Release a new version with an update ref to 'Azure.Identity'

[SimonCropp]

'Azure.Identity' 1.11.3 has a known moderate severity vulnerability, GHSA-m5vv-6r4h-3vj9

can you release a version that updates this reference

[dauinsight]

We'll look to have this scheduled for our next release

[SimonCropp]

this is a poor experience for consumers. for anyone who has CVE scanning turned on it breaks builds. and they need to explicitly add an azure reference to work around it. so for us it means doing a temporary hack on approx 40 projects just to build again. note that we dont even use azure.

if the sqlclient wants force a transitive azure ref on non azure users, then you should pro-actively release cve related fixes for azure.

[PureKrome]

if the sqlclient wants force a transitive azure ref on non azure users

or a version (stripped down?) without this nuget and whatever it offers? or how about the default version doesn't have this at all and a 2nd version has this so people who want to use Azure.Identity with their SqlClient can use that version. For the 99% rest of us, we don't need to worry about this transitive dep anymore/then.

[jnm2]

One reason of many to want #1108.

[ErikEJ]

@jnm2 Sure, but a better solution is to have a short timeline for release of s patch.

[jnm2]

For this individual occurrence, yes, but I'm also thinking of the future ones.

[CamiloTerevinto]

@jnm2 Sure, but a better solution is to have a short timeline for release of s patch.

Why is a better solution to have a shorter timeline on a dependency that many people don't even need? It would be one thing if SQL Server was Azure only, but there are the obvious cases of people hosting on-prem, on AWS and elsewhere - even on an Azure VM.

[ErikEJ]

@CamiloTerevinto if you are on premises I guess the vulnerability would not affect you, but Azure users would want a patch as soon as possible?

[CamiloTerevinto]

@ErikEJ it affects everyone that treats package vulnerability warnings as errors and those that use SCA as well.

[ErikEJ]

@CamiloTerevinto Exactly, so "a short timeline for release of a patch" would solve it for everyone! 😄

[JRahnama]

@CamiloTerevinto Exactly, so "a short timeline for release of a patch" would solve it for everyone! 😄

During last two months, Azure.Identity has released 5 consecutive version which four of them are deprecated now. Your suggestion indicates we should have had almost 3 patch releases per month.

An automated process could be created to check Azure.Identity latest version for deprecation notice each day and if there is any, hotfix release pipeline could be triggered to release a new version....

Let me discuss this internally with other team members and get back to you.

[ErikEJ]

@JRahnama yeah, it is a lot of updates, but would make all your consumers happy, and potentially avoid/obliviate the requirement to split the package.

[ErikEJ]

@JRahnama If you do this, consider that Azure.Identity depends on Microsoft.Identity.Client, so you should really not have an explicit dependcy on Micrsoft.Identity.Client, like you do today:

https://www.nuget.org/packages/Azure.Identity#dependencies-body-tab

    <AzureIdentityVersion>1.11.3</AzureIdentityVersion>
    <MicrosoftIdentityClientVersion>4.60.3</MicrosoftIdentityClientVersion>

[CamiloTerevinto]

@JRahnama yeah, it is a lot of updates, but would make all your consumers happy, and potentially avoid/obliviate the requirement to split the package.

@ErikEJ I don't understand this position to be honest. Why do you think that having dependencies that aren't needed for some clients but that are kept up to date somehow better than just not having the dependencies at all?
Even if you updated Azure.Identity and other dependencies quickly for security vulnerabilities, that's only meant for customers that are using Azure SQL - for the rest, you're making them see the release notes for this package to see how the release affects them.
You are also hoping that users will update this package quickly enough with the security vulnerability warning, and I have seen people ignore these on VS even.

@JRahnama If Azure.Identity is your dependency, to me, it doesn't matter how many security hotfix releases they do, it should be a high priority to get this package updated with the dependency patched. Otherwise, you are saying to users of this package that you don't care about their security.