 10th 2022 which is also over 16 months ago
• .NET 4.6.1 ended support on April 26th 2022 according to this page which is 17 months ago.

Remove high severity vulnerabilities

Packages.Data.props seem to be forcing <PackageReference Update="Newtonsoft.Json" Version="10.0.3" /> which according to nuget has at least 1 high severity vulnerability

Check PR #38885 for more comments

[jsquire]

Hi @svrooij. Thank you for your feedback. The majority of the Azure SDK ecosystem uses a netstandard2.0 target only and relies on Azure.Core for these dependencies. We're currently in the process of formalizing a policy around managing targets as the .NET platform continues to evolve. I agree this would be a good area for us to revisit as part of those efforts and consider whether or not we continue to need these as blanket references or we can move them to conditional based on target.

//fyi: @KrzysztofCwalina, @annelo-msft

[svrooij]

I've tried fixing it here, but it resulted in an even bigger mess.
The Azure.Core package is building, but some others fail.

#38885

I also stated that you might want to remove end-of-life targets.