Update Azure.Core and xunit dependencies

[ViktorHofer]

Updating the Azure.Core dependency to the latest version which now doesn't bring in the old System.Net.Http/4.3.0 package anymore and with it other potentially vulnerable packages.

Also update xunit to the latest available version: 2.5.1.

To double check:

• The right tests are in and and the right validation has happened. Guidance: https://github.com/dotnet/arcade/tree/main/Documentation/Validation

[ViktorHofer]

Unable to download https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/xunit.runner.console/2.5.1/xunit.runner.console.2.5.1.nupkg after retrying. Execution may fail as a result.

@mmitche can you please help me figure out which feed that is and why the download fails?

[mmitche]

https://dev.azure.com/dnceng/public/_artifacts/feed/dotnet-public/NuGet/xunit.runner.console/versions

Need to add the RTM version of the xunit packages to the dotnet-public feed https://github.com/dotnet/arcade/blob/f5d1610c0943aefc60193d26c43736b2c61a8ed6/Documentation/MirroringPackages.md?plain=1

[ViktorHofer]

Hmm still failing... No idea.

[ViktorHofer]

@mmitche the xunit console packages are fetched from the dotnet-eng feed, instead of dotnet-public. Any idea why? We have two options:

1. Add the xunit, xunit.runner.console, xunit.runner.visualstudio 2.5.1 packages to the dotnet-eng feed.
2. Change the infrastructure to retrieve the xunit packages from the dotnet-public feed.

[ViktorHofer]

cc @dotnet/arcade-contrib for my above question

[MiYanni]

@ViktorHofer

cc dotnet/arcade-contrib for my above question

Please don't @ that group as it has 259 people in it. There's a Teams channel where you can ask questions to the Arcade folks.

[danmoseley]

cc dotnet/arcade-contrib for my above question

Please don't @ that group as it has 259 people in it.

@markwilkie might be worth disabling notifications on this team perhaps

[markwilkie]

Good idea @danmoseley - done. @epananth - any chance you have insight into Victor's question?

[RussKie]

On a side note, is it necessary to publish 3.5G worth artifacts for every build?

[mmitche]

@mmitche the xunit console packages are fetched from the dotnet-eng feed, instead of dotnet-public. Any idea why? We have two options:

These should be pulled from dotnet-public. See https://github.com/dotnet/arcade/blob/main/Documentation/MirroringPackages.md for how to get them mirrored.

[mmitche]

On a side note, is it necessary to publish 3.5G worth artifacts for every build?

It's not, I think this can be removed. IIRC it's a switch to one of our YAML templates (publishBuildArtifacts?).

[sharwell]

ViktorHofer requested a review from mmitche September 19, 2023 09:56

These get cleared out after an expiration timeout. It's fine to remove items that would never be used for build diagnostics, but if it's something useful for some purpose it's not worth the pain of trying to add it back later when you need it (right now it's obvious what the paths are, but how do you find the path of a file that's not in the list?).