Upgrade packages with vulnerability

[MikeAlhayek]

@kevinchalet is it okay to update only these 2 packages in to /release.2.1 branch? Need to address the current vulnerability issue with these two dependencies and ship 2.1.7.

Note this is based on release/2.1 branch not main.

[kevinchalet]

@kevinchalet is it okay to update only these 2 packages in to /release.2.1 branch?

Well:

• The stable release references an old OpenIddict version (5.8) that is no longer developed or supported so it's not a scenario I'm testing: "your mileage may vary" 🤣
• The most recent IM versions reference a .NET 9.0 package (Microsoft.Bcl.Memory) on all their TFMs (including .NET 8.0), which could be problematic in some cases (someone told me they hit an issue with a .NET 8.0 app on Ubuntu Server, that has a very specific packaging and support policy for .NET).

[MikeAlhayek]

If we have to upgrade OpenId, we would have to release v2.2.0 instead of v2.1.7 so I was hoping to avoid having to do that. But if it is safer to upgrade OpenId and release v2.2.0 then maybe that is what we should do?

[kevinchalet]

Last time I suggested that (in January IIRC), it was ruled out because 3.0 was around the corner, which made releasing a 2.2 version not very appealing. Has anything changed in this regard?

If you decide to bump the OpenIddict version in the 2.x branch, you'll need to backport these 2 PRs:

• Migrate the OpenID module to OpenIddict 6.0 #16929
• Bump OpenIddict to 6.1.1 #17582

[MikeAlhayek]

@sebastienros should we release v2.2.0 instead of v2.1.7 only with the PRs we already backported along with the 2 PR referenced above? I think we are a bit far on v3.0.0.

[sebastienros]

Filed AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3208

[sebastienros]

There is no ideal solution with the current state of things. I suggest we keep the net9.0 Microsoft.Bcl dependency, so reference all valid versions, but once there is an IM with a truly long support then we switch to it. Hopefully before net9.0 becomes unsupported, which is in a year: May 12, 2026.

[kevinchalet]

FWIW, I came to the same conclusion when I had to decide what do in OpenIddict 7.0 (that will require ASP.NET Core 2.3+ instead of 2.1+ and thus will reference the 8.0 version of the .NET Extensions on older TFMs): previous OpenIddict versions referenced older IM versions for the older TFMs to avoid having mixed .NET Extensions versions, but 7.0 will target IM 8.x for all TFMs.

Hopefully they’ll be able to remove that dependency so this won’t be a problem at all.

[MikeAlhayek]

We decided to ship 2.1.7 with the vulnerability packages since they existing in 2.1.6 also until there is a fix or v3 is released.